@demlik/tea 0.12.0 → 0.14.0

package/dist/runtime-types-LWDoi943.d.ts

@@ -0,0 +1,998 @@
+import { Result } from 'better-result';
+import { P as Port, N as NoCellError, C as Cmd, S as Sub, d as Reducer, A as AnyCmdDef, M as Machine, e as Settled, a as CmdOf, T as Transitions, f as RequirementsOf, g as PortEmitter, O as OkOf, E as ErrOf, U as UpdateForm, h as InterpretDetached } from './core-CTzMJ82M.js';
+
+/**
+ * @packageDocumentation
+ * The host-side provider graph — what satisfies a Cmd's `R` (Requirements)
+ * channel.
+ *
+ * A `Cmd` is journaled data, so it can never carry a provider: a provider is a
+ * closure, and a closure does not survive a `Store<S>` round-trip (ADR 0014).
+ * The requirement it declares — `R` — is a TYPE, and a type needs no closure.
+ * So the graph that SATISFIES it lives one layer out, in the host, where
+ * closures are ordinary: `provide({ … })` builds the `ctx` object `run` already
+ * takes, acquiring each provider once, in dependency order, and releasing them
+ * in reverse when the run ends.
+ *
+ * The journal never sees any of this. Replay is a fold over Msgs (ADR 0014) and
+ * a fold calls no handler, so it calls no `acquire`. The graph is host wiring —
+ * hidden, per ADR 0015 — while the State it produced effects over stays visible.
+ *
+ * The contract is Effect's `Layer` + `Scope`, point for point, because that
+ * shape has a decade of production behind it and inventing a fourth one here
+ * would only be a fourth one to learn:
+ *
+ * 1. A provider is `acquire` plus an optional `release`; an `acquire` may depend
+ *    on other providers.
+ * 2. Built once per scope, in dependency order, MEMOIZED — a provider two others
+ *    depend on is acquired exactly once.
+ * 3. Released in reverse acquisition order, exactly once, on every terminal. A
+ *    `release` that throws does not stop its siblings from running.
+ * 4. An `acquire` failure releases whatever was already acquired, in reverse,
+ *    then surfaces as a typed `ProvideFailedError` (ADR 0011) — never a throw
+ *    that escapes `run`.
+ *
+ * A dependency is named with a TOKEN that carries its value type, so `acquire`
+ * needs no parameter annotation and a name the tokens do not list is a compile
+ * error where it is written. That is Effect's `Context.Tag` — a token carrying
+ * name and type together, with the requirement set derived from what the
+ * constructor reads (ZIO's `ZLayer` + `ZIO.service[T]` is the same move):
+ *
+ * ```ts
+ * const Config = dep<{ url: string }>()("config");
+ *
+ * const scoped = provide({
+ *   config: value({ url: "postgres://…" }),
+ *   db: layer([Config], ({ config }) => connect(config.url), (db) => db.close()),
+ * });
+ *
+ * // Either hand it straight to `run` — which acquires at boot and releases at
+ * // `stop()` — or open it yourself when the host wires its own `ctx`.
+ * const state = await driveToDone(run(machine, { ctx: scoped }), start, isDone);
+ * ```
+ *
+ * The string-array form — `layer(["config"], ({ config }: { config: C }) => …)`
+ * — is the UNTYPED escape hatch it remains beside. It spells each dependency
+ * twice, once in `deps` and once in the annotation, and nothing ties the two
+ * together until `provide` compares both against the map. Reach for it where
+ * there is no token to hand: a dep name computed rather than written, or a graph
+ * assembled against a `ctx` shape declared elsewhere.
+ */
+/**
+ * Brand marking a {@link Provided} graph apart from a hand-built `ctx`. Symbol
+ * keyed and module-private, so it reaches no export and no `ctx` object can
+ * collide with it by accident.
+ */
+declare const providedBrand: unique symbol;
+/**
+ * One node of the graph: an `acquire`, an optional `release`, and the names of
+ * the sibling providers `acquire` reads.
+ *
+ * `D` is the shape `acquire` receives — a record of the resolved values of
+ * {@link Provider.deps}. Build one with {@link layer} or {@link value} rather
+ * than by hand; the constructors are what keep `deps` and `D` in step.
+ *
+ * `K` is the dependency NAME set — the keys `deps` may spell. {@link layer}
+ * infers it from the literal you pass, and {@link provide} constrains it to the
+ * map's own keys, so a misspelled dependency is a compile error at the call site
+ * rather than an {@link UnknownProviderError} at `open()`. It defaults to
+ * `string` — the untyped reading, for a provider read back off an erased map.
+ *
+ * MIGRATION: that default is why an ANNOTATION of the two-argument form no
+ * longer fits inside {@link provide}. `readonly string[]` is not assignable to
+ * `readonly ("config" | "db")[]`, so `const db: Provider<string, D> = …` is
+ * rejected — a leaf `Provider<Config>` with `deps: []` included, since the
+ * default is what is compared, not the value. Either name the key set,
+ * `Provider<string, D, "config" | "db">`, or drop the annotation and let
+ * {@link layer} / {@link value} infer `K` from the literal, which is the shape
+ * this API is written for.
+ */
+interface Provider<T, D = Record<never, never>, K extends string = string> {
+    /** Names of the sibling providers `acquire` reads, resolved before it runs. */
+    readonly deps: readonly K[];
+    /**
+     * Build the value. May be async; may read its declared `deps`.
+     *
+     * A function-typed PROPERTY, not a method: a method's parameters are
+     * bivariant, and bivariance here would silently accept a provider whose deps
+     * disagree with the map's — the one check `provide` exists to make.
+     */
+    readonly acquire: (deps: D) => T | Promise<T>;
+    /**
+     * Tear the value down. Optional — a provider with no `release` is a value with
+     * no lifetime. May be async; the scope awaits it.
+     *
+     * A METHOD, unlike `acquire`: its parameter is this provider's OWN value, so
+     * there is no sibling to cross-check and the bivariance a method's parameters
+     * get is what lets a `Provider<Db, …>` be read through the erased
+     * `Provider<unknown, …>` the map's constraint spells.
+     */
+    release?(value: T): unknown;
+}
+/**
+ * The `ctx` a provider map produces: each key mapped to its provider's value.
+ */
+type ProvidedCtx<M> = {
+    [K in keyof M]: M[K] extends Provider<infer T, never, string> ? T : never;
+};
+/**
+ * A provider with no dependencies — {@link layer}'s one-argument form and
+ * {@link value}. Its `K` is `never`, so an empty `deps` fits EVERY map: a
+ * leaf provider built through those constructors is admissible wherever it is
+ * declared, whatever keys the map around it happens to have.
+ *
+ * It is the CONSTRUCTED form that this holds for. Annotating the same value
+ * `Provider<T>` puts `K` back at its `string` default and outside `provide`'s
+ * constraint — see the migration note on {@link Provider}.
+ */
+type LeafProvider<T> = Provider<T, Record<never, never>, never>;
+/**
+ * A live scope — the `ctx` its graph produced, plus the one call that tears it
+ * down. `release` is idempotent: the second call is a no-op, so a host that
+ * releases in a `finally` beside a `run` that already released cannot double-free.
+ */
+interface Scope<Ctx> {
+    /** The built `ctx`, one field per provider. */
+    readonly ctx: Ctx;
+    /**
+     * Release every acquired provider in reverse acquisition order, exactly once.
+     * Each `release` is isolated: a throw is routed to `onReleaseError` and the
+     * remaining releases still run. Never rejects.
+     */
+    release(): Promise<void>;
+}
+/**
+ * Sink for a `release` that threw. A release failure has no caller to reject at
+ * — the run is already over — so it is reported, never propagated.
+ */
+type OnReleaseError = (error: unknown, provider: string) => void;
+/**
+ * An unopened provider graph. Pass it to `run` as `ctx` (it acquires at boot and
+ * releases at `stop()`), or {@link Provided.open} it yourself when the host
+ * wires its own `ctx`.
+ */
+interface Provided<Ctx> {
+    /** Brand — see the module note. Never assigned by a consumer. */
+    readonly [providedBrand]: true;
+    /**
+     * Acquire the whole graph and return the live {@link Scope}. Rejects with a
+     * {@link ProvideFailedError} when an `acquire` fails, having already released
+     * everything it had acquired, in reverse.
+     */
+    open(onReleaseError?: OnReleaseError): Promise<Scope<Ctx>>;
+}
+/**
+ * An `acquire` failed. A typed failure (ADR 0011) rather than the raw throw:
+ * `provider` names the node that failed and `cause` carries what it threw, so a
+ * host reads which dependency the run could not stand up without matching on a
+ * message.
+ *
+ * By the time this is raised, every provider acquired before it has been
+ * released in reverse.
+ */
+declare class ProvideFailedError extends Error {
+    readonly _tag: "provide_failed";
+    /** The provider key whose `acquire` failed. */
+    readonly provider: string;
+    constructor(provider: string, cause: unknown);
+}
+/**
+ * A provider named a dependency the map has no key for. A contract breach
+ * (ADR 0011) — the wiring itself is wrong, so it throws rather than settling.
+ *
+ * `provide` binds `deps` to `keyof M`, so a map it typechecked can never raise
+ * this: the typo is a compile error at the call site instead. What is left is
+ * the UNTYPED path — a map cast (`as never`, `as any`), assembled at runtime, or
+ * read back through an erased `Provider<unknown, …>` — where there was no key
+ * set to check against. The error stays because that path is real, not because
+ * the typed one still needs it.
+ */
+declare class UnknownProviderError extends Error {
+    readonly _tag: "unknown_provider";
+    /** The missing key. */
+    readonly provider: string;
+    /** The provider that asked for it. */
+    readonly requiredBy: string;
+    constructor(provider: string, requiredBy: string);
+}
+/**
+ * The dependency graph has a cycle, so no acquisition order exists. A contract
+ * breach (ADR 0011): the wiring is wrong and no run can fix it.
+ */
+declare class ProviderCycleError extends Error {
+    readonly _tag: "provider_cycle";
+    /** The cycle, in the order it was walked, closing on its own first key. */
+    readonly cycle: readonly string[];
+    constructor(cycle: readonly string[]);
+}
+/**
+ * Phantom key carrying a {@link DepToken}'s VALUE type. Declared, never
+ * assigned: `dep` builds a token whose only runtime field is `name`, and this
+ * property exists so the type survives into {@link DepsOf}. Symbol keyed and
+ * module-private, so it reaches no export and no object literal can collide
+ * with it.
+ *
+ * Typed `(probe: never) => T`, which makes the token COVARIANT in `T`: a
+ * `DepToken<"config", Config>` is readable through the `DepToken<string,
+ * unknown>` bound {@link layer}'s tuple is constrained by, while the value type
+ * itself is still recovered exactly by {@link DepValue}'s `infer`.
+ */
+declare const depValue: unique symbol;
+/**
+ * A typed dependency name — Effect's `Context.Tag`. It carries the dependency's
+ * literal NAME and its VALUE type in one value, so {@link layer} derives the
+ * whole `acquire` parameter from the tokens and the caller annotates nothing.
+ *
+ * Build one with {@link dep}; the phantom field is not yours to write.
+ */
+interface DepToken<N extends string = string, T = unknown> {
+    /** The provider key this token stands for — the `keyof M` `provide` checks. */
+    readonly name: N;
+    /** Phantom — see the note on `depValue`. Never present at runtime. */
+    readonly [depValue]?: (probe: never) => T;
+}
+/** The value type a {@link DepToken} carries. */
+type DepValue<Token> = Token extends DepToken<string, infer T> ? T : never;
+/**
+ * The `acquire` parameter a tuple of {@link DepToken}s describes: one property
+ * per token, named by the token and typed with what it carries. This is the
+ * derivation that removes the second spelling — `D` is no longer annotated, it
+ * falls out of `deps`.
+ */
+type DepsOf<Tokens extends readonly DepToken<string, unknown>[]> = {
+    [N in Tokens[number]["name"]]: DepValue<Extract<Tokens[number], {
+        name: N;
+    }>>;
+};
+/**
+ * Mint a typed dependency token: `dep<Config>()("config")`.
+ *
+ * CURRIED because TypeScript infers type arguments all-or-nothing — naming `T`
+ * in a single call would force `N` to be spelled too, and a spelled `N` is the
+ * widening this token exists to prevent. Effect's `Context.Tag("name")<Self,
+ * Shape>()` curries for the same reason; this one takes the type first so the
+ * name stays inferred from the literal.
+ *
+ * ```ts
+ * const Config = dep<{ url: string }>()("config");
+ * const Db = dep<Connection>()("db");
+ * const cache = layer([Config, Db], ({ config, db }) => …);
+ * ```
+ */
+declare function dep<T>(): <const N extends string>(name: N) => DepToken<N, T>;
+/**
+ * Declare a provider with no dependencies: an `acquire` and an optional
+ * `release`.
+ */
+declare function layer<T>(acquire: () => T | Promise<T>, release?: (value: T) => unknown): LeafProvider<T>;
+/**
+ * Declare a provider that depends on siblings, naming each one with a
+ * {@link DepToken} — the TYPED route, and the one to reach for.
+ *
+ * `D` is {@link DepsOf} the tuple, so `acquire` takes NO annotation: its
+ * parameter is already a record of exactly the tokens' names at exactly the
+ * tokens' types. Both halves of a dependency mistake then land at THIS call —
+ * destructuring a property the tuple does not name does not compile, and
+ * reading one at the wrong type does not either — instead of surfacing inside
+ * `provide`'s `M` constraint as a message about the map.
+ *
+ * ```ts
+ * const Config = dep<Config>()("config");
+ * const db = layer([Config], ({ config }) => connect(config.url), (c) => c.end());
+ * ```
+ *
+ * This is Effect's `Context.Tag`, and ZIO's `ZIO.service[T]`: the requirement
+ * set is derived from what the constructor reads rather than restated beside it.
+ */
+declare function layer<T, const Tokens extends readonly DepToken<string, unknown>[]>(deps: Tokens, acquire: (deps: DepsOf<Tokens>) => T | Promise<T>, release?: (value: T) => unknown): Provider<T, DepsOf<Tokens>, Tokens[number]["name"]>;
+/**
+ * Declare a provider that depends on siblings, naming each one with a STRING —
+ * the untyped escape hatch. `deps` names them; `acquire` receives their resolved
+ * values as a record, and the annotation you give that parameter is what types
+ * `D`.
+ *
+ * Nothing ties the two spellings together: `layer(["config"], ({ config }: {
+ * cfg: C }) => …)` type-checks here and fails later, inside `provide`'s `M`
+ * constraint, in the map's vocabulary rather than the typo's. Prefer the token
+ * overload above, which derives the annotation instead of restating it; reach
+ * for this one where there is no token to hand.
+ *
+ * The names are inferred as literals, not widened to `string`, so {@link provide}
+ * can check them against the map's keys. `const K` is what pins that: without
+ * the modifier TypeScript 7 widens `["config"]` to `string[]` here where 5.x
+ * kept the literal, and every provider in the map then fails `provide`'s
+ * key constraint with "`string` is not assignable to `"config" | …`".
+ */
+declare function layer<T, D, const K extends string>(deps: readonly K[], acquire: (deps: D) => T | Promise<T>, release?: (value: T) => unknown): Provider<T, D, K>;
+/**
+ * Lift an already-built value into the graph — a provider with no `acquire` work
+ * and no lifetime. The escape hatch for the config object, the clock, the
+ * `fetch` you were handed: things a `ctx` carries that were never resources.
+ */
+declare function value<T>(v: T): LeafProvider<T>;
+/**
+ * Build an unopened provider graph from a map of providers.
+ *
+ * The map's own key set is the resulting `ctx`'s shape, and each provider is
+ * checked against that shape on BOTH of its ends — so both halves of a wiring
+ * mistake are a compile error here, not a surprise at 3 a.m.:
+ *
+ * - the `acquire` parameter, so a provider that reads `{ config: Config }`
+ *   beside a `config` provider of some other type does not compile;
+ * - the `deps` names, bound to `keyof M`, so `layer(["confg"], …)` does not
+ *   compile either.
+ *
+ * Nothing is acquired until the graph is opened — by `run`, at boot, or by
+ * {@link Provided.open}.
+ */
+declare function provide<M extends {
+    [K in keyof M]: Provider<unknown, ProvidedCtx<M>, Extract<keyof M, string>>;
+}>(map: M): Provided<ProvidedCtx<M>>;
+/** Is this `ctx` argument an unopened provider graph rather than a plain `ctx`? */
+declare function isProvided<Ctx>(candidate: Ctx | Provided<Ctx> | undefined): candidate is Provided<Ctx>;
+
+/**
+ * @demlik/tea runtime interface surface + pure helpers — the public types,
+ * interfaces, and construction/composition helpers the runtime (`./run`)
+ * implements against: `Store`, the error-sink and supervision contracts, the
+ * `RuntimeRef` / `BootingRuntime` / `Runtime` handle hierarchy, `definePort`, the
+ * identity-typed constructors `defineMachine` / `asReducer`, and the pure tools
+ * `replay` (compose without running) and `tryInterpret` (Railway).
+ */
+
+declare const ReducerBrand: unique symbol;
+type Branded<T> = T & {
+    readonly [ReducerBrand]: true;
+};
+/**
+ * Compile-time exhaustiveness assertion for default branches of switches over
+ * discriminated unions narrowed by hand (Sub handlers, message-bridge
+ * dispatchers, port fanouts) — TS narrows the operand to `never` only if every
+ * variant is covered, so adding one produces a compile error at the `absurd(x)`
+ * site. Strengthens invariant 7 (identity is explicit).
+ *
+ * @example
+ *   switch (msg.type) {
+ *     case "a": return ...;
+ *     case "b": return ...;
+ *     default: return absurd(msg);  // compile error if a "c" is added
+ *   }
+ */
+declare function absurd(x: never): never;
+declare const noop: <S, M, C extends Cmd>(state: S, _msg: M) => readonly [S, readonly C[]];
+/**
+ * Thrown by `definePort` when a name has already been registered in the current
+ * process. Symmetric with `SubIdCollisionError` (thrown by `reconcileSubs`) —
+ * both mechanize invariant 7 (identity is explicit) at the runtime layer the
+ * type system cannot reach (string names compared at runtime).
+ */
+declare class PortNameCollisionError extends Error {
+    readonly name = "PortNameCollisionError";
+    readonly _tag: "PortNameCollisionError";
+    constructor(portName: string);
+}
+/**
+ * Thrown by `reconcileSubs` when, within ONE desired subscription set, two subs
+ * share an `id` but declare different `type`s — a silent bug class the type
+ * system cannot reach (ids are strings compared at runtime). The symmetric twin
+ * of `PortNameCollisionError`: both mechanize invariant 7 (identity is explicit)
+ * at the runtime layer. Same id across transitions is the no-churn case and does
+ * NOT throw; only a within-set type conflict does.
+ */
+declare class SubIdCollisionError extends Error {
+    readonly name = "SubIdCollisionError";
+    readonly _tag: "SubIdCollisionError";
+    constructor(id: string, declaredType: string, conflictingType: string);
+}
+/**
+ * Test-only escape hatch — clears the module-level port-name registry so the
+ * collision assert in `definePort` doesn't false-positive across vitest's
+ * non-isolated runs. Production code MUST NOT call this.
+ *
+ * @internal test-only
+ */
+declare function __resetPortRegistry(): void;
+/**
+ * Which otherwise-unattributable runtime path produced an error. Every fanout is
+ * throw-isolated so one bad consumer never strands its siblings, and the
+ * isolated throw routes to the `OnError` sink rather than a bare `console.error`.
+ *
+ * - `"follow-up"` — a follow-up Msg an interpret handler returned rejected when
+ *   re-dispatched (the original dispatcher already resolved, so no caller).
+ *   A rejection caused by `stop()`'s own teardown is NOT this phase — see
+ *   `"discard"`.
+ * - `"stop-save"` — the final `store.save(state)` inside `stop()` threw
+ *   (`stop()` resolves regardless, so without the sink this was silent loss).
+ * - `"reduce"` — the pure `update` (reducer) threw synchronously; the configured
+ *   `Supervision` strategy decides what happens next, but the throw is surfaced
+ *   here as data first.
+ * - `"listener"` — a `runtime.subscribe(...)` listener threw during fanout.
+ * - `"observer"` — a `runtime.observe(...)` observer threw during fanout.
+ * - `"event"` — the `events` projector or an `on(type, ...)` handler threw.
+ * - `"boot"` — an `onBoot` handler threw (boot fanout, or a late registration).
+ * - `"port-emit"` — a `subscribePort` listener threw during a port emission.
+ * - `"sub-cleanup"` — a subscription's cleanup threw (reconcile-removal or
+ *   `stop()` teardown).
+ * - `"discard"` — work lost to a teardown the host asked for. Two witnesses,
+ *   both carrying a `RuntimeDiscardNotice`: `stop()` was called while interpret
+ *   handlers were still awaiting (`RuntimeDiscardedError`), and a Msg that
+ *   arrived DURING `stop()`'s drain and so could not be delivered
+ *   (`DispatchDiscardedError`), and teardown work that did not settle inside
+ *   `disposeTimeoutMs` (`DisposeTimeoutNotice`). The one phase that is a
+ *   LIFECYCLE report rather than a failure: legal, merely lossy.
+ * - `"identity-drop"` — the `Identity` filter dropped a message addressed to a
+ *   different instance (`IdentityDropNotice`). Its own phase rather than
+ *   `"discard"`: the loss is the FILTER WORKING, not a teardown, and a host
+ *   routing it (a metric, a 409 back to the caller) wants it apart from
+ *   unmount-time noise. Warn-only, like every `RuntimeDiscardNotice`.
+ * - `"provide"` — a `provide({ … })` graph handed to `run` as `ctx`. Two
+ *   witnesses: an `acquire` failed at boot (a `ProvideFailedError`, ALSO the
+ *   rejection of `ready`, so this report is the copy a sink gets rather than the
+ *   only route out), and a `release` threw during `stop()`, which carries
+ *   `context.provider` and has no other route out at all — the run is over.
+ *
+ * The phase never decides fatality — the ERROR CLASS does (`RuntimeDiscardNotice`
+ * warns, everything else rethrows). A phase is attached by the report site, so a
+ * consumer sink that throws while handling a `"discard"` report inherits that
+ * phase; keying the warn-only path on it would make the sink's own defect vanish.
+ */
+type RuntimeErrorPhase = "follow-up" | "stop-save" | "reduce" | "listener" | "observer" | "event" | "boot" | "port-emit" | "sub-cleanup" | "discard" | "identity-drop" | "provide";
+/** Context handed to an `OnError` sink alongside the error itself. */
+interface RuntimeErrorContext {
+    readonly phase: RuntimeErrorPhase;
+    /**
+     * The provider key a `"provide"` report is about — set when a `release` threw
+     * (the run is over; the throw has nowhere else to go). Absent on the acquire
+     * report, which also rejects `ready` with a `ProvideFailedError` that names it.
+     */
+    readonly provider?: string;
+}
+/**
+ * Sink for runtime failures that have no caller to reject at. Configured via
+ * `run(machine, { onError })`. Should be total — a throw inside the sink is
+ * itself surfaced via the default sink, so it can never re-introduce a silent
+ * failure.
+ */
+type OnError = (error: unknown, context: RuntimeErrorContext) => void;
+/** The three declared reducer-throw supervision strategies. */
+type SupervisionStrategy = "stop" | "escalate" | "restart";
+/**
+ * Declared supervision policy for a reducer (`update`) throw, at
+ * `run(machine, { supervision })`. The bare-string shorthands (`"stop"` /
+ * `"escalate"`) are accepted for the two strategies that need no host data;
+ * `restart` MUST be the object form because it carries the `rehydrate` callback,
+ * which MUST return a valid `S` synchronously (the reducer is synchronous, so
+ * recovery is too — no suspension across the single-writer slot).
+ */
+type Supervision<S, M extends {
+    type: string;
+}> = "stop" | "escalate" | {
+    readonly strategy: "stop";
+} | {
+    readonly strategy: "escalate";
+} | {
+    readonly strategy: "restart";
+    /**
+     * Host-provided rehydration to last-known-good state. Invoked when the
+     * reducer throws; its return value becomes the new state and the transition
+     * continues from there. Receives the pre-throw `state`, the `msg` that
+     * triggered the throw, and the thrown `error` so the host can route by
+     * cause.
+     */
+    readonly rehydrate: (state: S, msg: M, error: unknown) => S;
+};
+/**
+ * Raised by `idle()` when the quiescence wait hits its iteration cap without the
+ * dispatch tail stabilizing — `idle()` REJECTS rather than silently resolving,
+ * so a livelocking machine surfaces instead of masquerading as quiescent.
+ * Mechanizes invariant 6 at the runtime layer, the role `PortNameCollisionError`
+ * plays for invariant 7.
+ */
+declare class QuiescenceTimeoutError extends Error {
+    readonly iterations: number;
+    readonly name = "QuiescenceTimeoutError";
+    readonly _tag: "QuiescenceTimeoutError";
+    constructor(iterations: number);
+}
+/**
+ * Raised by `driveToDone` when the drive ends on a State its `failed` predicate
+ * marks as a failure. Carries that final State so the caller reads the failure
+ * off the Model the machine owns — never off a message string. A rejection, not
+ * a resolve, so a failed run cannot be mistaken for a finished one at the
+ * caller boundary (invariant 6).
+ */
+declare class DriveFailedError<S> extends Error {
+    readonly state: S;
+    readonly name = "DriveFailedError";
+    readonly _tag: "DriveFailedError";
+    constructor(state: S);
+}
+/**
+ * Raised by `driveToDone` when `start`'s follow-up chain quiesces on a State
+ * that is neither terminal nor `failed` AND nothing in the runtime can still
+ * transition it — no live Sub (manual or dep-keyed), no in-flight Cmd. Waiting
+ * past that point is not the Sub-driven contract, it is a leak: no transition is
+ * coming, so the drive would hang with the runtime alive and `stop()` never
+ * reached. The rejection carries the stalled State on `error.state`, sibling to
+ * `DriveFailedError`, so the caller reads where the machine parked off the
+ * Model rather than off a message string (invariant 6).
+ *
+ * A machine that CAN still move — a Sub that will deliver the terminal Msg after
+ * the dispatch quiesces — is not stalled and the drive keeps waiting; this names
+ * only the case where the runtime itself can prove nothing is coming.
+ */
+declare class DriveStalledError<S> extends Error {
+    readonly state: S;
+    readonly name = "DriveStalledError";
+    readonly _tag: "DriveStalledError";
+    constructor(state: S);
+}
+/**
+ * Base of the LOSSY-BUT-LEGAL teardown facts: work the host discarded by letting
+ * go of a runtime that still had something outstanding. Reported under
+ * `phase: "discard"`, never raised.
+ *
+ * It exists so "is this fatal?" has ONE definition — `error instanceof
+ * RuntimeDiscardNotice` — that the default sink can ask about any error from any
+ * site. The phase cannot answer it: a report site attaches the phase, so a
+ * consumer sink that throws while handling a `"discard"` report carries that
+ * phase into the sink-failure path, and a phase-keyed warn branch would swallow
+ * the sink's own defect. Sub-classing is how a new teardown fact opts into the
+ * warn-only treatment; nothing else can.
+ */
+declare abstract class RuntimeDiscardNotice extends Error {
+}
+/**
+ * Reported to the `OnError` sink under `phase: "discard"` when `stop()` is
+ * called while `interpret` handlers are still awaiting. The host is dropping
+ * its only handle on that work: `stop()` drains the tail, but the listeners,
+ * observers and event handlers that would have consumed the resulting
+ * transitions are gone, so the Cmds' results reach nobody.
+ *
+ * The motivating shape is `@demlik/tea/react`'s `useMachine`, which memoizes on
+ * `[machine, ctx, store]` — a ctx re-derived mid-flight replaces the runtime,
+ * and the in-flight mutation's response arrives for a runtime the UI no longer
+ * renders, silently rewinding the visible state. Never a throw: tearing a
+ * runtime down mid-flight is legal (a navigation does it every time), so this
+ * is surfaced as data, not raised. Mechanizes invariant 6 (no silent failures)
+ * at the teardown seam, the role `QuiescenceTimeoutError` plays for `idle()`.
+ */
+declare class RuntimeDiscardedError extends RuntimeDiscardNotice {
+    readonly pendingCmds: number;
+    readonly name = "RuntimeDiscardedError";
+    readonly _tag: "RuntimeDiscardedError";
+    constructor(pendingCmds: number);
+}
+/**
+ * Reported to the `OnError` sink under `phase: "identity-drop"` when the
+ * `Identity` filter drops a message addressed to a different instance.
+ *
+ * The drop itself is the feature — it is what lets a reducer stop repeating
+ * `if (msg.runId !== state.runId) return`. What was missing is that it was
+ * INVISIBLE: the dispatch resolved exactly like an applied one, so a reusable
+ * Durable Object serving run A and then run B lost every run-B message and
+ * reported success to each caller. The comment claiming "the one observable
+ * enforcement point" described this notice before it existed.
+ *
+ * Never fatal (`RuntimeDiscardNotice`): a mis-addressed message is a normal
+ * consequence of instance reuse, not a defect. A host that wants to act on it
+ * — a metric, a 409 to the caller, a re-route — reads `phase: "identity-drop"`
+ * in its own sink.
+ */
+declare class IdentityDropNotice extends RuntimeDiscardNotice {
+    readonly msgType: string;
+    readonly name = "IdentityDropNotice";
+    readonly _tag: "IdentityDropNotice";
+    constructor(msgType: string);
+}
+/**
+ * Reported to the `OnError` sink under `phase: "discard"` when `stop()`'s wait
+ * for async teardown work hits `disposeTimeoutMs`.
+ *
+ * `stop()` awaits the disposals it started so `await runtime.stop()` can mean
+ * "safe to evict". A `release` that never settles must not turn that guarantee
+ * into a host that never shuts down, so the wait is bounded and expiry is
+ * REPORTED rather than silently tolerated — the resource is genuinely still
+ * open at that point, and only the host can decide what that costs.
+ */
+declare class DisposeTimeoutNotice extends RuntimeDiscardNotice {
+    readonly pendingDisposals: number;
+    readonly timeoutMs: number;
+    readonly name = "DisposeTimeoutNotice";
+    readonly _tag: "DisposeTimeoutNotice";
+    constructor(pendingDisposals: number, timeoutMs: number);
+}
+/**
+ * The rejection of a dispatch that arrived DURING `stop()`'s drain — an in-flight
+ * interpret handler's follow-up Msg, a detached handler's terminal Msg, or a Sub
+ * that is still live because subs are torn down only after the drain. The stop
+ * barrier is absolute (the Msg is refused, never folded), so this names the loss.
+ *
+ * It is the SECOND witness of `RuntimeDiscardedError`'s fact, and it is why the
+ * drain window is a distinct runtime state rather than a plain `stopped` flag:
+ * a Msg refused inside the window was discarded BY the teardown, while the same
+ * refusal after `stop()` has returned is a consumer dispatching into a runtime it
+ * already retired — a real error, and still loud (`phase: "follow-up"`, or the
+ * caller's own rejection). The distinction is the state at refusal time, never
+ * the message text.
+ */
+declare class DispatchDiscardedError extends RuntimeDiscardNotice {
+    readonly msgType: string;
+    readonly name = "DispatchDiscardedError";
+    readonly _tag: "DispatchDiscardedError";
+    constructor(msgType: string);
+}
+/**
+ * Define a typed port. `name` is metadata (devtools / debug logs); port identity
+ * is by reference. Each definePort call must use a unique `name` — a second call
+ * with the same name throws `PortNameCollisionError`. Use ports for "data leaving
+ * the runtime selectively" (cursor announcements, DOM-mutation broadcasts,
+ * telemetry) that should NOT be folded into State. Strengthens invariant 7.
+ */
+declare function definePort<T>(name: string): Port<T>;
+interface Store<S> {
+    load(): Promise<unknown>;
+    save(state: S): Promise<void>;
+    migrate(raw: unknown): S | null;
+}
+interface FencedRead {
+    /** Raw bytes at the key, the `Store.load` contract unchanged. */
+    readonly raw: unknown;
+    /** The version those bytes were written at. A never-written key reads `0`. */
+    readonly version: number;
+}
+/**
+ * A `Store<S>` that can refuse a second live writer.
+ *
+ * `run` fences automatically when it is handed one of these: it reads the
+ * version at boot and compare-and-swaps on every save, so a second process that
+ * started from the same version is refused at its first write with a
+ * {@link StoreConflictError}. Hand `run` a plain `Store<S>` and it stays exactly
+ * as it was — the last writer wins, and single-writer is your precondition to
+ * keep (see `docs/explanation/durability-model.md`).
+ *
+ * Fencing is opt-in at 0.x: every shipped factory that can fence takes an
+ * explicit `{ fenced: true }` and returns this type; the unfenced call is
+ * byte-for-byte the old behaviour.
+ */
+interface FencedStore<S> extends Store<S> {
+    /** Discriminant — the one thing {@link isFencedStore} reads. */
+    readonly fenced: true;
+    /** `load`, plus the version those bytes carry. */
+    loadFenced(): Promise<FencedRead>;
+    /**
+     * Compare-and-swap save. Writes `state` only if the stored version is still
+     * `expectedVersion`, and resolves with the NEW version to swap on next time.
+     * Throws {@link StoreConflictError} when it is not.
+     */
+    saveFenced(state: S, expectedVersion: number): Promise<number>;
+}
+/** Narrow a `Store<S>` to a {@link FencedStore} — what `run` uses to decide. */
+declare function isFencedStore<S>(store: Store<S>): store is FencedStore<S>;
+/**
+ * Thrown when a fenced save finds a version other than the one it expected —
+ * another live writer has this run.
+ *
+ * A throw, not a settled failure Msg (ADR 0017, following ADR 0011): a second
+ * claimant is a contract breach of the single-writer promise, not a state this
+ * run can fold and continue from. There is no correct way for the loser to
+ * carry on, so it stops where it stands.
+ */
+declare class StoreConflictError extends Error {
+    readonly expectedVersion: number;
+    readonly actualVersion: number;
+    readonly name = "StoreConflictError";
+    readonly _tag: "store_conflict";
+    constructor(expectedVersion: number, actualVersion: number);
+}
+interface Schema<S> {
+    safeParse(raw: unknown): {
+        success: true;
+        data: S;
+    } | {
+        success: false;
+    };
+}
+/**
+ * Build a `Store.migrate` from a schema (job 1) and an optional thin `upcast`
+ * (job 2). `upcast` maps a recognized-but-OLD raw shape forward into the shape
+ * the schema validates; it defaults to identity (no version migration yet).
+ *
+ * Never throws — a shape the schema rejects returns `null`, the substrate's
+ * fresh-boot path, per the `Store.migrate` contract. An `upcast` that itself
+ * throws on a corrupt blob is caught and collapses to `null` (same posture).
+ */
+declare function schemaMigrate<S>(schema: Schema<S>, upcast?: (raw: unknown) => unknown): (raw: unknown) => S | null;
+type DispatchSettle = "quiescent" | "once";
+interface RuntimeRef<M extends {
+    type: string;
+}> {
+    /**
+     * Put a Msg in the runtime's inbox and resolve once processed. Runs to
+     * QUIESCENCE by default: settles only after the dispatched Msg AND every
+     * transitive interpret follow-up has drained. Pass `{ settle: "once" }` (or
+     * call `dispatchOnce`) for the single-step case.
+     *
+     * Rejection ordering: the ONE dispatched transition's own failure surfaces
+     * first, here. If it succeeds but the follow-up chain never stabilizes, the
+     * quiescent drain rejects with `QuiescenceTimeoutError`. Follow-up Msg
+     * rejections themselves route to the `onError` sink, never here.
+     */
+    dispatch(msg: M, opts?: {
+        readonly settle?: DispatchSettle;
+    }): Promise<void>;
+    /**
+     * Dispatch `msg` and resolve after exactly ONE transition's effects settle,
+     * WITHOUT draining the follow-up chain — equivalent to
+     * `dispatch(msg, { settle: "once" })`. Prefer plain `dispatch` unless you will
+     * `await runtime.idle()` yourself; the un-awaited follow-up chain is the
+     * footgun the quiescent default removed.
+     */
+    dispatchOnce(msg: M): Promise<void>;
+}
+interface BootingRuntime<S, M extends {
+    type: string;
+}, E extends {
+    type: string;
+} = never> extends RuntimeRef<M> {
+    dispatch(msg: M, opts?: {
+        readonly settle?: DispatchSettle;
+    }): Promise<void>;
+    dispatchOnce(msg: M): Promise<void>;
+    /**
+     * Register a zero-arg change notifier, fired for every applied transition
+     * with the fold's State already committed — `getState()` inside the listener
+     * reads it, not the State before. A `dispatch` issued from the listener is
+     * SCHEDULED onto the serial tail behind the fold that fired it, never folded
+     * re-entrantly and never discarded, so it needs no `setTimeout(fn, 0)`
+     * deferral; two listeners issuing in order fold in that order.
+     */
+    subscribe(listener: () => void): () => void;
+    /**
+     * Register a `(msg, state)` trace hook, fired for every applied transition
+     * with the fold's committed State. A `dispatch` issued from the observer is
+     * SCHEDULED onto the serial tail behind the fold that fired it, never folded
+     * re-entrantly and never discarded, so it needs no `setTimeout(fn, 0)`
+     * deferral; two listeners issuing in order fold in that order.
+     */
+    observe(observer: (msg: M, state: S) => void): () => void;
+    /**
+     * Subscribe to the INITIAL State — the boot transition. Fires exactly once:
+     * immediately if boot already completed (so a late subscriber never misses
+     * it), otherwise on the boot fanout. Returns a cleanup (a no-op once fired).
+     */
+    onBoot(handler: (state: S) => void): () => void;
+    /**
+     * Subscribe to a SEMANTIC event of `type`. The handler receives exactly the
+     * `E` member whose `type` matches `K`, so a consumer never touches another
+     * event's shape and never references the machine's PRIVATE Msg names. Multiple
+     * handlers per type; fanout is synchronous and throw-isolated. Fires only when
+     * the machine's `events` projector (wired on `run`) emits that type.
+     */
+    on<K extends E["type"]>(type: K, handler: (event: Extract<E, {
+        type: K;
+    }>) => void): () => void;
+    /**
+     * Subscribe to a typed Port. Multiple listeners per port; fanout is synchronous
+     * and isolated. Ports are for "data leaving the runtime selectively" (see
+     * `definePort`) — distinct from `observe` (every transition) and State.
+     */
+    subscribePort<T>(port: Port<T>, listener: (value: T) => void): () => void;
+    /**
+     * Emit a value on a Port from OUTSIDE an interpret handler — same synchronous
+     * fanout as `ctx.emit`. The canonical use is `observe`-driven emission (one
+     * runtime publishing a state-derived signal another subscribes to via
+     * `subscribePort`) without spawning a "tell the outside world" Cmd per
+     * transition.
+     */
+    emitPort<T>(port: Port<T>, value: T): void;
+    /**
+     * Resolves to the booted `Runtime<S, M>` after boot completes (or rejects with
+     * the boot error). This is the ONLY way to obtain a `Runtime` — and a
+     * `Runtime` is the only handle whose `getState()` is total. Awaiting `ready` is
+     * the single gate between "boot in flight" and "State exists":
+     *
+     * ```ts
+     * const runtime = await run(machine, opts).ready;
+     * runtime.getState(); // total — never throws-before-boot
+     * ```
+     *
+     * Idempotent — the same settled promise, resolving to the same `Runtime`, comes
+     * back on every read. Expresses canon §2.3 (boot is a named, awaitable moment).
+     */
+    ready: Promise<Runtime<S, M, E>>;
+    stop(): Promise<void>;
+}
+interface Runtime<S, M extends {
+    type: string;
+}, E extends {
+    type: string;
+} = never> extends BootingRuntime<S, M, E> {
+    /**
+     * The current State. TOTAL — never throws. Obtaining a `Runtime` requires
+     * awaiting `ready`, which only resolves AFTER boot has run `init` and set the
+     * initial State.
+     */
+    getState(): S;
+    /** Resolves to this same `Runtime` once boot completes. Idempotent. */
+    ready: Promise<Runtime<S, M, E>>;
+    /**
+     * Resolves once the runtime has reached QUIESCENCE — every dispatched Msg AND
+     * every transitive interpret follow-up has been processed, with no further step
+     * pending on the tail. Since plain `dispatch` already runs to quiescence, this
+     * is mainly for follow-ups left by a `dispatchOnce` single step, or a chain
+     * kicked off by a Sub / boot `init` cmds with no `dispatch` to await.
+     *
+     * Idempotent and re-entrant-safe. Tail rejections are NOT surfaced here (a
+     * failing dispatch surfaces on its OWN promise; follow-up rejections route to
+     * `onError`). The one rejection `idle()` produces is `QuiescenceTimeoutError`
+     * on hitting the iteration cap — so a livelock stays distinguishable from a
+     * genuine quiesce (invariant 6). A poll is still correct when waiting on an
+     * EXTERNAL event the runtime cannot enqueue itself.
+     */
+    idle(): Promise<void>;
+    /**
+     * The terminal State of the run, or `undefined` while in flight — "terminal"
+     * per the `terminal` predicate passed to `run()` (no predicate → never
+     * terminal → always `undefined`). The first-class result read: the run's
+     * product off the State the machine already owns, NOT scraped off the `observe`
+     * firehose by matching an internal Msg name. Total — never throws.
+     */
+    result(): S | undefined;
+    /**
+     * Resolves with the terminal State the first time the run reaches one (per the
+     * `terminal` predicate). If ALREADY terminal, resolves immediately; otherwise
+     * on the transition that first makes `terminal` hold. The awaitable companion
+     * to `result()`. With no predicate this never resolves. Idempotent and
+     * multi-caller safe.
+     */
+    done(): Promise<S>;
+}
+/**
+ * The `types` option: the slots of a machine's shape that no value in the
+ * object can imply, declared once as phantom values (`{} as Model`).
+ *
+ * `model` and `msg` are always named. `cmd` is named only by a machine whose
+ * Cmds are hand-written records rather than `Cmd.define` constructors listed
+ * under `cmds`; `sub` only by one whose Sub union `subscriptions` does not
+ * imply; `ctx` only by one whose handlers read a `Ctx` slice no Cmd's
+ * `requirements` declares.
+ */
+type MachineTypes<S, M extends {
+    type: string;
+}, C extends Cmd, U extends Sub, Ctx> = {
+    readonly model: S;
+    readonly msg: M;
+    readonly cmd?: C;
+    readonly sub?: U;
+    readonly ctx?: Ctx;
+};
+declare function defineMachine<S, M extends {
+    type: string;
+}, D extends AnyCmdDef, U extends Sub = Sub<never>, Ctx = unknown>(m: NoInfer<Omit<Machine<S, M | Settled<D>, CmdOf<D>, U, Ctx>, "cmds">> & {
+    readonly types: MachineTypes<S, M, Cmd<never>, U, Ctx>;
+    readonly cmds: readonly D[];
+}): Machine<S, M | Settled<D>, CmdOf<D>, U, Ctx>;
+declare function defineMachine<S, M extends {
+    type: string;
+}, C extends Cmd = Cmd<never>, U extends Sub = Sub<never>, Ctx = unknown>(m: NoInfer<Machine<S, M, C, U, Ctx>> & {
+    readonly types: MachineTypes<S, M, C, U, Ctx>;
+}): Machine<S, M, C, U, Ctx>;
+declare function defineMachine<S, M extends {
+    type: string;
+}, D extends AnyCmdDef, U extends Sub, Ctx>(m: Omit<Machine<S, M | Settled<D>, CmdOf<D>, U, Ctx>, "update" | "cmds"> & {
+    readonly cmds: readonly D[];
+    update: [S] extends [{
+        type: string;
+    }] ? Transitions<S, M | Settled<D>, CmdOf<D>> : never;
+}): Machine<S, M | Settled<D>, CmdOf<D>, U, Ctx>;
+declare function defineMachine<S, M extends {
+    type: string;
+}, D extends AnyCmdDef, U extends Sub, Ctx>(m: Omit<Machine<S, M | Settled<D>, CmdOf<D>, U, Ctx>, "update" | "cmds"> & {
+    readonly cmds: readonly D[];
+    update: Reducer<S, M | Settled<D>, CmdOf<D>>;
+}): Machine<S, M | Settled<D>, CmdOf<D>, U, Ctx>;
+declare function defineMachine<S, M extends {
+    type: string;
+}, C extends Cmd, U extends Sub, Ctx>(m: Omit<Machine<S, M, C, U, Ctx>, "update"> & {
+    update: [S] extends [{
+        type: string;
+    }] ? Transitions<S, M, C> : never;
+}): Machine<S, M, C, U, Ctx>;
+declare function defineMachine<S, M extends {
+    type: string;
+}, C extends Cmd, U extends Sub, Ctx>(m: Omit<Machine<S, M, C, U, Ctx>, "update"> & {
+    update: Reducer<S, M, C>;
+}): Machine<S, M, C, U, Ctx>;
+declare function asReducer<S, M extends {
+    type: string;
+}, C extends Cmd>(reducer: Reducer<S, M, C>): Branded<Reducer<S, M, C>>;
+type CtxArg<Ctx> = [Record<never, never>] extends [Ctx] ? {
+    ctx?: Ctx;
+} : {
+    ctx: Ctx;
+};
+/**
+ * `run`'s `ctx` field: the `Ctx` object, or a `provide` graph that builds one.
+ * Conditionally optional exactly like {@link CtxArg} — a machine that reads
+ * nothing from `ctx` may omit it.
+ */
+type ScopedCtxArg<Ctx> = [Record<never, never>] extends [Ctx] ? {
+    ctx?: Ctx | Provided<Ctx>;
+} : {
+    ctx: Ctx | Provided<Ctx>;
+};
+declare function replay<S, M extends {
+    type: string;
+}, C extends Cmd, U extends Sub, Ctx>(machine: Machine<S, M, C, U, Ctx>, opts: {
+    msgs: readonly M[];
+    ctx: Ctx;
+    loaded?: S | null;
+}): {
+    state: S;
+    cmds: C[];
+    subs: U[];
+    depSubs: {
+        index: number;
+        id: string;
+    }[];
+};
+declare function wrapDetached<C extends Cmd, M extends {
+    type: string;
+}, Allowed extends M, Ctx>(handler: InterpretDetached<C, Allowed, Ctx>): (cmd: C, ctx: Ctx & PortEmitter, dispatch?: (msg: M) => void) => Promise<void>;
+/**
+ * `applyCell`, with "no handler for this Msg" moved into the return type
+ * instead of a throw.
+ *
+ * `Ok` carries the handler's `[nextState, cmds]` verbatim; `Err` carries the same
+ * `NoCellError` (msg.type + state name + accepted set) `applyCell` would have
+ * thrown — both read one `lookupCell`, so neither can under-report. Dispatch
+ * inside `run` keeps using the throwing `applyCell` — this is for callers that
+ * step a machine themselves.
+ */
+declare function tryApplyCell<S, M extends {
+    type: string;
+}, C extends Cmd>(machine: {
+    update: object;
+    __form?: UpdateForm;
+}, state: S, msg: M): Result<readonly [S, readonly C[]], NoCellError>;
+/**
+ * The refusal `tryFoldMsgs` reports: WHICH msg in the log had no handler, where.
+ *
+ * A plain record, not a new `Error` subclass — it is a `Result` payload, never
+ * thrown, and the actual error is the existing `NoCellError` it carries. The
+ * package's thrown-error idiom (`class extends Error` + `_tag`, pinned by
+ * `error-idiom.test.ts`) applies to errors raised at the runtime edge; this one
+ * is never raised, so adding a class would state a promise it does not make.
+ */
+interface FoldRefusal<M> {
+    /** Index into the `msgs` array the fold was given. */
+    readonly index: number;
+    /** The offending Msg itself — so the caller can print it, not just point. */
+    readonly msg: M;
+    /** The underlying cell-lookup failure: msg.type + state name + accepted set. */
+    readonly error: NoCellError;
+}
+/**
+ * `foldMsgs`, with the "no handler for this Msg" case in the return type,
+ * INCLUDING which message failed.
+ *
+ * The motivating use is "this persisted log does not replay — tell the user
+ * where". A bare `Result<S, NoCellError>` cannot: the error names the msg.type
+ * and the state, but a log usually contains that type many times, so the
+ * INDEX is the load-bearing fact. The fold stops at the first refusal (state
+ * past that point is not defined) and returns it.
+ *
+ * Shares `foldMsgs`' dev-mode discipline: `deepFreeze` the input state,
+ * `assertPureResult` the handler's return. Both compile out of production.
+ */
+declare function tryFoldMsgs<S, M extends {
+    type: string;
+}, C extends Cmd>(machine: {
+    update: object;
+    __form?: UpdateForm;
+}, base: S, msgs: readonly M[]): Result<S, FoldRefusal<M>>;
+declare function settle<D extends AnyCmdDef, Ctx>(def: D, work: (cmd: CmdOf<D>, ctx: Ctx & RequirementsOf<CmdOf<D>> & PortEmitter) => Promise<Result<OkOf<D>, ErrOf<D>>>): (cmd: CmdOf<D>, ctx: Ctx & RequirementsOf<CmdOf<D>> & PortEmitter) => Promise<Settled<D>>;
+declare function tryInterpret<C extends Cmd, Ok, M, Ctx>(work: (cmd: C, ctx: Ctx) => Promise<Ok>, onOk: (value: Ok, cmd: C) => M, onErr: (error: unknown, cmd: C) => M): (cmd: C, ctx: Ctx) => Promise<M>;
+
+export { tryApplyCell as $, type SupervisionStrategy as A, type BootingRuntime as B, type CtxArg as C, type DepToken as D, absurd as E, type FencedStore as F, asReducer as G, defineMachine as H, IdentityDropNotice as I, definePort as J, dep as K, isFencedStore as L, type MachineTypes as M, isProvided as N, type OnError as O, PortNameCollisionError as P, QuiescenceTimeoutError as Q, type Runtime as R, type Store as S, layer as T, UnknownProviderError as U, noop as V, provide as W, replay as X, schemaMigrate as Y, settle as Z, __resetPortRegistry as _, type ScopedCtxArg as a, tryFoldMsgs as a0, tryInterpret as a1, value as a2, wrapDetached as a3, type Supervision as b, type Branded as c, type DepsOf as d, DispatchDiscardedError as e, type DispatchSettle as f, DisposeTimeoutNotice as g, DriveFailedError as h, DriveStalledError as i, type FencedRead as j, type FoldRefusal as k, type OnReleaseError as l, ProvideFailedError as m, type Provided as n, type ProvidedCtx as o, type Provider as p, ProviderCycleError as q, RuntimeDiscardNotice as r, RuntimeDiscardedError as s, type RuntimeErrorContext as t, type RuntimeErrorPhase as u, type RuntimeRef as v, type Schema as w, type Scope as x, StoreConflictError as y, SubIdCollisionError as z };