@demlik/tea 0.1.2 → 0.3.0

package/dist/chunk-BP2R7TPP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/observability.ts","../src/runtime-types.ts","../src/run.ts"],"names":["opts"],"mappings":";;;;AAsDO,SAAS,cAAA,CACd,SACA,IAAA,EACsB;AACtB,EAAA,MAAM,SAAwC,EAAC;AAC/C,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,KAA6C;AACzD,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,IAAA,EAAM,MAAA,CAAO,KAAA,EAAM;AAAA,EACzC,CAAA;AAMA,EAAA,MAAM,SAAA,GACJ,IAAA,IAAQ,CAAA,GACJ,MAAY;AAAA,EAAC,CAAA,GACb,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAK,KAAA,KAAU;AAC9B,IAAA,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA;AAAA,EACrB,CAAC,CAAA;AACP,EAAA,MAAM,MAAA,GACJ,IAAA,IAAQ,CAAA,GACJ,MAAY;AAAA,EAAC,CAAA,GACb,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,KAAU;AACxB,IAAA,IAAA,CAAK,EAAE,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,CAAA;AAAA,EAC3B,CAAC,CAAA;AAEP,EAAA,OAAO;AAAA,IACL,QAAA,GAAW;AAGT,MAAA,OAAO,OAAO,KAAA,EAAM;AAAA,IACtB,CAAA;AAAA,IACA,IAAA,GAAO;AACL,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,SAAA,EAAU;AACV,MAAA,MAAA,EAAO;AAAA,IACT;AAAA,GACF;AACF;AC3CO,SAAS,OAAO,CAAA,EAAiB;AACtC,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,KAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAAE,CAAA;AACrD;AAOO,IAAM,OAAO,CAClB,KAAA,EACA,SAC+B,CAAC,KAAA,EAAO,EAAE;AAK3C,IAAM,gBAAA,uBAAuB,GAAA,EAAY;AAQlC,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,wBAAA;AAAA,EAChB,IAAA,GAAO,wBAAA;AAAA,EAChB,YAAY,QAAA,EAAkB;AAC5B,IAAA,KAAA;AAAA,MACE,6BAA6B,QAAQ,CAAA,+IAAA;AAAA,KAGvC;AAAA,EACF;AACF;AAUO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC3B,IAAA,GAAO,qBAAA;AAAA,EAChB,IAAA,GAAO,qBAAA;AAAA,EAChB,WAAA,CAAY,EAAA,EAAY,YAAA,EAAsB,eAAA,EAAyB;AACrE,IAAA,KAAA;AAAA,MACE,CAAA,mCAAA,EAAsC,EAAE,CAAA,oBAAA,EAC7B,YAAY,eAAe,eAAe,CAAA,CAAA;AAAA,KACvD;AAAA,EACF;AACF;AASO,SAAS,mBAAA,GAA4B;AAC1C,EAAA,gBAAA,CAAiB,KAAA,EAAM;AACzB;AAkGO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAGhD,YAA4B,UAAA,EAAoB;AAC9C,IAAA,KAAA;AAAA,MACE,sDAAsD,UAAU,CAAA,yOAAA;AAAA,KAKlE;AAP0B,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAQ5B;AAAA,EAVkB,IAAA,GAAO,wBAAA;AAAA,EAChB,IAAA,GAAO,wBAAA;AAUlB;AASO,SAAS,WAAc,IAAA,EAAuB;AASnD,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA;AACb,IAAA,KAAA,GAAQ,IAAA,EAAM,GAAA,KAAQ,KAAA,CAAA,IAAa,IAAA,EAAM,GAAA,KAAQ,IAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,KAAA,GAAQ,KAAA;AAAA,EACV;AACA,EAAA,IAAI,CAAC,KAAA,IAAS,gBAAA,CAAiB,GAAA,CAAI,IAAI,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,uBAAuB,IAAI,CAAA;AAAA,EACvC;AACA,EAAA,gBAAA,CAAiB,IAAI,IAAI,CAAA;AACzB,EAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,IAAA,EAAK;AACjC;AAiEO,SAAS,aAAA,CACd,MAAA,EACA,MAAA,GAAoC,CAAC,QAAQ,GAAA,EACjB;AAC5B,EAAA,OAAO,CAAC,GAAA,KAA2B;AACjC,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,OAAO,GAAG,CAAA;AAAA,IACvB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACxC,IAAA,OAAO,MAAA,CAAO,OAAA,GAAU,MAAA,CAAO,IAAA,GAAO,IAAA;AAAA,EACxC,CAAA;AACF;AAmNO,SAAS,cAMd,CAAA,EAAuD;AAKvD,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAA,CAAO,cAAA,CAAe,GAAG,QAAA,EAAU;AAAA,MACjC,KAAA,EAAO,gBAAA,CAAiB,CAAA,CAAE,MAAgB,CAAA;AAAA,MAC1C,UAAA,EAAY,KAAA;AAAA,MACZ,QAAA,EAAU,KAAA;AAAA,MACV,YAAA,EAAc;AAAA,KACf,CAAA;AAAA,EACH;AACA,EAAA,OAAO,CAAA;AACT;AAWO,SAAS,UACd,OAAA,EAC2B;AAC3B,EAAA,OAAO,OAAA;AACT;AA+BO,SAAS,MAAA,CAOd,SACA,IAAA,EAMA;AAGA,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA;AAC9B,EAAA,MAAM,CAAC,cAAc,QAAQ,CAAA,GAAI,QAAQ,IAAA,CAAK,MAAA,EAAQ,KAAK,GAAG,CAAA;AAE9D,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KASF;AAAA,EACF;AAKA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,UAAA,EAAW,GAAI,WAAA;AAAA,IAClC,OAAA;AAAA,IACA,YAAA;AAAA,IACA,IAAA,CAAK;AAAA,GACP;AACA,EAAA,MAAM,IAAA,GAAY,CAAC,GAAG,QAAA,EAAU,GAAG,UAAU,CAAA;AAE7C,EAAA,MAAM,IAAA,GAAY,OAAA,CAAQ,aAAA,GACtB,CAAC,GAAG,QAAQ,aAAA,CAAc,KAAK,CAAC,CAAA,GAChC,EAAC;AAGL,EAAA,MAAM,UAA2C,EAAC;AAClD,EAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,OAAA,CAAQ,IAAA,CAAK,SAAQ,EAAG;AACnD,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA;AAC7B,MAAA,IAAI,IAAA,KAAS,IAAA,EAAM,OAAA,CAAQ,IAAA,CAAK,EAAE,OAAO,EAAA,EAAI,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACrE;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,OAAA,EAAQ;AACtC;AAkCO,SAAS,aAMd,OAAA,EAKiB;AAYjB,EAAA,OAAO,CAAC,GAAA,EAAK,GAAA,EAAK,QAAA,KAAa;AAC7B,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AACA,IAAA,OAAO,OAAA,CAAQ,GAAA,EAAK,GAAA,EAAK,QAAQ,CAAA;AAAA,EACnC,CAAA;AACF;AAWO,SAAS,YAAA,CACd,IAAA,EACA,IAAA,EACA,KAAA,EACkC;AAClC,EAAA,OAAO,OAAO,KAAK,GAAA,KAAQ;AACzB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW;AAAA,MACrC,GAAA,EAAK,MAAM,IAAA,CAAK,GAAA,EAAK,GAAG,CAAA;AAAA,MACxB,KAAA,EAAO,CAAC,KAAA,KAA4B;AAAA,KACrC,CAAA;AACD,IAAA,OAAO,OAAO,KAAA,CAAM;AAAA,MAClB,EAAA,EAAI,CAAC,KAAA,KAAU,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,MAC9B,GAAA,EAAK,CAAC,KAAA,KAAU,KAAA,CAAM,OAAO,GAAG;AAAA,KACjC,CAAA;AAAA,EACH,CAAA;AACF;;;AC7tBA,SAAS,cAAA,CAAe,OAAgB,QAAA,EAAqC;AAC3E,EAAA,UAAA,CAAW,MAAM;AACf,IAAA,MAAM,KAAA;AAAA,EACR,GAAG,CAAC,CAAA;AACN;AAWA,SAAS,qBACP,WAAA,EAC6B;AAC7B,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,EAAE,UAAU,MAAA,EAAO;AACzD,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,EAAU,OAAO,EAAE,UAAU,WAAA,EAAY;AACpE,EAAA,OAAO,WAAA;AACT;AAaO,SAAS,GAAA,CAQd,SACA,IAAA,EA6ByB;AACzB,EAAA,MAAM,EAAE,OAAM,GAAI,IAAA;AAGlB,EAAA,MAAM,GAAA,GAAO,IAAA,CAAK,GAAA,IAAO,EAAC;AAC1B,EAAA,MAAM,OAAA,GAAU,KAAK,SAAA,IAAa,GAAA;AAElC,EAAA,MAAM,aAAA,GACJ,IAAA,CAAK,MAAA,KAAW,MAAM,EAAC,CAAA;AAEzB,EAAA,MAAM,UAAA,GAAoC,IAAA,CAAK,QAAA,KAAa,MAAM,KAAA,CAAA;AAElE,EAAA,MAAM,OAAA,GAAmB,KAAK,OAAA,IAAW,cAAA;AAGzC,EAAA,MAAM,WAAA,GAAc,CAAC,KAAA,EAAgB,OAAA,KAAuC;AAC1E,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IACxB,SAAS,SAAA,EAAW;AAClB,MAAA,cAAA,CAAe,SAAkB,CAAA;AAAA,IACnC;AAAA,EACF,CAAA;AAMA,EAAA,SAAS,MAAA,CACP,KAAA,EACA,KAAA,EACA,EAAA,EACM;AACN,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,IAAI,CAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,CAAA;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,WAAA,GAAc,oBAAA,CAA2B,IAAA,CAAK,WAAW,CAAA;AAG/D,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,SAAA,GAAqB,IAAA;AACzB,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAwB;AAOhD,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAGzB;AACF,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAgB;AAEtC,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAgC;AAEtD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAwB;AACjD,EAAA,IAAI,MAAA,GAAS,KAAA;AAEb,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAqC;AAE/D,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAwB;AAIhD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAkD;AAI3E,EAAA,SAAS,QAAA,CAAY,MAAe,KAAA,EAAgB;AAClD,IAAA,MAAM,WAAA,GAAc,YAAA,CAAa,GAAA,CAAI,IAAqB,CAAA;AAC1D,IAAA,IAAI,CAAC,WAAA,IAAe,WAAA,CAAY,IAAA,KAAS,CAAA,EAAG;AAC5C,IAAA,MAAA,CAAO,aAAa,WAAA,EAAa,CAAC,QAAA,KAAa,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,EAChE;AAIA,EAAA,MAAM,YAAA,GAAkC,EAAE,GAAG,GAAA,EAAK,MAAM,QAAA,EAAS;AAGjE,EAAA,IAAI,IAAA,GAAsB,QAAQ,OAAA,EAAQ;AAM1C,EAAA,SAAS,SAAS,GAAA,EAA6B;AAC7C,IAAA,KAAA,MAAW,MAAM,GAAA,EAAK;AACpB,MAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,EAAE,CAAA;AAClC,MAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,OAAA,EAAQ;AAAA,MACV,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,aAAA,EAAe,CAAA;AAAA,MAC3C;AACA,MAAA,WAAA,CAAY,OAAO,EAAE,CAAA;AAAA,IACvB;AAAA,EACF;AAOA,EAAA,SAAS,eAAe,OAAA,EAAiC;AACvD,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,OAAA,GAAU,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA;AACxC,MAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,OAAA,EAAQ;AAAA,MAClB,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,aAAA,EAAe,CAAA;AAAA,MAC3C;AACA,MAAA,cAAA,CAAe,OAAO,KAAK,CAAA;AAAA,IAC7B;AAAA,EACF;AAmBA,EAAA,SAAS,gBAAA,GAA4B;AACnC,IAAA,IAAI,UAAA,GAAsB,IAAA;AAC1B,IAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AACrB,IAAA,IAAI,CAAC,MAAM,OAAO,UAAA;AAClB,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,KAAK,CAAA,IAAK,IAAA,CAAK,SAAQ,EAAG;AACvC,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,KAAU,CAAA;AAElC,MAAA,IAAI,SAAS,IAAA,EAAM;AAEjB,QAAA,cAAA,CAAe,CAAC,CAAC,CAAC,CAAA;AAClB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,EAAA,GAAK,eAAe,IAAI,CAAA;AAC9B,MAAA,MAAM,OAAA,GAAU,cAAA,CAAe,GAAA,CAAI,CAAC,CAAA;AACpC,MAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,SAAA,KAAc,EAAA,EAAI;AAErD,QAAA;AAAA,MACF;AAEA,MAAA,cAAA,CAAe,CAAC,CAAC,CAAC,CAAA;AAClB,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,KAAA,CAAM,MAAA,CAAO,KAAA,EAAY,iBAAiB,GAAG,CAAA;AAC7D,QAAA,cAAA,CAAe,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,EAAA,EAAI,SAAS,CAAA;AAAA,MAClD,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,UAAA,KAAe,MAAM,UAAA,GAAa,GAAA;AAAA,MAExC;AAAA,IACF;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAQA,EAAA,SAAS,aAAA,GAAsB;AAK7B,IAAA,MAAM,WAAW,gBAAA,EAAiB;AAClC,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AAC1B,MAAA,IAAI,QAAA,KAAa,MAAM,MAAM,QAAA;AAC7B,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,aAAA,CAAc,KAAU,CAAA;AAChD,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AAKnC,IAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAChD,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAC3C,MAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,GAAA,CAAI,IAAA,EAAM;AACnD,QAAA,MAAM,IAAI,mBAAA,CAAoB,GAAA,CAAI,EAAA,EAAI,QAAA,EAAU,IAAI,IAAI,CAAA;AAAA,MAC1D;AACA,MAAA,eAAA,CAAgB,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,GAAA,CAAI,IAAI,CAAA;AAAA,IACtC;AAGA,IAAA,KAAA,MAAW,GAAA,IAAO,OAAA,EAAS,UAAA,CAAW,GAAA,CAAI,IAAI,EAAE,CAAA;AAChD,IAAA,QAAA,CAAS,CAAC,GAAG,WAAA,CAAY,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,CAAC,EAAA,KAAO,CAAC,UAAA,CAAW,GAAA,CAAI,EAAE,CAAC,CAAC,CAAA;AAGpE,IAAA,IAAI,eAAA,GAA2B,QAAA;AAC/B,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA,EAAG;AAC7B,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,SAAA,GAAY,GAAA,CAAI,IAAiB,CAAA;AACzD,MAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,QAAA;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,OAAA;AAAA,UACd,GAAA;AAAA,UACA,GAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,WAAA,CAAY,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,OAAO,CAAA;AAAA,MACjC,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,eAAA,KAAoB,MAAM,eAAA,GAAkB,GAAA;AAAA,MAElD;AAAA,IACF;AACA,IAAA,IAAI,eAAA,KAAoB,MAAM,MAAM,eAAA;AAAA,EACtC;AAKA,EAAA,MAAM,YAAA,GACH,OAAA,CAAiD,SAAA,IACjD,EAAC;AAUJ,EAAA,MAAM,iBAAA,GAAoB,CAAC,GAAA,KAAiB;AAC1C,IAAA,eAAA,CAAgB,GAAG,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AAC7C,MAAA,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,IAC3C,CAAC,CAAA;AAAA,EACH,CAAA;AAOA,EAAA,eAAe,aAAa,IAAA,EAAmC;AAC7D,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,IAAiB,CAAA;AAClD,MAAA,IAAI,CAAC,OAAA,EAAS;AACd,MAAA,MAAM,SAAS,MAAM,OAAA;AAAA,QACnB,GAAA;AAAA,QACA,YAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,EAAM;AAI3C,QAAA,eAAA,CAAgB,MAAW,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACrD,UAAA,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,QAC3C,CAAC,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,MAAA,CAAO,SAAA,EAAW,UAAA,EAAY,CAAC,QAAA,KAAa,UAAU,CAAA;AAAA,EACxD;AAIA,EAAA,SAAS,cAAc,GAAA,EAAc;AACnC,IAAA,IAAI,SAAA,CAAU,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACjD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,MAAA,CAAO,WAAW,UAAA,EAAY,CAAC,aAAa,QAAA,CAAS,GAAA,EAAK,QAAQ,CAAC,CAAA;AAAA,EACrE;AAIA,EAAA,SAAS,WAAW,GAAA,EAAc;AAChC,IAAA,IAAI,aAAA,CAAc,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACrD,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AACnC,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3C,MAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,MAAA,MAAA,CAAO,QAAQ,OAAA,EAAS,CAAC,OAAA,KAAY,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACrD;AAAA,EACF;AAGA,EAAA,SAAS,QAAA,GAAiB;AACxB,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,IAAI,YAAA,CAAa,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACpD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,MAAA,CAAO,cAAc,MAAA,EAAQ,CAAC,OAAA,KAAY,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EAC7D;AAIA,EAAA,SAAS,iBAAA,GAA0B;AACjC,IAAA,IAAI,WAAA,CAAY,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACnD,IAAA,IAAI,CAAC,UAAA,CAAW,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,WAAW,CAAA;AAC9B,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,OAAA,IAAW,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,EAChD;AAMA,EAAA,eAAe,MAAA,CAAO,IAAA,EAAS,GAAA,EAAQ,IAAA,EAAmC;AACxE,IAAA,KAAA,GAAQ,IAAA;AACR,IAAA,IAAI,KAAA,EAAO,MAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAChC,IAAA,aAAA,EAAc;AACd,IAAA,MAAM,aAAa,IAAI,CAAA;AACvB,IAAA,aAAA,EAAc;AACd,IAAA,aAAA,CAAc,GAAG,CAAA;AACjB,IAAA,UAAA,CAAW,GAAG,CAAA;AACd,IAAA,iBAAA,EAAkB;AAAA,EACpB;AAQA,EAAA,eAAe,aAAa,GAAA,EAAuB;AACjD,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAUA,IAAA,IAAI,OAAA,CAAQ,aAAa,MAAA,EAAW;AAClC,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAC5C,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,KAAK,CAAA;AAK1C,QAAA,IACE,QAAQ,MAAA,IACR,cAAA,CAAe,SAAS,CAAA,KAAM,cAAA,CAAe,GAAG,CAAA,EAChD;AACA,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAMA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,MAAM,IAAI,CAAA,GAAI,gBAAA,CAA0B,OAAA,EAAS,OAAO,GAAG,CAAA;AAAA,IAC9D,SAAS,WAAA,EAAa;AAEpB,MAAA,WAAA,CAAY,WAAA,EAAa,EAAE,KAAA,EAAO,QAAA,EAAU,CAAA;AAC5C,MAAA,QAAQ,YAAY,QAAA;AAAU,QAC5B,KAAK,SAAA,EAAW;AAId,UAAA,MAAM,MAAA,CAAO,YAAY,SAAA,CAAU,KAAA,EAAO,KAAK,WAAW,CAAA,EAAG,GAAA,EAAK,EAAE,CAAA;AACpE,UAAA;AAAA,QACF;AAAA,QACA,KAAK,UAAA;AAEH,UAAA,MAAM,WAAA;AAAA,QACR;AAGE,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,MAAM,WAAA;AAAA;AACV,IACF;AACA,IAAA,MAAM,MAAA,CAAO,IAAA,EAAM,GAAA,EAAK,IAAI,CAAA;AAAA,EAC9B;AASA,EAAA,IAAI,kBAAgC,EAAC;AACrC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,CAAC,YAAA,EAAc,QAAQ,IAAI,OAAA,CAAQ,IAAA,CAAK,MAAM,GAAG,CAAA;AACvD,IAAA,KAAA,GAAQ,YAAA;AACR,IAAA,eAAA,GAAkB,QAAA;AAAA,EACpB;AAEA,EAAA,eAAe,eAAA,GAAiC;AAC9C,IAAA,IAAI,KAAA,EAAO;AAKT,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,EAAK;AAC7B,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAChC,MAAA,MAAM,CAAC,YAAA,EAAc,QAAQ,IAAI,OAAA,CAAQ,IAAA,CAAK,QAAQ,GAAG,CAAA;AACzD,MAAA,KAAA,GAAQ,YAAA;AACR,MAAA,eAAA,GAAkB,QAAA;AAClB,MAAA,MAAM,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,aAAA,EAAc;AACd,IAAA,MAAM,aAAa,eAAe,CAAA;AAClC,IAAA,aAAA,EAAc;AAGd,IAAA,QAAA,EAAS;AAET,IAAA,iBAAA,EAAkB;AAAA,EACpB;AAOA,EAAA,SAAS,gBAAgB,GAAA,EAAuB;AAC9C,IAAA,IAAI,OAAA;AACF,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AACjE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,MAAM;AAC3B,MAAA,IAAI,SAAA,KAAc,MAAM,MAAM,SAAA;AAC9B,MAAA,OAAO,aAAa,GAAG,CAAA;AAAA,IACzB,CAAC,CAAA;AAGD,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAC1B,IAAA,OAAO,IAAA;AAAA,EACT;AAUA,EAAA,eAAe,iBAAA,GAAmC;AAChD,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,EAAS,CAAA,EAAA,EAAK;AAChC,MAAA,MAAM,QAAA,GAAW,IAAA;AACjB,MAAA,MAAM,QAAA;AACN,MAAA,IAAI,SAAS,QAAA,EAAU;AAAA,IACzB;AACA,IAAA,MAAM,IAAI,uBAAuB,OAAO,CAAA;AAAA,EAC1C;AAQA,EAAA,eAAe,oBAAA,CACb,KACAA,KAAAA,EACe;AACf,IAAA,MAAM,gBAAgB,GAAG,CAAA;AACzB,IAAA,IAAIA,KAAAA,EAAM,WAAW,MAAA,EAAQ;AAC7B,IAAA,MAAM,iBAAA,EAAkB;AAAA,EAC1B;AAMA,EAAA,MAAM,cAAc,eAAA,EAAgB;AACpC,EAAA,IAAA,GAAO,WAAA,CAAY,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChC,IAAA,SAAA,GAAY,GAAA;AAAA,EACd,CAAC,CAAA;AAKD,EAAA,MAAM,eAA0C,WAAA,CAAY,IAAA;AAAA,IAC1D,MAAM;AAAA,GACR;AAEA,EAAA,MAAM,OAAA,GAA4B;AAAA,IAChC,QAAA,EAAU,oBAAA;AAAA,IACV,YAAA,EAAc,eAAA;AAAA,IACd,QAAA,GAAc;AAIZ,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IACA,UAAU,QAAA,EAAkC;AAC1C,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,MAC3B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,QAAQ,QAAA,EAAkD;AACxD,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,MAC3B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,OAAO,OAAA,EAAyC;AAG9C,MAAA,IAAI,MAAA,IAAU,UAAU,MAAA,EAAW;AACjC,QAAA,MAAM,QAAA,GAAW,KAAA;AACjB,QAAA,MAAA,CAAO,CAAC,OAAO,CAAA,EAAG,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AAC5C,QAAA,OAAO,MAAM;AAAA,QAAC,CAAA;AAAA,MAChB;AACA,MAAA,YAAA,CAAa,IAAI,OAAO,CAAA;AACxB,MAAA,OAAO,MAAM;AACX,QAAA,YAAA,CAAa,OAAO,OAAO,CAAA;AAAA,MAC7B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,EAAA,CACE,MACA,OAAA,EACY;AAIZ,MAAA,IAAI,MAAA,GAAS,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AACnC,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,MAAA,uBAAa,GAAA,EAAwB;AACrC,QAAA,aAAA,CAAc,GAAA,CAAI,MAAM,MAAM,CAAA;AAAA,MAChC;AACA,MAAA,MAAM,MAAA,GAAS,OAAA;AACf,MAAA,MAAA,CAAO,IAAI,MAAM,CAAA;AACjB,MAAA,OAAO,MAAM;AACX,QAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AAClC,QAAA,IAAI,QAAQ,MAAA,EAAW;AACvB,QAAA,GAAA,CAAI,OAAO,MAAM,CAAA;AACjB,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,CAAA,EAAG,aAAA,CAAc,OAAO,IAAI,CAAA;AAAA,MAC/C,CAAA;AAAA,IACF,CAAA;AAAA,IACA,aAAA,CAAiB,MAAe,QAAA,EAA0C;AACxE,MAAA,MAAM,GAAA,GAAM,IAAA;AACZ,MAAA,IAAI,MAAA,GAAS,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACjC,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,uBAAa,GAAA,EAA8B;AAC3C,QAAA,YAAA,CAAa,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,MAC9B;AAEA,MAAA,MAAM,MAAA,GAAS,QAAA;AACf,MAAA,MAAA,CAAO,IAAI,MAAM,CAAA;AACjB,MAAA,OAAO,MAAM;AACX,QAAA,MAAM,GAAA,GAAM,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AAChC,QAAA,IAAI,CAAC,GAAA,EAAK;AACV,QAAA,GAAA,CAAI,OAAO,MAAM,CAAA;AACjB,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,CAAA,EAAG,YAAA,CAAa,OAAO,GAAG,CAAA;AAAA,MAC7C,CAAA;AAAA,IACF,CAAA;AAAA,IACA,QAAA,CAAY,MAAe,KAAA,EAAgB;AAEzC,MAAA,QAAA,CAAS,MAAM,KAAK,CAAA;AAAA,IACtB,CAAA;AAAA,IACA,KAAA,EAAO,YAAA;AAAA,IACP,IAAA,GAAsB;AACpB,MAAA,OAAO,iBAAA,EAAkB;AAAA,IAC3B,CAAA;AAAA,IACA,MAAA,GAAwB;AAGtB,MAAA,MAAM,OAAA,GAAU,KAAA;AAChB,MAAA,OAAO,UAAA,CAAW,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AAAA,IACzC,CAAA;AAAA,IACA,IAAA,GAAmB;AAGjB,MAAA,MAAM,OAAA,GAAU,KAAA;AAChB,MAAA,IAAI,WAAW,OAAO,CAAA,EAAG,OAAO,OAAA,CAAQ,QAAQ,OAAO,CAAA;AACvD,MAAA,OAAO,IAAI,OAAA,CAAW,CAAC,OAAA,KAAY;AACjC,QAAA,WAAA,CAAY,IAAI,OAAO,CAAA;AAAA,MACzB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,IAAA,GAAsB;AAC1B,MAAA,OAAA,GAAU,IAAA;AAGV,MAAA,MAAM,IAAA;AAEN,MAAA,QAAA,CAAS,CAAC,GAAG,WAAA,CAAY,IAAA,EAAM,CAAC,CAAA;AAEhC,MAAA,cAAA,CAAe,CAAC,GAAG,cAAA,CAAe,IAAA,EAAM,CAAC,CAAA;AAIzC,MAAA,IAAI,KAAA,IAAS,KAAA,KAAU,MAAA,IAAa,SAAA,KAAc,IAAA,EAAM;AACtD,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,QACxB,SAAS,KAAA,EAAO;AACd,UAAA,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,OAAO,OAAA;AACT","file":"chunk-BP2R7TPP.js","sourcesContent":["import type { BootingRuntime } from \"./runtime-types\";\n\n// === historyTracker: composable observability helper ===\n//\n// A bounded ring buffer of recent `(msg, state)` transitions, built on the\n// Runtime's public `observe` API. The substrate itself stays minimal — it has\n// no notion of history, no opt to enable one, no method on the Runtime\n// interface to read one. Anything that wants \"recent transitions\" composes via\n// this helper.\n//\n// Why not put this on the Runtime interface as `runtime.history()`? Because\n// history is derivable. Putting it on the Runtime privileges one use case\n// (debug inspectors) at the substrate level and grows the interface for\n// everyone; the composition shape stays out of the dispatch loop entirely, so\n// the substrate's hot path pays no cost for a feature it doesn't need.\n\nexport interface HistoryTracker<S, M extends { type: string }> {\n  /**\n   * Snapshot of recorded transitions, oldest first. Each entry is\n   * `{ msg, state }`: `msg` is `null` for the boot transition (recorded via\n   * `onBoot`) and the applied Msg for every other (recorded via `observe`).\n   *\n   * Returns a shallow copy: the array is fresh on every call (callers may\n   * iterate, slice, or replay without affecting the tracker's buffer).\n   * Entry values are references to the originals (TEA states/msgs are\n   * conventionally immutable; do not mutate them if your S/M is not).\n   */\n  snapshot(): readonly { readonly msg: M | null; readonly state: S }[];\n  /**\n   * Detach the underlying observer. After `stop()`:\n   *   - No new transitions are recorded.\n   *   - `snapshot()` continues to work and returns the buffer's contents\n   *     at the moment of stop (useful for post-hoc inspection in tests).\n   *   - The tracker holds no references that would prevent GC of the\n   *     `runtime` argument other than the entries already buffered.\n   *\n   * Idempotent — subsequent calls are no-ops.\n   */\n  stop(): void;\n}\n\n/**\n * Create a bounded history tracker over a Runtime. The tracker subscribes to\n * the runtime via `observe(...)` and retains the last `size` `(msg, state)`\n * transitions in a FIFO ring buffer.\n *\n * @param runtime  Any `BootingRuntime<S, M>` (a full `Runtime` satisfies it).\n *                 The tracker uses only `observe`, which is total before boot —\n *                 attach it to the synchronous `run()` handle to record the\n *                 boot transition.\n * @param size     Buffer cap. `size <= 0` produces an inert no-op tracker:\n *                 no observer is attached to the runtime, `snapshot()` is\n *                 always `[]`, and `stop()` is a no-op.\n */\nexport function historyTracker<S, M extends { type: string }>(\n  runtime: BootingRuntime<S, M>,\n  size: number,\n): HistoryTracker<S, M> {\n  const buffer: { msg: M | null; state: S }[] = [];\n  let stopped = false;\n\n  const push = (entry: { msg: M | null; state: S }): void => {\n    buffer.push(entry);\n    if (buffer.length > size) buffer.shift();\n  };\n\n  // The boot transition (the `{ msg: null, state }` head entry) arrives via\n  // `onBoot`; applied transitions arrive via `observe` with a total `msg`. The\n  // public snapshot shape (`msg: M | null`) is unchanged — boot is still\n  // `msg: null`.\n  const unobserve =\n    size <= 0\n      ? (): void => {}\n      : runtime.observe((msg, state) => {\n          push({ msg, state });\n        });\n  const unboot =\n    size <= 0\n      ? (): void => {}\n      : runtime.onBoot((state) => {\n          push({ msg: null, state });\n        });\n\n  return {\n    snapshot() {\n      // Shallow copy — callers may freely iterate or mutate the returned\n      // array. Entry values are references; see HistoryTracker docs.\n      return buffer.slice();\n    },\n    stop() {\n      if (stopped) return;\n      stopped = true;\n      unobserve();\n      unboot();\n    },\n  };\n}\n","/**\n * @demlik/tea runtime interface surface + pure helpers — the public types,\n * interfaces, and construction/composition helpers the runtime (`./run`)\n * implements against: `Store`, the error-sink and supervision contracts, the\n * `RuntimeRef` / `BootingRuntime` / `Runtime` handle hierarchy, `definePort`, the\n * identity-typed constructors `defineMachine` / `asReducer`, and the pure tools\n * `replay` (compose without running) and `tryInterpret` (Railway).\n */\n\nimport { Result } from \"better-result\";\nimport type {\n  InterpretDetached,\n  Machine,\n  Port,\n  PortEmitter,\n  Reducer,\n  Sub,\n  Transitions,\n} from \"./pure/core\";\nimport {\n  type Cmd,\n  detectUpdateForm,\n  foldUpdates,\n  structuralHash,\n} from \"./pure/core\";\n\n// The nominal brand minted ONLY through the validated construction path\n// (`asReducer` / `defineMachine`). A raw record of handlers is a structural\n// `Reducer<S, M, C>`; a branded one has passed through the single minting\n// boundary. The brand is an *optional* phantom so the structural annotation form\n// (`const update: Reducer<...> = { ... }`) keeps accepting plain object literals\n// — the guard that rejects an async reducer is `SyncReturn`'s non-thenable\n// return, enforced on every cell.\ndeclare const ReducerBrand: unique symbol;\n\n// A `Reducer` (or `Transitions`) minted through `asReducer` / `defineMachine`.\n// Carries the phantom brand; otherwise identical to its structural counterpart.\nexport type Branded<T> = T & { readonly [ReducerBrand]: true };\n\n/**\n * Compile-time exhaustiveness assertion for default branches of switches over\n * discriminated unions narrowed by hand (Sub handlers, message-bridge\n * dispatchers, port fanouts) — TS narrows the operand to `never` only if every\n * variant is covered, so adding one produces a compile error at the `absurd(x)`\n * site. Strengthens invariant 7 (identity is explicit).\n *\n * @example\n *   switch (msg.type) {\n *     case \"a\": return ...;\n *     case \"b\": return ...;\n *     default: return absurd(msg);  // compile error if a \"c\" is added\n *   }\n */\nexport function absurd(x: never): never {\n  throw new Error(`unreachable: ${JSON.stringify(x)}`);\n}\n\n// The explicit \"this cell ignores this msg\" helper. Naming the no-op forces the\n// author to *decide* \"this cell does nothing\" (a real decision), distinct from\n// \"I forgot to write this cell\" (which the mapped type rejects); an implicit\n// wildcard would silently swallow a future Msg variant that should be handled.\n// Assignable to any Transitions cell regardless of S/M/C concrete types.\nexport const noop = <S, M, C extends Cmd>(\n  state: S,\n  _msg: M,\n): readonly [S, readonly C[]] => [state, []];\n\n// Module-level registry — process-scope, identity-by-name. The runtime witness\n// that every port name in this process is unique. Cleared only by the test-only\n// `__resetPortRegistry()` helper.\nconst definedPortNames = new Set<string>();\n\n/**\n * Thrown by `definePort` when a name has already been registered in the current\n * process. Symmetric with `SubIdCollisionError` (thrown by `reconcileSubs`) —\n * both mechanize invariant 7 (identity is explicit) at the runtime layer the\n * type system cannot reach (string names compared at runtime).\n */\nexport class PortNameCollisionError extends Error {\n  override readonly name = \"PortNameCollisionError\";\n  readonly _tag = \"PortNameCollisionError\" as const;\n  constructor(portName: string) {\n    super(\n      `definePort: a port named \"${portName}\" was already defined. ` +\n        `Each definePort call must use a unique name. ` +\n        `If two modules need the same port, export it from one module and import it.`,\n    );\n  }\n}\n\n/**\n * Thrown by `reconcileSubs` when, within ONE desired subscription set, two subs\n * share an `id` but declare different `type`s — a silent bug class the type\n * system cannot reach (ids are strings compared at runtime). The symmetric twin\n * of `PortNameCollisionError`: both mechanize invariant 7 (identity is explicit)\n * at the runtime layer. Same id across transitions is the no-churn case and does\n * NOT throw; only a within-set type conflict does.\n */\nexport class SubIdCollisionError extends Error {\n  override readonly name = \"SubIdCollisionError\";\n  readonly _tag = \"SubIdCollisionError\" as const;\n  constructor(id: string, declaredType: string, conflictingType: string) {\n    super(\n      `@demlik/tea: Sub.id collision: id=\"${id}\" declared as ` +\n        `type=\"${declaredType}\" and type=\"${conflictingType}\"`,\n    );\n  }\n}\n\n/**\n * Test-only escape hatch — clears the module-level port-name registry so the\n * collision assert in `definePort` doesn't false-positive across vitest's\n * non-isolated runs. Production code MUST NOT call this.\n *\n * @internal test-only\n */\nexport function __resetPortRegistry(): void {\n  definedPortNames.clear();\n}\n\n/**\n * Which otherwise-unattributable runtime path produced an error. Every fanout is\n * throw-isolated so one bad consumer never strands its siblings, and the\n * isolated throw routes to the `OnError` sink rather than a bare `console.error`.\n *\n * - `\"follow-up\"` — a follow-up Msg an interpret handler returned rejected when\n *   re-dispatched (the original dispatcher already resolved, so no caller).\n * - `\"stop-save\"` — the final `store.save(state)` inside `stop()` threw\n *   (`stop()` resolves regardless, so without the sink this was silent loss).\n * - `\"reduce\"` — the pure `update` (reducer) threw synchronously; the configured\n *   `Supervision` strategy decides what happens next, but the throw is surfaced\n *   here as data first.\n * - `\"listener\"` — a `runtime.subscribe(...)` listener threw during fanout.\n * - `\"observer\"` — a `runtime.observe(...)` observer threw during fanout.\n * - `\"event\"` — the `events` projector or an `on(type, ...)` handler threw.\n * - `\"boot\"` — an `onBoot` handler threw (boot fanout, or a late registration).\n * - `\"port-emit\"` — a `subscribePort` listener threw during a port emission.\n * - `\"sub-cleanup\"` — a subscription's cleanup threw (reconcile-removal or\n *   `stop()` teardown).\n */\nexport type RuntimeErrorPhase =\n  | \"follow-up\"\n  | \"stop-save\"\n  | \"reduce\"\n  | \"listener\"\n  | \"observer\"\n  | \"event\"\n  | \"boot\"\n  | \"port-emit\"\n  | \"sub-cleanup\";\n\n/** Context handed to an `OnError` sink alongside the error itself. */\nexport interface RuntimeErrorContext {\n  readonly phase: RuntimeErrorPhase;\n}\n\n/**\n * Sink for runtime failures that have no caller to reject at. Configured via\n * `run(machine, { onError })`. Should be total — a throw inside the sink is\n * itself surfaced via the default sink, so it can never re-introduce a silent\n * failure.\n */\nexport type OnError = (error: unknown, context: RuntimeErrorContext) => void;\n\n// === Supervision: declared policy for a reducer throw ===\n//\n// A throw inside the pure `update` is a synchronous throw (the reentrancy brand\n// makes a reducer provably synchronous), catchable in the dispatch loop — the\n// seam Akka supervisor strategies / Erlang-OTP supervision trees occupy: \"let it\n// crash\" becomes CONFIG. Every strategy routes the failure to `onError` with\n// `phase: \"reduce\"` FIRST (invariant 6), then differs in what happens next:\n//\n//   - `stop`    — halt (SAFE DEFAULT). State is NOT advanced; the dispatch\n//                 promise rejects; every subsequent dispatch rejects. Never a\n//                 silent resume.\n//   - `escalate`— surface + propagate: the dispatch promise rejects so the\n//                 failure bubbles to a parent supervisor. The runtime stays live.\n//   - `restart` — re-init from a host-provided last-known-good state and keep\n//                 folding. The core owns no snapshot logic — the host supplies\n//                 `rehydrate()`, the core installs its result and continues.\n\n/** The three declared reducer-throw supervision strategies. */\nexport type SupervisionStrategy = \"stop\" | \"escalate\" | \"restart\";\n\n/**\n * Declared supervision policy for a reducer (`update`) throw, at\n * `run(machine, { supervision })`. The bare-string shorthands (`\"stop\"` /\n * `\"escalate\"`) are accepted for the two strategies that need no host data;\n * `restart` MUST be the object form because it carries the `rehydrate` callback,\n * which MUST return a valid `S` synchronously (the reducer is synchronous, so\n * recovery is too — no suspension across the single-writer slot).\n */\nexport type Supervision<S, M extends { type: string }> =\n  | \"stop\"\n  | \"escalate\"\n  | { readonly strategy: \"stop\" }\n  | { readonly strategy: \"escalate\" }\n  | {\n      readonly strategy: \"restart\";\n      /**\n       * Host-provided rehydration to last-known-good state. Invoked when the\n       * reducer throws; its return value becomes the new state and the transition\n       * continues from there. Receives the pre-throw `state`, the `msg` that\n       * triggered the throw, and the thrown `error` so the host can route by\n       * cause.\n       */\n      readonly rehydrate: (state: S, msg: M, error: unknown) => S;\n    };\n\n/**\n * Raised by `idle()` when the quiescence wait hits its iteration cap without the\n * dispatch tail stabilizing — `idle()` REJECTS rather than silently resolving,\n * so a livelocking machine surfaces instead of masquerading as quiescent.\n * Mechanizes invariant 6 at the runtime layer, the role `PortNameCollisionError`\n * plays for invariant 7.\n */\nexport class QuiescenceTimeoutError extends Error {\n  override readonly name = \"QuiescenceTimeoutError\";\n  readonly _tag = \"QuiescenceTimeoutError\" as const;\n  constructor(public readonly iterations: number) {\n    super(\n      `@demlik/tea: idle() did not reach quiescence after ${iterations} ` +\n        `iterations — the dispatch tail kept advancing. The machine is ` +\n        `likely livelocking (an interpret handler enqueues a follow-up Msg ` +\n        `that enqueues another, without end). Bound the follow-up chain in ` +\n        `the reducer, or stop the runtime.`,\n    );\n  }\n}\n\n/**\n * Define a typed port. `name` is metadata (devtools / debug logs); port identity\n * is by reference. Each definePort call must use a unique `name` — a second call\n * with the same name throws `PortNameCollisionError`. Use ports for \"data leaving\n * the runtime selectively\" (cursor announcements, DOM-mutation broadcasts,\n * telemetry) that should NOT be folded into State. Strengthens invariant 7.\n */\nexport function definePort<T>(name: string): Port<T> {\n  // HMR skip — Vite / dev servers re-import the module on hot reload, which\n  // would otherwise false-positive on every definePort across reloads. The\n  // try/catch is load-bearing for service-worker bundles: Vite polyfills\n  // `import.meta.url` via `document.baseURI`, which throws ReferenceError in\n  // an MV3 service worker. A throw here would abort SW install (Chrome\n  // surfaces it as \"registration failed status 15\"). Catching it = \"no HMR\n  // detected\" = the collision check applies, which is the correct SW\n  // behavior (SWs reload via chrome.runtime.reload, not module HMR).\n  let isHmr = false;\n  try {\n    const meta = import.meta as { hot?: unknown };\n    isHmr = meta?.hot !== undefined && meta?.hot !== null;\n  } catch {\n    isHmr = false;\n  }\n  if (!isHmr && definedPortNames.has(name)) {\n    throw new PortNameCollisionError(name);\n  }\n  definedPortNames.add(name);\n  return { __brand: \"port\", name } as Port<T>;\n}\n\n// === Store: pluggable persistence adapter ===\n//\n// `load()` returns `unknown` because storage genuinely doesn't know `S` —\n// chrome.storage returns whatever JSON lives at the key, DurableObjectStorage\n// returns whatever bytes were serialized. Casting raw storage to `S` at the\n// adapter boundary is the exact `as S` move forbidden by invariant 8\n// everywhere else in the substrate. `load()` returning `unknown` makes the\n// substrate stop pretending.\n//\n// `migrate(raw)` is the boundary parse. Returns `S` on a recognized shape —\n// the substrate passes it to `init` as `loaded`. Returns `null` on any\n// unrecognized shape — the substrate passes `null` to `init`, fresh-boot\n// path. Must NOT throw: if a future shape is unrecognizable, returning\n// `null` boots clean from a known-good path. Throwing here would\n// indistinguishably collapse \"storage corruption\" and \"schema migration not\n// yet written\" — both are runtime decisions, not panics.\n//\n// Strengthens invariant 8 (the boundary parses; the core trusts) — the\n// substrate now enforces the parse instead of relying on every adapter\n// remembering to.\nexport interface Store<S> {\n  load(): Promise<unknown>;\n  save(state: S): Promise<void>;\n  migrate(raw: unknown): S | null;\n}\n\n// === Schema-derived migrate: single-source the durable State ===\n//\n// The boundary parse `migrate(raw)` is two jobs glued together:\n//   1. STRUCTURAL VALIDATION — \"is this the current shape?\" 100% derivable\n//      from the State type, pure boilerplate, the part that drifts when a\n//      field is added to a variant but the hand-written parser isn't updated.\n//   2. VERSION MIGRATION — \"upgrade an OLD shape to the current one\" (default a\n//      missing field, drop a dead one, remap a removed enum). Genuine logic.\n//      Encodes decisions about how past rows map forward. NOT derivable.\n//\n// `schemaMigrate` derives job 1 from a schema and isolates job 2 in a thin,\n// explicit `upcast` run BEFORE the parse. When the State type is itself\n// `Schema<S>`-inferred (`type S = SchemaOutput<typeof schema>`), the type and\n// the validator are the SAME declaration — you cannot add a field to the type\n// without it being in the schema, so the parse always enforces the current\n// shape. The `as S` an adapter would otherwise write on `safeParse().data` is\n// deleted: the schema's output IS `S`.\n//\n// The kernel stays library-agnostic — `Schema<S>` is the minimal Standard-\n// Schema-shaped surface (`safeParse`) that both zod 3 and zod 4 satisfy. No\n// validator is imported here; the consumer supplies one.\n//\n// Strengthens invariant 8 (the boundary parses; the core trusts) and invariant\n// 1 (state is a value — one declaration sources both type and parser).\nexport interface Schema<S> {\n  safeParse(raw: unknown): { success: true; data: S } | { success: false };\n}\n\n/**\n * Build a `Store.migrate` from a schema (job 1) and an optional thin `upcast`\n * (job 2). `upcast` maps a recognized-but-OLD raw shape forward into the shape\n * the schema validates; it defaults to identity (no version migration yet).\n *\n * Never throws — a shape the schema rejects returns `null`, the substrate's\n * fresh-boot path, per the `Store.migrate` contract. An `upcast` that itself\n * throws on a corrupt blob is caught and collapses to `null` (same posture).\n */\nexport function schemaMigrate<S>(\n  schema: Schema<S>,\n  upcast: (raw: unknown) => unknown = (raw) => raw,\n): (raw: unknown) => S | null {\n  return (raw: unknown): S | null => {\n    let migrated: unknown;\n    try {\n      migrated = upcast(raw);\n    } catch {\n      return null;\n    }\n    const parsed = schema.safeParse(migrated);\n    return parsed.success ? parsed.data : null;\n  };\n}\n\n// === DispatchSettle: how far a dispatch awaits ===\n//\n// The default is the SAFE one, `\"quiescent\"` — `dispatch` resolves only once the\n// entire transitive follow-up chain has drained (the same drain `idle()`\n// performs). Were the default one transition, an `interpret` follow-up Msg would\n// enqueue a fresh transition fire-and-forget relative to the original\n// `dispatch`, resolving \"early\". The rare single-step case opts in with `\"once\"`\n// (or the `dispatchOnce` convenience).\nexport type DispatchSettle = \"quiescent\" | \"once\";\n\n// === RuntimeRef<M>: typed sibling-runtime handle ===\n//\n// Exposes only the inbox of a Runtime — `dispatch` / `dispatchOnce`. Use it as\n// the field type when one runtime holds a *sibling* (composition by reduction\n// across orthogonal lifecycles — invariant 5): the holder learns the Msg shape\n// it can send, nothing about the referenced runtime's State/Cmd/Sub/Ctx/\n// observers/Port fanout. `Runtime<S, M>` extends `RuntimeRef<M>` structurally.\nexport interface RuntimeRef<M extends { type: string }> {\n  /**\n   * Put a Msg in the runtime's inbox and resolve once processed. Runs to\n   * QUIESCENCE by default: settles only after the dispatched Msg AND every\n   * transitive interpret follow-up has drained. Pass `{ settle: \"once\" }` (or\n   * call `dispatchOnce`) for the single-step case.\n   *\n   * Rejection ordering: the ONE dispatched transition's own failure surfaces\n   * first, here. If it succeeds but the follow-up chain never stabilizes, the\n   * quiescent drain rejects with `QuiescenceTimeoutError`. Follow-up Msg\n   * rejections themselves route to the `onError` sink, never here.\n   */\n  dispatch(msg: M, opts?: { readonly settle?: DispatchSettle }): Promise<void>;\n  /**\n   * Dispatch `msg` and resolve after exactly ONE transition's effects settle,\n   * WITHOUT draining the follow-up chain — equivalent to\n   * `dispatch(msg, { settle: \"once\" })`. Prefer plain `dispatch` unless you will\n   * `await runtime.idle()` yourself; the un-awaited follow-up chain is the\n   * footgun the quiescent default removed.\n   */\n  dispatchOnce(msg: M): Promise<void>;\n}\n\n// === BootingRuntime: handle returned SYNCHRONOUSLY from run() ===\n//\n// `run()` returns a `BootingRuntime<S, M>` the instant it is called, while boot\n// is still in flight. It exposes exactly the surface TOTAL before boot: queue a\n// dispatch, subscribe, observe, wire a Port, stop. What you may NOT do is read\n// State (`getState`) or wait for quiescence (`idle`) — those need the initial\n// State to exist, and are the difference between a BootingRuntime and a\n// `Runtime`, enforced at the type level so \"read State before boot\" is a COMPILE\n// error, not a runtime throw.\n//\n// `subscribe` is the React-shaped change notifier (zero-arg, paired with\n// `getState()`). `observe` is the devtools-shaped trace hook — `(msg, state)`\n// for every APPLIED transition; boot is delivered via `onBoot` instead, so\n// `observe`'s `msg` is total (never `null`). `on(type, handler)` is the SEMANTIC\n// event channel: only the public, `type`-narrowed events a machine projects,\n// never its PRIVATE Msg vocabulary. `E` defaults to `never` (no projector → `on`\n// uncallable).\nexport interface BootingRuntime<\n  S,\n  M extends { type: string },\n  E extends { type: string } = never,\n> extends RuntimeRef<M> {\n  dispatch(msg: M, opts?: { readonly settle?: DispatchSettle }): Promise<void>;\n  dispatchOnce(msg: M): Promise<void>;\n  subscribe(listener: () => void): () => void;\n  observe(observer: (msg: M, state: S) => void): () => void;\n  /**\n   * Subscribe to the INITIAL State — the boot transition. Fires exactly once:\n   * immediately if boot already completed (so a late subscriber never misses\n   * it), otherwise on the boot fanout. Returns a cleanup (a no-op once fired).\n   */\n  onBoot(handler: (state: S) => void): () => void;\n  /**\n   * Subscribe to a SEMANTIC event of `type`. The handler receives exactly the\n   * `E` member whose `type` matches `K`, so a consumer never touches another\n   * event's shape and never references the machine's PRIVATE Msg names. Multiple\n   * handlers per type; fanout is synchronous and throw-isolated. Fires only when\n   * the machine's `events` projector (wired on `run`) emits that type.\n   */\n  on<K extends E[\"type\"]>(\n    type: K,\n    handler: (event: Extract<E, { type: K }>) => void,\n  ): () => void;\n  /**\n   * Subscribe to a typed Port. Multiple listeners per port; fanout is synchronous\n   * and isolated. Ports are for \"data leaving the runtime selectively\" (see\n   * `definePort`) — distinct from `observe` (every transition) and State.\n   */\n  subscribePort<T>(port: Port<T>, listener: (value: T) => void): () => void;\n  /**\n   * Emit a value on a Port from OUTSIDE an interpret handler — same synchronous\n   * fanout as `ctx.emit`. The canonical use is `observe`-driven emission (one\n   * runtime publishing a state-derived signal another subscribes to via\n   * `subscribePort`) without spawning a \"tell the outside world\" Cmd per\n   * transition.\n   */\n  emitPort<T>(port: Port<T>, value: T): void;\n  /**\n   * Resolves to the booted `Runtime<S, M>` after boot completes (or rejects with\n   * the boot error). This is the ONLY way to obtain a `Runtime` — and a\n   * `Runtime` is the only handle whose `getState()` is total. Awaiting `ready` is\n   * the single gate between \"boot in flight\" and \"State exists\":\n   *\n   * ```ts\n   * const runtime = await run(machine, opts).ready;\n   * runtime.getState(); // total — never throws-before-boot\n   * ```\n   *\n   * Idempotent — the same settled promise, resolving to the same `Runtime`, comes\n   * back on every read. Expresses canon §2.3 (boot is a named, awaitable moment).\n   */\n  ready: Promise<Runtime<S, M, E>>;\n  stop(): Promise<void>;\n}\n\n// === Runtime: the BOOTED handle `ready` resolves to ===\n//\n// A `BootingRuntime<S, M>` whose boot has completed. It adds the two members\n// only meaningful once the initial State exists — `getState()` (total) and\n// `idle()` (quiescence) — and narrows `ready` to resolve to itself. You never\n// construct one directly; you obtain it via `await bootingRuntime.ready`, which\n// makes \"read State before boot\" unrepresentable rather than merely discouraged.\nexport interface Runtime<\n  S,\n  M extends { type: string },\n  E extends { type: string } = never,\n> extends BootingRuntime<S, M, E> {\n  /**\n   * The current State. TOTAL — never throws. Obtaining a `Runtime` requires\n   * awaiting `ready`, which only resolves AFTER boot has run `init` and set the\n   * initial State.\n   */\n  getState(): S;\n  /** Resolves to this same `Runtime` once boot completes. Idempotent. */\n  ready: Promise<Runtime<S, M, E>>;\n  /**\n   * Resolves once the runtime has reached QUIESCENCE — every dispatched Msg AND\n   * every transitive interpret follow-up has been processed, with no further step\n   * pending on the tail. Since plain `dispatch` already runs to quiescence, this\n   * is mainly for follow-ups left by a `dispatchOnce` single step, or a chain\n   * kicked off by a Sub / boot `init` cmds with no `dispatch` to await.\n   *\n   * Idempotent and re-entrant-safe. Tail rejections are NOT surfaced here (a\n   * failing dispatch surfaces on its OWN promise; follow-up rejections route to\n   * `onError`). The one rejection `idle()` produces is `QuiescenceTimeoutError`\n   * on hitting the iteration cap — so a livelock stays distinguishable from a\n   * genuine quiesce (invariant 6). A poll is still correct when waiting on an\n   * EXTERNAL event the runtime cannot enqueue itself.\n   */\n  idle(): Promise<void>;\n  /**\n   * The terminal State of the run, or `undefined` while in flight — \"terminal\"\n   * per the `terminal` predicate passed to `run()` (no predicate → never\n   * terminal → always `undefined`). The first-class result read: the run's\n   * product off the State the machine already owns, NOT scraped off the `observe`\n   * firehose by matching an internal Msg name. Total — never throws.\n   */\n  result(): S | undefined;\n  /**\n   * Resolves with the terminal State the first time the run reaches one (per the\n   * `terminal` predicate). If ALREADY terminal, resolves immediately; otherwise\n   * on the transition that first makes `terminal` hold. The awaitable companion\n   * to `result()`. With no predicate this never resolves. Idempotent and\n   * multi-caller safe.\n   */\n  done(): Promise<S>;\n}\n\n// === defineMachine: identity-typed pass-through ===\n//\n// Overloads enforce exactly one `update` shape per call so consumers see a\n// concrete type, not the internal union. Runtime is identity — `run` branches on\n// the structural shape of `update` (Reducer = record of functions; Transitions =\n// record of records) when dispatching, so overload resolution picks the right\n// branch by value shape. Strengthens invariant 2 (record forms have no\n// fall-through default) and invariant 7 (the variant set is load-bearing).\n\n// Transitions-form overload — 2D table keyed by State.type then Msg.type.\n// Declared FIRST (most specific). The S constraint is a conditional (`S extends\n// { type: string } ? Transitions<...> : never`) not a generic-parameter\n// constraint, so `S` stays unconstrained at the signature and the public\n// `Parameters<typeof defineMachine<NonDiscriminatedS, ...>>` pattern skips this\n// overload (update becomes `never`) instead of failing.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  m: Omit<Machine<S, M, C, U, Ctx>, \"update\"> & {\n    // `[S]` tuple-wrap disables distributive conditional behavior — see\n    // the comment on `Machine.update` for why distribution is wrong here.\n    update: [S] extends [{ type: string }] ? Transitions<S, M, C> : never;\n  },\n): Machine<S, M, C, U, Ctx>;\n// Reducer-form overload — flat record keyed by Msg.type.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  m: Omit<Machine<S, M, C, U, Ctx>, \"update\"> & {\n    update: Reducer<S, M, C>;\n  },\n): Machine<S, M, C, U, Ctx>;\n// Implementation signature — accepts both via the union on `Machine.update`.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(m: Machine<S, M, C, U, Ctx>): Machine<S, M, C, U, Ctx> {\n  // Tag the update form ONCE, here at the typed construction boundary, so no\n  // downstream reader re-derives it structurally. Non-enumerable so it does not\n  // serialize, show up in `Object.keys`, or collide with a Msg.type key.\n  // Idempotent under re-wrap (`defineMachine(defineMachine(m))`).\n  if (m.__form === undefined) {\n    Object.defineProperty(m, \"__form\", {\n      value: detectUpdateForm(m.update as object),\n      enumerable: false,\n      writable: false,\n      configurable: true,\n    });\n  }\n  return m;\n}\n\n// === asReducer: the validated minting path for a reducer ===\n//\n// Turns a raw record of handlers into a branded `Reducer<S, M, C>`. The\n// parameter type's every cell returns the non-thenable `SyncReturn<S, C>`, so\n// the reentrancy guard fires HERE, at construction: an `async` cell returns\n// `Promise<...>`, not assignable to `SyncReturn`, and `tsc` rejects it. PURE —\n// identity at runtime (the brand is phantom). `defineMachine` brands its\n// `update` internally the same way, so this exists for the standalone `const\n// update = asReducer<...>({ ... })` form.\nexport function asReducer<S, M extends { type: string }, C extends Cmd>(\n  reducer: Reducer<S, M, C>,\n): Branded<Reducer<S, M, C>> {\n  return reducer as Branded<Reducer<S, M, C>>;\n}\n\n// === CtxArg<Ctx>: the `ctx` field of `run`'s opts, conditionally optional ===\n//\n// A PURE machine reads nothing from `ctx` (its `Ctx` is `NoCtx` /\n// `Record<string, never>` / `unknown`); forcing `ctx: {}` is ceremony for a\n// value the type already pins as empty. So `ctx` is CONDITIONALLY optional: when\n// `{}` satisfies `Ctx` it may be OMITTED (defaulted to `{}`), so a pure reducer\n// runs as `run(machine)`; when `Ctx` carries a field a handler reads, `ctx` stays\n// REQUIRED. `[Record<never, never>] extends [Ctx]` reads as \"is `{}` assignable\n// to `Ctx`\" — true for the context-free shapes, false for `{ db: … }`; the\n// tuple-wrap disables distributive conditional behavior.\nexport type CtxArg<Ctx> = [Record<never, never>] extends [Ctx]\n  ? { ctx?: Ctx }\n  : { ctx: Ctx };\n\n// === replay: pure unit-test helper ===\n//\n// Composes `init(loaded ?? null, ctx)` then `update(state, msg)` for each msg.\n// Returns the final state plus the cmds that *would* have been emitted and the\n// subs that *would* have been desired at the final state. It does NOT call any\n// `interpret[type]` handler, does NOT touch `Store`, and does NOT start any\n// subscription. `subscriptions` IS called to derive `subs` — that lets tests\n// assert what would be wired up without actually wiring it.\n//\n// Dep-keyed Subs are reported in `depSubs`: for each `machine.subs` entry\n// active at the FINAL state (its `deps` non-null), the entry's `index` and the\n// derived `id` (`structuralHash(deps)`) — so a test can assert \"the deadline +\n// checkpoint + bridge dep-subs are armed in `running`\" without wiring any\n// source. Same intent as `subs` for the manual path: assert the desired set\n// purely. `source` is NEVER called (replay starts no subscription).\nexport function replay<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  opts: { msgs: readonly M[]; ctx: Ctx; loaded?: S | null },\n): {\n  state: S;\n  cmds: C[];\n  subs: U[];\n  depSubs: { index: number; id: string }[];\n} {\n  // Coerce undefined → null so `replay` with `loaded: undefined` calls\n  // `init(null, ctx)`.\n  const loaded = opts.loaded ?? null;\n  const [initialState, initCmds] = machine.init(loaded, opts.ctx);\n\n  if (loaded !== null && initCmds.length > 0) {\n    throw new Error(\n      \"TEA contract violation: machine.init must return [state, []] (no Cmds) \" +\n        \"when `loaded` is non-null. Init's rehydrate branch is a pure state \" +\n        \"passthrough — the migration/parse boundary, not the boot-effect hook.\\n\\n\" +\n        \"Routes for boot effects:\\n\" +\n        \"  - Stateless infrastructure (e.g. chrome.alarms ensure) → host module \" +\n        \"top level, outside TEA.\\n\" +\n        \"  - State-conditional resume (e.g. re-attach a session) → a `boot` Msg \" +\n        \"dispatched once from the host after `run(...)` returns, handled in update.\\n\\n\" +\n        \"See .patterns/tea/tea-invariants.md (Invariant 2).\",\n    );\n  }\n\n  // `replay` and `foldMsgs` share ONE internal fold (`foldUpdates`), keyed on\n  // `formOf` — the same reader `run` uses — so all three agree on the\n  // reducer-vs-transitions form by construction.\n  const { state, cmds: foldedCmds } = foldUpdates<S, M, C>(\n    machine,\n    initialState,\n    opts.msgs,\n  );\n  const cmds: C[] = [...initCmds, ...foldedCmds];\n\n  const subs: U[] = machine.subscriptions\n    ? [...machine.subscriptions(state)]\n    : [];\n\n  // The dep-keyed desired set at the final state — `deps` only, never `source`.\n  const depSubs: { index: number; id: string }[] = [];\n  if (machine.subs) {\n    for (const [index, entry] of machine.subs.entries()) {\n      const deps = entry.deps(state);\n      if (deps !== null) depSubs.push({ index, id: structuralHash(deps) });\n    }\n  }\n\n  return { state, cmds, subs, depSubs };\n}\n\n// === wrapDetached: the typed Cmd→Msg edge for a detached interpret handler ===\n//\n// Adapts an `InterpretDetached<C, Allowed, Ctx>` — a handler that detaches its\n// long-running work (`ctx.waitUntil(...)`) and fires its TERMINAL Msg through\n// the kernel-injected `dispatch` — into a plain `Interpret` cell that drops into\n// the `interpret` dictionary unchanged. The point is the NARROWING: `Allowed`\n// is the subset of the Msg union this Cmd is permitted to produce, and the\n// `dispatch` the handler sees is typed `(msg: Allowed) => void`. A wrong /\n// typo'd terminal Msg from the detached site then fails to compile (rung 2),\n// where today it reaches for a host-wired `ctx.dispatch` typed to the full\n// union and compiles silently (rung 5 — the allowed set on a comment).\n//\n// `Allowed extends M` is the constraint that makes this SOUND at the kernel:\n// the kernel injects the WIDE `dispatch: (msg: M) => void`, the handler only\n// ever calls it with `Allowed` values (its own narrowed signature enforces\n// that), and every `Allowed` is a valid `M`. So passing the wide dispatch into\n// the narrow-expecting handler is type-correct in one direction (the values the\n// handler produces are all `M`) — the narrowing constrains the AUTHOR, not the\n// kernel. No `as` on data: the only widen is the function reference itself\n// (`dispatch` accepting `M` is usable where one accepting `Allowed` is wanted\n// because `Allowed extends M` — contravariant parameter, sound here because the\n// handler never sees a non-`Allowed` value), expressed by the explicit\n// `Allowed`/`M` generic relation, not a cast.\n//\n// Opt-in / additive: a leaf handler that resolves on its own keeps returning\n// `Promise<M | void>` and never touches `wrapDetached`. Only the detached sites\n// adopt it. The wrapped result is structurally a plain cell, so the `interpret`\n// map type is unchanged.\n//\n// Strengthens invariant 3 (effects are data — the detached effect's terminal\n// result feeds back as a Msg, now a TYPED edge) and invariant 7 (identity is\n// explicit — a Cmd's allowed result-Msg set is load-bearing at the type level).\nexport function wrapDetached<\n  C extends Cmd,\n  M extends { type: string },\n  Allowed extends M,\n  Ctx,\n>(\n  handler: InterpretDetached<C, Allowed, Ctx>,\n): (\n  cmd: C,\n  ctx: Ctx & PortEmitter,\n  dispatch?: (msg: M) => void,\n) => Promise<void> {\n  // The injected `dispatch` accepts the full `M`. The handler's signature only\n  // lets it call `dispatch` with `Allowed` (⊆ M) values, so handing it the\n  // wide fn is sound: `(msg: M) => void` is callable wherever\n  // `(msg: Allowed) => void` is wanted, and every value the handler passes is a\n  // valid `M`. No data cast — the relation is carried by `Allowed extends M`.\n  //\n  // `dispatch` is OPTIONAL on the signature to match the `Interpret` cell type\n  // (additive — see `Interpret`). The kernel ALWAYS passes it from\n  // `runInterpret`; a detached handler invoked WITHOUT a dispatch (only a\n  // mis-wired direct caller could do this) has no way to fire its terminal Msg,\n  // so we fail loudly (rung 4) rather than silently dropping the seam's result.\n  return (cmd, ctx, dispatch) => {\n    if (dispatch === undefined) {\n      throw new Error(\n        \"@demlik/tea: a wrapDetached handler was invoked without the injected dispatch. \" +\n          \"The kernel always supplies it; call the handler through the runtime, not directly.\",\n      );\n    }\n    return handler(cmd, ctx, dispatch);\n  };\n}\n\n// === tryInterpret: Railway sugar over `Result.tryPromise` ===\n//\n// Wraps a fallible `(cmd, ctx) => Promise<Ok>` into a handler for\n// `interpret[type]`: on success resolves `onOk(value, cmd)`, on rejection\n// `onErr(error, cmd)`. It NEVER rejects (assuming `onOk`/`onErr` are total).\n//\n// We use the `{try, catch: (e) => e}` form (not the one-arg thunk) so the\n// original error passes through untouched — the one-arg form wraps errors in\n// `UnhandledException`, which would break `instanceof` checks inside `onErr`.\nexport function tryInterpret<C extends Cmd, Ok, M, Ctx>(\n  work: (cmd: C, ctx: Ctx) => Promise<Ok>,\n  onOk: (value: Ok, cmd: C) => M,\n  onErr: (error: unknown, cmd: C) => M,\n): (cmd: C, ctx: Ctx) => Promise<M> {\n  return async (cmd, ctx) => {\n    const result = await Result.tryPromise({\n      try: () => work(cmd, ctx),\n      catch: (error: unknown): unknown => error,\n    });\n    return result.match({\n      ok: (value) => onOk(value, cmd),\n      err: (error) => onErr(error, cmd),\n    });\n  };\n}\n","/**\n * @demlik/tea runtime — `run`: boot + the serial dispatch loop. The pure helpers\n * that compose against a machine without running it (`replay`, `tryInterpret`)\n * live in `./runtime-types`.\n */\n\nimport type {\n  Dispose,\n  Interpret,\n  Machine,\n  Port,\n  PortEmitter,\n  Sub,\n} from \"./pure/core\";\nimport { applyCellChecked, type Cmd, structuralHash } from \"./pure/core\";\nimport type {\n  BootingRuntime,\n  CtxArg,\n  DispatchSettle,\n  OnError,\n  Runtime,\n  RuntimeErrorContext,\n  RuntimeErrorPhase,\n  Store,\n  Supervision,\n} from \"./runtime-types\";\nimport { QuiescenceTimeoutError, SubIdCollisionError } from \"./runtime-types\";\n\n// Default `onError` sink: re-throw on a fresh macrotask so the failure reaches\n// the host's global error handler instead of vanishing — surface, not swallow\n// (invariant 6).\nfunction defaultOnError(error: unknown, _context: RuntimeErrorContext): void {\n  setTimeout(() => {\n    throw error;\n  }, 0);\n}\n\n// Normalize `Supervision` (bare string or object) so the dispatch loop branches\n// on `.strategy` once. Default `stop`. Derived from `Supervision` — the object\n// arms are exactly its non-string members, so the restart `rehydrate` payload\n// has a single source of truth.\ntype NormalizedSupervision<S, M extends { type: string }> = Extract<\n  Supervision<S, M>,\n  object\n>;\n\nfunction normalizeSupervision<S, M extends { type: string }>(\n  supervision: Supervision<S, M> | undefined,\n): NormalizedSupervision<S, M> {\n  if (supervision === undefined) return { strategy: \"stop\" };\n  if (typeof supervision === \"string\") return { strategy: supervision };\n  return supervision;\n}\n\n// === run ===\n//\n// Returns a `BootingRuntime<S, M>` synchronously; boot runs as the FIRST entry\n// on the serial dispatch tail, awaited implicitly by every public method.\n//\n// Save-then-effects ordering is structural: every transition mutates state,\n// awaits `store.save(newState)`, then reconciles subscriptions, then runs\n// `interpret` for emitted cmds, then fires external listeners. A throw in any\n// effect phase leaves the persisted state ahead of the host's belief about\n// what executed — the Railway discipline (`tryInterpret` in handlers) makes\n// that safe in practice.\nexport function run<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n  E extends { type: string } = never,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  opts: CtxArg<Ctx> & {\n    store?: Store<S>;\n    onError?: OnError;\n    /**\n     * The SEMANTIC event projector. Maps one APPLIED transition `(msg, state)`\n     * to zero-or-more public events of `E`; `[]` skips the transition. Maps the\n     * machine's PRIVATE Msg vocabulary to NAMED events — the private names never\n     * reach `on`'s `E` surface. Omit → `E = never` and `on` is uncallable. PURE.\n     */\n    events?: (msg: M, state: S) => readonly E[];\n    /**\n     * Declared policy for a reducer (`update`) throw. Always surfaced via\n     * `onError` (`phase: \"reduce\"`); the strategy decides what the runtime does\n     * next. Defaults to `\"stop\"`. See `Supervision`.\n     */\n    supervision?: Supervision<S, M>;\n    /**\n     * The run-terminality predicate — makes the run's outcome first-class. Fed to\n     * `Runtime.result()` and `Runtime.done()`. PURE. Omit → never terminal.\n     */\n    terminal?: (state: S) => boolean;\n    /**\n     * Iteration cap for `idle()`'s quiescence wait. Defaults to 100_000. Test\n     * seam only. Production code must not set it.\n     *\n     * @internal test-only\n     */\n    __idleCap?: number;\n  },\n): BootingRuntime<S, M, E> {\n  const { store } = opts;\n  // `ctx` is conditionally optional (see `CtxArg`); default the nullish case to\n  // `{}` so the augmented-ctx spread and `init(loaded, ctx)` get a value.\n  const ctx = (opts.ctx ?? {}) as Ctx;\n  const idleCap = opts.__idleCap ?? 100_000;\n  // No projector → `E = never` and `on` is uncallable.\n  const projectEvents: (msg: M, state: S) => readonly E[] =\n    opts.events ?? (() => []);\n  // No predicate → never terminal (`result()` always `undefined`).\n  const isTerminal: (state: S) => boolean = opts.terminal ?? (() => false);\n  // Absent sink → `defaultOnError` (invariant 6).\n  const onError: OnError = opts.onError ?? defaultOnError;\n  // A throwing sink routes THAT throw through `defaultOnError` so it can't\n  // re-create a silent failure.\n  const reportError = (error: unknown, context: RuntimeErrorContext): void => {\n    try {\n      onError(error, context);\n    } catch (sinkError) {\n      defaultOnError(sinkError, context);\n    }\n  };\n\n  // Throw-isolated fanout: run `fn` for every item, routing any throw to the\n  // sink under `phase` so one bad consumer never strands its siblings\n  // (invariant 6). The single home for that isolation discipline — every\n  // synchronous listener/observer/handler fanout goes through here.\n  function fanout<T>(\n    items: Iterable<T>,\n    phase: RuntimeErrorPhase,\n    fn: (item: T) => void,\n  ): void {\n    for (const item of items) {\n      try {\n        fn(item);\n      } catch (err) {\n        reportError(err, { phase });\n      }\n    }\n  }\n  const supervision = normalizeSupervision<S, M>(opts.supervision);\n\n  // `state` is late-initialized inside the boot step (the head of the tail).\n  let state: S | undefined;\n  let bootError: unknown = null;\n  let stopped = false;\n\n  const subRegistry = new Map<string, () => void>();\n  // Dep-keyed Sub registry. One slot per `machine.subs[i]`, keyed by the entry's\n  // array index (its stable identity across reconciles — a dep-keyed Sub has no\n  // author-supplied id). `runningId` is the `structuralHash(deps)` of the live\n  // source; an absent slot means the entry is currently inactive (its `deps`\n  // returned null). The same dispose-on-change / dispose-on-null machinery the\n  // manual Sub path uses, with the id DERIVED instead of author-supplied.\n  const depSubRegistry = new Map<\n    number,\n    { runningId: string; dispose: Dispose }\n  >();\n  const listeners = new Set<() => void>();\n  // Observers get (msg, state) for every APPLIED transition (boot goes via `onBoot`).\n  const observers = new Set<(msg: M, state: S) => void>();\n  // `booted` lets an `onBoot` handler registered AFTER boot fire immediately.\n  const bootHandlers = new Set<(state: S) => void>();\n  let booted = false;\n  // Keyed by event `type`, stored monomorphically (per-type safety at `on`).\n  const eventHandlers = new Map<string, Set<(event: E) => void>>();\n  // `done()` waiters — the first terminal transition drains them.\n  const doneWaiters = new Set<(state: S) => void>();\n\n  // Keyed by Port reference (identity is by-reference per Elm); per-port type\n  // safety is enforced at the call sites.\n  const portRegistry = new Map<Port<unknown>, Set<(value: unknown) => void>>();\n\n  // `emit` injected onto ctx: synchronous fanout, no-op on no subscribers,\n  // listener throws isolated + routed to the sink (invariant 6).\n  function portEmit<T>(port: Port<T>, value: T): void {\n    const subscribers = portRegistry.get(port as Port<unknown>);\n    if (!subscribers || subscribers.size === 0) return;\n    fanout(subscribers, \"port-emit\", (listener) => listener(value));\n  }\n\n  // Spread into a fresh object so handlers get a Ctx & PortEmitter without\n  // mutating the caller's ctx (which may be shared across runtimes / tests).\n  const augmentedCtx: Ctx & PortEmitter = { ...ctx, emit: portEmit };\n\n  // Every step chains onto `tail` — the single concurrency gate.\n  let tail: Promise<void> = Promise.resolve();\n\n  // Tear down each named sub: run its cleanup (throws isolated + routed to the\n  // sink under `\"sub-cleanup\"`), then drop it from the registry regardless of a\n  // cleanup throw. The single home for the cleanup-and-delete discipline shared\n  // by `reconcileSubs`'s removal pass and `stop()`.\n  function stopSubs(ids: Iterable<string>): void {\n    for (const id of ids) {\n      const cleanup = subRegistry.get(id);\n      if (cleanup === undefined) continue;\n      try {\n        cleanup();\n      } catch (err) {\n        reportError(err, { phase: \"sub-cleanup\" });\n      }\n      subRegistry.delete(id);\n    }\n  }\n\n  // Dispose each named dep-keyed slot: run its `Dispose` (throws isolated +\n  // routed to the sink under `\"sub-cleanup\"`, exactly as `stopSubs` does for the\n  // manual path), then drop the slot regardless of a throw. The single home for\n  // the dispose-and-delete discipline shared by `reconcileDepSubs`'s teardown /\n  // re-arm passes and `stop()`.\n  function disposeDepSubs(indices: Iterable<number>): void {\n    for (const index of indices) {\n      const running = depSubRegistry.get(index);\n      if (running === undefined) continue;\n      try {\n        running.dispose();\n      } catch (err) {\n        reportError(err, { phase: \"sub-cleanup\" });\n      }\n      depSubRegistry.delete(index);\n    }\n  }\n\n  /**\n   * Reconcile the dep-keyed Subs (`machine.subs`) against `state`. Runs as the\n   * first pass of `reconcileSubs`, sharing the dispose-on-change /\n   * dispose-on-null machinery with the manual Sub path. For each entry:\n   *\n   *   - `deps(state)` is null → the Sub is inactive in this state; dispose it\n   *     if it was running.\n   *   - `deps(state)` is non-null → `id = structuralHash(deps)`; if no source\n   *     is running for this entry, or the running id differs (re-arm), dispose\n   *     the old source and run `source(state, dispatch, ctx)` to open a fresh\n   *     one (the entry re-derives its own typed slice from `state`).\n   *   - Unchanged id → leave the source running (the no-churn case).\n   *\n   * Start throws are collected and returned rather than thrown here (same\n   * contract as the manual path) so one bad source doesn't strand the others.\n   * A machine that declares no `subs` returns immediately — the pass is inert.\n   */\n  function reconcileDepSubs(): unknown {\n    let firstError: unknown = null;\n    const subs = machine.subs;\n    if (!subs) return firstError;\n    for (const [i, entry] of subs.entries()) {\n      const deps = entry.deps(state as S);\n\n      if (deps === null) {\n        // Inactive in this state — tear down if running.\n        disposeDepSubs([i]);\n        continue;\n      }\n\n      const id = structuralHash(deps);\n      const running = depSubRegistry.get(i);\n      if (running !== undefined && running.runningId === id) {\n        // No-churn case: same deps → leave the source running.\n        continue;\n      }\n      // Re-arm (id changed) or first arm — dispose the stale source first.\n      disposeDepSubs([i]);\n      try {\n        const dispose = entry.source(state as S, enqueueDispatch, ctx);\n        depSubRegistry.set(i, { runningId: id, dispose });\n      } catch (err) {\n        if (firstError === null) firstError = err;\n        // Do NOT register; continue so other dep-keyed sources still arm.\n      }\n    }\n    return firstError;\n  }\n\n  /**\n   * Reconcile subscriptions against `state`, after every save. Same id old+new →\n   * leave running; removed id → cleanup (throws isolated, routed to the sink);\n   * new id → start (throw remembered and re-thrown after the loop so all other\n   * new subs still register).\n   */\n  function reconcileSubs(): void {\n    // Dep-keyed pass FIRST, then the manual aggregate — ONE reconcile pass over\n    // both paths. Its start error is remembered (it happened first) and thrown\n    // after the manual pass so a bad dep-keyed source never strands the manual\n    // subs, and vice versa.\n    const depError = reconcileDepSubs();\n    if (!machine.subscriptions) {\n      if (depError !== null) throw depError;\n      return;\n    }\n    const desired = machine.subscriptions(state as S);\n    const desiredIds = new Set<string>();\n\n    // Collision assert: within one desired set, two subs sharing an id but\n    // declaring different types is a silent bug class. (Same id across\n    // transitions is the no-churn case and MUST NOT throw.)\n    const desiredTypeById = new Map<string, string>();\n    for (const sub of desired) {\n      const existing = desiredTypeById.get(sub.id);\n      if (existing !== undefined && existing !== sub.type) {\n        throw new SubIdCollisionError(sub.id, existing, sub.type);\n      }\n      desiredTypeById.set(sub.id, sub.type);\n    }\n\n    // Removals first — anything in the registry not in `desired` should stop.\n    for (const sub of desired) desiredIds.add(sub.id);\n    stopSubs([...subRegistry.keys()].filter((id) => !desiredIds.has(id)));\n\n    // Additions — anything in `desired` not in the registry should start.\n    let firstStartError: unknown = depError;\n    for (const sub of desired) {\n      if (subRegistry.has(sub.id)) continue;\n      const handler = machine.subscribe?.[sub.type as U[\"type\"]];\n      if (!handler) {\n        // No handler for this sub type — programmer error; skip.\n        continue;\n      }\n      try {\n        const cleanup = handler(\n          sub as Extract<U, { type: U[\"type\"] }>,\n          ctx,\n          enqueueDispatch,\n        );\n        subRegistry.set(sub.id, cleanup);\n      } catch (err) {\n        if (firstStartError === null) firstStartError = err;\n        // Do NOT register; continue to next sub so other starts still run.\n      }\n    }\n    if (firstStartError !== null) throw firstStartError;\n  }\n\n  // `interpret` is optional when `C extends Cmd<never>`; default a missing map to\n  // `{}` — the per-cmd `if (!handler) continue` preserves invariant-6 forward\n  // progress for a miswired consumer.\n  const interpretMap: Interpret<M, C, Ctx> =\n    (machine as { interpret?: Interpret<M, C, Ctx> }).interpret ??\n    ({} as Interpret<M, C, Ctx>);\n\n  // The injected dispatch for DETACHED handlers. Same serial-tail enqueue every\n  // other dispatch uses (`enqueueDispatch` chains on `tail`), wrapped to a sync\n  // `(msg) => void` so a detached handler's `ctx.waitUntil(...)` tail can fire\n  // its terminal Msg without awaiting the runtime. The rejection has no caller\n  // (the original dispatcher already resolved), so it routes to the sink under\n  // `\"follow-up\"` — the same phase the returned-follow-up path uses. A handler\n  // authored via `wrapDetached` receives a NARROWED view of this fn (only its\n  // declared result-Msg set); a plain leaf handler ignores it entirely.\n  const interpretDispatch = (msg: M): void => {\n    enqueueDispatch(msg).catch((error: unknown) => {\n      reportError(error, { phase: \"follow-up\" });\n    });\n  };\n\n  /**\n   * Run `interpret` for each emitted cmd. A returned follow-up Msg is enqueued\n   * onto the tail (NOT dispatched re-entrantly). The first error stops further\n   * handlers in this transition.\n   */\n  async function runInterpret(cmds: readonly C[]): Promise<void> {\n    for (const cmd of cmds) {\n      const handler = interpretMap[cmd.type as C[\"type\"]];\n      if (!handler) continue;\n      const follow = await handler(\n        cmd as Extract<C, { type: C[\"type\"] }>,\n        augmentedCtx,\n        interpretDispatch,\n      );\n      if (follow !== undefined && follow !== null) {\n        // The follow-up's rejection has no caller (the original dispatcher\n        // resolved), so route it to the sink (invariant 6); name a failure Msg\n        // via `tryInterpret` to fold it back into state.\n        enqueueDispatch(follow as M).catch((error: unknown) => {\n          reportError(error, { phase: \"follow-up\" });\n        });\n      }\n    }\n  }\n\n  // Throws isolated so one bad listener does not strand the others.\n  function fireListeners(): void {\n    fanout(listeners, \"listener\", (listener) => listener());\n  }\n\n  // After `fireListeners` so observers see what subscribers see. APPLIED\n  // transitions only — `msg` is total (boot routes to `fireBoot`).\n  function fireObservers(msg: M): void {\n    if (observers.size === 0 || state === undefined) return;\n    const snapshot = state;\n    fanout(observers, \"observer\", (observer) => observer(msg, snapshot));\n  }\n\n  // Project the transition to semantic events and fan each to its `on(...)`\n  // handlers; a throw in the projector OR a handler is isolated.\n  function fireEvents(msg: M): void {\n    if (eventHandlers.size === 0 || state === undefined) return;\n    let events: readonly E[];\n    try {\n      events = projectEvents(msg, state);\n    } catch (err) {\n      reportError(err, { phase: \"event\" });\n      return;\n    }\n    for (const event of events) {\n      const bucket = eventHandlers.get(event.type);\n      if (bucket === undefined) continue;\n      fanout(bucket, \"event\", (handler) => handler(event));\n    }\n  }\n\n  // Fire every `onBoot` handler with the initial State ONCE and flip `booted`.\n  function fireBoot(): void {\n    booted = true;\n    if (bootHandlers.size === 0 || state === undefined) return;\n    const snapshot = state;\n    fanout(bootHandlers, \"boot\", (handler) => handler(snapshot));\n  }\n\n  // Resolve every parked `done()` waiter iff the just-folded State is terminal —\n  // so `done()` settles on the same transition `result()` first returns it.\n  function settleDoneWaiters(): void {\n    if (doneWaiters.size === 0 || state === undefined) return;\n    if (!isTerminal(state)) return;\n    const snapshot = state;\n    const parked = [...doneWaiters];\n    doneWaiters.clear();\n    for (const resolve of parked) resolve(snapshot);\n  }\n\n  // The post-transition commit tail: install state, then save → reconcile subs →\n  // interpret → fire fanout → settle done-waiters. Save-before-effects is the\n  // hard ordering; tests pin it. The normal transition and the `restart`\n  // supervision branch both end here.\n  async function commit(next: S, msg: M, cmds: readonly C[]): Promise<void> {\n    state = next;\n    if (store) await store.save(next);\n    reconcileSubs();\n    await runInterpret(cmds);\n    fireListeners();\n    fireObservers(msg);\n    fireEvents(msg);\n    settleDoneWaiters();\n  }\n\n  /**\n   * One full transition: update → save → reconcile subs → interpret → fire.\n   * Save-before-effects is the hard ordering; tests pin it. A `save` throw\n   * propagates after the in-memory `state` is advanced; reconcile/interpret\n   * throws after `save` has succeeded.\n   */\n  async function stepDispatch(msg: M): Promise<void> {\n    if (state === undefined) {\n      throw new Error(\"@demlik/tea: runtime not booted\");\n    }\n    // Instance-identity filter. When the machine declares an `identity`, a\n    // message addressed to a DIFFERENT identity is dropped here — before\n    // `update` runs, so the reducer never sees a foreign-instance message and\n    // no cell needs a `msg.runId !== state.runId` guard. A message with no\n    // identity (`ofMsg` undefined) is identity-agnostic and always proceeds.\n    // The drop resolves the dispatch (no throw) and advances nothing: no save,\n    // no reconcile, no interpret, no listener/observer/event fire, no\n    // done-waiter settle. Identity is explicit (invariant 7) and the drop is\n    // the one observable enforcement point (invariant 6).\n    if (machine.identity !== undefined) {\n      const addressed = machine.identity.ofMsg(msg);\n      if (addressed !== undefined) {\n        const own = machine.identity.ofState(state);\n        // `own === undefined` ⇒ this instance has no identity to defend yet\n        // (e.g. an `idle` state before any run is established). An addressed\n        // message in that state is identity-establishing, not foreign — never\n        // dropped. Drop only when BOTH identities are present and differ.\n        if (\n          own !== undefined &&\n          structuralHash(addressed) !== structuralHash(own)\n        ) {\n          return;\n        }\n      }\n    }\n    // The reducer is the only synchronous user code; the reentrancy brand\n    // guarantees it cannot suspend, so a throw here is clean with `state` still\n    // pre-transition. Route it to the supervision strategy. Dispatch goes\n    // through `applyCellChecked` — the single dev-checked reducer-vs-transitions\n    // primitive `foldUpdates` also folds through (see `pure/core.ts`).\n    let next: S;\n    let cmds: readonly C[];\n    try {\n      [next, cmds] = applyCellChecked<S, M, C>(machine, state, msg);\n    } catch (reduceError) {\n      // Invariant 6 — surface the failure as data FIRST, for every strategy.\n      reportError(reduceError, { phase: \"reduce\" });\n      switch (supervision.strategy) {\n        case \"restart\": {\n          // Host supplies last-known-good state; core installs it and KEEPS\n          // FOLDING from there with no cmds (the throwing reduce produced none).\n          // A throw inside `rehydrate` is NOT caught — it surfaces to the caller.\n          await commit(supervision.rehydrate(state, msg, reduceError), msg, []);\n          return;\n        }\n        case \"escalate\":\n          // Surface + propagate; the runtime stays live for a parent supervisor.\n          throw reduceError;\n        default:\n          // `stop` (safe default): halt. State is NOT advanced; propagate so THIS\n          // dispatch also rejects — the halt is observable, never a silent resume.\n          stopped = true;\n          throw reduceError;\n      }\n    }\n    await commit(next, msg, cmds);\n  }\n\n  // Boot has two phases. With NO store, `loaded = null` without an await — run\n  // `init(null, ctx)` IMMEDIATELY so `getState()` is observable synchronously\n  // (what `useSyncExternalStore` consumers need to render the first commit\n  // without a flicker). The async remainder runs in `stepBootEffects` as the\n  // first tail entry. With a store we cannot `init` synchronously (we'd invent a\n  // loaded value), so the full path runs there; `store.load` throws propagate\n  // via the boot promise.\n  let pendingInitCmds: readonly C[] = [];\n  if (!store) {\n    const [initialState, initCmds] = machine.init(null, ctx);\n    state = initialState;\n    pendingInitCmds = initCmds;\n  }\n\n  async function stepBootEffects(): Promise<void> {\n    if (store) {\n      // Boundary parse (invariant 8): `store.load()` returns `unknown`;\n      // `store.migrate(raw)` is the required parse — `S` on recognized shape,\n      // `null` on unrecognized (boots fresh). `migrate` MUST NOT throw; if it\n      // does we surface via the boot promise (same as a `load` throw).\n      const raw = await store.load();\n      const parsed = store.migrate(raw);\n      const [initialState, initCmds] = machine.init(parsed, ctx);\n      state = initialState;\n      pendingInitCmds = initCmds;\n      await store.save(state);\n    }\n    reconcileSubs();\n    await runInterpret(pendingInitCmds);\n    fireListeners();\n    // Boot has no applied Msg — deliver the initial State via `onBoot`, not\n    // `observe`, and project no semantic event.\n    fireBoot();\n    // A rehydrated boot can land terminal — settle any pre-boot `done()` waiter.\n    settleDoneWaiters();\n  }\n\n  /**\n   * Enqueue a dispatch on the tail — the single gate re-entrant interpret /\n   * subscribe calls also go through. Rejects when the runtime is stopped, boot\n   * failed, or the reducer / save / sub start / interpret throws.\n   */\n  function enqueueDispatch(msg: M): Promise<void> {\n    if (stopped)\n      return Promise.reject(new Error(\"@demlik/tea: runtime stopped\"));\n    const next = tail.then(() => {\n      if (bootError !== null) throw bootError;\n      return stepDispatch(msg);\n    });\n    // Swallow the rejection on the tail so one failing dispatch does NOT poison\n    // every subsequent one. The original `next` still rejects for the caller.\n    tail = next.catch(() => {});\n    return next;\n  }\n\n  /**\n   * Drain the serial tail to quiescence. Every interpret follow-up calls\n   * `enqueueDispatch`, which reassigns `tail` SYNCHRONOUSLY before the parent\n   * step resolves, so awaiting the current `tail` and re-reading it catches every\n   * transitively enqueued follow-up; loop until the reference is stable. Bounded\n   * by `idleCap` — on cap REJECT with `QuiescenceTimeoutError` (never a silent\n   * resolve), keeping a livelock distinguishable from quiescence (invariant 6).\n   */\n  async function drainToQuiescence(): Promise<void> {\n    for (let i = 0; i < idleCap; i++) {\n      const observed = tail;\n      await observed;\n      if (tail === observed) return;\n    }\n    throw new QuiescenceTimeoutError(idleCap);\n  }\n\n  /**\n   * The public `dispatch`: run-to-quiescence by default. Await the Msg's OWN\n   * transition first (so a reducer / save / interpret throw on THIS Msg surfaces\n   * before any drain), then — unless `{ settle: \"once\" }` — drain the transitive\n   * follow-up chain.\n   */\n  async function dispatchToQuiescence(\n    msg: M,\n    opts?: { readonly settle?: DispatchSettle },\n  ): Promise<void> {\n    await enqueueDispatch(msg);\n    if (opts?.settle === \"once\") return;\n    await drainToQuiescence();\n  }\n\n  // `bootPromise` is the un-swallowed promise `runtime.ready` chains off (so\n  // callers see the boot error directly); `tail` gets the swallowed branch so a\n  // boot failure does NOT poison every subsequent dispatch's chain (each surfaces\n  // `bootError` in `enqueueDispatch`).\n  const bootPromise = stepBootEffects();\n  tail = bootPromise.catch((err) => {\n    bootError = err;\n  });\n\n  // `ready` chains off `bootPromise` so a failed boot never hands out a `Runtime`\n  // (keeping `getState()` total). The `runtime` forward reference resolves at\n  // `.then` time, after the literal below initializes. Idempotent.\n  const readyPromise: Promise<Runtime<S, M, E>> = bootPromise.then(\n    () => runtime,\n  );\n\n  const runtime: Runtime<S, M, E> = {\n    dispatch: dispatchToQuiescence,\n    dispatchOnce: enqueueDispatch,\n    getState(): S {\n      // TOTAL. A `Runtime` is only obtainable by awaiting `ready`, which resolves\n      // AFTER boot set `state`; a failed boot rejects `ready`, so no `Runtime` is\n      // handed out then. The cast encodes that invariant.\n      return state as S;\n    },\n    subscribe(listener: () => void): () => void {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    observe(observer: (msg: M, state: S) => void): () => void {\n      observers.add(observer);\n      return () => {\n        observers.delete(observer);\n      };\n    },\n    onBoot(handler: (state: S) => void): () => void {\n      // Already booted → fire immediately (cleanup is a no-op) so a late\n      // subscriber never misses the one-shot boot.\n      if (booted && state !== undefined) {\n        const snapshot = state;\n        fanout([handler], \"boot\", (h) => h(snapshot));\n        return () => {};\n      }\n      bootHandlers.add(handler);\n      return () => {\n        bootHandlers.delete(handler);\n      };\n    },\n    on<K extends E[\"type\"]>(\n      type: K,\n      handler: (event: Extract<E, { type: K }>) => void,\n    ): () => void {\n      // Monomorphic registry; per-type narrowing lives at THIS call site, and\n      // `fireEvents` only routes an event to its own bucket, so the erased call\n      // is sound.\n      let bucket = eventHandlers.get(type);\n      if (bucket === undefined) {\n        bucket = new Set<(event: E) => void>();\n        eventHandlers.set(type, bucket);\n      }\n      const erased = handler as (event: E) => void;\n      bucket.add(erased);\n      return () => {\n        const set = eventHandlers.get(type);\n        if (set === undefined) return;\n        set.delete(erased);\n        if (set.size === 0) eventHandlers.delete(type);\n      };\n    },\n    subscribePort<T>(port: Port<T>, listener: (value: T) => void): () => void {\n      const key = port as Port<unknown>;\n      let bucket = portRegistry.get(key);\n      if (!bucket) {\n        bucket = new Set<(value: unknown) => void>();\n        portRegistry.set(key, bucket);\n      }\n      // Bucket stores `(value: unknown) => void`; per-port type safety at this site.\n      const erased = listener as (value: unknown) => void;\n      bucket.add(erased);\n      return () => {\n        const set = portRegistry.get(key);\n        if (!set) return;\n        set.delete(erased);\n        if (set.size === 0) portRegistry.delete(key);\n      };\n    },\n    emitPort<T>(port: Port<T>, value: T): void {\n      // Lets `observe`-driven Port emission work without a per-transition Cmd.\n      portEmit(port, value);\n    },\n    ready: readyPromise,\n    idle(): Promise<void> {\n      return drainToQuiescence();\n    },\n    result(): S | undefined {\n      // TOTAL. No predicate → `isTerminal` is `() => false`, so a non-terminating\n      // machine reads `undefined` forever.\n      const current = state as S;\n      return isTerminal(current) ? current : undefined;\n    },\n    done(): Promise<S> {\n      // Already terminal → resolve at once (never parks, so it can't miss the\n      // terminal transition). Otherwise park a resolver for `settleDoneWaiters`.\n      const current = state as S;\n      if (isTerminal(current)) return Promise.resolve(current);\n      return new Promise<S>((resolve) => {\n        doneWaiters.add(resolve);\n      });\n    },\n    async stop(): Promise<void> {\n      stopped = true;\n      // Drain in-flight work. Tail rejections were swallowed at enqueue time, so\n      // this await always resolves.\n      await tail;\n      // Run every active sub cleanup; throws isolated and routed to the sink.\n      stopSubs([...subRegistry.keys()]);\n      // Dispose every live dep-keyed source too (same throw-isolation).\n      disposeDepSubs([...depSubRegistry.keys()]);\n      // Flush final state. A save throw here does not reject `stop()` (contract:\n      // resolves regardless) but IS loss of the last write, so route it to the\n      // sink rather than swallowing it (invariant 6).\n      if (store && state !== undefined && bootError === null) {\n        try {\n          await store.save(state);\n        } catch (error) {\n          reportError(error, { phase: \"stop-save\" });\n        }\n      }\n    },\n  };\n\n  return runtime;\n}\n"]}

package/dist/chunk-C6QC273X.js

@@ -0,0 +1,71 @@
+import { replay } from './chunk-BP2R7TPP.js';
+import { applyCell } from './chunk-PBDYW2TU.js';
+import * as fc from 'fast-check';
+
+// src/pbt/runners/replay-fold.ts
+function foldEvents(machine, ctx, loaded, msgs) {
+  const { state: initialState } = replay(machine, {
+    msgs: [],
+    ctx,
+    loaded: loaded ?? null
+  });
+  const states = [initialState];
+  const steps = [];
+  let current = initialState;
+  for (const msg of msgs) {
+    const [next, emitted] = applyCell(machine, current, msg);
+    steps.push({ prev: current, msg, next, cmds: [...emitted] });
+    states.push(next);
+    current = next;
+  }
+  return { states, steps, finalState: current };
+}
+
+// src/pbt/runners/property.ts
+function resolveFcParams(opts) {
+  return {
+    numRuns: opts?.numRuns ?? 200,
+    ...opts?.seed !== void 0 ? { seed: opts.seed } : {}
+  };
+}
+function runProperty(machine, ctx, seqArb, opts, check) {
+  fc.assert(
+    fc.property(seqArb, (msgs) => {
+      check(foldEvents(machine, ctx, opts?.loaded ?? null, msgs));
+    }),
+    resolveFcParams(opts)
+  );
+}
+function propertyTerminates(machine, ctx, seqArb, terminal, opts) {
+  runProperty(machine, ctx, seqArb, opts, ({ finalState }) => {
+    if (!terminal(finalState)) {
+      throw new Error(
+        `propertyTerminates: final state did not match terminal predicate. Final: ${JSON.stringify(finalState)}`
+      );
+    }
+  });
+}
+function propertyInvariant(machine, ctx, seqArb, invariant, opts) {
+  runProperty(machine, ctx, seqArb, opts, ({ steps }) => {
+    for (const step of steps) {
+      if (!invariant(step)) {
+        throw new Error(
+          `propertyInvariant: failed at step msg=${JSON.stringify(step.msg)} prev=${JSON.stringify(step.prev)} next=${JSON.stringify(step.next)} cmds=${JSON.stringify(step.cmds)}`
+        );
+      }
+    }
+  });
+}
+function propertyTrace(machine, ctx, seqArb, predicate, opts) {
+  runProperty(machine, ctx, seqArb, opts, ({ steps, finalState }) => {
+    if (!predicate(steps, finalState)) {
+      throw new Error(
+        `propertyTrace: predicate failed on trace length=${steps.length}, final=${JSON.stringify(finalState)}`
+      );
+    }
+  });
+}
+
+export { foldEvents, propertyInvariant, propertyTerminates, propertyTrace };
+//# sourceMappingURL=chunk-C6QC273X.js.map
+//# sourceMappingURL=chunk-C6QC273X.js.map

package/dist/chunk-C6QC273X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pbt/runners/replay-fold.ts","../src/pbt/runners/property.ts"],"names":[],"mappings":";;;;;AAiEO,SAAS,UAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,IAAA,EAKA;AAKA,EAAA,MAAM,EAAE,KAAA,EAAO,YAAA,EAAa,GAAI,OAAO,OAAA,EAAS;AAAA,IAC9C,MAAM,EAAC;AAAA,IACP,GAAA;AAAA,IACA,QAAQ,MAAA,IAAU;AAAA,GACnB,CAAA;AAKD,EAAA,MAAM,MAAA,GAAc,CAAC,YAAY,CAAA;AACjC,EAAA,MAAM,QAAyB,EAAC;AAChC,EAAA,IAAI,OAAA,GAAU,YAAA;AAEd,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,CAAC,IAAA,EAAM,OAAO,IAAI,SAAA,CAAmB,OAAA,EAAS,SAAS,GAAG,CAAA;AAChE,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,IAAA,EAAM,IAAA,EAAM,CAAC,GAAG,OAAO,CAAA,EAAG,CAAA;AAC3D,IAAA,MAAA,CAAO,KAAK,IAAI,CAAA;AAChB,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,UAAA,EAAY,OAAA,EAAQ;AAC9C;;;AC5DA,SAAS,gBACP,IAAA,EAC+B;AAC/B,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,MAAM,OAAA,IAAW,GAAA;AAAA,IAC1B,GAAI,MAAM,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,GAAI;AAAC,GACxD;AACF;AAQA,SAAS,WAAA,CAOP,OAAA,EACA,GAAA,EACA,MAAA,EACA,MACA,KAAA,EACM;AACN,EAAG,EAAA,CAAA,MAAA;AAAA,IACE,EAAA,CAAA,QAAA,CAAS,MAAA,EAAQ,CAAC,IAAA,KAAS;AAC5B,MAAA,KAAA,CAAM,WAAW,OAAA,EAAS,GAAA,EAAK,MAAM,MAAA,IAAU,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,IAC5D,CAAC,CAAA;AAAA,IACD,gBAAmB,IAAI;AAAA,GACzB;AACF;AAoBO,SAAS,kBAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,UACA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,SAAS,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAC,EAAE,YAAW,KAAM;AAC1D,IAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AAIzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,yEAAA,EACY,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,OACxC;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH;AAuBO,SAAS,iBAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,WACA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,SAAS,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAC,EAAE,OAAM,KAAM;AACrD,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,CAAC,SAAA,CAAU,IAAI,CAAA,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,sCAAA,EAAyC,KAAK,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC,CAAA,MAAA,EACvD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,MAAA,EAAS,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,SAC3D,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,SACrC;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH;AAiBO,SAAS,aAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,WAIA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,OAAA,EAAS,KAAK,MAAA,EAAQ,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,YAAW,KAAM;AACjE,IAAA,IAAI,CAAC,SAAA,CAAU,KAAA,EAAO,UAAU,CAAA,EAAG;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,mDAAmD,KAAA,CAAM,MAAM,WACpD,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,OACvC;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH","file":"chunk-C6QC273X.js","sourcesContent":["// ---------------------------------------------------------------------------\n// `foldEvents` — pure deterministic fold over a Msg sequence.\n//\n// PBT needs the per-step (prev/msg/next/cmds) structure to assert\n// step-shaped invariants. The substrate's `replay(machine, opts)` returns\n// only final state + cumulative cmds — insufficient. We use `replay` for\n// the boot step (calls `machine.init(loaded, ctx)` faithfully) then walk\n// msgs ourselves through `applyCell`, the substrate's own cell dispatch.\n//\n// Why walk cells directly instead of looping `replay` once per msg with\n// `loaded: prevState`? Because `init(loaded)` runs every call, and on\n// machines with non-trivial init transforms (e.g. the audit machine's\n// `auditing → attach_debugger` resume cell) that would either (a) re-fire\n// the transform on every step, or (b) require fragile cmd-subtraction to\n// isolate this step's cmds. Calling the cells directly keeps the fold pure\n// and the cmds per-step exactly.\n//\n// Dispatches through `applyCell` — the single primitive `run`/`replay` use —\n// so form classification agrees with production by construction (#275).\n//\n// `foldEvents` does NOT call `interpret`, does NOT touch a Store, does NOT\n// start Subs. The reducer surface is the contract.\n// ---------------------------------------------------------------------------\n\nimport {\n  applyCell,\n  type Cmd,\n  type Machine,\n  replay,\n  type Sub,\n} from \"../../index\";\n\n/**\n * One unit in a fold trace — the four pieces of data a property\n * invariant typically asserts on. `prev` is the state before the msg\n * applied; `next` is the state after; `cmds` is the cmds emitted by this\n * single step (NOT the running total).\n */\nexport interface Step<S, M, C> {\n  readonly prev: S;\n  readonly msg: M;\n  readonly next: S;\n  readonly cmds: readonly C[];\n}\n\n/**\n * Fold a Msg sequence through a machine's pure reducer, returning the\n * per-step trace, every state in order, and the final state. Initial\n * state comes from `replay(machine, { msgs: [], ctx, loaded })` — i.e.\n * `machine.init(loaded ?? null, ctx)` faithfully. Init's emitted cmds\n * are NOT included in any `Step` (they're the boot moment, not a Msg).\n *\n * @param machine  The machine under test.\n * @param ctx      The Ctx — typically `stubCtxThrowingProxy<Ctx>()` when\n *                 init is pure. Pass a real ctx if init reads from it.\n * @param loaded   Optional pre-init snapshot (the `loaded` arg to\n *                 `machine.init`). Defaults to `null` (fresh boot).\n * @param msgs     The Msg sequence to fold.\n *\n * @example\n *   const { states, steps, finalState } = foldEvents(machine, ctx, null, [\n *     { type: \"start\" }, { type: \"tick\" }, { type: \"stop\" },\n *   ]);\n *   // steps[1] = { prev: { type: \"counting\", n: 0 }, msg: { type: \"tick\" }, ... }\n */\nexport function foldEvents<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  loaded: NoInfer<S> | null,\n  msgs: readonly NoInfer<M>[],\n): {\n  readonly states: readonly S[];\n  readonly steps: readonly Step<S, M, C>[];\n  readonly finalState: S;\n} {\n  // Boot through `replay` so `init` runs faithfully and we honor the\n  // substrate's loaded-snapshot contract (init may transform the loaded\n  // value before the first Msg lands — e.g. the audit machine flips\n  // `debuggerAttached: false` on resume).\n  const { state: initialState } = replay(machine, {\n    msgs: [],\n    ctx,\n    loaded: loaded ?? null,\n  });\n\n  // Per-msg dispatch goes through `applyCell` — the same primitive `run` and\n  // `replay` use — so this runner classifies the update form identically to\n  // production (`formOf` honors the `__form` tag; #275).\n  const states: S[] = [initialState];\n  const steps: Step<S, M, C>[] = [];\n  let current = initialState;\n\n  for (const msg of msgs) {\n    const [next, emitted] = applyCell<S, M, C>(machine, current, msg);\n    steps.push({ prev: current, msg, next, cmds: [...emitted] });\n    states.push(next);\n    current = next;\n  }\n\n  return { states, steps, finalState: current };\n}\n","// ---------------------------------------------------------------------------\n// Property runners — three thin wrappers over `fc.assert(fc.property(...))`\n// that fold a generated Msg sequence through the machine via `foldEvents`\n// and pipe the result into a TEA-shaped predicate.\n//\n//   - `propertyTerminates` — every sequence ends in a terminal state.\n//   - `propertyInvariant`  — predicate holds on every (prev, msg, next, cmds) step.\n//   - `propertyTrace`      — predicate holds on the full (trace, final) shape.\n//\n// Each runner accepts `numRuns` (passed through to fast-check), an optional\n// `loaded` snapshot (forwarded to `foldEvents`), and the Msg-sequence\n// arbitrary. They return `void`; failures throw via fast-check's standard\n// shrinking output.\n//\n// Default shrinker is fast-check's built-in (open question 4): drop-msg /\n// prefix shrinkers can be layered later but are opt-in, not default. The\n// built-in shrinker handles array-shape shrinking + per-element variant\n// shrinking automatically.\n// ---------------------------------------------------------------------------\n\nimport * as fc from \"fast-check\";\nimport type { Cmd, Machine, Sub } from \"../../index\";\nimport { foldEvents, type Step } from \"./replay-fold\";\n\n/** Common options shared by every property runner. */\ninterface PropertyOpts<S> {\n  /** Pre-init snapshot — passed to `machine.init(loaded, ctx)`. Default `null`. */\n  readonly loaded?: S | null;\n  /** Number of generated sequences to test. Forwarded to `fc.assert`. */\n  readonly numRuns?: number;\n  /** Optional fast-check seed for reproducibility. */\n  readonly seed?: number;\n}\n\n/** The `foldEvents` result a runner's `check` inspects. */\ntype FoldResult<S, M, C> = {\n  readonly states: readonly S[];\n  readonly steps: readonly Step<S, M, C>[];\n  readonly finalState: S;\n};\n\n/**\n * Build the fast-check parameters shared by every runner: the 200-default\n * `numRuns` plus an optional `seed`. Single source of truth so a change to\n * the default lands in one place.\n */\nfunction resolveFcParams<M>(\n  opts: PropertyOpts<unknown> | undefined,\n): fc.Parameters<[readonly M[]]> {\n  return {\n    numRuns: opts?.numRuns ?? 200,\n    ...(opts?.seed !== undefined ? { seed: opts.seed } : {}),\n  };\n}\n\n/**\n * The fold+assert core every runner shares: assert `check` over each\n * generated Msg sequence, folded once through the machine via `foldEvents`.\n * `check` throws on failure so the error message carries the offending\n * shape into fast-check's shrunk counter-example.\n */\nfunction runProperty<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: Ctx,\n  seqArb: fc.Arbitrary<readonly M[]>,\n  opts: PropertyOpts<S> | undefined,\n  check: (result: FoldResult<S, M, C>) => void,\n): void {\n  fc.assert(\n    fc.property(seqArb, (msgs) => {\n      check(foldEvents(machine, ctx, opts?.loaded ?? null, msgs));\n    }),\n    resolveFcParams<M>(opts),\n  );\n}\n\n/**\n * Assert every generated Msg sequence ends in a terminal state. `terminal`\n * is the predicate that names the acceptable final states (often\n * `(s) => s.type === \"done\" || s.type === \"idle\"`).\n *\n * The \"every sequence\" property catches stuck states (machine gets to a\n * non-terminal state and no further msg can escape) AND silent loops\n * (every msg variant is a noop from a given state).\n *\n * @example\n *   propertyTerminates(\n *     auditBackgroundMachine,\n *     stubCtxThrowingProxy<BackgroundCtx>(),\n *     arbMsgSequence(msgArb, { minLength: 1, maxLength: 30 }),\n *     (s) => s.type === \"done\" || s.type === \"idle\",\n *     { loaded: auditingState, numRuns: 500 },\n *   );\n */\nexport function propertyTerminates<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  terminal: (state: NoInfer<S>) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ finalState }) => {\n    if (!terminal(finalState)) {\n      // Throwing here (vs returning false) lets the error message carry\n      // the offending final state — fast-check pretty-prints it inside\n      // the shrunk counter-example.\n      throw new Error(\n        `propertyTerminates: final state did not match terminal predicate. ` +\n          `Final: ${JSON.stringify(finalState)}`,\n      );\n    }\n  });\n}\n\n/**\n * Assert a predicate holds on EVERY transition step in a generated\n * sequence. The predicate sees `{ prev, msg, next, cmds }` per step;\n * return true to accept, false (or throw) to fail.\n *\n * Use to pin a \"when X happens in state Y, cmd Z must be emitted\" rule.\n * The shrinker minimizes the offending sequence to the smallest Msg list\n * that still violates the predicate.\n *\n * @example\n *   // Pin the resume-handshake fix: `ws:client:hello` in auditing must\n *   // emit `send_ws { client:ready }`.\n *   propertyInvariant(\n *     auditBackgroundMachine, ctx,\n *     arbMsgSequence(msgArb, { prefix: [{ type: \"ws:client:hello\" }] }),\n *     ({ prev, msg, cmds }) =>\n *       !(prev.type === \"auditing\" && msg.type === \"ws:client:hello\") ||\n *       cmds.some((c) => c.type === \"send_ws\" && c.msg.type === \"client:ready\"),\n *     { loaded: auditingState, numRuns: 200 },\n *   );\n */\nexport function propertyInvariant<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  invariant: (step: Step<NoInfer<S>, NoInfer<M>, NoInfer<C>>) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ steps }) => {\n    for (const step of steps) {\n      if (!invariant(step)) {\n        throw new Error(\n          `propertyInvariant: failed at step msg=${JSON.stringify(step.msg)} ` +\n            `prev=${JSON.stringify(step.prev)} next=${JSON.stringify(step.next)} ` +\n            `cmds=${JSON.stringify(step.cmds)}`,\n        );\n      }\n    }\n  });\n}\n\n/**\n * Assert a predicate over the full trace plus the final state. Use when\n * the property is \"some Msg appeared in the trace before reaching the\n * final state\" or \"no two consecutive steps had the same state.type\" —\n * predicates that need the full sequence, not a single step.\n *\n * @example\n *   propertyTrace(\n *     machine, ctx, seqArb,\n *     (steps, final) =>\n *       final.type !== \"done\" ||\n *       steps.some((step) => step.msg.type === \"ws:audit:done\"),\n *     { loaded: auditingState, numRuns: 500 },\n *   );\n */\nexport function propertyTrace<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  predicate: (\n    steps: readonly Step<NoInfer<S>, NoInfer<M>, NoInfer<C>>[],\n    finalState: NoInfer<S>,\n  ) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ steps, finalState }) => {\n    if (!predicate(steps, finalState)) {\n      throw new Error(\n        `propertyTrace: predicate failed on trace length=${steps.length}, ` +\n          `final=${JSON.stringify(finalState)}`,\n      );\n    }\n  });\n}\n"]}

package/dist/{chunk-7W4LMPUW.js → chunk-CAXMQJJ3.js}

@@ -1,6 +1,6 @@
-import { createSnapshot } from './chunk-EHIX7NYZ.js';
-import { deadlineSub } from './chunk-K7Q23EQ4.js';
-import { queueAdapter } from './chunk-HJO6VNQI.js';
+import { createSnapshot } from './chunk-MVY5DAMF.js';
+import { deadlineSub } from './chunk-RMX4EOQK.js';
+import { queueAdapter } from './chunk-MU6MCIAC.js';
 
 // src/monitored-run/index.ts
 function safetyTimerId(runId, progressSeq) {
@@ -14,19 +14,18 @@ function createMonitoredRun(config = {}) {
     every: config.snapshotEvery,
     ...config.snapshotKey !== void 0 ? { key: config.snapshotKey } : {}
   }) : null;
+  const activeSnap = snap ?? createSnapshot({ every: 1 });
   function init() {
     return {
-      phase: "running",
-      runId: "",
+      phase: "idle",
       stepStates: [],
       startedAt: 0,
       lastProgressAt: 0,
       progressSeq: 0,
-      failure: null,
       // A default snapshot slice even without the brick → uniform shape. When
-      // `snap` is null the slice is created with a throwaway cadence; its
-      // `record` is never called, so the cadence value is inert.
-      snapshot: (snap ?? createSnapshot({ every: 1 })).init()
+      // `snap` is null the inert `activeSnap` default supplies the slice; its
+      // `record` is never called, so the cadence value is immaterial.
+      snapshot: activeSnap.init()
     };
   }
   function seedStages(at) {
@@ -42,14 +41,13 @@ function createMonitoredRun(config = {}) {
   }
   function start(s, runId, at) {
     const next = {
-      ...s,
       phase: "running",
       runId,
       stepStates: isPipeline ? seedStages(at) : [],
       startedAt: at,
       lastProgressAt: at,
       progressSeq: 0,
-      failure: null
+      snapshot: s.snapshot
     };
     return [next, []];
   }
@@ -62,7 +60,7 @@ function createMonitoredRun(config = {}) {
     return [{ ...s, snapshot }, cmds];
   }
   function progress(s, payload, at) {
-    if (s.phase === "done" || s.phase === "failed") return [s, []];
+    if (s.phase !== "running" && s.phase !== "stale") return [s, []];
     const bumped = {
       ...bumpProgress(s, at),
       phase: "running"
@@ -74,7 +72,7 @@ function createMonitoredRun(config = {}) {
     return [{ ...s, phase: "stale" }, []];
   }
   function advance(s, payload, result, at) {
-    if (s.phase === "done" || s.phase === "failed") return [s, []];
+    if (s.phase !== "running" && s.phase !== "stale") return [s, []];
     if (result.kind === "fail") {
       const failed = {
         ...s,
@@ -115,8 +113,7 @@ function createMonitoredRun(config = {}) {
     return [{ ...s, snapshot }, cmds];
   }
   function onDeadline(s, msg) {
-    if (s.phase === "done" || s.phase === "failed") return [s, []];
-    if (s.runId === "") return [s, []];
+    if (s.phase !== "running" && s.phase !== "stale") return [s, []];
     if (msg.id !== safetyTimerId(s.runId, s.progressSeq)) return [s, []];
     const failed = {
       ...s,
@@ -126,10 +123,8 @@ function createMonitoredRun(config = {}) {
     return [failed, []];
   }
   function boot(s, at) {
-    if (s.phase === "done" || s.phase === "failed") return [s, []];
-    const [bootedSnapshot] = (snap ?? createSnapshot({ every: 1 })).boot(
-      s.snapshot
-    );
+    if (s.phase !== "running" && s.phase !== "stale") return [s, []];
+    const [bootedSnapshot] = activeSnap.boot(s.snapshot);
     const reseeded = {
       ...s,
       phase: "running",
@@ -146,7 +141,6 @@ function createMonitoredRun(config = {}) {
   }
   function subs(s) {
     if (config.deadlineMs === void 0) return [];
-    if (s.runId === "") return [];
     if (s.phase !== "running" && s.phase !== "stale") return [];
     return [
       deadlineSub(
@@ -156,8 +150,7 @@ function createMonitoredRun(config = {}) {
     ];
   }
   function handlers(ports) {
-    const active = snap ?? createSnapshot({ every: 1 });
-    return active.handlers({ store: ports.store });
+    return activeSnap.handlers({ store: ports.store });
   }
   function confirmSnapshot(s, msg) {
     if (snap === null) return s;
@@ -182,5 +175,5 @@ function liftRun(state, [slice, cmds]) {
 }
 
 export { createMonitoredRun, liftRun };
-//# sourceMappingURL=chunk-7W4LMPUW.js.map
-//# sourceMappingURL=chunk-7W4LMPUW.js.map
+//# sourceMappingURL=chunk-CAXMQJJ3.js.map
+//# sourceMappingURL=chunk-CAXMQJJ3.js.map

package/dist/chunk-CAXMQJJ3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/monitored-run/index.ts"],"names":[],"mappings":";;;;;AA6RA,SAAS,aAAA,CAAc,OAAe,WAAA,EAA6B;AACjE,EAAA,OAAO,CAAA,iBAAA,EAAoB,KAAK,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AACjD;AAeO,SAAS,kBAAA,CACd,MAAA,GAAoC,EAAC,EACrC;AACA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,EAAC;AACjC,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,GAAS,CAAA;AAKnC,EAAA,MAAM,KAAK,YAAA,EAAoB;AAM/B,EAAA,MAAM,IAAA,GACJ,MAAA,CAAO,aAAA,KAAkB,MAAA,GACrB,cAAA,CAAkB;AAAA,IAChB,OAAO,MAAA,CAAO,aAAA;AAAA,IACd,GAAI,OAAO,WAAA,KAAgB,MAAA,GACvB,EAAE,GAAA,EAAK,MAAA,CAAO,WAAA,EAAY,GAC1B;AAAC,GACN,CAAA,GACD,IAAA;AAON,EAAA,MAAM,aAAa,IAAA,IAAQ,cAAA,CAAkB,EAAE,KAAA,EAAO,GAAG,CAAA;AAGzD,EAAA,SAAS,IAAA,GAAiC;AACxC,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,MAAA;AAAA,MACP,YAAY,EAAC;AAAA,MACb,SAAA,EAAW,CAAA;AAAA,MACX,cAAA,EAAgB,CAAA;AAAA,MAChB,WAAA,EAAa,CAAA;AAAA;AAAA;AAAA;AAAA,MAIb,QAAA,EAAU,WAAW,IAAA;AAAK,KAC5B;AAAA,EACF;AAQA,EAAA,SAAS,WAAW,EAAA,EAAyC;AAC3D,IAAA,IAAI,QAAqC,EAAC;AAC1C,IAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,CAAA,KAAM;AAC3B,MAAA,KAAA,GAAQ,EAAA,CAAG,QAAQ,KAAA,EAAO,KAAA,EAAO,IAAI,CAAA,MAAA,EAAS,CAAC,EAAE,CAAA,CAAE,IAAA;AAAA,IACrD,CAAC,CAAA;AAGD,IAAA,MAAM,OAAA,GAAU,EAAA,CAAG,KAAA,CAAM,KAAA,EAAO,EAAE,CAAA;AAClC,IAAA,OAAO,OAAA,GAAU,QAAQ,IAAA,GAAO,KAAA;AAAA,EAClC;AAGA,EAAA,SAAS,aACP,CAAA,EAC8B;AAC9B,IAAA,OAAO,EAAE,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,SAAS,CAAA;AAAA,EACxD;AAUA,EAAA,SAAS,KAAA,CACP,CAAA,EACA,KAAA,EACA,EAAA,EACoE;AAKpE,IAAA,MAAM,IAAA,GAAiC;AAAA,MACrC,KAAA,EAAO,SAAA;AAAA,MACP,KAAA;AAAA,MACA,UAAA,EAAY,UAAA,GAAa,UAAA,CAAW,EAAE,IAAI,EAAC;AAAA,MAC3C,SAAA,EAAW,EAAA;AAAA,MACX,cAAA,EAAgB,EAAA;AAAA,MAChB,WAAA,EAAa,CAAA;AAAA,MACb,UAAU,CAAA,CAAE;AAAA,KACd;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,EAAE,CAAA;AAAA,EAClB;AAOA,EAAA,SAAS,YAAA,CAAa,GAAmB,EAAA,EAA4B;AACnE,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,cAAA,EAAgB,IAAI,WAAA,EAAa,CAAA,CAAE,cAAc,CAAA,EAAE;AAAA,EACpE;AAQA,EAAA,SAAS,cAAA,CACP,CAAA,EACA,OAAA,EACA,EAAA,EACoE;AACpE,IAAA,IAAI,SAAS,IAAA,EAAM,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAChC,IAAA,MAAM,CAAC,UAAU,IAAI,CAAA,GAAI,KAAK,MAAA,CAAO,CAAA,CAAE,QAAA,EAAU,OAAA,EAAS,EAAE,CAAA;AAI5D,IAAA,OAAO,CAAC,EAAE,GAAG,CAAA,EAAG,QAAA,IAAY,IAAqC,CAAA;AAAA,EACnE;AAWA,EAAA,SAAS,QAAA,CACP,CAAA,EACA,OAAA,EACA,EAAA,EACoE;AACpE,IAAA,IAAI,CAAA,CAAE,KAAA,KAAU,SAAA,IAAa,CAAA,CAAE,KAAA,KAAU,SAAS,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAC/D,IAAA,MAAM,MAAA,GAAmC;AAAA,MACvC,GAAG,YAAA,CAAa,CAAA,EAAG,EAAE,CAAA;AAAA,MACrB,KAAA,EAAO;AAAA,KACT;AACA,IAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,OAAA,EAAS,EAAE,CAAA;AAAA,EAC3C;AAYA,EAAA,SAAS,UACP,CAAA,EACoE;AACpE,IAAA,IAAI,EAAE,KAAA,KAAU,SAAA,SAAkB,CAAC,CAAA,EAAG,EAAE,CAAA;AACxC,IAAA,OAAO,CAAC,EAAE,GAAG,CAAA,EAAG,OAAO,OAAA,EAAQ,EAAG,EAAE,CAAA;AAAA,EACtC;AAsBA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,OAAA,EACA,MAAA,EACA,EAAA,EACoE;AACpE,IAAA,IAAI,CAAA,CAAE,KAAA,KAAU,SAAA,IAAa,CAAA,CAAE,KAAA,KAAU,SAAS,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAI/D,IAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ;AAC1B,MAAA,MAAM,MAAA,GAAmC;AAAA,QACvC,GAAG,CAAA;AAAA,QACH,KAAA,EAAO,QAAA;AAAA,QACP,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,OAAA;AAAA,UACR,KAAA,EAAO,YAAA,CAAa,CAAC,CAAA,EAAG,KAAA;AAAA,UACxB,OAAO,MAAA,CAAO;AAAA;AAChB,OACF;AACA,MAAA,OAAO,CAAC,MAAA,EAAQ,EAAE,CAAA;AAAA,IACpB;AAIA,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,CAAA,EAAG,EAAE,CAAA;AAGjC,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAA,GAAiC,EAAE,GAAG,MAAA,EAAQ,OAAO,MAAA,EAAO;AAGlE,MAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,EAAE,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,OAAA,GAAU,aAAa,CAAC,CAAA;AAC9B,IAAA,MAAM,SAAA,GACJ,OAAA,KAAY,MAAA,GACR,EAAA,CAAG,QAAA,CAAS,CAAA,CAAE,UAAA,EAAY,OAAA,CAAQ,EAAE,CAAA,CAAE,IAAA,GACtC,CAAA,CAAE,UAAA;AACR,IAAA,MAAM,OAAA,GAAU,EAAA,CAAG,KAAA,CAAM,SAAA,EAAW,EAAE,CAAA;AAEtC,IAAA,IAAI,YAAY,IAAA,EAAM;AAEpB,MAAA,MAAM,IAAA,GAAiC;AAAA,QACrC,GAAG,MAAA;AAAA,QACH,KAAA,EAAO,MAAA;AAAA,QACP,UAAA,EAAY;AAAA,OACd;AACA,MAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,EAAE,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,KAAA,GAAkC;AAAA,MACtC,GAAG,MAAA;AAAA,MACH,YAAY,OAAA,CAAQ;AAAA,KACtB;AACA,IAAA,OAAO,cAAA,CAAe,KAAA,EAAO,OAAA,EAAS,EAAE,CAAA;AAAA,EAC1C;AAOA,EAAA,SAAS,kBAAA,CACP,CAAA,EACA,OAAA,EACA,EAAA,EACoE;AACpE,IAAA,IAAI,SAAS,IAAA,EAAM,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAChC,IAAA,MAAM,CAAC,UAAU,IAAI,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,CAAE,QAAA,EAAU,OAAA,EAAS,EAAE,CAAA;AAE3D,IAAA,OAAO,CAAC,EAAE,GAAG,CAAA,EAAG,QAAA,IAAY,IAAqC,CAAA;AAAA,EACnE;AAkBA,EAAA,SAAS,UAAA,CACP,GACA,GAAA,EACoE;AAMpE,IAAA,IAAI,CAAA,CAAE,KAAA,KAAU,SAAA,IAAa,CAAA,CAAE,KAAA,KAAU,SAAS,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAG/D,IAAA,IAAI,GAAA,CAAI,EAAA,KAAO,aAAA,CAAc,CAAA,CAAE,KAAA,EAAO,CAAA,CAAE,WAAW,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AACnE,IAAA,MAAM,MAAA,GAAmC;AAAA,MACvC,GAAG,CAAA;AAAA,MACH,KAAA,EAAO,QAAA;AAAA,MACP,SAAS,EAAE,MAAA,EAAQ,UAAA,EAAY,EAAA,EAAI,IAAI,IAAA;AAAK,KAC9C;AACA,IAAA,OAAO,CAAC,MAAA,EAAQ,EAAE,CAAA;AAAA,EACpB;AAmBA,EAAA,SAAS,IAAA,CACP,GACA,EAAA,EACoE;AACpE,IAAA,IAAI,CAAA,CAAE,KAAA,KAAU,SAAA,IAAa,CAAA,CAAE,KAAA,KAAU,SAAS,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAK/D,IAAA,MAAM,CAAC,cAAc,CAAA,GAAI,UAAA,CAAW,IAAA,CAAK,EAAE,QAAQ,CAAA;AACnD,IAAA,MAAM,QAAA,GAAqC;AAAA,MACzC,GAAG,CAAA;AAAA,MACH,KAAA,EAAO,SAAA;AAAA,MACP,cAAA,EAAgB,EAAA;AAAA,MAChB,WAAA,EAAa,EAAE,WAAA,GAAc,CAAA;AAAA,MAC7B,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAMZ;AACA,IAAA,OAAO,CAAC,QAAA,EAAU,EAAE,CAAA;AAAA,EACtB;AAoBA,EAAA,SAAS,KAAK,CAAA,EAAqD;AACjE,IAAA,IAAI,MAAA,CAAO,UAAA,KAAe,MAAA,EAAW,OAAO,EAAC;AAC7C,IAAA,IAAI,EAAE,KAAA,KAAU,SAAA,IAAa,EAAE,KAAA,KAAU,OAAA,SAAgB,EAAC;AAC1D,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,QACE,aAAA,CAAc,CAAA,CAAE,KAAA,EAAO,CAAA,CAAE,WAAW,CAAA;AAAA,QACpC,CAAA,CAAE,iBAAiB,MAAA,CAAO;AAAA;AAC5B,KACF;AAAA,EACF;AAeA,EAAA,SAAS,SACP,KAAA,EAQA;AACA,IAAA,OAAO,WAAW,QAAA,CAAS,EAAE,KAAA,EAAO,KAAA,CAAM,OAAO,CAAA;AAAA,EACnD;AAOA,EAAA,SAAS,eAAA,CACP,GACA,GAAA,EAC0B;AAC1B,IAAA,IAAI,IAAA,KAAS,MAAM,OAAO,CAAA;AAK1B,IAAA,MAAM,CAAC,SAAS,CAAA,GAAI,KAAK,OAAA,CAAQ,CAAA,CAAE,UAAU,GAAG,CAAA;AAChD,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,QAAA,EAAU,SAAA,EAAU;AAAA,EACrC;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAQO,SAAS,OAAA,CAKd,KAAA,EACA,CAAC,KAAA,EAAO,IAAI,CAAA,EACgB;AAC5B,EAAA,OAAO,CAAC,EAAE,GAAG,OAAO,GAAA,EAAK,KAAA,IAAS,IAAI,CAAA;AACxC","file":"chunk-CAXMQJJ3.js","sourcesContent":["/**\n * @demlik/tea/monitored-run — a long-running operation that is BOTH staged and\n * watched: an ordered stage pipeline whose POSITION survives eviction, wrapped\n * by a no-progress safety deadline and (optionally) a periodic durable\n * checkpoint.\n *\n * This is the merge of two field-guide concerns the audit-agent machine\n * hand-wired together (`seed/audit-agent-machine`): the OUTER pipeline position\n * (`RunStage` — planning → testing → summarizing → reporting, replayed on cold\n * wake by re-emitting the one outstanding effect) and the no-progress safety\n * alarm (`subs.ts`, keyed on `progressSeq` so every progress event retires the\n * old alarm and arms a fresh one). `monitored-run` lifts both into one config-\n * driven knob with the uniform L2 contract `resilient-call` established:\n * `init()`, the verbs (`start` / `advance` / `progress` / `onDeadline` /\n * `boot`), `subs(state)`, and `handlers(ports)`.\n *\n *   - It is **staged, optionally**. Omit `stages` and the run is single-shot:\n *     `start` enters `running`, `advance` finishes it to `done`. Provide\n *     `stages` and it becomes an ordered pipeline — each `advance` retires the\n *     current stage and claims the next, finishing to `done` only when the last\n *     stage is retired. The pipeline POSITION lives in the Model (a\n *     `work-queue` of stage items), so an eviction mid-pipeline resumes at the\n *     same stage via `boot` — the audit machine's \"pipeline position survives\n *     eviction\" property, generalized.\n *   - It is **watched**. While `running`, a no-progress deadline is armed at\n *     `lastProgressAt + deadlineMs` and keyed on `progressSeq`. Every\n *     `progress` / `advance` bumps the seq, so the substrate retires the old\n *     alarm and arms a new one — a self-rearming watchdog. If the alarm fires\n *     (`onDeadline`) the run goes `failed` with a deadline reason. Omit\n *     `deadlineMs` → no watchdog (the `stale` phase is never reachable).\n *   - It **checkpoints, optionally**. Provide `snapshotEvery` and every\n *     progress unit is accounted to a `../snapshot` slice; once the cadence is\n *     reached a checkpoint Cmd is emitted (interpreted by the spliced snapshot\n *     `handlers`), so a crashed run restarts from the last durable checkpoint\n *     rather than from zero. Omit it → no checkpointing.\n *\n * ## Why the run lifecycle is INLINE (run-tracker not extracted)\n *\n * The phase union (`idle` / `running` / `stale` / `done` / `failed`, a\n * discriminated union carrying only each phase's own data) and its bookkeeping\n * (`runId`, `startedAt`, `lastProgressAt`, `progressSeq`) live directly on this\n * slice rather than behind a `run-tracker` sub-knob.\n * Extraction earns its keep when two independent axes vary; here the lifecycle\n * has exactly one anchoring axis (this run), so a separate module would be a\n * premature seam. The two genuinely independent axes — the safety DEADLINE and\n * the periodic SNAPSHOT — ARE extracted (`../deadline`, `../snapshot`), and the\n * stage list is a `../work-queue` slice (`QueueItem<Stage>[]`) whose every\n * status flip is DELEGATED to the blessed `../work-queue/ops` (`enqueueOp` /\n * `claimNextOp` / `markDoneOp`) — never re-rolled here. The lifecycle is the\n * glue between them.\n *\n * ## The two non-negotiables (canon)\n *\n *   - **Durable** — the slice is plain data (the stage queue is a\n *     JSON-serializable `QueueItem<Stage>[]`, the snapshot slice is plain\n *     numbers), so it survives DO eviction / reload.\n *   - **Replayable** — every transition is a pure verb returning new state +\n *     Cmds; nothing here reads the clock or RNG. Time arrives as an `at` / `atMs`\n *     parameter; the only clock read is `Date.now()` inside the snapshot\n *     `handlers` port (the effect boundary), exactly as `../snapshot` stamps it.\n *\n * ## Typical wiring\n *\n *   const run = createMonitoredRun<MyStage, MyState>({\n *     stages: [\"plan\", \"test\", \"report\"],\n *     deadlineMs: 10 * 60_000,\n *     snapshotEvery: 25,\n *   });\n *\n *   init: (loaded) => loaded ? [loaded, []] : [{ run: run.init() }, []],\n *   update: {\n *     begin:    (s, m) => lift(s, run.start(s.run, m.runId, m.at)),\n *     advance:  (s, m) => lift(s, run.advance(s.run, checkpoint(s), m.result, m.at)),\n *     progress: (s, m) => lift(s, run.progress(s.run, checkpoint(s), m.at)),\n *     run_deadline: (s, m) => lift(s, run.onDeadline(s.run, m)),\n *     boot:     (s, m) => lift(s, run.boot(s.run, m.at)),\n *   },\n *   subscriptions: (s) => run.subs(s.run),\n *   subscribe: { deadline: subscribeDeadline },\n *   interpret: run.handlers({ store: r2 }),\n */\n\nimport {\n  type DeadlineExceeded,\n  type DeadlineSub,\n  deadlineSub,\n  subscribeDeadline,\n} from \"../deadline\";\nimport type { Cmd, Interpret } from \"../index\";\nimport {\n  createSnapshot,\n  type SnapshotFailedMsg,\n  type SnapshotLoadCmd,\n  type SnapshotLoadedMsg,\n  type SnapshotLoadFailedMsg,\n  type SnapshotSavedMsg,\n  type SnapshotState,\n  type SnapshotStore,\n  type SnapshotWriteCmd,\n} from \"../snapshot\";\nimport type { QueueItem } from \"../work-queue\";\nimport { queueAdapter } from \"../work-queue/adapter\";\n\n// ===========================================================================\n// Config — the knob. Every field optional; omit a field → omit its gate.\n// ===========================================================================\n\n/**\n * The monitored-run knob. EVERY field is optional:\n *   - omit `stages`       → single-shot run (no pipeline; one `advance` finishes).\n *   - omit `deadlineMs`   → no no-progress watchdog (the run is never auto-failed).\n *   - omit `snapshotEvery`→ no periodic checkpoint (no `snapshot_write` Cmds).\n *\n * An empty config `{}` is a valid single-shot, unwatched, uncheckpointed run.\n *\n * `Stage` is the consumer's stage identifier — any JSON-serializable value\n * (a string id, a `{ kind, ... }` record). It rides through the stage queue\n * unchanged so the consumer's reducer can branch on the current stage to emit\n * that stage's outstanding effect (the audit machine's `outstandingEffect`).\n */\nexport interface MonitoredRunConfig<Stage> {\n  /**\n   * The ordered stages of the pipeline. Position survives eviction (lives in\n   * the Model's stage queue). Omit for a single-shot run. An empty array is\n   * treated as single-shot too — there is nothing to pipeline through.\n   */\n  readonly stages?: readonly Stage[];\n  /**\n   * No-progress watchdog budget, in ms. The safety deadline is armed at\n   * `lastProgressAt + deadlineMs` and re-armed on every progress event. Omit\n   * for no watchdog.\n   */\n  readonly deadlineMs?: number;\n  /**\n   * Checkpoint cadence — write a durable snapshot once this many progress\n   * units have accumulated. Threaded straight into `../snapshot`'s `every`.\n   * Omit for no checkpointing.\n   */\n  readonly snapshotEvery?: number;\n  /**\n   * Store key the rolling checkpoint is written under. Forwarded to\n   * `../snapshot`'s `key`; defaults to that module's `@@snapshot`. Ignored\n   * when `snapshotEvery` is omitted.\n   */\n  readonly snapshotKey?: string;\n}\n\n// ===========================================================================\n// Slice — the Model field this knob owns. Run lifecycle INLINE + composed bricks.\n// ===========================================================================\n\n/**\n * Why a run terminated as `failed`. Discriminated so each reason carries only\n * its own data (pattern 11):\n *   - `deadline`  — the no-progress watchdog fired (`onDeadline`).\n *   - `stage`     — the consumer reported a stage failure via `advance(..., fail)`.\n *\n * `stale` is a SEPARATE phase (not a fail reason): a run is `stale` only by an\n * explicit consumer signal that progress has wedged WITHOUT the deadline having\n * fired — a soft, recoverable observation. The deadline firing is a hard\n * terminal (`failed { reason: \"deadline\" }`).\n *\n * The `stage` variant carries the FAILING STAGE VALUE (the `Stage` itself), not\n * a positional index: done stages leave the queue (`markDoneOp` filters them),\n * so a residual index drifts as the pipeline advances. The stage value is the\n * stable, meaningful identifier — `undefined` for a single-shot run (no stage).\n */\nexport type RunFailure<Stage> =\n  | { readonly reason: \"deadline\"; readonly at: number }\n  | {\n      readonly reason: \"stage\";\n      readonly stage: Stage | undefined;\n      readonly error: unknown;\n    };\n\n/**\n * The run bookkeeping every phase carries in common, split out so each arm of\n * the `MonitoredRunState` discriminated union names only the data it ADDS\n * (`runId` on started phases, `failure` on `failed`) — the same discipline the\n * sibling `PaginatorState` uses for its shared `seen` / `pages` counters. Plain\n * data end to end so the whole slice survives DO eviction / reload:\n *\n *   - `stepStates`     — the stage pipeline as a `work-queue` of stage items.\n *                        Empty for a single-shot run. The ONE `running` item is\n *                        the current stage; `done` items are retired stages\n *                        (they leave the queue via `markDoneOp`, so the queue\n *                        shrinks as the pipeline advances and is empty at\n *                        `done`). POSITION survives eviction because this list\n *                        is durable.\n *   - `startedAt`      — `at` of `start`. Observability; never compared in a verb.\n *   - `lastProgressAt` — `at` of the most recent progress event; the watchdog\n *                        base. Re-armed by `progress` / `advance`.\n *   - `progressSeq`    — monotonic progress counter; keys the safety alarm Sub\n *                        id so every bump retires the old alarm and arms a new\n *                        one (the audit subs' `safety:{progressSeq}` discipline).\n *   - `snapshot`       — the `../snapshot` slice (cadence counter + durable\n *                        watermark). Always present (uniform shape); the gate\n *                        is simply never driven when `snapshotEvery` is omitted.\n */\ninterface RunCore<Stage> {\n  readonly stepStates: readonly QueueItem<Stage>[];\n  readonly startedAt: number;\n  readonly lastProgressAt: number;\n  readonly progressSeq: number;\n  readonly snapshot: SnapshotState;\n}\n\n/**\n * The slice — a discriminated union on `phase` so each phase carries ONLY its\n * own data and impossible combinations are unrepresentable (pattern 11), the\n * same idiom the sibling `CircuitState` / `PaginatorState` / `RunFailure` follow:\n *\n *   - `idle`    — created but never started. Carries no `runId` (identity is\n *                 host-minted at `start`) and no `failure`: \"not started\" is its\n *                 OWN phase, not a `running` run wearing an empty-string `runId`\n *                 sentinel. `start` is the only transition out, so no verb has to\n *                 guard \"has this actually started?\" — `phase === \"idle\"` says it.\n *   - `running` — the run is live. Carries the host-minted `runId` and the\n *                 `RunCore` pipeline position + watchdog bookkeeping.\n *   - `stale`   — a soft \"no progress observed\" mark the consumer can set and\n *                 clear; still resumable (a `progress` clears it back to\n *                 `running`). Distinct from a fired deadline, which is terminal.\n *   - `done`    — every stage retired (or the single-shot `advance` landed).\n *   - `failed`  — terminal failure; the typed `failure` reason rides ONLY this\n *                 arm, so it is present iff `phase === \"failed\"` BY CONSTRUCTION —\n *                 there is no nullable side field to keep in sync.\n *\n * `runId` is the host-minted run identity, stamped at `start` (the machine never\n * mints — see the audit seed's \"run identity is host-minted\"). It rides every\n * started phase, but not `idle`.\n */\nexport type MonitoredRunState<Stage> =\n  | (RunCore<Stage> & { readonly phase: \"idle\" })\n  | (RunCore<Stage> & { readonly phase: \"running\"; readonly runId: string })\n  | (RunCore<Stage> & { readonly phase: \"stale\"; readonly runId: string })\n  | (RunCore<Stage> & { readonly phase: \"done\"; readonly runId: string })\n  | (RunCore<Stage> & {\n      readonly phase: \"failed\";\n      readonly runId: string;\n      readonly failure: RunFailure<Stage>;\n    });\n\n/**\n * The live (still-timed) phases — `running` or `stale`. The verbs narrow to this\n * before touching the watchdog bookkeeping (`runId` / `progressSeq`), so a\n * settled (`done` / `failed`) or never-started (`idle`) slice can never be bumped\n * — the narrow replaces the old `runId === \"\"` born-live guard.\n */\ntype LiveRun<Stage> = Extract<\n  MonitoredRunState<Stage>,\n  { readonly phase: \"running\" | \"stale\" }\n>;\n\n/**\n * The outcome a consumer reports to `advance`: the current stage either\n * succeeded (retire it, claim the next) or failed (terminate the run). Plain\n * data — the consumer parses its stage result at its own boundary and hands a\n * settled outcome here.\n */\nexport type StageResult =\n  | { readonly kind: \"ok\" }\n  | { readonly kind: \"fail\"; readonly error: unknown };\n\n// ===========================================================================\n// Cmd + Msg — re-exported from the composed bricks so consumers wire one import.\n// ===========================================================================\n\n/** The checkpoint-write Cmd, generic over the consumer's checkpoint value `V`. */\nexport type MonitoredRunCmd<V> = SnapshotWriteCmd<V>;\n\n/** The deadline Msg the safety alarm dispatches when the watchdog fires. */\nexport type MonitoredRunTimerMsg = DeadlineExceeded;\n\n/** Ports the consumer supplies to `handlers` — just the checkpoint store. */\nexport interface MonitoredRunPorts<V> {\n  /** Where periodic checkpoints are written (R2 / KV / DO sub-key / Map). */\n  readonly store: SnapshotStore<V>;\n}\n\n// ===========================================================================\n// Sub-id family. The safety alarm is keyed on `progressSeq` so a progress\n// event retires the old alarm and arms a new one (single-shot, re-armed by id\n// bump — the audit subs discipline).\n// ===========================================================================\n\nfunction safetyTimerId(runId: string, progressSeq: number): string {\n  return `monitored:safety:${runId}:${progressSeq}`;\n}\n\n// ===========================================================================\n// The knob factory.\n// ===========================================================================\n\n/**\n * Build a monitored-run knob from `config`. `Stage` is the consumer's stage\n * identifier type; `V` is the consumer's checkpoint value type (what\n * `snapshotEvery` checkpoints). Returns the uniform L2 knob contract.\n *\n * No `rng` parameter: unlike `resilient-call`, nothing here jitters — the only\n * external inputs are time (an `at` / `atMs` parameter) and the consumer's\n * stage outcomes. The clock is read only inside the snapshot `handlers` port.\n */\nexport function createMonitoredRun<Stage, V = unknown>(\n  config: MonitoredRunConfig<Stage> = {},\n) {\n  const stages = config.stages ?? [];\n  const isPipeline = stages.length > 0;\n\n  // The stage-queue seam, bound once. Every stage status flip delegates to the\n  // `QueueAdapter` verbs (`wq.enqueue` / `wq.claim` / `wq.markDone`), so the\n  // `QueueItem<Stage>` shape stays insulated behind them.\n  const wq = queueAdapter<Stage>();\n\n  // The snapshot sub-knob is built only when `snapshotEvery` is configured;\n  // absence is `null` so the progress gate short-circuits to \"no checkpoint\".\n  // When present, the slice still carries a default SnapshotState so the shape\n  // is uniform across configs — the gate simply never records into it.\n  const snap =\n    config.snapshotEvery !== undefined\n      ? createSnapshot<V>({\n          every: config.snapshotEvery,\n          ...(config.snapshotKey !== undefined\n            ? { key: config.snapshotKey }\n            : {}),\n        })\n      : null;\n\n  // The snapshot knob to actually drive: `snap` when configured, else a single\n  // inert default (`every: 1`) bound ONCE here. Its `record` is never invoked\n  // (the progress gate short-circuits when `snap` is null), so the cadence value\n  // is immaterial — one shared stateless knob of pure functions stands in for\n  // the disabled-checkpoint case across init/boot/handlers.\n  const activeSnap = snap ?? createSnapshot<V>({ every: 1 });\n\n  /** The starting slice for a never-started run: the `idle` phase, no `runId`. */\n  function init(): MonitoredRunState<Stage> {\n    return {\n      phase: \"idle\",\n      stepStates: [],\n      startedAt: 0,\n      lastProgressAt: 0,\n      progressSeq: 0,\n      // A default snapshot slice even without the brick → uniform shape. When\n      // `snap` is null the inert `activeSnap` default supplies the slice; its\n      // `record` is never called, so the cadence value is immaterial.\n      snapshot: activeSnap.init(),\n    };\n  }\n\n  /**\n   * Seed the stage queue from the configured stages: every stage enqueued\n   * `pending`, then the first claimed `running`. `at` stamps the claim. PURE —\n   * the work-queue ops are pure array transforms; ids are positional (`stage:i`)\n   * so they are deterministic and replayable (no `crypto`, no `Math.random`).\n   */\n  function seedStages(at: number): readonly QueueItem<Stage>[] {\n    let queue: readonly QueueItem<Stage>[] = [];\n    stages.forEach((stage, i) => {\n      queue = wq.enqueue(queue, stage, at, `stage:${i}`).next;\n    });\n    // Claim the first stage as the running position. A non-empty pipeline always\n    // has a pending head here, so the claim succeeds.\n    const claimed = wq.claim(queue, at);\n    return claimed ? claimed.next : queue;\n  }\n\n  /** The current (running) stage item, or `undefined` for a single-shot run. */\n  function currentStage(\n    s: MonitoredRunState<Stage>,\n  ): QueueItem<Stage> | undefined {\n    return s.stepStates.find((i) => i.status === \"running\");\n  }\n\n  // === Verb: start =========================================================\n\n  /**\n   * Start (or restart) the run for `runId` at time `at`. Seeds the stage queue\n   * (if a pipeline) and enters `running` with the watchdog clock primed. Stamps\n   * `runId` from the host — the machine never mints (invariant: identity is\n   * host-minted, parsed at the boundary). PURE.\n   */\n  function start(\n    s: MonitoredRunState<Stage>,\n    runId: string,\n    at: number,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    // Build the `running` arm explicitly rather than spreading `...s`: a restart\n    // from `failed` must NOT carry the old `failure` field forward (the `running`\n    // arm has none), and a start from `idle` has no `runId` to preserve. Only the\n    // snapshot slice threads through.\n    const next: MonitoredRunState<Stage> = {\n      phase: \"running\",\n      runId,\n      stepStates: isPipeline ? seedStages(at) : [],\n      startedAt: at,\n      lastProgressAt: at,\n      progressSeq: 0,\n      snapshot: s.snapshot,\n    };\n    return [next, []];\n  }\n\n  /**\n   * Bump the watchdog clock: set `lastProgressAt`/`progressSeq` so the safety\n   * alarm Sub id changes and the substrate re-arms a fresh deadline. Shared by\n   * `progress` and `advance`. PURE.\n   */\n  function bumpProgress(s: LiveRun<Stage>, at: number): LiveRun<Stage> {\n    return { ...s, lastProgressAt: at, progressSeq: s.progressSeq + 1 };\n  }\n\n  /**\n   * Account one progress unit to the snapshot slice (when the brick is\n   * configured), returning the new slice + any checkpoint Cmd. `payload` is the\n   * consumer's checkpoint value to persist. PURE — `snap.record` is pure, the\n   * write is realized only when the runtime performs the emitted Cmd.\n   */\n  function recordSnapshot(\n    s: MonitoredRunState<Stage>,\n    payload: V,\n    at: number,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    if (snap === null) return [s, []];\n    const [snapshot, cmds] = snap.record(s.snapshot, payload, at);\n    // `snap.record` only ever emits `SnapshotWriteCmd<V>` (its sole Cmd), but\n    // its signature widens to `readonly Cmd[]`. Narrow back to this knob's\n    // precise Cmd union so a consumer's host Cmd type can stay exact.\n    return [{ ...s, snapshot }, cmds as readonly MonitoredRunCmd<V>[]];\n  }\n\n  // === Verb: progress ======================================================\n\n  /**\n   * Record forward progress: bump the watchdog (re-arming the safety alarm),\n   * clear any `stale` mark back to `running`, and account a snapshot unit\n   * (emitting a checkpoint Cmd on a cadence hit). A no-op unless the run is live\n   * (`running` / `stale`) — a late progress event on a settled (`done` /\n   * `failed`) or never-started (`idle`) run is ignored. PURE.\n   */\n  function progress(\n    s: MonitoredRunState<Stage>,\n    payload: V,\n    at: number,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    if (s.phase !== \"running\" && s.phase !== \"stale\") return [s, []];\n    const bumped: MonitoredRunState<Stage> = {\n      ...bumpProgress(s, at),\n      phase: \"running\",\n    };\n    return recordSnapshot(bumped, payload, at);\n  }\n\n  // === Verb: markStale =====================================================\n\n  /**\n   * Mark the run `stale` — a soft \"no progress observed\" signal the consumer\n   * raises WITHOUT the deadline having fired (e.g. an upstream heartbeat gap).\n   * Recoverable: the next `progress` flips it back to `running`. A no-op unless\n   * the run is currently `running` (a settled run cannot go stale). Does NOT\n   * touch `progressSeq` — going stale is not progress, so the armed deadline\n   * keeps counting toward the hard terminal. PURE.\n   */\n  function markStale(\n    s: MonitoredRunState<Stage>,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    if (s.phase !== \"running\") return [s, []];\n    return [{ ...s, phase: \"stale\" }, []];\n  }\n\n  // === Verb: advance =======================================================\n\n  /**\n   * Advance the pipeline on a stage outcome:\n   *\n   *   - `result.kind === \"fail\"` → terminate `failed { reason: \"stage\" }`,\n   *     carrying the failing stage index + error. No further stages run.\n   *   - `result.kind === \"ok\"`:\n   *       - single-shot run → finish to `done` (and force a final checkpoint\n   *         when checkpointing, so the last durable snapshot is the terminal\n   *         state).\n   *       - pipeline → retire the current stage (`markDoneOp`) and claim the\n   *         next (`claimNextOp`). If none remain, finish to `done`. The new\n   *         position survives eviction.\n   *\n   * An advance is itself a progress event, so it bumps the watchdog (re-arming\n   * the alarm at the new stage) and accounts a snapshot unit. A no-op on a\n   * settled (`done` / `failed`) or never-started (`idle`) run. PURE — `at` is the\n   * only clock, ids are positional.\n   */\n  function advance(\n    s: MonitoredRunState<Stage>,\n    payload: V,\n    result: StageResult,\n    at: number,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    if (s.phase !== \"running\" && s.phase !== \"stale\") return [s, []];\n\n    // Stage failure → hard terminal. Carry the failing stage VALUE (stable),\n    // `undefined` for a single-shot run with no stage.\n    if (result.kind === \"fail\") {\n      const failed: MonitoredRunState<Stage> = {\n        ...s,\n        phase: \"failed\",\n        failure: {\n          reason: \"stage\",\n          stage: currentStage(s)?.input,\n          error: result.error,\n        },\n      };\n      return [failed, []];\n    }\n\n    // Success: bump the watchdog first (an advance is progress), then move the\n    // pipeline position.\n    const bumped = bumpProgress(s, at);\n\n    // Single-shot: one advance finishes the run.\n    if (!isPipeline) {\n      const done: MonitoredRunState<Stage> = { ...bumped, phase: \"done\" };\n      // Force a terminal checkpoint so the last durable snapshot is `done`,\n      // not whatever the cadence happened to land on.\n      return finishWithSnapshot(done, payload, at);\n    }\n\n    // Pipeline: retire the running stage, claim the next.\n    const current = currentStage(s);\n    const afterDone =\n      current !== undefined\n        ? wq.markDone(s.stepStates, current.id).next\n        : s.stepStates;\n    const claimed = wq.claim(afterDone, at);\n\n    if (claimed === null) {\n      // No more stages — the pipeline is complete.\n      const done: MonitoredRunState<Stage> = {\n        ...bumped,\n        phase: \"done\",\n        stepStates: afterDone,\n      };\n      return finishWithSnapshot(done, payload, at);\n    }\n\n    // Advance to the next stage — POSITION now points at the claimed item.\n    const moved: MonitoredRunState<Stage> = {\n      ...bumped,\n      stepStates: claimed.next,\n    };\n    return recordSnapshot(moved, payload, at);\n  }\n\n  /**\n   * Finish helper: force a terminal checkpoint when checkpointing is enabled\n   * (so the durable snapshot is the terminal state), else just settle. Shared\n   * by single-shot finish and pipeline completion. PURE.\n   */\n  function finishWithSnapshot(\n    s: MonitoredRunState<Stage>,\n    payload: V,\n    at: number,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    if (snap === null) return [s, []];\n    const [snapshot, cmds] = snap.force(s.snapshot, payload, at);\n    // Same narrowing as `recordSnapshot`: `snap.force` emits only the write Cmd.\n    return [{ ...s, snapshot }, cmds as readonly MonitoredRunCmd<V>[]];\n  }\n\n  // === Verb: onDeadline ====================================================\n\n  /**\n   * The safety alarm fired. Two outcomes by Sub-id match:\n   *\n   *   - the alarm matches the CURRENT `progressSeq` (no progress since it was\n   *     armed) → the run is wedged → terminate `failed { reason: \"deadline\" }`.\n   *   - the alarm matches an OLDER seq → a stale fire racing a progress event\n   *     that already re-armed the alarm → no-op (the substrate retired this id;\n   *     tolerate a fire still in flight defensively).\n   *\n   * A no-op on a settled run (its alarm was reconciled away; tolerate a stale\n   * fire) and on a NEVER-STARTED (`idle`) run (`subs` armed nothing for it, so\n   * any alarm reaching it is a rogue fire that must not un-start it). PURE —\n   * `msg.atMs` stamps the failure.\n   */\n  function onDeadline(\n    s: MonitoredRunState<Stage>,\n    msg: MonitoredRunTimerMsg,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    // Only a live (`running` / `stale`) run is watched. A settled (`done` /\n    // `failed`) run's alarm was reconciled away, and a never-started (`idle`) run\n    // — which has no host-minted `runId` and armed nothing — must not be\n    // un-started by a born-live/rogue fire. The phase narrow IS the guard the old\n    // `runId === \"\"` sentinel stood in for.\n    if (s.phase !== \"running\" && s.phase !== \"stale\") return [s, []];\n    // Only the alarm armed against the current progressSeq is live. A bumped\n    // seq means progress re-armed it; an older fire is stale.\n    if (msg.id !== safetyTimerId(s.runId, s.progressSeq)) return [s, []];\n    const failed: MonitoredRunState<Stage> = {\n      ...s,\n      phase: \"failed\",\n      failure: { reason: \"deadline\", at: msg.atMs },\n    };\n    return [failed, []];\n  }\n\n  // === Verb: boot ==========================================================\n\n  /**\n   * Resume after a reload (cold wake). Re-seeds the watchdog clock to `at` so\n   * the safety alarm re-arms from NOW (the pre-crash `lastProgressAt` would\n   * immediately fire a deadline that already elapsed during downtime — a cold\n   * wake is not a no-progress wedge). Bumps `progressSeq` so the alarm gets a\n   * fresh id, and resets the snapshot cadence counter (un-checkpointed\n   * pre-crash progress is moot — recovery resumes from the last durable\n   * checkpoint). The pipeline POSITION (`stepStates`) is preserved untouched —\n   * that is the whole point of staging: resume at the same stage.\n   *\n   * A no-op on a settled (`done` / `failed`) or never-started (`idle`) run. Emits\n   * NO Cmd — re-emitting the current stage's outstanding effect is the CONSUMER's\n   * job (it knows the per-stage Cmd), the audit machine's `outstandingEffect(stage)`\n   * pattern. PURE.\n   */\n  function boot(\n    s: MonitoredRunState<Stage>,\n    at: number,\n  ): readonly [MonitoredRunState<Stage>, readonly MonitoredRunCmd<V>[]] {\n    if (s.phase !== \"running\" && s.phase !== \"stale\") return [s, []];\n    // `snap.boot` returns the reducer-cell shape `[SnapshotState, Cmd[]]`\n    // (uniform across every sibling knob); a boot emits no Cmd, so take only the\n    // slice. Assigning the tuple itself would put an ARRAY where a SnapshotState\n    // belongs — a type error AND a non-round-trippable slice.\n    const [bootedSnapshot] = activeSnap.boot(s.snapshot);\n    const reseeded: MonitoredRunState<Stage> = {\n      ...s,\n      phase: \"running\",\n      lastProgressAt: at,\n      progressSeq: s.progressSeq + 1,\n      snapshot: bootedSnapshot,\n      // Any stage left `running` mid-flight stays the running position; the\n      // queue is already correct (a single in-flight stage). resetRunningOp is\n      // NOT applied — unlike a work pool, a monitored run has exactly one\n      // in-flight stage and resuming it (not re-queuing it) is the correct\n      // cold-wake behavior.\n    };\n    return [reseeded, []];\n  }\n\n  // === Subs ================================================================\n\n  /**\n   * Pre-wired subscriptions: the no-progress safety deadline, armed only while\n   * the run is live (`running` / `stale`) AND a `deadlineMs` is configured. The\n   * Sub id is keyed on `progressSeq`, so every progress event retires the old\n   * alarm and the substrate arms a fresh one at the new `lastProgressAt +\n   * deadlineMs` — a self-rearming watchdog with no manual `clearTimeout`. A\n   * settled run desires no subs. Wire `subscribe: { deadline: subscribeDeadline }`.\n   *\n   * A NEVER-STARTED slice (`init()`) is its OWN `idle` phase, not a `running` run\n   * with an empty `runId`. The `phase !== \"running\" && phase !== \"stale\"` narrow\n   * therefore excludes it structurally — no separate `runId === \"\"` sentinel gate\n   * is needed. Were `idle` armed, it would fire a deadline at `0 + deadlineMs`\n   * (already in the past) and auto-fail a run that never began — the \"born live\"\n   * defect. `start` is the only transition out of `idle`, so the watchdog exists\n   * exactly once a real run is in flight.\n   */\n  function subs(s: MonitoredRunState<Stage>): readonly DeadlineSub[] {\n    if (config.deadlineMs === undefined) return [];\n    if (s.phase !== \"running\" && s.phase !== \"stale\") return [];\n    return [\n      deadlineSub(\n        safetyTimerId(s.runId, s.progressSeq),\n        s.lastProgressAt + config.deadlineMs,\n      ),\n    ];\n  }\n\n  // === Handlers ============================================================\n\n  /**\n   * Pre-wired interpret handler for the checkpoint write. Delegates wholesale to\n   * `../snapshot`'s `handlers` (which performs the `put` and routes Ok →\n   * `snapshot_saved` / Err → `snapshot_failed` via Railway — the write never\n   * rejects into the runtime). When checkpointing is disabled (`snapshotEvery`\n   * omitted), no `snapshot_write` Cmd is ever emitted, so the returned map is an\n   * inert no-op handler — kept for a uniform `handlers(ports)` call shape.\n   *\n   * Fold the `snapshot_saved` Msg back through this knob's `confirmSnapshot`\n   * verb to advance the durable watermark.\n   */\n  function handlers(\n    ports: MonitoredRunPorts<V>,\n  ): Interpret<\n    | SnapshotSavedMsg\n    | SnapshotFailedMsg\n    | SnapshotLoadedMsg<V>\n    | SnapshotLoadFailedMsg,\n    SnapshotWriteCmd<V> | SnapshotLoadCmd,\n    unknown\n  > {\n    return activeSnap.handlers({ store: ports.store });\n  }\n\n  /**\n   * Fold a confirmed checkpoint write into the slice — advances the snapshot\n   * watermark (forward-only). A no-op pass-through when checkpointing is\n   * disabled. PURE. Fold the `snapshot_saved` Msg here.\n   */\n  function confirmSnapshot(\n    s: MonitoredRunState<Stage>,\n    msg: SnapshotSavedMsg,\n  ): MonitoredRunState<Stage> {\n    if (snap === null) return s;\n    // `snap.confirm` returns the reducer-cell shape `[SnapshotState, Cmd[]]`\n    // (an ack emits nothing). Take only the slice — folding the whole tuple into\n    // `snapshot` would store an ARRAY where a SnapshotState belongs (a type error\n    // and a non-round-trippable slice).\n    const [confirmed] = snap.confirm(s.snapshot, msg);\n    return { ...s, snapshot: confirmed };\n  }\n\n  return {\n    init,\n    start,\n    progress,\n    markStale,\n    advance,\n    onDeadline,\n    boot,\n    confirmSnapshot,\n    subs,\n    handlers,\n  };\n}\n\n/**\n * Lift a knob result `[slice, cmds]` into a host `[State, cmds]` where the\n * slice lives at `state.run`. Convenience for the common single-slice host;\n * hosts with a differently-named field spread by hand. PURE — a thin record\n * rebuild, no clock / RNG.\n */\nexport function liftRun<\n  S extends { run: MonitoredRunState<Stage> },\n  Stage,\n  C extends Cmd,\n>(\n  state: S,\n  [slice, cmds]: readonly [MonitoredRunState<Stage>, readonly C[]],\n): readonly [S, readonly C[]] {\n  return [{ ...state, run: slice }, cmds];\n}\n\n/**\n * Re-export the deadline Sub primitives so consumers (and tests) wire one\n * import: `subscribeDeadline` is the `subscribe` cell, `deadlineSub` builds the\n * Sub literal this knob's `subs` emits.\n */\nexport { subscribeDeadline, deadlineSub };\nexport type {\n  DeadlineSub,\n  DeadlineExceeded,\n  SnapshotSavedMsg,\n  SnapshotWriteCmd,\n};\n"]}

package/dist/{chunk-UV6UWGEO.js → chunk-D736QUGF.js}

@@ -1,4 +1,5 @@
-import { queueAdapter } from './chunk-HJO6VNQI.js';
+import { queueAdapter } from './chunk-MU6MCIAC.js';
+import { at } from './chunk-FV3Z5MBE.js';
 
 // src/fan-out/index.ts
 function launchBudget(concurrency) {
@@ -47,7 +48,7 @@ function launchUpTo(state, config) {
 }
 function settleOne(state, id, status, idOf) {
   const runIdx = state.running.findIndex((item) => idOf(item) === id);
-  const input = runIdx === -1 ? void 0 : state.running[runIdx];
+  const input = at(state.running, runIdx);
   if (input === void 0) return void 0;
   const running = [
     ...state.running.slice(0, runIdx),
@@ -56,7 +57,7 @@ function settleOne(state, id, status, idOf) {
   const ledgerIdx = state.items.findIndex(
     (item) => item.id === id && item.status === "running"
   );
-  const ledger = ledgerIdx === -1 ? void 0 : state.items[ledgerIdx];
+  const ledger = at(state.items, ledgerIdx);
   const items = ledger === void 0 ? state.items : [
     ...state.items.slice(0, ledgerIdx),
     { ...ledger, status },
@@ -143,5 +144,5 @@ function createFanOut(config) {
 }
 
 export { createFanOut, initFanOut, isComplete };
-//# sourceMappingURL=chunk-UV6UWGEO.js.map
-//# sourceMappingURL=chunk-UV6UWGEO.js.map
+//# sourceMappingURL=chunk-D736QUGF.js.map
+//# sourceMappingURL=chunk-D736QUGF.js.map