@demlik/tea 0.2.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@demlik/tea",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "TEA-faithful state machine substrate — one package, every host adapter. Core + subs + testing, plus React, Durable Object, Chrome extension, Node, in-memory, work-queue, devtools, and property-testing modules as subpaths.",
   "keywords": [
     "tea",
@@ -290,6 +290,7 @@
     "react": "19.0.0",
     "react-dom": "19.0.0",
     "tsup": "^8.3.5",
+    "typedoc": "0.28.20",
     "typescript": "5.7.3",
     "vitest": "~3.0.7",
     "ws": "8.18.1"
@@ -304,6 +305,8 @@
     "demo:saga": "vitest run src/workflow/demo.test.ts",
     "typecheck": "tsc --noEmit",
     "typecheck:examples": "tsc -p examples/tsconfig.json",
+    "docs:reference": "TEA_DOCS_WRITE=1 vitest run src/docs/reference/generate-reference.test.ts",
+    "docs:reference:check": "pnpm run docs:reference && git diff --exit-code -- docs/reference",
     "verify-exports": "node scripts/verify-exports.mjs"
   }
 }

package/dist/chunk-2YOE5PIS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rate-limit/index.ts"],"names":[],"mappings":";AAsDO,SAAS,UAAA,CACd,QAAA,EACA,YAAA,EACA,KAAA,EACa;AACb,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,QAAA;AAAA,IACR,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA,EAAc;AAAA,GAChB;AACF;AAcO,SAAS,MAAA,CAAO,QAAqB,KAAA,EAA4B;AACtE,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA,CAAI,GAAG,KAAA,GAAQ,MAAA,CAAO,YAAY,CAAA,GAAI,GAAA;AAC9D,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,GAAS,UAAA,GAAa,MAAA,CAAO,YAAA;AACxD,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,UAAU,WAAW,CAAA;AAAA,IAC7C,YAAA,EAAc;AAAA,GAChB;AACF;AAeO,SAAS,UAAA,CACd,MAAA,EACA,KAAA,EACA,CAAA,GAAI,CAAA,EAC6B;AACjC,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,KAAK,CAAA;AACrC,EAAA,IAAI,QAAA,CAAS,UAAU,CAAA,EAAG;AACxB,IAAA,OAAO,CAAC,EAAE,GAAG,QAAA,EAAU,QAAQ,QAAA,CAAS,MAAA,GAAS,CAAA,EAAE,EAAG,IAAI,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,CAAC,UAAU,KAAK,CAAA;AACzB;AAqBO,SAAS,UAAA,CAAW,UAAkB,KAAA,EAA8B;AACzE,EAAA,OAAO,EAAE,IAAA,EAAM,EAAC,EAAG,UAAU,KAAA,EAAM;AACrC;AAgBO,SAAS,MAAA,CACd,QACA,KAAA,EACmC;AACnC,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,CAAO,QAAA;AAC9B,EAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,IAAI,MAAM,CAAA;AACnD,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,KAAA,EAAO;AAChC,IAAA,OAAO,CAAC,EAAE,GAAG,MAAA,EAAQ,IAAA,EAAM,CAAC,GAAG,MAAA,EAAQ,KAAK,CAAA,EAAE,EAAG,IAAI,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,CAAC,EAAE,GAAG,QAAQ,IAAA,EAAM,MAAA,IAAU,KAAK,CAAA;AAC5C;AAQO,SAAS,SAAA,CAAU,QAAuB,KAAA,EAAuB;AACtE,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,CAAO,QAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,GAAI,MAAM,CAAA,CAAE,MAAA;AACnD,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,QAAQ,IAAI,CAAA;AACxC","file":"chunk-2YOE5PIS.js","sourcesContent":["/**\n * @demlik/tea/rate-limit — two rate limiters as pure state + ops.\n *\n * Same shape as `@demlik/tea/work-queue`'s `ops.ts`: a state type plus pure\n * transition functions. Host-agnostic by construction — no `Date.now()`, no\n * timers, no I/O. The caller injects the clock (`nowMs`) and wires the result\n * into its own reducer / interpret. This keeps the limiters inside TEA's\n * invariant 2 (transitions are pure: same inputs → same outputs, no `Date.now`)\n * so a consumer can fold them through `update` and exercise them with `replay`\n * / the pbt fold without a fake clock.\n *\n * Every op returns a NEW state value and never mutates its input (invariant 1 —\n * state is a value, not a place). The `tryConsume` / `record` ops return a\n * `[next, ok]` tuple so the caller branches on the decision while threading the\n * advanced state forward; `refill` / `remaining` are read-shaped helpers.\n *\n * Two complementary algorithms, picked by the cost the caller wants to pay:\n *\n *   - **Token bucket** — O(1) state (four numbers), smooths bursts against a\n *     steady refill rate. Allows a burst up to `capacity`, then throttles to\n *     `refillPerSec`. Cheapest; the default choice.\n *   - **Sliding window log** — O(limit) state (one timestamp per in-window\n *     hit), exact \"no more than `limit` events per `windowMs`\". Pay the memory\n *     for precise window edges when a token bucket's continuous refill would\n *     let through too many at a boundary.\n *\n * NOT exported from the package root — reached via the `@demlik/tea/rate-limit`\n * subpath, same one-shape-per-package rule as `work-queue` and `do`.\n */\n\n// ===========================================================================\n// Token bucket\n// ===========================================================================\n\n/**\n * A token bucket: `tokens` of `capacity` available now, replenished at\n * `refillPerSec` tokens per second. `lastRefillMs` is the clock reading at\n * which `tokens` was last computed — `refill` advances it. All four fields are\n * plain numbers so the whole bucket is trivially JSON-serializable into a\n * consumer's `Store<S>`.\n */\nexport interface TokenBucket {\n  readonly tokens: number;\n  readonly capacity: number;\n  readonly refillPerSec: number;\n  readonly lastRefillMs: number;\n}\n\n/**\n * Create a full bucket. Starts at `capacity` tokens (the conventional \"a fresh\n * limiter lets the first burst through\" behavior) and stamps `lastRefillMs`\n * with the caller's clock so the first `refill` measures elapsed time from\n * boot, not from epoch 0.\n */\nexport function initBucket(\n  capacity: number,\n  refillPerSec: number,\n  nowMs: number,\n): TokenBucket {\n  return {\n    tokens: capacity,\n    capacity,\n    refillPerSec,\n    lastRefillMs: nowMs,\n  };\n}\n\n/**\n * Add the tokens accrued since `lastRefillMs`, clamped to `capacity`, and\n * advance `lastRefillMs` to `nowMs`. PURE — returns a new bucket; the input is\n * untouched.\n *\n * A `nowMs` at or before `lastRefillMs` (clock not advanced, or skewed\n * backwards) adds a non-positive amount; `Math.max(0, …)` floors the elapsed\n * term so a backwards clock can never *remove* tokens. `lastRefillMs` still\n * advances to `nowMs` so the bucket tracks the latest reading the caller\n * presented — the next forward step measures from there, not from a stale\n * future timestamp.\n */\nexport function refill(bucket: TokenBucket, nowMs: number): TokenBucket {\n  const elapsedSec = Math.max(0, nowMs - bucket.lastRefillMs) / 1000;\n  const replenished = bucket.tokens + elapsedSec * bucket.refillPerSec;\n  return {\n    ...bucket,\n    tokens: Math.min(bucket.capacity, replenished),\n    lastRefillMs: nowMs,\n  };\n}\n\n/**\n * Refill against `nowMs`, then attempt to take `n` tokens (default 1).\n *\n * On success returns `[next, true]` with `n` subtracted; on failure returns\n * `[refilled, false]` — the refilled bucket (so the caller keeps the advanced\n * clock + accrued tokens) with no tokens spent. Branch on the boolean, thread\n * the bucket forward regardless:\n *\n *   const [b1, ok] = tryConsume(bucket, nowMs);\n *   return ok ? [{ ...state, bucket: b1 }, [doWork]] : [{ ...state, bucket: b1 }, []];\n *\n * PURE — input bucket is never mutated.\n */\nexport function tryConsume(\n  bucket: TokenBucket,\n  nowMs: number,\n  n = 1,\n): readonly [TokenBucket, boolean] {\n  const refilled = refill(bucket, nowMs);\n  if (refilled.tokens >= n) {\n    return [{ ...refilled, tokens: refilled.tokens - n }, true];\n  }\n  return [refilled, false];\n}\n\n// ===========================================================================\n// Sliding window log\n// ===========================================================================\n\n/**\n * A sliding-window log: the timestamps of every hit still inside the trailing\n * `windowMs`, capped at `limit` events per window. `hits` is `readonly` and\n * kept oldest-first (pruning slices the stale prefix off the front, recording\n * appends to the back), so the array is its own sorted index. Exact at the\n * window edge — unlike a token bucket's continuous refill, a hit leaves the\n * count the instant it ages past `windowMs`.\n */\nexport interface SlidingWindow {\n  readonly hits: readonly number[];\n  readonly windowMs: number;\n  readonly limit: number;\n}\n\n/** Create an empty window. No hits recorded yet. */\nexport function initWindow(windowMs: number, limit: number): SlidingWindow {\n  return { hits: [], windowMs, limit };\n}\n\n/**\n * Prune hits older than `nowMs - windowMs`, then record `nowMs` if there is\n * room. Returns `[next, true]` with the hit appended when `hits.length < limit`\n * after pruning, else `[pruned, false]` — the pruned window (capacity recovers\n * as old hits age out) with nothing appended.\n *\n * The cutoff is half-open: a hit exactly `windowMs` old is pruned (`<= cutoff`\n * drops it), so a hit recorded at `t` no longer counts at `t + windowMs`. That\n * makes the window's capacity fully recover `windowMs` after the last hit, the\n * behavior tests pin.\n *\n * PURE — input window is never mutated; `hits` is rebuilt by `filter` +\n * spread.\n */\nexport function record(\n  window: SlidingWindow,\n  nowMs: number,\n): readonly [SlidingWindow, boolean] {\n  const cutoff = nowMs - window.windowMs;\n  const pruned = window.hits.filter((t) => t > cutoff);\n  if (pruned.length < window.limit) {\n    return [{ ...window, hits: [...pruned, nowMs] }, true];\n  }\n  return [{ ...window, hits: pruned }, false];\n}\n\n/**\n * How many more hits `record` would accept at `nowMs` without blocking —\n * `limit` minus the live (post-prune) hit count, floored at 0. Read-only: it\n * prunes a local copy to answer but returns no new window. Use it to render a\n * \"N requests remaining\" affordance without committing a hit.\n */\nexport function remaining(window: SlidingWindow, nowMs: number): number {\n  const cutoff = nowMs - window.windowMs;\n  const live = window.hits.filter((t) => t > cutoff).length;\n  return Math.max(0, window.limit - live);\n}\n"]}

package/dist/chunk-3545BOYL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/do/durable-effects.ts"],"names":[],"mappings":";AA+GO,SAAS,WAAA,GAA0C;AACxD,EAAA,2BAAW,GAAA,EAAmB;AAChC;AAcO,SAAS,gBAAA,CACd,QACA,KAAA,EACyB;AACzB,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,MAAM,CAAA;AAC3B,EAAA,QAAQ,MAAM,IAAA;AAAM,IAClB,KAAK,aAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT,KAAK,kBAAA;AACH,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,EAAE,CAAA;AACpB,MAAA,OAAO,IAAA;AAAA;AAEb;AAWO,SAAS,WACd,MAAA,EACyB;AACzB,EAAA,IAAI,SAAS,WAAA,EAAe;AAC5B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,EAAQ,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACnE,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,iBACd,MAAA,EAC0B;AAC1B,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,MAAM,CAAA,IAAK,MAAA,MAAY,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,EAAQ,CAAA;AAC1D,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,MAAA,CACd,QACA,EAAA,EACS;AACT,EAAA,OAAO,MAAA,CAAO,IAAI,EAAE,CAAA;AACtB;AAsDO,SAAS,qBAAwB,OAAA,EAGV;AAC5B,EAAA,IAAI,SAAkC,OAAA,EAAS,MAAA,GAC3C,WAAW,OAAA,CAAQ,MAAM,IACzB,WAAA,EAAe;AAKnB,EAAA,IAAI,OAAA,GAAU,SAAS,MAAA,IAAU,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS,MAAA,KAAW,MAAA,IAAa,OAAA,EAAS,MAAA,EAAQ;AACpD,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,EAAQ,IAAI,EAAE,EAAA,GAAK,OAAA,YAAmB,CAAA,CAAE,EAAA;AAAA,EAClE,CAAA,MAAA,IAAW,OAAA,EAAS,MAAA,KAAW,MAAA,EAAW;AACxC,IAAA,KAAA,MAAW,MAAM,MAAA,CAAO,IAAA,IAAQ,IAAI,EAAA,GAAK,SAAS,OAAA,GAAU,EAAA;AAAA,EAC9D;AAEA,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,EAAQ;AACV,MAAA,OAAA,IAAW,CAAA;AACX,MAAA,MAAM,EAAA,GAAK,OAAA;AACX,MAAA,MAAM,KAAA,GAAuB,EAAE,IAAA,EAAM,aAAA,EAAe,IAAI,MAAA,EAAO;AAC/D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,IAAI,KAAA,EAAM;AAAA,IACrB,CAAA;AAAA,IACA,QAAQ,EAAA,EAAI;AACV,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAC/B,MAAA,MAAM,KAAA,GAAyB,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAG;AAC9D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,WAAW,KAAA,EAAM;AAAA,IAC5B,CAAA;AAAA,IACA,SAAA,GAAY;AACV,MAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,IAChC,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF","file":"chunk-3545BOYL.js","sourcesContent":["/**\n * @demlik/tea/do — the durable pending-effects ledger (substrate primitive #1).\n *\n * Durable *state* and durable *effects* are different problems. An\n * event-sourced actor rebuilds its STATE by folding the event log\n * (`doEventSourcedStore`, sibling file). But an outbound side effect — a tool\n * round-trip, a message to a sibling grain — is fire-and-forget: if the actor\n * interprets the `Cmd` inside an activation that hibernates mid-flight, the\n * effect is lost, yet nothing in the replayed state records that it is still\n * OWED. This is the one real tax of the event-sourced-virtual-actor target\n * (ADR 0003 primitive #1): \"I owe this effect\" must itself be part of the\n * folded state.\n *\n * Akka's classic `AtLeastOnceDelivery` solves it with a ledger of unconfirmed\n * deliveries kept AS PART OF the persisted state: each `deliver` adds an entry\n * keyed by a monotonic `deliveryId`; each `confirmDelivery` removes it. On\n * recovery the ledger is rebuilt from the SAME events, and any surviving entry\n * is re-sent. At-least-once ⇒ a confirmed-but-not-yet-persisted delivery WILL\n * be re-sent after a crash, so the receiver must deduplicate by id.\n *\n * ## The load-bearing rule (do not violate)\n *\n * The ledger is a PURE FOLD over the same kind of event stream the actor\n * already replays — it is **NOT** a separately-persisted side table:\n *\n *   - `effect_owed`     — `{ id, effect }` ADDS an entry to the ledger.\n *   - `effect_confirmed`— `{ id }`         REMOVES the entry.\n *\n * `foldLedger(events)` is `events.reduce(applyEffectEvent, empty())` — the same\n * fold shape `replay` / `foldEvents` / the recorder use. Persist these two\n * events into the SAME log `doEventSourcedStore` already appends (they are just\n * Msg variants), and the ledger is rebuilt for free on the next activation:\n * `foldLedger(log)` after eviction equals `foldLedger(log)` never-evicted, by\n * construction (a pure fold over identical input).\n *\n * On activation (replay completion), `survivingEffects(ledger)` returns the\n * owed-but-unconfirmed entries to re-fire, ordered by their monotonic id. The\n * re-fire is a SIDE EFFECT DERIVED from the surviving ledger — never stored\n * separately, never fired during replay (recovery.md: add to the ledger during\n * recovery; let recovery-END re-emit the survivors).\n *\n * Anti-patterns this file refuses (mirroring durable-effects.md):\n *   - A side-table ledger persisted apart from the events. The events ARE the\n *     ledger; the Map is rebuilt by folding them.\n *   - Re-firing every historical effect during replay. Only `survivingEffects`\n *     (post-fold) re-emits.\n *   - Assuming the receiver gets each effect exactly once. At-least-once: dedup\n *     by `id` at the receiver (`hasOwed` / `isConfirmed` here are the sender's\n *     view; the receiver owns its own dedup).\n */\n\nimport type { Cmd } from \"../index\";\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The two events the ledger folds. These are ordinary Msg variants — persist\n// them into the same event log `doEventSourcedStore` appends, and the ledger\n// rebuilds itself on the next activation with no extra storage.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Monotonic, gap-free delivery id — the single correlation + dedup key. */\nexport type DeliveryId = number;\n\n/**\n * An effect is now OWED: it has been decided but its delivery is not yet\n * confirmed. Adds `{ id → effect }` to the ledger when folded.\n *\n * Persist this BEFORE interpreting the effect (durable-effects.md rule:\n * \"persist the intent before deliver\"). A crash between persist and deliver is\n * fine — the surviving entry re-fires on activation. A crash before the persist\n * means the effect was never owed, so nothing is lost that the actor promised.\n */\nexport interface EffectOwed<E> extends Cmd<\"effect_owed\"> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/**\n * An owed effect has been CONFIRMED delivered. Removes its entry from the\n * ledger when folded. Persist this BEFORE acting on the confirmation\n * (\"persist the confirmation before confirmDelivery\").\n */\nexport interface EffectConfirmed extends Cmd<\"effect_confirmed\"> {\n  readonly id: DeliveryId;\n}\n\n/** The event union the ledger folds over. `E` is the consumer's effect type. */\nexport type EffectLedgerEvent<E> = EffectOwed<E> | EffectConfirmed;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The ledger itself — a pure value. Insertion-ordered by monotonic id, so\n// `survivingEffects` re-emits in owed-order without a sort.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * The pending-effects ledger: owed-but-unconfirmed effects keyed by their\n * monotonic delivery id. A pure value reconstructed by `foldLedger` — it is\n * never persisted on its own; the events are.\n *\n * `ReadonlyMap` preserves insertion order, which (because ids are appended\n * monotonically) is exactly id order — so iteration yields the survivors\n * oldest-first with no sort.\n */\nexport type PendingEffectsLedger<E> = ReadonlyMap<DeliveryId, E>;\n\n/** A single surviving entry to re-emit: its id and the effect it owes. */\nexport interface OwedEffect<E> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/** The empty ledger — the fold's seed (a fresh actor owes nothing). */\nexport function emptyLedger<E>(): PendingEffectsLedger<E> {\n  return new Map<DeliveryId, E>();\n}\n\n/**\n * Apply ONE ledger event — the reducer at the heart of the fold.\n *\n *   - `effect_owed`      → add `{ id → effect }`.\n *   - `effect_confirmed` → remove `id` (no-op if already absent: a duplicate\n *     confirm, or a confirm for an id evicted with the actor — at-least-once\n *     tolerates both).\n *\n * Pure: returns a NEW ledger, never mutates the input — so folding the same\n * events twice (live and post-eviction) yields equal results, and a caller may\n * keep the prior ledger value.\n */\nexport function applyEffectEvent<E>(\n  ledger: PendingEffectsLedger<E>,\n  event: EffectLedgerEvent<E>,\n): PendingEffectsLedger<E> {\n  const next = new Map(ledger);\n  switch (event.type) {\n    case \"effect_owed\":\n      next.set(event.id, event.effect);\n      return next;\n    case \"effect_confirmed\":\n      next.delete(event.id);\n      return next;\n  }\n}\n\n/**\n * THE FOLD. Rebuild the ledger from an event stream — the same fold shape\n * `replay` uses for state. After a simulated eviction this is called over the\n * persisted log and yields a ledger byte-for-byte equal to the never-evicted\n * one, because a pure fold over identical input is identical.\n *\n * This is the function that proves \"no side table\": the ledger is `events`\n * reduced, nothing more.\n */\nexport function foldLedger<E>(\n  events: Iterable<EffectLedgerEvent<E>>,\n): PendingEffectsLedger<E> {\n  let ledger = emptyLedger<E>();\n  for (const event of events) ledger = applyEffectEvent(ledger, event);\n  return ledger;\n}\n\n/**\n * RE-EMIT ON ACTIVATION. Given the rebuilt ledger, the owed-but-unconfirmed\n * effects to re-fire — ordered oldest-first by monotonic id. On a fresh /\n * fully-confirmed actor this is empty (nothing re-emitted).\n *\n * Idempotency is the RECEIVER's job: it must dedup by `id`, because\n * at-least-once means a re-emitted already-handled id WILL arrive again\n * (e.g. an effect confirmed in the activation that hibernated before the\n * `effect_confirmed` event was persisted). Re-firing the same id is therefore\n * a no-op AT THE RECEIVER, not here.\n */\nexport function survivingEffects<E>(\n  ledger: PendingEffectsLedger<E>,\n): readonly OwedEffect<E>[] {\n  const out: OwedEffect<E>[] = [];\n  for (const [id, effect] of ledger) out.push({ id, effect });\n  return out;\n}\n\n/** Is this id still owed (unconfirmed) in the ledger? Sender-side view. */\nexport function isOwed<E>(\n  ledger: PendingEffectsLedger<E>,\n  id: DeliveryId,\n): boolean {\n  return ledger.has(id);\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// pendingEffectsLedger — the stateful, monotonic-id-issuing recorder.\n//\n// The pure `foldLedger` is the contract; this is the ergonomic driver a host\n// uses live. It owns the monotonic `deliveryId` (gap-free, shared across all\n// destinations — durable-effects.md), emits the `effect_owed` / `effect_confirmed`\n// events for the caller to PERSIST, and keeps an in-memory mirror folded from\n// those same events so `survivingEffects` is available without a re-read.\n//\n// Mirrors `deferredGateway`'s factory shape: no clock / RNG captured; pure\n// bookkeeping. The caller is responsible for persisting each returned event\n// into the log (so the ledger survives eviction) and for actually interpreting\n// the effect after the owed event is durable.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * A live, monotonic-id-issuing ledger recorder.\n *\n *   - `owe(effect)` — allocate the next `deliveryId`, return the\n *     `effect_owed` event to PERSIST plus the allocated `id`. Folding the event\n *     into the recorder's mirror is done for you; the caller persists it.\n *   - `confirm(id)` — return the `effect_confirmed` event to PERSIST, and `true`\n *     iff the id was owed (a duplicate confirm returns `false` — the boolean is\n *     itself a dedup signal, exactly Akka `confirmDelivery`).\n *   - `surviving()` — the current owed-but-unconfirmed effects (for re-emit on\n *     activation).\n *   - `ledger()` — the current folded ledger value.\n *   - `lastId()` — the highest id issued (so a host can seed the counter from a\n *     rebuilt ledger after eviction; see `restore`).\n */\nexport interface PendingEffectsRecorder<E> {\n  owe(effect: E): { id: DeliveryId; event: EffectOwed<E> };\n  confirm(id: DeliveryId): { confirmed: boolean; event: EffectConfirmed };\n  surviving(): readonly OwedEffect<E>[];\n  ledger(): PendingEffectsLedger<E>;\n  lastId(): DeliveryId;\n}\n\n/**\n * Build a live recorder. `restore` rehydrates it after an eviction: pass the\n * events read back from the log (or the rebuilt ledger's survivors) so the\n * monotonic counter resumes WITHOUT gaps and the mirror reflects the surviving\n * owed set. Omit `restore` for a fresh actor.\n *\n * Counter seeding rule: the next id is `max(seen ids) + 1`. Restoring only the\n * survivors is sufficient for correctness of re-emit, but to keep ids gap-free\n * across confirmed-and-pruned entries the host should pass `lastId` explicitly\n * when it has it (e.g. persisted alongside the snapshot). When only survivors\n * are known, the counter resumes from the highest surviving id — a confirmed id\n * higher than every survivor could in principle be reissued, so a host that\n * needs strict global monotonicity persists `lastId`.\n */\nexport function pendingEffectsLedger<E>(restore?: {\n  readonly events?: Iterable<EffectLedgerEvent<E>>;\n  readonly lastId?: DeliveryId;\n}): PendingEffectsRecorder<E> {\n  let mirror: PendingEffectsLedger<E> = restore?.events\n    ? foldLedger(restore.events)\n    : emptyLedger<E>();\n\n  // Seed the monotonic counter. Prefer an explicit `lastId` (gap-free across\n  // pruned ids); else the highest id observed in the restore events; else the\n  // highest surviving id; else 0 (fresh).\n  let counter = restore?.lastId ?? 0;\n  if (restore?.lastId === undefined && restore?.events) {\n    for (const e of restore.events) if (e.id > counter) counter = e.id;\n  } else if (restore?.lastId === undefined) {\n    for (const id of mirror.keys()) if (id > counter) counter = id;\n  }\n\n  return {\n    owe(effect) {\n      counter += 1;\n      const id = counter;\n      const event: EffectOwed<E> = { type: \"effect_owed\", id, effect };\n      mirror = applyEffectEvent(mirror, event);\n      return { id, event };\n    },\n    confirm(id) {\n      const confirmed = mirror.has(id);\n      const event: EffectConfirmed = { type: \"effect_confirmed\", id };\n      mirror = applyEffectEvent(mirror, event);\n      return { confirmed, event };\n    },\n    surviving() {\n      return survivingEffects(mirror);\n    },\n    ledger() {\n      return mirror;\n    },\n    lastId() {\n      return counter;\n    },\n  };\n}\n"]}

package/dist/chunk-5VNWZADP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/retry-backoff/index.ts"],"names":[],"mappings":";AA8EO,SAAS,KAAA,CAAM,EAAA,EAAkB,KAAA,GAAQ,KAAA,EAAY;AAC1D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,SAAS,EAAA,EAAG;AAClB,IAAA,IAAI,EAAE,MAAA,IAAU,CAAA,IAAK,MAAA,GAAS,CAAA,CAAA,EAAI;AAChC,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,6BAA6B,MAAM,CAAA,6BAAA;AAAA,OACrC;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAA;AACT;AAOO,IAAM,aAAkB,IAAA,CAAK;AA4B7B,IAAM,kBAAA,GAAkC;AAAA,EAC7C,MAAA,EAAQ,GAAA;AAAA,EACR,MAAA,EAAQ,CAAA;AAAA,EACR,KAAA,EAAO,GAAA;AAAA,EACP,WAAA,EAAa,CAAA;AAAA,EACb,MAAA,EAAQ;AACV;AAuBO,SAAS,YAAA,CACd,OAAA,EACA,MAAA,EACA,GAAA,GAAW,UAAA,EACH;AAIR,EAAA,MAAM,WAAA,GAAc,OAAA,GAAU,CAAA,GAAI,CAAA,GAAI,OAAA;AACtC,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,WAAA;AAMrD,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,WAAW,CAAA,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,WAAW,CAAA;AAE5E,EAAA,QAAQ,OAAO,MAAA;AAAQ,IACrB,KAAK,MAAA;AACH,MAAA,OAAO,CAAA;AAAA,IACT,KAAK,MAAA;AAKH,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAA,KAAQ,CAAC,CAAA;AAAA,IAC9B,KAAK,OAAA;AAGH,MAAA,OAAO,IAAA,CAAK,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,GAAA,EAAI,IAAK,IAAI,CAAA,CAAE,CAAA;AAAA;AAEhD;AAgBO,SAAS,SAAA,GAAwB;AACtC,EAAA,OAAO,EAAE,SAAS,CAAA,EAAE;AACtB;AAMO,SAAS,aAAA,CAAc,OAAmB,KAAA,EAA4B;AAC3E,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,GAAU,CAAA,EAAG,WAAW,KAAA,EAAM;AACxD;AASO,SAAS,WAAA,CAAY,OAAmB,MAAA,EAA8B;AAC3E,EAAA,OAAO,KAAA,CAAM,UAAU,MAAA,CAAO,WAAA;AAChC;AASO,SAAS,WAAA,CACd,KAAA,EACA,MAAA,EACA,GAAA,GAAW,UAAA,EACH;AACR,EAAA,OAAO,YAAA,CAAa,KAAA,CAAM,OAAA,EAAS,MAAA,EAAQ,GAAG,CAAA;AAChD","file":"chunk-5VNWZADP.js","sourcesContent":["/**\n * @demlik/tea/retry-backoff — exponential backoff with jitter + cap, and the\n * retry-attempt state every fallible `interpret` handler folds over.\n *\n * This is a \"pure state + ops\" module in the same mold as\n * `@demlik/tea/work-queue`: a state type plus pure transition functions,\n * storage- and host-agnostic, that a consumer wires into their own reducer /\n * interpret. Nothing here reads the clock or the RNG on its own behalf —\n * randomness is *injected* (`rng`) and time is *computed by the caller* from\n * the millisecond delays this module returns. That keeps every function\n * deterministic and unit-testable, and keeps the substrate's purity invariants\n * intact when the result is threaded through `update` (invariant 2) and the\n * delay is realized as a `Cmd` the runtime performs (invariant 3).\n *\n * Typical wiring:\n *\n *   // in `update`, on a failure Msg:\n *   const retry = recordFailure(state.retry, msg.error);\n *   if (!shouldRetry(retry, policy)) return [toGaveUp(state), []];\n *   const delayMs = nextDelayMs(retry, policy);              // pure: rng injected at call site\n *   return [{ ...state, retry }, [{ type: \"ScheduleRetry\", delayMs, into: TimerFiredRetry }]];\n *\n * The reducer stays pure: `nextDelayMs` is called with the runtime's RNG only\n * at the emit boundary (or the caller defers the whole delay computation to the\n * `interpret` handler and passes `rng` there). Either way the substrate never\n * sees `Math.random()` inside a transition body.\n *\n * NOT a substrate primitive: it depends on nothing from `../index`. It is a\n * leaf utility consumers reach via the `@demlik/tea/retry-backoff` subpath.\n */\n\n/**\n * Jitter strategy applied to the computed backoff delay.\n *\n * Names follow the AWS \"Exponential Backoff And Jitter\" taxonomy (Brooker,\n * 2015), the same vocabulary used by the AWS SDKs and most retry libraries:\n *\n *   - `\"none\"`  — no jitter; the delay is the raw capped exponential `d`.\n *                 Deterministic, but synchronizes retries across clients\n *                 (thundering herd). Use only when callers are already\n *                 de-correlated by other means.\n *   - `\"full\"`  — uniform random in `[0, d]`. Maximum spread; best herd\n *                 avoidance, highest variance in latency.\n *   - `\"equal\"` — `d/2 + random(0, d/2)`, i.e. uniform in `[d/2, d]`. Half the\n *                 delay is fixed, half is jittered: keeps a latency floor while\n *                 still de-correlating clients. A common default.\n */\nexport type Jitter = \"none\" | \"full\" | \"equal\";\n\ndeclare const RngBrand: unique symbol;\n\n/**\n * A source of uniform randomness in `[0, 1)` — the `Math.random` contract.\n *\n * Nominally branded so the `[0, 1)` range is enforced at *construction*, not\n * by a comment. A raw `() => number` does NOT satisfy `Rng`: a stray `() => 5`\n * or `() => -1` is rejected by the type before it can ever feed the jitter\n * math and breach the `0 <= delay <= capMs` postcondition. The only way to\n * mint an `Rng` is {@link asRng} (or the {@link defaultRng} const), so the\n * range obligation lives at the boundary where randomness enters the module —\n * \"parse, don't validate\" applied to a function value.\n */\nexport type Rng = (() => number) & { readonly [RngBrand]: true };\n\n/**\n * Brand a `[0, 1)` generator as an {@link Rng}. The single entry point for\n * randomness into this module: callers (production wiring and tests alike)\n * pass their raw generator through here, which optionally asserts the contract\n * and tags the value. The probe is a cheap guard against the most common\n * misuse (returning a non-unit value); it does not — and cannot — prove\n * uniformity.\n *\n * PURE with respect to the module: it neither reads the clock nor calls the\n * generator on the module's behalf unless `probe` is set. The probe is opt-in\n * (default off) so wrapping a hot generator stays allocation- and call-free.\n *\n * @throws RangeError if `probe` is enabled and a sampled value is outside `[0, 1)`.\n */\nexport function asRng(fn: () => number, probe = false): Rng {\n  if (probe) {\n    const sample = fn();\n    if (!(sample >= 0 && sample < 1)) {\n      throw new RangeError(\n        `asRng: generator returned ${sample}, outside the [0, 1) contract`,\n      );\n    }\n  }\n  return fn as Rng;\n}\n\n/**\n * The production default: `Math.random`, branded. Used wherever an `Rng` is\n * required but the caller omits one — at the effect boundary, never inside a\n * reducer.\n */\nexport const defaultRng: Rng = Math.random as Rng;\n\n/**\n * A retry policy is pure configuration — the knobs of the backoff curve. It\n * carries no mutable state; `RetryState` does. One policy is shared across all\n * the attempts of one logical operation (often a module-scope const).\n */\nexport interface RetryPolicy {\n  /** Delay for attempt 0, in milliseconds, before any jitter or cap. */\n  readonly baseMs: number;\n  /** Geometric growth factor. `2` doubles the delay each attempt. */\n  readonly factor: number;\n  /** Hard ceiling, in milliseconds. The capped exponential never exceeds this. */\n  readonly capMs: number;\n  /**\n   * Maximum number of attempts. `shouldRetry` allows attempts `0 .. maxAttempts-1`,\n   * so `maxAttempts: 3` means \"try once, then retry at most twice\" (attempts 0, 1, 2).\n   */\n  readonly maxAttempts: number;\n  /** Jitter strategy applied to the capped exponential delay. */\n  readonly jitter: Jitter;\n}\n\n/**\n * Sensible defaults: 100ms base, doubling, capped at 30s, up to 5 attempts,\n * full jitter (the herd-avoidance default). Tuned for network calls; override\n * per call site rather than mutating this shared const.\n */\nexport const defaultRetryPolicy: RetryPolicy = {\n  baseMs: 100,\n  factor: 2,\n  capMs: 30_000,\n  maxAttempts: 5,\n  jitter: \"full\",\n};\n\n/**\n * Compute the delay for a given 0-based `attempt` under `policy`.\n *\n * PURE. The exponential is `baseMs * factor ** attempt`, clamped to `capMs`,\n * then jittered. `rng` is injected so the result is deterministic in tests —\n * pass an `rng` returning a fixed value to pin the jitter; the production\n * default reads `Math.random` only when the caller omits it (at the effect\n * boundary, never inside a reducer).\n *\n * `rng` is an {@link Rng} — a `[0, 1)` generator branded at construction via\n * {@link asRng}, so a raw `() => 5` can't be passed here. The returned delay\n * is always in `[0, capMs]` regardless of jitter strategy:\n *   - `\"none\"`  → exactly the capped exponential `d`.\n *   - `\"full\"`  → `rng() * d`, uniform in `[0, d]`.\n *   - `\"equal\"` → `d/2 + rng() * d/2`, uniform in `[d/2, d]`.\n *\n * `attempt` is treated as `>= 0`; a negative attempt is clamped to 0 so a\n * caller's off-by-one never produces a fractional exponent or a delay below\n * `baseMs`. `capMs` is also the floor of the clamp, so a misconfigured\n * `capMs < baseMs` still yields a delay within `[0, capMs]`.\n */\nexport function backoffDelay(\n  attempt: number,\n  policy: RetryPolicy,\n  rng: Rng = defaultRng,\n): number {\n  // Clamp the attempt to >= 0 so factor ** attempt is never a fractional /\n  // negative exponent. The exponential can overflow to Infinity for large\n  // attempts; Math.min with capMs collapses that back to the ceiling.\n  const safeAttempt = attempt < 0 ? 0 : attempt;\n  const exponential = policy.baseMs * policy.factor ** safeAttempt;\n  // `factor ** attempt` overflows to Infinity for large attempts. With\n  // `baseMs > 0` that's `Infinity`, which Math.min collapses back to `capMs`.\n  // With `baseMs === 0` it's `0 * Infinity === NaN`; a zero base means zero\n  // delay, so treat NaN as 0 (otherwise NaN poisons the comparison and breaks\n  // the `0 <= delay <= capMs` postcondition).\n  const d = Number.isNaN(exponential) ? 0 : Math.min(policy.capMs, exponential);\n\n  switch (policy.jitter) {\n    case \"none\":\n      return d;\n    case \"full\":\n      // Uniform in [0, d]. Math.min re-pins the upper bound: at subnormal /\n      // extreme-precision `d`, `rng() * d` can round one ULP above `d`, which\n      // would breach the documented `delay <= capMs` postcondition. Clamping to\n      // `d` (already <= capMs) makes the invariant hold by construction.\n      return Math.min(d, rng() * d);\n    case \"equal\":\n      // Fixed half + jittered half → uniform in [d/2, d]. Same FP-rounding clamp\n      // as \"full\": `d/2 + rng()*(d/2)` can round above `d` for subnormal `d`.\n      return Math.min(d, d / 2 + rng() * (d / 2));\n  }\n}\n\n/**\n * Per-operation retry state: how many attempts have failed so far, and the most\n * recent error. `lastError` is `unknown` because the failure can be anything a\n * boundary surfaces (an `Error`, a tagged result, a string) — this module never\n * inspects it, it only carries it forward for the consumer's reducer to read.\n */\nexport interface RetryState {\n  /** Count of failures recorded so far. Also the 0-based index of the next attempt. */\n  readonly attempt: number;\n  /** The error from the most recent failure, if any. Carried, never interpreted. */\n  readonly lastError?: unknown;\n}\n\n/** The starting state: zero attempts, no error yet. */\nexport function initRetry(): RetryState {\n  return { attempt: 0 };\n}\n\n/**\n * Record a failed attempt. PURE — returns a *new* state with `attempt`\n * incremented and `lastError` set; the input `state` is never mutated.\n */\nexport function recordFailure(state: RetryState, error: unknown): RetryState {\n  return { attempt: state.attempt + 1, lastError: error };\n}\n\n/**\n * Whether another attempt is permitted under `policy`. PURE.\n *\n * `attempt` is the number of failures recorded so far (= the index of the next\n * attempt). We may retry while that index is below `maxAttempts`, i.e. attempts\n * `0 .. maxAttempts-1` are allowed and the `maxAttempts`-th is refused.\n */\nexport function shouldRetry(state: RetryState, policy: RetryPolicy): boolean {\n  return state.attempt < policy.maxAttempts;\n}\n\n/**\n * The delay to wait before the next attempt, given the current state. PURE.\n *\n * Bridges `RetryState` → `backoffDelay` by using `state.attempt` as the 0-based\n * attempt index, so the delay grows with each recorded failure. `rng` is\n * injected for determinism, same contract as `backoffDelay`.\n */\nexport function nextDelayMs(\n  state: RetryState,\n  policy: RetryPolicy,\n  rng: Rng = defaultRng,\n): number {\n  return backoffDelay(state.attempt, policy, rng);\n}\n"]}

package/dist/chunk-6GIGQT6C.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/resilient-call/index.ts"],"names":[],"mappings":";;;;;;;;;AA+SA,SAAS,cAAc,MAAA,EAAyB;AAC9C,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,MAAA,EAAW,OAAO,IAAA;AACzC,EAAA,OAAO;AAAA,IACL,gBAAA,EAAkB,OAAO,OAAA,CAAQ,SAAA;AAAA,IACjC,UAAA,EAAY,OAAO,OAAA,CAAQ,UAAA;AAAA,IAC3B,iBAAA,EAAmB,MAAA,CAAO,OAAA,CAAQ,iBAAA,IAAqB;AAAA,GACzD;AACF;AAIA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,OAAO,mBAAmB,GAAG,CAAA,CAAA;AAC/B;AACA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,OAAO,sBAAsB,GAAG,CAAA,CAAA;AAClC;AAmBO,SAAS,mBAAA,CACd,MAAA,EACA,GAAA,GAAoB,IAAA,CAAK,MAAA,EACzB;AACA,EAAA,MAAM,OAAA,GAAU,cAAc,MAAM,CAAA;AAKpC,EAAA,MAAM,UAAA,GAAa,MAAM,GAAG,CAAA;AAG5B,EAAA,SAAS,IAAA,GAA6B;AACpC,IAAA,OAAO;AAAA,MACL,SAAS,WAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMrB,MAAA,EAAQ,OAAO,SAAA,GACX,UAAA;AAAA,QACE,OAAO,SAAA,CAAU,QAAA;AAAA,QACjB,OAAO,SAAA,CAAU,YAAA;AAAA,QACjB;AAAA,OACF,GACA,UAAA,CAAW,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA;AAAA,MACtB,OAAO,EAAC;AAAA,MACR,OAAO,SAAA,EAAa;AAAA,MACpB,OAAO;AAAC,KACV;AAAA,EACF;AAGA,EAAA,SAAS,OAAA,CAAQ,GAAyB,GAAA,EAAyB;AACjE,IAAA,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,IAAK,SAAA,EAAU;AAAA,EACnC;AAGA,EAAA,SAAS,WAAW,EAAA,EAAoB;AACtC,IAAA,OAAO,MAAA,CAAO,QAAA,GAAW,EAAA,GAAK,MAAA,CAAO,SAAS,EAAA,GAAK,CAAA;AAAA,EACrD;AA2BA,EAAA,SAAS,IAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,IACA,YAAA,EACuD;AAEvD,IAAA,IAAI,MAAA,CAAO,UAAU,MAAA,EAAW;AAC9B,MAAA,MAAM,MAAA,GAAS,GAAA,CAAS,CAAA,CAAE,KAAA,EAAO,KAAK,EAAE,CAAA;AACxC,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,CAAA,EAAG,EAAE,CAAA;AAAA,MACrE;AAAA,IACF;AAMA,IAAA,IAAI,SAAS,CAAA,CAAE,MAAA;AACf,IAAA,IAAI,MAAA,CAAO,cAAc,MAAA,EAAW;AAClC,MAAA,MAAM,CAAC,IAAA,EAAM,QAAQ,CAAA,GAAI,UAAA,CAAW,QAAQ,EAAE,CAAA;AAC9C,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,IAAI,CAAC,QAAA,EAAU;AAGb,QAAA,OAAO,OAAA;AAAA,UACL,EAAE,GAAG,CAAA,EAAG,MAAA,EAAO;AAAA,UACf,GAAA;AAAA,UACA,KAAA;AAAA,UACA,cAAA;AAAA,UACA,EAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,UAAU,CAAA,CAAE,OAAA;AAChB,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,MAAM,CAAC,IAAA,EAAM,EAAE,IAAI,OAAA,CAAQ,OAAA,EAAS,SAAS,EAAE,CAAA;AAC/C,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,IAAI,CAAC,EAAA,EAAI;AACP,QAAA,OAAO;AAAA,UACL,EAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA,EAAG,MAAA,EAAQ,OAAA,EAAQ;AAAA,UACjE;AAAC,SACH;AAAA,MACF;AAAA,IACF;AAGA,IAAA,OAAO;AAAA,MACL;AAAA,QACE,GAAG,QAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,YAAA,EAAc,CAAA;AAAA,QAC5D,OAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,CAAC,EAAE,IAAA,EAAM,QAAQ,YAAA,EAAc,GAAA,EAAK,OAAO;AAAA,KAC7C;AAAA,EACF;AAQA,EAAA,SAAS,QACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,KAAA,EACA,IACA,YAAA,EACuD;AACvD,IAAA,IAAI,MAAA,CAAO,UAAU,MAAA,EAAW;AAC9B,MAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,IACzD;AACA,IAAA,MAAM,QAAQ,aAAA,CAAc,OAAA,CAAQ,CAAA,EAAG,GAAG,GAAG,KAAK,CAAA;AAClD,IAAA,MAAM,SAAA,GAAY,EAAE,GAAG,CAAA,EAAG,KAAA,EAAO,EAAE,GAAG,CAAA,CAAE,KAAA,EAAO,CAAC,GAAG,GAAG,OAAM,EAAE;AAC9D,IAAA,IAAI,CAAC,WAAA,CAAY,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACrC,MAAA,OAAO,CAAC,OAAA,CAAQ,SAAA,EAAW,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,IACjE;AACA,IAAA,MAAM,YAAY,EAAA,GAAK,WAAA,CAAY,KAAA,EAAO,MAAA,CAAO,OAAO,UAAU,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,OAAA,CAAQ,WAAW,GAAA,EAAK;AAAA,QACtB,KAAA,EAAO,eAAA;AAAA,QACP,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,MACD;AAAC,KACH;AAAA,EACF;AAGA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACsB;AACtB,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,KAAA,EAAO,EAAE,GAAG,CAAA,CAAE,KAAA,EAAO,CAAC,GAAG,GAAG,KAAA,EAAM,EAAE;AAAA,EACrD;AAUA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,EAAA,EACuD;AACvD,IAAA,OAAO,KAAK,CAAA,EAAG,GAAA,EAAK,OAAO,EAAA,EAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAAA,EAC/C;AASA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,GAAA,EACuD;AACvD,IAAA,MAAM,OAAA,GACJ,YAAY,IAAA,GAAO,SAAA,CAAU,EAAE,OAAA,EAAS,OAAO,IAAI,CAAA,CAAE,OAAA;AACvD,IAAA,MAAM,QACJ,MAAA,CAAO,KAAA,KAAU,MAAA,GACb,GAAA,CAAS,EAAE,KAAA,EAAO,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,IAAI,EAAA,EAAI,MAAA,CAAO,KAAA,CAAM,KAAK,IAC7D,CAAA,CAAE,KAAA;AAER,IAAA,MAAM,EAAE,CAAC,GAAG,GAAG,UAAU,GAAG,KAAA,KAAU,CAAA,CAAE,KAAA;AACxC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,GAAG,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,OAAO,WAAA,EAAa,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,CAAA;AAAA,QAC7D,OAAA;AAAA,QACA,KAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA;AAAC,KACH;AAAA,EACF;AAUA,EAAA,SAAS,IAAA,CACP,CAAA,EACA,GAAA,EACA,GAAA,EACuD;AACvD,IAAA,MAAM,OAAA,GACJ,OAAA,KAAY,IAAA,GAAO,SAAA,CAAU,CAAA,CAAE,SAAS,OAAA,EAAS,GAAA,CAAI,EAAE,CAAA,GAAI,CAAA,CAAE,OAAA;AAC/D,IAAA,MAAM,WAAA,GAAc,EAAE,GAAG,CAAA,EAAG,OAAA,EAAQ;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AACxB,IAAA,MAAM,KAAA,GAAQ,IAAA,EAAM,KAAA,KAAU,SAAA,GAAY,KAAK,KAAA,GAAQ,MAAA;AACvD,IAAA,MAAM,YAAA,GACJ,MAAM,KAAA,KAAU,SAAA,GAAY,KAAK,YAAA,GAAe,UAAA,CAAW,IAAI,EAAE,CAAA;AAGnE,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO;AAAA,QACL,OAAA,CAAQ,aAAa,GAAA,EAAK,EAAE,OAAO,QAAA,EAAU,KAAA,EAAO,GAAA,CAAI,KAAA,EAAO,CAAA;AAAA,QAC/D;AAAC,OACH;AAAA,IACF;AACA,IAAA,OAAO,OAAA,CAAQ,aAAa,GAAA,EAAK,KAAA,EAAO,IAAI,KAAA,EAAO,GAAA,CAAI,IAAI,YAAY,CAAA;AAAA,EACzE;AA6BA,EAAA,SAAS,YAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACuD;AACvD,IAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,EACzD;AAgBA,EAAA,SAAS,OAAA,CACP,GACA,GAAA,EACuD;AACvD,IAAA,KAAA,MAAW,CAAC,KAAK,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,CAAA,CAAE,KAAK,CAAA,EAAG;AACjD,MAAA,IAAI,GAAA,CAAI,EAAA,KAAO,YAAA,CAAa,GAAG,CAAA,EAAG;AAChC,QAAA,IAAI,KAAK,KAAA,KAAU,eAAA,SAAwB,CAAC,CAAA,EAAG,EAAE,CAAA;AACjD,QAAA,OAAO,IAAA,CAAK,GAAG,GAAA,EAAK,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,EAAM,KAAK,YAAY,CAAA;AAAA,MAC7D;AACA,MAAA,IAAI,GAAA,CAAI,EAAA,KAAO,eAAA,CAAgB,GAAG,CAAA,EAAG;AAGnC,QAAA,IAAI,IAAA,CAAK,KAAA,KAAU,SAAA,IAAa,IAAA,CAAK,KAAA,KAAU,eAAA;AAC7C,UAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAMf,QAAA,OAAO;AAAA,UACL,OAAA,CAAQ,GAAG,GAAA,EAAK;AAAA,YACd,KAAA,EAAO,QAAA;AAAA,YACP,KAAA,EAAO;AAAA,cACL,IAAA,EAAM,mBAAA;AAAA,cACN,IAAI,GAAA,CAAI,EAAA;AAAA,cACR,MAAM,GAAA,CAAI;AAAA;AACZ,WACD,CAAA;AAAA,UACD;AAAC,SACH;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACf;AAWA,EAAA,SAAS,KAAK,CAAA,EAAiD;AAC7D,IAAA,MAAM,MAAqB,EAAC;AAC5B,IAAA,KAAA,MAAW,CAAC,KAAK,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,CAAA,CAAE,KAAK,CAAA,EAAG;AACjD,MAAA,IAAI,IAAA,CAAK,UAAU,eAAA,EAAiB;AAClC,QAAA,GAAA,CAAI,KAAK,WAAA,CAAY,YAAA,CAAa,GAAG,CAAA,EAAG,IAAA,CAAK,SAAS,CAAC,CAAA;AAAA,MACzD;AACA,MAAA,IACE,MAAA,CAAO,QAAA,KAAa,MAAA,KACnB,IAAA,CAAK,KAAA,KAAU,SAAA,IAAa,IAAA,CAAK,KAAA,KAAU,eAAA,CAAA,IAC5C,IAAA,CAAK,YAAA,GAAe,CAAA,EACpB;AACA,QAAA,GAAA,CAAI,KAAK,WAAA,CAAY,eAAA,CAAgB,GAAG,CAAA,EAAG,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAaA,EAAA,SAAS,SAAS,KAAA,EAA6B;AAC7C,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,YAAA;AAAA,QASb,CAAC,GAAA,KAAQ,KAAA,CAAM,IAAI,GAAA,CAAI,KAAA,EAAO,IAAI,GAAG,CAAA;AAAA,QACrC,CAAC,QAAQ,GAAA,MAAwB;AAAA,UAC/B,MAAM,OAAA,CAAQ,WAAA;AAAA,UACd,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAA;AAAA,UACA,EAAA,EAAI,KAAK,GAAA;AAAI,SACf,CAAA;AAAA,QACA,CAAC,OAAO,GAAA,MAAkB;AAAA,UACxB,MAAM,OAAA,CAAQ,YAAA;AAAA,UACd,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,KAAA;AAAA,UACA,EAAA,EAAI,KAAK,GAAA;AAAI,SACf;AAAA;AACF,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,YAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAYO,SAAS,cAAA,CAMd,KAAA,EACA,CAAC,KAAA,EAAO,IAAI,CAAA,EACgB;AAC5B,EAAA,OAAO,CAAC,EAAE,GAAG,OAAO,UAAA,EAAY,KAAA,IAAS,IAAI,CAAA;AAC/C","file":"chunk-6GIGQT6C.js","sourcesContent":["/**\n * @deprecated `@demlik/tea/resilient-call` is deprecated in favor of\n * `@demlik/tea/with-resilience` — the higher-order `withResilience(base,\n * config)` wrapper (TEA-idiomatic: it wraps any existing machine instead of\n * forcing a bespoke embedded slice; epic consolidation verdict, survivor\n * `with-resilience`). The APIs are NOT drop-in; migration map:\n *\n *   - `createResilientCall(config, rng)` + hand-wiring `init` / the verbs /\n *     `subs` / `handlers` into your machine → `withResilience(base, { target,\n *     ...bricks }, rng)`. Nothing is wired by hand anymore: the wrapper\n *     intercepts the `target` base Cmd and routes it through the gate.\n *   - `ResilientConfig` bricks (`retry` / `circuit` / `rateLimit` / `cache` /\n *     `deadline`) → unchanged; `ResilienceConfig` extends the same knob and\n *     adds `target` (required), `keyOf?` (per-call key — was `attempt`'s `key`\n *     argument), and `at?` (time-as-data reader — REQUIRED with any\n *     time-sensitive brick; `withResilience` throws at construction without it).\n *   - The slice at your chosen Model field + `liftResilience` → the wrapper\n *     owns `model.$resilience`; there is nothing to lift.\n *   - Verbs `attempt` / `succeed` / `fail` / `onTimer` → internal to the\n *     wrapper; results route as `$resilience:ok` / `$resilience:err` /\n *     `$resilience:timer` Msgs through the merged `update` (the old\n *     `resilient_run` / `resilient_ok` / `resilient_err` vocabulary is renamed\n *     into the `$resilience:` namespace).\n *   - `settleFailed` → NO equivalent. It exists for embedded-slice consumers\n *     (`authed-call`, `paginated-walk`) that settle a call without touching the\n *     breaker; the wrapper exposes no caller-facing settle verb.\n *   - `handlers(ports)` / `subs(state)` / the `subscribeDeadline` re-export →\n *     handled by the wrapper; run the returned machine like any other.\n *\n * Removal window (\"deprecate, don't delete\"): the `./resilient-call` subpath\n * export survives one minor release after this deprecation ships, then is\n * removed. Internal sibling modules (`with-resilience` itself, `agent`,\n * `llm-call`, `authed-call`, `reconciler`, `paginated-walk`) intentionally keep\n * importing `../resilient-call` — the deprecation targets the PUBLISHED export,\n * not the module's internal role.\n */\n\n/**\n * @demlik/tea/resilient-call — the ROOT composition: a single resilience knob\n * that bundles cache → circuit-breaker → rate-limit → exponential-backoff retry\n * (with a deadline-driven retry timer) around any fallible `(input) => Promise`\n * port.\n *\n * This is `examples/resilient-fetch.ts`'s hand-wired `attempt()` generalized:\n *\n *   - It is **keyed**. The example tracked one URL at a time; this tracks N\n *     concurrent logical calls, each under a string `key`. The cache, the\n *     waiting-retry bookkeeping, and the retry timers are all per-key, while the\n *     circuit breaker and token bucket are shared (one downstream target, one\n *     breaker / one bucket — the example's implicit single-target assumption\n *     made explicit).\n *   - It is **config-driven**, not hand-wired. You hand `createResilientCall`\n *     a `ResilientConfig` and get back the uniform knob contract every L2\n *     composition exposes: `init()`, the four verbs (`attempt` / `succeed` /\n *     `fail` / `onTimer`), `subs(state)`, and `handlers(ports)`.\n *   - Every brick is **optional**. Omit `cache` and the cache gate disappears\n *     (`get` is never consulted); omit `circuit` and every call passes the\n *     breaker; omit `rateLimit` and the bucket never throttles; omit `retry`\n *     and a failure is terminal (no backoff, no timer); omit `deadline` and no\n *     overall wall-clock cap is armed. \"Omit a brick → omit its gate\" is the\n *     whole config story — there are no other modes.\n *\n * Four later compositions (`llm-call`, `paginated-walk`, `authed-call`,\n * `reconciler`) inherit THIS slice + verb shape, so the contract here is\n * load-bearing: the slice is a flat record of brick states, every verb returns\n * `readonly [State, Cmd[]]`, time is always an `at` / `now` parameter, and the\n * RNG used for jitter is injected on the config (never read inside a verb).\n *\n * ## The two non-negotiables (canon)\n *\n *   - **Durable** — the slice is a plain-data Model field (brick states are all\n *     JSON-serializable), so it survives DO eviction / reload.\n *   - **Replayable** — every transition is a verb returning new state + Cmds;\n *     `replay` reconstructs it exactly. Nothing here closes over time or RNG.\n *\n * ## Where the clock / RNG live\n *\n * Inside the verbs: nowhere. Time arrives as `at` on `attempt` / `onTimer` and\n * is carried on the result / timer Msgs the consumer dispatches. Jitter RNG is\n * injected once at `createResilientCall(config, rng)` and threaded into\n * `nextDelayMs` at the verb boundary — deterministic in tests, `Math.random`\n * by default. The ONLY clock read is `Date.now()` inside the `handlers` port\n * (the effect boundary), exactly as `resilient-fetch.ts` stamps its result Msgs.\n *\n * ## Typical wiring\n *\n *   const rc = createResilientCall<string, Result>({\n *     cache: { ttlMs: 60_000 },\n *     circuit: { threshold: 5, cooldownMs: 30_000 },\n *     rateLimit: { capacity: 10, refillPerSec: 5 },\n *     retry: defaultRetryPolicy,\n *     deadline: { ms: 5_000 },\n *   });\n *\n *   // in the machine:\n *   init: () => [{ resilience: rc.init() }, []],\n *   update: {\n *     fetch:   (s, m) => lift(s, rc.attempt(s.resilience, m.key, m.input, m.at)),\n *     call_ok: (s, m) => lift(s, rc.succeed(s.resilience, m.key, m)),\n *     call_err:(s, m) => lift(s, rc.fail(s.resilience, m.key, m)),\n *     retry_due:(s, m) => lift(s, rc.onTimer(s.resilience, m)),\n *   },\n *   subscriptions: (s) => rc.subs(s.resilience),\n *   subscribe: { deadline: subscribeDeadline },\n *   interpret: rc.handlers({ run: ctx.call }),\n */\n\nimport {\n  get as cacheGet,\n  set as cacheSet,\n  initCache,\n  type TtlCache,\n} from \"../cache\";\nimport {\n  type CircuitState,\n  canPass,\n  initCircuit,\n  onFailure,\n  onSuccess,\n} from \"../circuit-breaker\";\nimport {\n  type DeadlineExceeded,\n  type DeadlineSub,\n  deadlineSub,\n  subscribeDeadline,\n} from \"../deadline\";\nimport { type Cmd, type NoCtx, tryInterpret } from \"../index\";\nimport { MsgType } from \"../protocol\";\nimport { initBucket, type TokenBucket, tryConsume } from \"../rate-limit\";\nimport {\n  asRng,\n  initRetry,\n  nextDelayMs,\n  type RetryPolicy,\n  type RetryState,\n  recordFailure,\n  shouldRetry,\n} from \"../retry-backoff\";\n\n// ===========================================================================\n// Config — the knob. Every brick optional; omit a brick → omit its gate.\n// ===========================================================================\n\n/** Circuit-breaker knob — only the two numbers a consumer ever tunes. */\nexport interface CircuitConfig {\n  /** Consecutive failures that trip the breaker open. */\n  readonly threshold: number;\n  /** How long the breaker stays open before admitting a probe, in ms. */\n  readonly cooldownMs: number;\n  /**\n   * Probes admitted in `half_open` before fast-failing the rest of the round.\n   * Defaults to 1 (a single probe decides recovery) — matches the circuit-\n   * breaker module's `defaultCircuitPolicy`.\n   */\n  readonly halfOpenMaxProbes?: number;\n}\n\n/** Token-bucket rate-limit knob. */\nexport interface RateLimitConfig {\n  /** Burst size — the bucket starts full at `capacity`. */\n  readonly capacity: number;\n  /** Steady-state refill rate, tokens per second. */\n  readonly refillPerSec: number;\n}\n\n/** Per-entry TTL cache knob. */\nexport interface CacheConfig {\n  /** How long a cached success stays fresh, in ms. */\n  readonly ttlMs: number;\n}\n\n/** Overall wall-clock deadline knob — an absolute cap per in-flight call. */\nexport interface DeadlineConfig {\n  /** Budget from the moment a call starts, in ms. */\n  readonly ms: number;\n}\n\n/**\n * The resilience knob. EVERY field is optional: omit a brick and its gate is\n * skipped entirely (the slice still carries a default brick state so the shape\n * stays uniform across configs, but the gate is never consulted). An empty\n * config `{}` is a valid pass-through — a bare effect with no resilience at all.\n */\nexport interface ResilientConfig {\n  readonly retry?: RetryPolicy;\n  readonly circuit?: CircuitConfig;\n  readonly rateLimit?: RateLimitConfig;\n  readonly cache?: CacheConfig;\n  readonly deadline?: DeadlineConfig;\n}\n\n// ===========================================================================\n// Slice — the Model field this knob owns. A flat record of brick states.\n// ===========================================================================\n\n/**\n * Per-key call phase. `key` indexes a logical call; several can be in flight at\n * once (the generalization of the example's single `url`). Discriminated on\n * `phase` so each phase carries only its own data (pattern 11):\n *\n *   - `idle`          — never attempted, or fully settled and forgotten.\n *   - `running`       — the effect Cmd is out; awaiting `succeed` / `fail`.\n *                       Carries `deadlineAtMs` (absolute cap, `0` if no deadline\n *                       brick) and the last `input` so a retry can re-issue it.\n *   - `waiting_retry` — a transient failure backed off; the retry timer is armed\n *                       for `retryAtMs`. Carries `input` for the re-attempt.\n *   - `circuit_open`  — the breaker fast-failed this attempt. Terminal for this\n *                       call until the consumer re-attempts after cooldown.\n *   - `succeeded`     — settled OK. `result` is the value the port produced.\n *   - `failed`        — settled Err (out of retries, or no retry brick). `error`\n *                       carries the last failure.\n */\nexport type CallPhase<I, R> =\n  | { readonly phase: \"idle\" }\n  | {\n      readonly phase: \"running\";\n      readonly input: I;\n      readonly deadlineAtMs: number;\n    }\n  | {\n      readonly phase: \"waiting_retry\";\n      readonly input: I;\n      readonly retryAtMs: number;\n      readonly deadlineAtMs: number;\n    }\n  | { readonly phase: \"circuit_open\" }\n  | { readonly phase: \"succeeded\"; readonly result: R }\n  | { readonly phase: \"failed\"; readonly error: unknown };\n\n/**\n * The slice. `circuit` / `bucket` are SHARED across keys (one downstream target\n * → one breaker, one bucket). `retry` and `cache` are PER KEY (each logical call\n * has its own backoff count + cached result), as is the per-call `CallPhase`.\n * Every field is plain data → the whole slice serializes into a `Store<S>`.\n *\n * `retry` / `cache` keep a default brick value even when the corresponding\n * config brick is omitted, so the slice shape is identical regardless of which\n * bricks the consumer enabled — the verbs simply never consult the unused brick.\n */\nexport interface ResilientState<I, R> {\n  readonly circuit: CircuitState;\n  readonly bucket: TokenBucket;\n  readonly retry: Readonly<Record<string, RetryState>>;\n  readonly cache: TtlCache<R>;\n  readonly calls: Readonly<Record<string, CallPhase<I, R>>>;\n}\n\n// ===========================================================================\n// Cmds + Msgs the knob speaks. Generic over the port input `I`.\n// ===========================================================================\n\n/**\n * The one effect this knob emits: \"run the port for `key` with `input`\". The\n * consumer's `handlers(ports)` interprets it; it carries no closure — `input`\n * is plain data (invariant 3).\n */\nexport type RunCmd<I> = Cmd<typeof MsgType.ResilientRun> & {\n  readonly key: string;\n  readonly input: I;\n};\n\n/** Settle Msgs the `handlers` port dispatches back. `at` is stamped at the boundary. */\nexport type SucceedMsg<R> = {\n  readonly type: typeof MsgType.ResilientOk;\n  readonly key: string;\n  readonly result: R;\n  readonly at: number;\n};\nexport type FailMsg = {\n  readonly type: typeof MsgType.ResilientErr;\n  readonly key: string;\n  readonly error: unknown;\n  readonly at: number;\n};\n\n/** The retry / deadline timer Msg — `DeadlineExceeded`, keyed by the call `key`. */\nexport type ResilientTimerMsg = DeadlineExceeded;\n\n/**\n * The plain-data error a deadline-failed call settles with. A `{_tag, ...}`\n * sentinel — NEVER a `new Error(...)` — so the slice stays JSON-serializable\n * (Error objects round-trip to `{}` and carry a stack trace, both of which break\n * the slice's durability invariant). `id` / `atMs` echo the timer that fired so\n * a consumer can attribute the failure to its deadline.\n */\nexport type DeadlineExceededError = {\n  readonly _tag: \"deadline_exceeded\";\n  readonly id: string;\n  readonly atMs: number;\n};\n\n/** Ports the consumer supplies to `handlers`. */\nexport interface ResilientPorts<I, R> {\n  /** The fallible work this knob wraps. Throws on failure → routed to `fail`. */\n  readonly run: (input: I, key: string) => Promise<R>;\n}\n\n// ===========================================================================\n// Internal brick-policy derivation — config → the L1 policy shapes.\n// ===========================================================================\n\n// A circuit policy is only built when the brick is configured; absence is\n// represented as `null` so the gate can short-circuit to \"always pass\".\nfunction circuitPolicy(config: ResilientConfig) {\n  if (config.circuit === undefined) return null;\n  return {\n    failureThreshold: config.circuit.threshold,\n    cooldownMs: config.circuit.cooldownMs,\n    halfOpenMaxProbes: config.circuit.halfOpenMaxProbes ?? 1,\n  };\n}\n\n// Sub-id families. Each call's retry timer is a deadline keyed by `key`, so a\n// machine running many concurrent calls reconciles each independently.\nfunction retryTimerId(key: string): string {\n  return `resilient:retry:${key}`;\n}\nfunction deadlineTimerId(key: string): string {\n  return `resilient:deadline:${key}`;\n}\n\n// ===========================================================================\n// The knob factory.\n// ===========================================================================\n\n/**\n * Build a resilient-call knob from `config`. `rng` is injected for retry\n * jitter — pass a fixed `() => 0.5` in tests to pin backoff; defaults to\n * `Math.random` (read at the verb boundary, never inside a brick op). It is\n * curried onto the factory rather than threaded through every verb so callers\n * spell the determinism choice once.\n *\n * Returns the uniform L2 knob contract. `I` is the port input type, `R` the\n * port result type.\n *\n * @deprecated Use `withResilience` from `@demlik/tea/with-resilience` — not\n * drop-in; see the migration map at the top of this module.\n */\nexport function createResilientCall<I, R>(\n  config: ResilientConfig,\n  rng: () => number = Math.random,\n) {\n  const cPolicy = circuitPolicy(config);\n  // Re-affirm the `[0, 1)` contract at the seam where the injected generator\n  // feeds the backoff math (brand from `../retry-backoff`). The factory's\n  // public param stays a plain `() => number` so transitive callers are\n  // unchanged; `asRng` is the single point it's branded for `nextDelayMs`.\n  const rngBranded = asRng(rng);\n\n  /** The starting slice. Bricks not in `config` still get a default value. */\n  function init(): ResilientState<I, R> {\n    return {\n      circuit: initCircuit(),\n      // The bucket carries a default value even without the rateLimit brick so\n      // the slice shape is uniform, but the rate-limit GATE is skipped entirely\n      // when the brick is absent (see `gate`) — the bucket is simply never\n      // consulted. A `0/0` placeholder bucket would be touched by `tryConsume`;\n      // a `1-cap` default is harmless because the gate never calls it.\n      bucket: config.rateLimit\n        ? initBucket(\n            config.rateLimit.capacity,\n            config.rateLimit.refillPerSec,\n            0,\n          )\n        : initBucket(1, 1, 0),\n      retry: {},\n      cache: initCache<R>(),\n      calls: {},\n    };\n  }\n\n  /** Read this key's retry state, defaulting to a fresh one. */\n  function retryOf(s: ResilientState<I, R>, key: string): RetryState {\n    return s.retry[key] ?? initRetry();\n  }\n\n  /** Compute the absolute deadline for a call starting at `at` (0 = no cap). */\n  function deadlineAt(at: number): number {\n    return config.deadline ? at + config.deadline.ms : 0;\n  }\n\n  /**\n   * The shared decision: cache → rate-limit → circuit gate, then either emit\n   * the effect or schedule a retry. `deadlineAtMs` is threaded so a re-attempt\n   * (from `onTimer`) keeps the ORIGINAL overall deadline rather than restarting\n   * it. PURE — `at` is the only clock; `rng` is the injected jitter source.\n   *\n   * Used by both `attempt` (fresh call) and `onTimer` (retry timer fired) so\n   * the gate logic lives in exactly one place — the example's shared `attempt`\n   * helper, lifted to a keyed knob.\n   *\n   * ## Why rate-limit is gated BEFORE the circuit probe\n   *\n   * The circuit-breaker's `canPass` is not a passive read: in `half_open` it\n   * *consumes* a probe slot (advancing `probes`), and the consumed slot is only\n   * released when a probe RESOLVES via `onSuccess` / `onFailure`. So a probe\n   * slot may only be taken when this attempt is actually going to reach the\n   * backend (i.e. emit the `resilient_run` Cmd). The rate-limit gate can reject\n   * an attempt and return a backoff WITHOUT any Cmd — no backend call, so no\n   * settle Msg ever comes back. If the circuit probe were consumed first, that\n   * rate-limited attempt would burn the half-open probe budget on a call that\n   * never happened, wedging the breaker `half_open` at its probe cap forever\n   * (nothing moves it out of `half_open` but a resolved probe). Running the\n   * rate-limit gate first means the circuit probe is consumed ONLY on the path\n   * that emits the effect.\n   */\n  function gate(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    at: number,\n    deadlineAtMs: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    // 1) Serve from cache if fresh — no effect at all. Skipped when no cache brick.\n    if (config.cache !== undefined) {\n      const cached = cacheGet(s.cache, key, at);\n      if (cached !== undefined) {\n        return [setCall(s, key, { phase: \"succeeded\", result: cached }), []];\n      }\n    }\n\n    // 2) Rate-limit gate FIRST — it may reject with no Cmd, so it must run\n    // before any circuit probe is consumed (see header note). Skipped entirely\n    // when no rateLimit brick — the bucket is never consulted, so the default\n    // placeholder bucket stays untouched.\n    let bucket = s.bucket;\n    if (config.rateLimit !== undefined) {\n      const [next, hasToken] = tryConsume(bucket, at);\n      bucket = next;\n      if (!hasToken) {\n        // Rate-limited: treat as a transient failure and back off via retry.\n        // The circuit is untouched — no probe is spent on a call that never ran.\n        return backoff(\n          { ...s, bucket },\n          key,\n          input,\n          \"rate_limited\",\n          at,\n          deadlineAtMs,\n        );\n      }\n    }\n\n    // 3) Circuit-breaker gate. `null` policy → no breaker → always pass. Reached\n    // only once a token is secured, so a half-open probe is consumed exclusively\n    // on the path that emits the effect below.\n    let circuit = s.circuit;\n    if (cPolicy !== null) {\n      const [next, ok] = canPass(circuit, cPolicy, at);\n      circuit = next;\n      if (!ok) {\n        return [\n          { ...setCall(s, key, { phase: \"circuit_open\" }), bucket, circuit },\n          [],\n        ];\n      }\n    }\n\n    // 4) All gates passed — emit the effect as data.\n    return [\n      {\n        ...setCall(s, key, { phase: \"running\", input, deadlineAtMs }),\n        circuit,\n        bucket,\n      },\n      [{ type: MsgType.ResilientRun, key, input }],\n    ];\n  }\n\n  /**\n   * Back off after a transient failure: record it, and if `retry` permits\n   * another attempt, enter `waiting_retry` with the retry timer armed; else\n   * settle `failed`. When no `retry` brick is configured the call fails on the\n   * first failure (no backoff, no timer). PURE.\n   */\n  function backoff(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    error: unknown,\n    at: number,\n    deadlineAtMs: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    if (config.retry === undefined) {\n      return [setCall(s, key, { phase: \"failed\", error }), []];\n    }\n    const retry = recordFailure(retryOf(s, key), error);\n    const withRetry = { ...s, retry: { ...s.retry, [key]: retry } };\n    if (!shouldRetry(retry, config.retry)) {\n      return [setCall(withRetry, key, { phase: \"failed\", error }), []];\n    }\n    const retryAtMs = at + nextDelayMs(retry, config.retry, rngBranded);\n    return [\n      setCall(withRetry, key, {\n        phase: \"waiting_retry\",\n        input,\n        retryAtMs,\n        deadlineAtMs,\n      }),\n      [],\n    ];\n  }\n\n  // Set the phase for one key, leaving every other field untouched.\n  function setCall(\n    s: ResilientState<I, R>,\n    key: string,\n    phase: CallPhase<I, R>,\n  ): ResilientState<I, R> {\n    return { ...s, calls: { ...s.calls, [key]: phase } };\n  }\n\n  // === Verb: attempt =======================================================\n\n  /**\n   * Start (or restart) the call for `key` with `input` at time `at`. Runs the\n   * cache → circuit → rate-limit gate and either emits the `resilient_run`\n   * effect, schedules a retry, fast-fails (circuit open), or serves the cache.\n   * PURE.\n   */\n  function attempt(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    at: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    return gate(s, key, input, at, deadlineAt(at));\n  }\n\n  // === Verb: succeed =======================================================\n\n  /**\n   * Record a success for `key`: close the breaker, fill the cache (if a cache\n   * brick exists), reset this key's retry count, and settle `succeeded`. PURE —\n   * `msg.at` is the cache write clock.\n   */\n  function succeed(\n    s: ResilientState<I, R>,\n    key: string,\n    msg: SucceedMsg<R>,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    const circuit =\n      cPolicy !== null ? onSuccess(s.circuit, cPolicy) : s.circuit;\n    const cache =\n      config.cache !== undefined\n        ? cacheSet(s.cache, key, msg.result, msg.at, config.cache.ttlMs)\n        : s.cache;\n    // Drop this key's retry counter — a success ends the retry run.\n    const { [key]: _dropped, ...retry } = s.retry;\n    return [\n      {\n        ...setCall(s, key, { phase: \"succeeded\", result: msg.result }),\n        circuit,\n        cache,\n        retry,\n      },\n      [],\n    ];\n  }\n\n  // === Verb: fail ==========================================================\n\n  /**\n   * Record a failure for `key`: trip the breaker (it may open), then back off —\n   * schedule a retry if `retry` permits, else settle `failed`. PURE — `msg.at`\n   * stamps the breaker trip + the retry delay base. Re-issues from the call's\n   * remembered `input` and preserves the original overall `deadlineAtMs`.\n   */\n  function fail(\n    s: ResilientState<I, R>,\n    key: string,\n    msg: FailMsg,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    const circuit =\n      cPolicy !== null ? onFailure(s.circuit, cPolicy, msg.at) : s.circuit;\n    const withCircuit = { ...s, circuit };\n    const call = s.calls[key];\n    const input = call?.phase === \"running\" ? call.input : undefined;\n    const deadlineAtMs =\n      call?.phase === \"running\" ? call.deadlineAtMs : deadlineAt(msg.at);\n    // No remembered input (e.g. a stray fail for a key not running) → just\n    // settle failed after tripping the breaker; nothing to re-issue.\n    if (input === undefined) {\n      return [\n        setCall(withCircuit, key, { phase: \"failed\", error: msg.error }),\n        [],\n      ];\n    }\n    return backoff(withCircuit, key, input, msg.error, msg.at, deadlineAtMs);\n  }\n\n  // === Verb: settleFailed ==================================================\n\n  /**\n   * Settle `key` to terminal `failed` with `error` WITHOUT touching the circuit\n   * breaker or this key's retry counter. PURE.\n   *\n   * This is the verb for a failure that is NOT a downstream-health signal: the\n   * call must end now, but the breaker must not trip and the backoff run must\n   * not advance. `fail` is the opposite — it records the failure against the\n   * breaker (it may open) and feeds the retry policy (it may back off). Use\n   * `settleFailed` when the *reason* the call cannot proceed has nothing to do\n   * with downstream health:\n   *\n   *   - `authed-call` settles a 401 it cannot fix (e.g. the refresh budget is\n   *     spent): a bad token is the caller's problem, not the backend's —\n   *     tripping the breaker on it would punish a healthy target, and backing\n   *     off would just retry a request that will 401 again.\n   *   - `paginated-walk` settles a terminal walk error (e.g. a malformed page\n   *     the consumer rejects) that should stop the walk without poisoning the\n   *     shared breaker the next page fetch passes through.\n   *\n   * Because it leaves `circuit` and `retry[key]` untouched, the breaker keeps\n   * its health view of the actual backend and a later `attempt` for this key\n   * starts a fresh retry run. Both sibling knobs previously hand-rolled this by\n   * splicing `calls` directly; this verb gives them one named, tested entry\n   * point so the slice's settle invariants live in exactly one place.\n   */\n  function settleFailed(\n    s: ResilientState<I, R>,\n    key: string,\n    error: unknown,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    return [setCall(s, key, { phase: \"failed\", error }), []];\n  }\n\n  // === Verb: onTimer =======================================================\n\n  /**\n   * A timer fired for some key. Two kinds, disambiguated by the Sub id:\n   *\n   *   - retry timer    → re-run the gate for that key's remembered input,\n   *                      re-checking the circuit + bucket at THIS time.\n   *   - deadline timer → the overall budget elapsed → settle `failed` with a\n   *                      deadline error, no matter the current phase.\n   *\n   * A timer for a key no longer `waiting_retry` (retry) / no longer in flight\n   * (deadline) is a no-op — the reconcile pass races the result; the verb must\n   * tolerate a stale fire. PURE.\n   */\n  function onTimer(\n    s: ResilientState<I, R>,\n    msg: ResilientTimerMsg,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    for (const [key, call] of Object.entries(s.calls)) {\n      if (msg.id === retryTimerId(key)) {\n        if (call.phase !== \"waiting_retry\") return [s, []];\n        return gate(s, key, call.input, msg.atMs, call.deadlineAtMs);\n      }\n      if (msg.id === deadlineTimerId(key)) {\n        // Deadline only fires for a still-active call. A settled call has no\n        // armed deadline Sub, but tolerate a stale fire defensively.\n        if (call.phase !== \"running\" && call.phase !== \"waiting_retry\")\n          return [s, []];\n        // Plain-data sentinel, NOT a `new Error(...)`: an Error object is not\n        // JSON-serializable (it round-trips to `{}`) and captures a stack trace,\n        // both of which break the slice's durability invariant once it is\n        // persisted into a `Store<S>` and reloaded. A `{_tag, ...}` record keeps\n        // the slice round-trip-equal under JSON.parse(JSON.stringify(...)).\n        return [\n          setCall(s, key, {\n            phase: \"failed\",\n            error: {\n              _tag: \"deadline_exceeded\",\n              id: msg.id,\n              atMs: msg.atMs,\n            } satisfies DeadlineExceededError,\n          }),\n          [],\n        ];\n      }\n    }\n    return [s, []];\n  }\n\n  // === Subs ================================================================\n\n  /**\n   * Pre-wired subscriptions: a retry timer for every `waiting_retry` call, and\n   * (when the `deadline` brick is configured) an overall deadline timer for\n   * every still-active call. Both are `DeadlineSub`s reconciled by id, so a\n   * phase change cancels the matching timer automatically — no manual\n   * `clearTimeout`. Wire `subscribe: { deadline: subscribeDeadline }`.\n   */\n  function subs(s: ResilientState<I, R>): readonly DeadlineSub[] {\n    const out: DeadlineSub[] = [];\n    for (const [key, call] of Object.entries(s.calls)) {\n      if (call.phase === \"waiting_retry\") {\n        out.push(deadlineSub(retryTimerId(key), call.retryAtMs));\n      }\n      if (\n        config.deadline !== undefined &&\n        (call.phase === \"running\" || call.phase === \"waiting_retry\") &&\n        call.deadlineAtMs > 0\n      ) {\n        out.push(deadlineSub(deadlineTimerId(key), call.deadlineAtMs));\n      }\n    }\n    return out;\n  }\n\n  // === Handlers ============================================================\n\n  /**\n   * Pre-wired interpret handler for `resilient_run`. Wraps the consumer's\n   * `run` port via `tryInterpret` (Railway): success → `resilient_ok`, failure\n   * → `resilient_err`, each stamped with `Date.now()` at the effect boundary —\n   * the ONE permitted clock read (interpret is impure; the reducer never reads\n   * the clock). Assign to the machine's `interpret`:\n   *\n   *   interpret: rc.handlers({ run: (input, key) => ctx.callBackend(input) })\n   */\n  function handlers(ports: ResilientPorts<I, R>) {\n    return {\n      resilient_run: tryInterpret<\n        RunCmd<I>,\n        R,\n        SucceedMsg<R> | FailMsg,\n        // The work fn reads nothing from ctx — it forwards `cmd.input` to the\n        // consumer-supplied `run` port. `NoCtx` (not `unknown`) marks this as a\n        // DELIBERATE context-free seam, so callers see intent, not looseness.\n        NoCtx\n      >(\n        (cmd) => ports.run(cmd.input, cmd.key),\n        (result, cmd): SucceedMsg<R> => ({\n          type: MsgType.ResilientOk,\n          key: cmd.key,\n          result,\n          at: Date.now(),\n        }),\n        (error, cmd): FailMsg => ({\n          type: MsgType.ResilientErr,\n          key: cmd.key,\n          error,\n          at: Date.now(),\n        }),\n      ),\n    };\n  }\n\n  return {\n    init,\n    attempt,\n    succeed,\n    fail,\n    settleFailed,\n    onTimer,\n    subs,\n    handlers,\n  };\n}\n\n/**\n * Lift a knob result `[slice, cmds]` into a host `[State, cmds]` where the\n * slice lives at `state.resilience`. A convenience for the common single-slice\n * host; consumers with a differently-named field spread by hand. Pure — a thin\n * record rebuild, no clock / RNG.\n *\n * @deprecated Use `withResilience` from `@demlik/tea/with-resilience` — the\n * wrapper owns `model.$resilience`, so there is nothing to lift; see the\n * migration map at the top of this module.\n */\nexport function liftResilience<\n  S extends { resilience: ResilientState<I, R> },\n  I,\n  R,\n  C extends Cmd,\n>(\n  state: S,\n  [slice, cmds]: readonly [ResilientState<I, R>, readonly C[]],\n): readonly [S, readonly C[]] {\n  return [{ ...state, resilience: slice }, cmds];\n}\n\n/**\n * Re-export the deadline Sub primitives so consumers (and tests) wire one\n * import: `subscribeDeadline` is the `subscribe` cell, `deadlineSub` builds the\n * Sub literal this knob's `subs` emits.\n */\nexport { subscribeDeadline, deadlineSub };\nexport type { DeadlineSub, DeadlineExceeded };\n"]}

package/dist/chunk-6VDCTR7N.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"names":["state","opts"],"mappings":";;;AAyGO,SAAS,OAAO,CAAA,EAAiB;AACtC,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,KAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAAE,CAAA;AACrD;AAgBO,IAAM,OAAO,CAClB,KAAA,EACA,SAC+B,CAAC,KAAA,EAAO,EAAE;AAK3C,IAAM,gBAAA,uBAAuB,GAAA,EAAY;AASlC,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,wBAAA;AAAA,EACzB,YAAY,QAAA,EAAkB;AAC5B,IAAA,KAAA;AAAA,MACE,6BAA6B,QAAQ,CAAA,+IAAA;AAAA,KAGvC;AAAA,EACF;AACF;AAUO,SAAS,mBAAA,GAA4B;AAC1C,EAAA,gBAAA,CAAiB,KAAA,EAAM;AACzB;AAgFA,SAAS,cAAA,CAAe,OAAgB,QAAA,EAAqC;AAC3E,EAAA,UAAA,CAAW,MAAM;AACf,IAAA,MAAM,KAAA;AAAA,EACR,GAAG,CAAC,CAAA;AACN;AA2FA,SAAS,qBACP,WAAA,EAC6B;AAC7B,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,EAAE,UAAU,MAAA,EAAO;AACzD,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,EAAU,OAAO,EAAE,UAAU,WAAA,EAAY;AACpE,EAAA,OAAO,WAAA;AACT;AAYO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAEhD,YAA4B,UAAA,EAAoB;AAC9C,IAAA,KAAA;AAAA,MACE,sDAAsD,UAAU,CAAA,yOAAA;AAAA,KAKlE;AAP0B,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAQ5B;AAAA,EATkB,IAAA,GAAO,wBAAA;AAU3B;AAgBO,SAAS,WAAc,IAAA,EAAuB;AASnD,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA;AACb,IAAA,KAAA,GAAQ,IAAA,EAAM,GAAA,KAAQ,KAAA,CAAA,IAAa,IAAA,EAAM,GAAA,KAAQ,IAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,KAAA,GAAQ,KAAA;AAAA,EACV;AACA,EAAA,IAAI,CAAC,KAAA,IAAS,gBAAA,CAAiB,GAAA,CAAI,IAAI,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,uBAAuB,IAAI,CAAA;AAAA,EACvC;AACA,EAAA,gBAAA,CAAiB,IAAI,IAAI,CAAA;AACzB,EAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,IAAA,EAAK;AACjC;AA6ZO,SAAS,cAMd,CAAA,EAAuD;AAMvD,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAA,CAAO,cAAA,CAAe,GAAG,QAAA,EAAU;AAAA,MACjC,KAAA,EAAO,gBAAA,CAAiB,CAAA,CAAE,MAAgB,CAAA;AAAA,MAC1C,UAAA,EAAY,KAAA;AAAA,MACZ,QAAA,EAAU,KAAA;AAAA,MACV,YAAA,EAAc;AAAA,KACf,CAAA;AAAA,EACH;AACA,EAAA,OAAO,CAAA;AACT;AAkBO,SAAS,UACd,OAAA,EAC2B;AAC3B,EAAA,OAAO,OAAA;AACT;AAuCO,SAAS,GAAA,CAQd,SACA,IAAA,EAgDyB;AACzB,EAAA,MAAM,EAAE,OAAM,GAAI,IAAA;AAMlB,EAAA,MAAM,GAAA,GAAO,IAAA,CAAK,GAAA,IAAO,EAAC;AAC1B,EAAA,MAAM,OAAA,GAAU,KAAK,SAAA,IAAa,GAAA;AAIlC,EAAA,MAAM,aAAA,GACJ,IAAA,CAAK,MAAA,KAAW,MAAM,EAAC,CAAA;AAIzB,EAAA,MAAM,UAAA,GAAoC,IAAA,CAAK,QAAA,KAAa,MAAM,KAAA,CAAA;AAKlE,EAAA,MAAM,OAAA,GAAmB,KAAK,OAAA,IAAW,cAAA;AAIzC,EAAA,MAAM,WAAA,GAAc,CAAC,KAAA,EAAgB,OAAA,KAAuC;AAC1E,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IACxB,SAAS,SAAA,EAAW;AAClB,MAAA,cAAA,CAAe,SAAkB,CAAA;AAAA,IACnC;AAAA,EACF,CAAA;AAIA,EAAA,MAAM,WAAA,GAAc,oBAAA,CAA2B,IAAA,CAAK,WAAW,CAAA;AAI/D,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,SAAA,GAAqB,IAAA;AACzB,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAwB;AAChD,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAgB;AAKtC,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAgC;AAKtD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAwB;AACjD,EAAA,IAAI,MAAA,GAAS,KAAA;AAOb,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAqC;AAM/D,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAwB;AAQhD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAkD;AAM3E,EAAA,SAAS,QAAA,CAAY,MAAe,KAAA,EAAgB;AAClD,IAAA,MAAM,WAAA,GAAc,YAAA,CAAa,GAAA,CAAI,IAAqB,CAAA;AAC1D,IAAA,IAAI,CAAC,WAAA,IAAe,WAAA,CAAY,IAAA,KAAS,CAAA,EAAG;AAC5C,IAAA,KAAA,MAAW,YAAY,WAAA,EAAa;AAClC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAK,CAAA;AAAA,MAChB,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAKA,EAAA,MAAM,YAAA,GAAkC,EAAE,GAAG,GAAA,EAAK,MAAM,QAAA,EAAS;AAOjE,EAAA,SAAS,WAAA,CAAYA,QAAU,GAAA,EAAoC;AACjE,IAAA,IAAI,OAAA,aAAoBA,MAAK,CAAA;AAC7B,IAAA,MAAM,MAAA,GAAS,SAAA,CAAmB,OAAA,EAASA,MAAAA,EAAO,GAAG,CAAA;AACrD,IAAA,IAAI,OAAA,EAAS,gBAAA,CAAiB,MAAA,EAAQ,GAAA,CAAI,IAAI,CAAA;AAC9C,IAAA,OAAO,MAAA;AAAA,EACT;AAMA,EAAA,IAAI,IAAA,GAAsB,QAAQ,OAAA,EAAQ;AAY1C,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AAC5B,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,aAAA,CAAc,KAAU,CAAA;AAChD,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AASnC,IAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAChD,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAC3C,MAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,GAAA,CAAI,IAAA,EAAM;AACnD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sCAAsC,GAAA,CAAI,EAAE,uBAAuB,QAAQ,CAAA,YAAA,EAAe,IAAI,IAAI,CAAA,CAAA;AAAA,SACpG;AAAA,MACF;AACA,MAAA,eAAA,CAAgB,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,GAAA,CAAI,IAAI,CAAA;AAAA,IACtC;AAGA,IAAA,KAAA,MAAW,GAAA,IAAO,OAAA,EAAS,UAAA,CAAW,GAAA,CAAI,IAAI,EAAE,CAAA;AAChD,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,CAAA,IAAK,WAAA,EAAa;AACvC,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA,EAAG;AACvB,QAAA,IAAI;AACF,UAAA,OAAA,EAAQ;AAAA,QACV,SAAS,GAAA,EAAK;AACZ,UAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,aAAA,EAAe,CAAA;AAAA,QAC3C;AACA,QAAA,WAAA,CAAY,OAAO,EAAE,CAAA;AAAA,MACvB;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,GAA2B,IAAA;AAC/B,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA,EAAG;AAC7B,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,SAAA,GAAY,GAAA,CAAI,IAAiB,CAAA;AACzD,MAAA,IAAI,CAAC,OAAA,EAAS;AAIZ,QAAA;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,OAAA;AAAA,UACd,GAAA;AAAA,UACA,GAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,WAAA,CAAY,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,OAAO,CAAA;AAAA,MACjC,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,eAAA,KAAoB,MAAM,eAAA,GAAkB,GAAA;AAAA,MAElD;AAAA,IACF;AACA,IAAA,IAAI,eAAA,KAAoB,MAAM,MAAM,eAAA;AAAA,EACtC;AAgBA,EAAA,MAAM,YAAA,GACH,OAAA,CAAyC,SAAA,IAAc,EAAC;AAU3D,EAAA,eAAe,aAAa,IAAA,EAAmC;AAC7D,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,IAAiB,CAAA;AAClD,MAAA,IAAI,CAAC,OAAA,EAAS;AACd,MAAA,MAAM,SAAS,MAAM,OAAA;AAAA,QACnB,GAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,EAAM;AAQ3C,QAAA,eAAA,CAAgB,MAAW,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACrD,UAAA,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,QAC3C,CAAC,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAQA,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,MAAA,IAAI;AACF,QAAA,QAAA,EAAS;AAAA,MACX,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AASA,EAAA,SAAS,cAAc,GAAA,EAAc;AACnC,IAAA,IAAI,SAAA,CAAU,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACjD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAK,QAAQ,CAAA;AAAA,MACxB,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAUA,EAAA,SAAS,WAAW,GAAA,EAAc;AAChC,IAAA,IAAI,aAAA,CAAc,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACrD,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AACnC,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3C,MAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,MAAA,KAAA,MAAW,WAAW,MAAA,EAAQ;AAC5B,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf,SAAS,GAAA,EAAK;AACZ,UAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAAA,QACrC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAQA,EAAA,SAAS,QAAA,GAAiB;AACxB,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,IAAI,YAAA,CAAa,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACpD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,KAAA,MAAW,WAAW,YAAA,EAAc;AAClC,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,QAAQ,CAAA;AAAA,MAClB,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AAWA,EAAA,SAAS,iBAAA,GAA0B;AACjC,IAAA,IAAI,WAAA,CAAY,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACnD,IAAA,IAAI,CAAC,UAAA,CAAW,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,WAAW,CAAA;AAC9B,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,OAAA,IAAW,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,EAChD;AASA,EAAA,eAAe,MAAA,CAAO,IAAA,EAAS,GAAA,EAAQ,IAAA,EAAmC;AACxE,IAAA,KAAA,GAAQ,IAAA;AACR,IAAA,IAAI,KAAA,EAAO,MAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAIhC,IAAA,aAAA,EAAc;AACd,IAAA,MAAM,aAAa,IAAI,CAAA;AACvB,IAAA,aAAA,EAAc;AACd,IAAA,aAAA,CAAc,GAAG,CAAA;AACjB,IAAA,UAAA,CAAW,GAAG,CAAA;AACd,IAAA,iBAAA,EAAkB;AAAA,EACpB;AAWA,EAAA,eAAe,aAAa,GAAA,EAAuB;AACjD,IAAA,IAAI,UAAU,MAAA,EAAW;AAEvB,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAKA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,IAAA,EAAM,IAAI,CAAA,GAAI,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,IACvC,SAAS,WAAA,EAAa;AAEpB,MAAA,WAAA,CAAY,WAAA,EAAa,EAAE,KAAA,EAAO,QAAA,EAAU,CAAA;AAC5C,MAAA,QAAQ,YAAY,QAAA;AAAU,QAC5B,KAAK,SAAA,EAAW;AASd,UAAA,MAAM,MAAA,CAAO,YAAY,SAAA,CAAU,KAAA,EAAO,KAAK,WAAW,CAAA,EAAG,GAAA,EAAK,EAAE,CAAA;AACpE,UAAA;AAAA,QACF;AAAA,QACA,KAAK,UAAA;AAIH,UAAA,MAAM,WAAA;AAAA,QACR;AAKE,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,MAAM,WAAA;AAAA;AACV,IACF;AACA,IAAA,MAAM,MAAA,CAAO,IAAA,EAAM,GAAA,EAAK,IAAI,CAAA;AAAA,EAC9B;AAqCA,EAAA,IAAI,kBAAgC,EAAC;AACrC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,CAAC,YAAA,EAAc,QAAQ,IAAI,OAAA,CAAQ,IAAA,CAAK,MAAM,GAAG,CAAA;AACvD,IAAA,KAAA,GAAQ,YAAA;AACR,IAAA,eAAA,GAAkB,QAAA;AAAA,EACpB;AAEA,EAAA,eAAe,eAAA,GAAiC;AAC9C,IAAA,IAAI,KAAA,EAAO;AAQT,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,EAAK;AAC7B,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAChC,MAAA,MAAM,CAAC,YAAA,EAAc,QAAQ,IAAI,OAAA,CAAQ,IAAA,CAAK,QAAQ,GAAG,CAAA;AACzD,MAAA,KAAA,GAAQ,YAAA;AACR,MAAA,eAAA,GAAkB,QAAA;AAClB,MAAA,MAAM,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,aAAA,EAAc;AACd,IAAA,MAAM,aAAa,eAAe,CAAA;AAClC,IAAA,aAAA,EAAc;AAId,IAAA,QAAA,EAAS;AAGT,IAAA,iBAAA,EAAkB;AAAA,EACpB;AAYA,EAAA,SAAS,gBAAgB,GAAA,EAAuB;AAC9C,IAAA,IAAI,OAAA;AACF,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AACjE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,MAAM;AAC3B,MAAA,IAAI,SAAA,KAAc,MAAM,MAAM,SAAA;AAC9B,MAAA,OAAO,aAAa,GAAG,CAAA;AAAA,IACzB,CAAC,CAAA;AAID,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAC1B,IAAA,OAAO,IAAA;AAAA,EACT;AAgBA,EAAA,eAAe,iBAAA,GAAmC;AAChD,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,EAAS,CAAA,EAAA,EAAK;AAChC,MAAA,MAAM,QAAA,GAAW,IAAA;AACjB,MAAA,MAAM,QAAA;AACN,MAAA,IAAI,SAAS,QAAA,EAAU;AAAA,IACzB;AACA,IAAA,MAAM,IAAI,uBAAuB,OAAO,CAAA;AAAA,EAC1C;AAYA,EAAA,eAAe,oBAAA,CACb,KACAC,KAAAA,EACe;AACf,IAAA,MAAM,gBAAgB,GAAG,CAAA;AACzB,IAAA,IAAIA,KAAAA,EAAM,WAAW,MAAA,EAAQ;AAC7B,IAAA,MAAM,iBAAA,EAAkB;AAAA,EAC1B;AAaA,EAAA,MAAM,cAAc,eAAA,EAAgB;AACpC,EAAA,IAAA,GAAO,WAAA,CAAY,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChC,IAAA,SAAA,GAAY,GAAA;AAAA,EACd,CAAC,CAAA;AASD,EAAA,MAAM,eAA0C,WAAA,CAAY,IAAA;AAAA,IAC1D,MAAM;AAAA,GACR;AAEA,EAAA,MAAM,OAAA,GAA4B;AAAA,IAChC,QAAA,EAAU,oBAAA;AAAA,IACV,YAAA,EAAc,eAAA;AAAA,IACd,QAAA,GAAc;AAaZ,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IACA,UAAU,QAAA,EAAkC;AAC1C,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,MAC3B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,QAAQ,QAAA,EAAkD;AACxD,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,MAC3B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,OAAO,OAAA,EAAyC;AAI9C,MAAA,IAAI,MAAA,IAAU,UAAU,MAAA,EAAW;AACjC,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf,SAAS,GAAA,EAAK;AACZ,UAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA;AAAA,QACpC;AACA,QAAA,OAAO,MAAM;AAAA,QAAC,CAAA;AAAA,MAChB;AACA,MAAA,YAAA,CAAa,IAAI,OAAO,CAAA;AACxB,MAAA,OAAO,MAAM;AACX,QAAA,YAAA,CAAa,OAAO,OAAO,CAAA;AAAA,MAC7B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,EAAA,CACE,MACA,OAAA,EACY;AAKZ,MAAA,IAAI,MAAA,GAAS,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AACnC,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,MAAA,uBAAa,GAAA,EAAwB;AACrC,QAAA,aAAA,CAAc,GAAA,CAAI,MAAM,MAAM,CAAA;AAAA,MAChC;AACA,MAAA,MAAM,MAAA,GAAS,OAAA;AACf,MAAA,MAAA,CAAO,IAAI,MAAM,CAAA;AACjB,MAAA,OAAO,MAAM;AACX,QAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AAClC,QAAA,IAAI,QAAQ,MAAA,EAAW;AACvB,QAAA,GAAA,CAAI,OAAO,MAAM,CAAA;AACjB,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,CAAA,EAAG,aAAA,CAAc,OAAO,IAAI,CAAA;AAAA,MAC/C,CAAA;AAAA,IACF,CAAA;AAAA,IACA,aAAA,CAAiB,MAAe,QAAA,EAA0C;AACxE,MAAA,MAAM,GAAA,GAAM,IAAA;AACZ,MAAA,IAAI,MAAA,GAAS,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACjC,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,uBAAa,GAAA,EAA8B;AAC3C,QAAA,YAAA,CAAa,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,MAC9B;AAIA,MAAA,MAAM,MAAA,GAAS,QAAA;AACf,MAAA,MAAA,CAAO,IAAI,MAAM,CAAA;AACjB,MAAA,OAAO,MAAM;AACX,QAAA,MAAM,GAAA,GAAM,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AAChC,QAAA,IAAI,CAAC,GAAA,EAAK;AACV,QAAA,GAAA,CAAI,OAAO,MAAM,CAAA;AACjB,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,CAAA,EAAG,YAAA,CAAa,OAAO,GAAG,CAAA;AAAA,MAC7C,CAAA;AAAA,IACF,CAAA;AAAA,IACA,QAAA,CAAY,MAAe,KAAA,EAAgB;AAKzC,MAAA,QAAA,CAAS,MAAM,KAAK,CAAA;AAAA,IACtB,CAAA;AAAA;AAAA;AAAA;AAAA,IAIA,KAAA,EAAO,YAAA;AAAA,IACP,IAAA,GAAsB;AAOpB,MAAA,OAAO,iBAAA,EAAkB;AAAA,IAC3B,CAAA;AAAA,IACA,MAAA,GAAwB;AAKtB,MAAA,MAAM,OAAA,GAAU,KAAA;AAChB,MAAA,OAAO,UAAA,CAAW,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AAAA,IACzC,CAAA;AAAA,IACA,IAAA,GAAmB;AAGjB,MAAA,MAAM,OAAA,GAAU,KAAA;AAChB,MAAA,IAAI,WAAW,OAAO,CAAA,EAAG,OAAO,OAAA,CAAQ,QAAQ,OAAO,CAAA;AAIvD,MAAA,OAAO,IAAI,OAAA,CAAW,CAAC,OAAA,KAAY;AACjC,QAAA,WAAA,CAAY,IAAI,OAAO,CAAA;AAAA,MACzB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,IAAA,GAAsB;AAC1B,MAAA,OAAA,GAAU,IAAA;AAIV,MAAA,MAAM,IAAA;AAGN,MAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,CAAA,IAAK,WAAA,EAAa;AACvC,QAAA,IAAI;AACF,UAAA,OAAA,EAAQ;AAAA,QACV,SAAS,GAAA,EAAK;AACZ,UAAA,WAAA,CAAY,GAAA,EAAK,EAAE,KAAA,EAAO,aAAA,EAAe,CAAA;AAAA,QAC3C;AACA,QAAA,WAAA,CAAY,OAAO,EAAE,CAAA;AAAA,MACvB;AAKA,MAAA,IAAI,KAAA,IAAS,KAAA,KAAU,MAAA,IAAa,SAAA,KAAc,IAAA,EAAM;AACtD,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,QACxB,SAAS,KAAA,EAAO;AACd,UAAA,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,OAAO,OAAA;AACT;AA6EO,SAAS,cAAA,CACd,SACA,IAAA,EACsB;AACtB,EAAA,MAAM,SAAwC,EAAC;AAC/C,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,KAA6C;AACzD,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,IAAA,EAAM,MAAA,CAAO,KAAA,EAAM;AAAA,EACzC,CAAA;AAMA,EAAA,MAAM,SAAA,GACJ,IAAA,IAAQ,CAAA,GACJ,MAAY;AAAA,EAAC,CAAA,GACb,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAK,KAAA,KAAU;AAC9B,IAAA,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA;AAAA,EACrB,CAAC,CAAA;AACP,EAAA,MAAM,MAAA,GACJ,IAAA,IAAQ,CAAA,GACJ,MAAY;AAAA,EAAC,CAAA,GACb,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,KAAU;AACxB,IAAA,IAAA,CAAK,EAAE,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,CAAA;AAAA,EAC3B,CAAC,CAAA;AAEP,EAAA,OAAO;AAAA,IACL,QAAA,GAAW;AAGT,MAAA,OAAO,OAAO,KAAA,EAAM;AAAA,IACtB,CAAA;AAAA,IACA,IAAA,GAAO;AACL,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,SAAA,EAAU;AACV,MAAA,MAAA,EAAO;AAAA,IACT;AAAA,GACF;AACF;AAgBO,SAAS,MAAA,CAOd,SACA,IAAA,EACoC;AAGpC,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA;AAC9B,EAAA,MAAM,CAAC,cAAc,QAAQ,CAAA,GAAI,QAAQ,IAAA,CAAK,MAAA,EAAQ,KAAK,GAAG,CAAA;AAE9D,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KASF;AAAA,EACF;AAOA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,UAAA,EAAW,GAAI,WAAA;AAAA,IAClC,OAAA;AAAA,IACA,YAAA;AAAA,IACA,IAAA,CAAK;AAAA,GACP;AACA,EAAA,MAAM,IAAA,GAAY,CAAC,GAAG,QAAA,EAAU,GAAG,UAAU,CAAA;AAE7C,EAAA,MAAM,IAAA,GAAY,OAAA,CAAQ,aAAA,GACtB,CAAC,GAAG,QAAQ,aAAA,CAAc,KAAK,CAAC,CAAA,GAChC,EAAC;AAEL,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,IAAA,EAAK;AAC7B;AAiBO,SAAS,YAAA,CACd,IAAA,EACA,IAAA,EACA,KAAA,EACkC;AAClC,EAAA,OAAO,OAAO,KAAK,GAAA,KAAQ;AACzB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW;AAAA,MACrC,GAAA,EAAK,MAAM,IAAA,CAAK,GAAA,EAAK,GAAG,CAAA;AAAA,MACxB,KAAA,EAAO,CAAC,KAAA,KAA4B;AAAA,KACrC,CAAA;AACD,IAAA,OAAO,OAAO,KAAA,CAAM;AAAA,MAClB,EAAA,EAAI,CAAC,KAAA,KAAU,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,MAC9B,GAAA,EAAK,CAAC,KAAA,KAAU,KAAA,CAAM,OAAO,GAAG;AAAA,KACjC,CAAA;AAAA,EACH,CAAA;AACF","file":"chunk-6VDCTR7N.js","sourcesContent":["/**\n * @demlik/tea — TEA-faithful state machine substrate.\n *\n * This module exposes the full Locked API Surface from the PRD as types and\n * implements `defineMachine` (identity, task 1), `run` (task 2), and\n * `replay` + `tryInterpret` (task 3).\n *\n * `replay` is the pure unit-test tool: it composes `init` + `update` only,\n * never touches `Store`, never calls `interpret`, never starts subscriptions.\n *\n * `tryInterpret` is Railway sugar — wraps a fallible async function and routes\n * Ok/Err to two Msg constructors via better-result.\n */\n\nimport { Result } from \"better-result\";\nimport type {\n  Machine,\n  Port,\n  PortEmitter,\n  Reducer,\n  Sub,\n  Transitions,\n} from \"./pure/core\";\nimport {\n  __DEV__,\n  applyCell,\n  assertPureResult,\n  type Cmd,\n  deepFreeze,\n  detectUpdateForm,\n  foldUpdates,\n} from \"./pure/core\";\n\nexport type {\n  ContextFree,\n  Interpret,\n  Machine,\n  NoCtx,\n  Port,\n  PortEmitter,\n  Reducer,\n  Sub,\n  SubId,\n  Subscribe,\n  SyncReturn,\n  Transitions,\n  UpdateForm,\n} from \"./pure/core\";\n// Re-export the pure-core surface so the root `@demlik/tea` entry is unchanged\n// (additive; the runtime-free guarantee lives on `@demlik/tea/pure`).\nexport {\n  applyCell,\n  Cmd,\n  detectUpdateForm,\n  foldMsgs,\n  formOf,\n  msgKeysOf,\n  NoCellError,\n  subId,\n} from \"./pure/core\";\n\n// The nominal brand minted ONLY through the validated construction path\n// (`asReducer` / `defineMachine`). Mirrors `retry-backoff`'s `RngBrand`: a raw\n// record of handlers is a structural `Reducer<S, M, C>`, but a `Reducer` that\n// also carries this phantom brand is one that has passed through the single\n// minting boundary. The brand is an *optional* phantom so the structural\n// `Reducer<S, M, C>` annotation form (`const update: Reducer<...> = { ... }`)\n// keeps accepting plain object literals — the guard that actually rejects an\n// async reducer is `SyncReturn`'s non-thenable return, enforced on every cell.\ndeclare const ReducerBrand: unique symbol;\n\n// A `Reducer` (or `Transitions`) that has been minted through `asReducer` /\n// `defineMachine`. Carries the phantom brand; otherwise identical to its\n// structural counterpart.\nexport type Branded<T> = T & { readonly [ReducerBrand]: true };\n\n// === absurd: compile-time exhaustiveness assertion ===\n//\n// Use in default branches of switches over discriminated unions where every\n// case should be handled explicitly. TS narrows the operand to `never` only\n// if every variant has been covered upstream; adding a new variant produces\n// a compile error at the `absurd(x)` site.\n//\n// The substrate's `Reducer<S, M, C>` and `Transitions<S, M, C>` forms cover\n// the reducer-side exhaustiveness with mapped types — no `absurd` needed\n// there. This helper exists for the OTHER boundaries where a discriminated\n// union is narrowed by hand: Sub handlers mapping a wire-protocol\n// discriminant to flat Msg variants, message-bridge dispatchers, port\n// fanouts, etc. Without it, consumers redeclare the same 3-line helper\n// across files; with it, the substrate owns the one canonical version.\n//\n// Strengthens invariant 7 (identity is explicit).\n/**\n * Compile-time exhaustiveness assertion. Use in default branches of\n * switches over discriminated unions where every case should be handled\n * explicitly — TS narrows the type to `never` only if every variant has\n * been covered. Strengthens invariant 7 (identity is explicit).\n *\n * @example\n *   switch (msg.type) {\n *     case \"a\": return ...;\n *     case \"b\": return ...;\n *     default: return absurd(msg);  // compile error if a \"c\" is added\n *   }\n */\nexport function absurd(x: never): never {\n  throw new Error(`unreachable: ${JSON.stringify(x)}`);\n}\n\n// === noop: the explicit \"this cell ignores this msg\" helper ===\n//\n// Elm's fallback for unhandled (state × msg) pairs is implicit:\n// `_ -> (model, Cmd.none)` in a case expression. We make it explicit because\n// implicit no-ops are silent regressions waiting to happen — a future Msg\n// variant that *should* be handled gets swallowed by the wildcard.\n//\n// Naming the no-op forces the author to *decide*: \"this cell does nothing\"\n// is a real decision, distinct from \"I forgot to write this cell.\" The\n// mapped type rejects the second case; `noop` names the first.\n//\n// Assignable to any Transitions cell regardless of S/M/C concrete types\n// (the type parameters are free) — drop it into any cell without per-type\n// casts.\nexport const noop = <S, M, C extends Cmd>(\n  state: S,\n  _msg: M,\n): readonly [S, readonly C[]] => [state, []];\n\n// Module-level registry — process-scope, identity-by-name. The set is the\n// runtime witness that every port name in this process is unique. Cleared\n// only by the test-only `__resetPortRegistry()` helper.\nconst definedPortNames = new Set<string>();\n\n/**\n * Thrown by `definePort` when a name has already been registered in the\n * current process. Symmetric with the `Sub.id` collision assert in\n * `reconcileSubs` — both mechanize invariant 7 (identity is explicit) at the\n * runtime layer the type system cannot reach (string names compared at\n * runtime, not at compile time).\n */\nexport class PortNameCollisionError extends Error {\n  override readonly name = \"PortNameCollisionError\";\n  constructor(portName: string) {\n    super(\n      `definePort: a port named \"${portName}\" was already defined. ` +\n        `Each definePort call must use a unique name. ` +\n        `If two modules need the same port, export it from one module and import it.`,\n    );\n  }\n}\n\n/**\n * Test-only escape hatch — clears the module-level port-name registry so the\n * collision assert in `definePort` doesn't false-positive across vitest's\n * non-isolated runs. Production code MUST NOT call this; the registry is the\n * invariant-7 witness for the process lifetime.\n *\n * @internal test-only\n */\nexport function __resetPortRegistry(): void {\n  definedPortNames.clear();\n}\n\n// === Runtime error sink (invariant 6 — no silent failures) ===\n//\n// The runtime has points where a failure has no natural caller to reject at:\n// a follow-up Msg an interpret handler enqueued (the original dispatcher\n// already resolved), and the final `store.save` during `stop()` (whose\n// contract is a resolved Promise). Historically both were swallowed —\n// `.catch(() => {})` and a bare `console.error` — which violates invariant 6:\n// the runtime must be inspectable; no silent failures.\n//\n// `RuntimeErrorContext` tags WHICH swallowed path produced the error so a sink\n// can route by phase. `OnError` is the sink itself, configured at `run(...)`.\n// When no sink is provided the runtime uses `defaultOnError`, which RE-THROWS\n// on a fresh macrotask — surfacing to the host's unhandled-rejection / global\n// error handler rather than vanishing. The default surfaces; it never swallows.\n\n/**\n * Which otherwise-unattributable runtime path produced an error.\n *\n * - `\"follow-up\"` — a follow-up Msg an interpret handler returned rejected\n *   when re-dispatched. The original dispatcher already resolved, so this\n *   rejection has no caller; without the sink it was swallowed.\n * - `\"stop-save\"` — the final `store.save(state)` inside `stop()` threw.\n *   `stop()` resolves regardless (its contract), so without the sink this was\n *   silent loss of the last write.\n * - `\"reduce\"` — the pure `update` (reducer) threw synchronously while folding\n *   a Msg. #71's reentrancy brand makes a reducer provably synchronous, so this\n *   throw is catchable in the dispatch loop; the configured `Supervision`\n *   strategy decides what the runtime does next (`stop` / `escalate` /\n *   `restart`), but the failure is ALWAYS surfaced here as data first.\n *\n * The fanout phases (#277). Every fanout is throw-isolated so one bad\n * consumer never strands its siblings — and the isolated throw routes here\n * rather than to a bare `console.error`, so a sink wired to e.g. Sentry sees\n * every \"no caller to reject at\" failure:\n *\n * - `\"listener\"` — a `runtime.subscribe(...)` listener threw during the\n *   post-transition fanout.\n * - `\"observer\"` — a `runtime.observe(...)` observer threw during the\n *   post-transition fanout.\n * - `\"event\"` — the semantic-event path threw: either the `events` projector\n *   itself, or an `on(type, ...)` handler.\n * - `\"boot\"` — an `onBoot` handler threw (at the boot fanout, or on the\n *   immediate fire of a late post-boot registration).\n * - `\"port-emit\"` — a `subscribePort` listener threw during a port emission.\n * - `\"sub-cleanup\"` — a subscription's cleanup threw (on reconcile-removal,\n *   or during `stop()` teardown).\n */\nexport type RuntimeErrorPhase =\n  | \"follow-up\"\n  | \"stop-save\"\n  | \"reduce\"\n  | \"listener\"\n  | \"observer\"\n  | \"event\"\n  | \"boot\"\n  | \"port-emit\"\n  | \"sub-cleanup\";\n\n/** Context handed to an `OnError` sink alongside the error itself. */\nexport interface RuntimeErrorContext {\n  readonly phase: RuntimeErrorPhase;\n}\n\n/**\n * Sink for runtime failures that have no caller to reject at. Configured via\n * `run(machine, { onError })`. Should be total — a throw inside the sink is\n * itself surfaced via `defaultOnError`, so the sink can never re-introduce a\n * silent failure.\n */\nexport type OnError = (error: unknown, context: RuntimeErrorContext) => void;\n\n/**\n * Default `onError` sink: re-throw on a fresh macrotask so the failure reaches\n * the host's global error / unhandledRejection handler instead of vanishing.\n * Used whenever `run(...)` is called without an explicit `onError`. The least\n * surprising default — it surfaces rather than swallows (invariant 6) without\n * forcing every caller to wire a sink.\n */\nfunction defaultOnError(error: unknown, _context: RuntimeErrorContext): void {\n  setTimeout(() => {\n    throw error;\n  }, 0);\n}\n\n// === Supervision: declared policy for a reducer throw (ADR 0003 #4) ===\n//\n// The resilience kit (retry, circuit-breaker, …) covers *effect* failures —\n// throws inside `interpret`. A throw inside the pure `update` (the reducer) had\n// no declared policy: it simply rejected the dispatch promise and left the\n// runtime in an ambiguous \"did we halt or not?\" state. #71's reentrancy brand\n// makes a reducer provably synchronous, so a reducer throw is now a synchronous\n// throw catchable in the dispatch loop. This is the seam Akka supervisor\n// strategies / Erlang-OTP supervision trees occupy: \"let it crash\" becomes\n// CONFIG, not hope.\n//\n// Every strategy routes the failure to the `onError` sink with `phase:\n// \"reduce\"` FIRST (invariant 6 — errors are data, never silently swallowed),\n// then differs in what the runtime does next:\n//\n//   - `stop`    — halt the runtime. State is NOT advanced; the dispatch promise\n//                 rejects with the reducer error; every subsequent dispatch\n//                 rejects (\"runtime stopped\"). The SAFE DEFAULT: a reducer that\n//                 violated its own invariants does not get to keep folding.\n//                 Never a silent resume.\n//   - `escalate`— surface via `onError` AND propagate: the dispatch promise\n//                 rejects with the reducer error so the failure bubbles to the\n//                 caller/parent supervisor. The runtime is NOT halted (a parent\n//                 may choose to keep dispatching) — escalation is \"tell someone\n//                 above me\", not \"die\".\n//   - `restart` — re-initialize from a host-provided last-known-good state and\n//                 keep folding. The core does NOT own snapshot logic; the host\n//                 supplies `rehydrate()`, the core invokes it, installs its\n//                 result as the new state, and continues the transition\n//                 (save → reconcile → interpret → fire) from there. The\n//                 original failure is still surfaced as data via `onError`.\n//\n// The restart rehydrate is a host callback by design: the core has no opinion\n// on where last-known-good state lives (a snapshot Store, an in-memory cache, a\n// recomputed default). Mirrors how `Store` keeps persistence out of core.\n\n/** The three declared reducer-throw supervision strategies. */\nexport type SupervisionStrategy = \"stop\" | \"escalate\" | \"restart\";\n\n/**\n * Declared supervision policy for a reducer (`update`) throw, configured at\n * `run(machine, { supervision })`.\n *\n * - `{ strategy: \"stop\" }` — halt + surface (the safe default; also the bare\n *   shorthand `\"stop\"`).\n * - `{ strategy: \"escalate\" }` — surface + propagate, runtime stays live (also\n *   the bare shorthand `\"escalate\"`).\n * - `{ strategy: \"restart\", rehydrate }` — surface, then re-init from the\n *   host-supplied last-known-good `S` and keep folding. `rehydrate` receives\n *   the failing `(state, msg, error)` so the host can log / pick a snapshot;\n *   it MUST return a valid `S` synchronously (the reducer is synchronous, so\n *   recovery is too — no suspension across the single-writer slot).\n *\n * The bare-string shorthands (`\"stop\"` / `\"escalate\"`) are accepted for the two\n * strategies that need no host data; `restart` MUST be the object form because\n * it carries the `rehydrate` callback.\n */\nexport type Supervision<S, M extends { type: string }> =\n  | \"stop\"\n  | \"escalate\"\n  | { readonly strategy: \"stop\" }\n  | { readonly strategy: \"escalate\" }\n  | {\n      readonly strategy: \"restart\";\n      /**\n       * Host-provided rehydration to last-known-good state. Invoked by the core\n       * when the reducer throws; its return value becomes the new state and the\n       * transition continues from there. Receives the pre-throw `state`, the\n       * `msg` that triggered the throw, and the thrown `error` so the host can\n       * route by cause.\n       */\n      readonly rehydrate: (state: S, msg: M, error: unknown) => S;\n    };\n\n/**\n * Normalize the `Supervision` config (bare string or object) into a single\n * object shape so the dispatch loop branches on `.strategy` once. The default\n * — applied when `run(...)` is called without `supervision` — is `stop`: the\n * explicit, safe choice. It surfaces via `onError` and halts; it never silently\n * resumes a machine whose reducer just violated an invariant (invariant 6).\n */\ntype NormalizedSupervision<S, M extends { type: string }> =\n  | { readonly strategy: \"stop\" }\n  | { readonly strategy: \"escalate\" }\n  | {\n      readonly strategy: \"restart\";\n      readonly rehydrate: (state: S, msg: M, error: unknown) => S;\n    };\n\nfunction normalizeSupervision<S, M extends { type: string }>(\n  supervision: Supervision<S, M> | undefined,\n): NormalizedSupervision<S, M> {\n  if (supervision === undefined) return { strategy: \"stop\" };\n  if (typeof supervision === \"string\") return { strategy: supervision };\n  return supervision;\n}\n\n/**\n * Raised by `idle()` when the quiescence wait hits its iteration cap without\n * the dispatch tail stabilizing. Replaces the old silent fall-through-resolve\n * (which made \"the loop quiesced\" indistinguishable from \"we gave up\"):\n * `idle()` now REJECTS with this so a livelocking machine surfaces instead of\n * masquerading as quiescent.\n *\n * Mechanizes invariant 6 (no silent failures) at the runtime layer — the same\n * role `PortNameCollisionError` plays for invariant 7.\n */\nexport class QuiescenceTimeoutError extends Error {\n  override readonly name = \"QuiescenceTimeoutError\";\n  constructor(public readonly iterations: number) {\n    super(\n      `@demlik/tea: idle() did not reach quiescence after ${iterations} ` +\n        `iterations — the dispatch tail kept advancing. The machine is ` +\n        `likely livelocking (an interpret handler enqueues a follow-up Msg ` +\n        `that enqueues another, without end). Bound the follow-up chain in ` +\n        `the reducer, or stop the runtime.`,\n    );\n  }\n}\n\n/**\n * Define a typed port. `name` is metadata (shown in devtools / debug logs);\n * port identity is by reference. Each definePort call must use a unique\n * `name` — a second call with the same name throws\n * `PortNameCollisionError`. If two modules need the same port, export it\n * from one module and import it from the other.\n *\n * Use ports for \"data leaving the runtime selectively\" — e.g. cursor\n * announcements, DOM-mutation broadcasts, telemetry events that should NOT be\n * folded into State and should NOT be observed by every transition listener.\n *\n * Strengthens invariant 7 (identity is explicit) — the runtime assert is the\n * Port-side counterpart of `SubId`'s id collision check in `reconcileSubs`.\n */\nexport function definePort<T>(name: string): Port<T> {\n  // HMR skip — Vite / dev servers re-import the module on hot reload, which\n  // would otherwise false-positive on every definePort across reloads. The\n  // try/catch is load-bearing for service-worker bundles: Vite polyfills\n  // `import.meta.url` via `document.baseURI`, which throws ReferenceError in\n  // an MV3 service worker. A throw here would abort SW install (Chrome\n  // surfaces it as \"registration failed status 15\"). Catching it = \"no HMR\n  // detected\" = the collision check applies, which is the correct SW\n  // behavior (SWs reload via chrome.runtime.reload, not module HMR).\n  let isHmr = false;\n  try {\n    const meta = import.meta as { hot?: unknown };\n    isHmr = meta?.hot !== undefined && meta?.hot !== null;\n  } catch {\n    isHmr = false;\n  }\n  if (!isHmr && definedPortNames.has(name)) {\n    throw new PortNameCollisionError(name);\n  }\n  definedPortNames.add(name);\n  return { __brand: \"port\", name } as Port<T>;\n}\n\n// === Store: pluggable persistence adapter ===\n//\n// `load()` returns `unknown` because storage genuinely doesn't know `S` —\n// chrome.storage returns whatever JSON lives at the key, DurableObjectStorage\n// returns whatever bytes were serialized. Casting raw storage to `S` at the\n// adapter boundary is the exact `as S` move forbidden by invariant 8\n// everywhere else in the substrate. `load()` returning `unknown` makes the\n// substrate stop pretending.\n//\n// `migrate(raw)` is the boundary parse. Returns `S` on a recognized shape —\n// the substrate passes it to `init` as `loaded`. Returns `null` on any\n// unrecognized shape — the substrate passes `null` to `init`, fresh-boot\n// path. Must NOT throw: if a future shape is unrecognizable, returning\n// `null` boots clean from a known-good path. Throwing here would\n// indistinguishably collapse \"storage corruption\" and \"schema migration not\n// yet written\" — both are runtime decisions, not panics.\n//\n// Strengthens invariant 8 (the boundary parses; the core trusts) — the\n// substrate now enforces the parse instead of relying on every adapter\n// remembering to.\nexport interface Store<S> {\n  load(): Promise<unknown>;\n  save(state: S): Promise<void>;\n  migrate(raw: unknown): S | null;\n}\n\n// === DispatchSettle: how far a dispatch awaits ===\n//\n// `dispatch(msg)` settles ONE transition by default would be the dangerous\n// choice (issue #50): an `interpret` handler that returns a follow-up Msg\n// enqueues a FRESH transition on the tail, and that follow-up is fire-and-\n// forget relative to the original `dispatch`. Callers that forgot to also\n// `await idle()` saw their dispatch resolve \"early\", before the consequences\n// of the Msg had run — which is why the codebase grew a dispatch+`idle()`\n// wrapper and tests fell back to `for (i<200) sleep(5)` polls.\n//\n// So the default is the SAFE one: `\"quiescent\"` — `dispatch` resolves only\n// once the entire transitive follow-up chain has drained (the same drain\n// `idle()` performs). The rare single-step case (a caller that genuinely wants\n// one transition and will await the tail itself) opts in with `\"once\"`, or\n// uses the `dispatchOnce` convenience.\nexport type DispatchSettle = \"quiescent\" | \"once\";\n\n// === RuntimeRef<M>: typed sibling-runtime handle ===\n//\n// A `RuntimeRef<M>` exposes only the inbox of a Runtime — `dispatch(msg)` (and\n// its single-step sibling `dispatchOnce(msg)`).\n// Use it as the field type when one runtime holds a reference to a *sibling*\n// runtime (composition by reduction across orthogonal lifecycles — invariant\n// 5). The holder learns the Msg shape it can send, nothing about the\n// referenced runtime's State, Cmd, Sub, Ctx, observers, listeners, or Port\n// fanout. That asymmetry is the point: cross-runtime coupling collapses to\n// \"I can put a Msg in your inbox\", which is the smallest coordination\n// surface that preserves typed cross-runtime calls.\n//\n// `Runtime<S, M>` extends `RuntimeRef<M>` structurally — every Runtime is\n// trivially a RuntimeRef. The narrowing happens at the *consumer's* Ctx\n// type, not via a runtime cast.\n//\n// Strengthens invariant 5 (composition by reduction — sibling runtimes\n// coordinate through the narrowest typed surface) and invariant 6 (runtime\n// is small and inspectable — what a holder *can* do to a sibling runtime is\n// exactly one method, not the full surface).\nexport interface RuntimeRef<M extends { type: string }> {\n  /**\n   * Put a Msg in the runtime's inbox and resolve once it has been processed.\n   *\n   * Runs to QUIESCENCE by default (issue #50): the returned promise settles\n   * only after the dispatched Msg AND every follow-up Msg its `interpret`\n   * handlers (transitively) returned have drained off the serial tail. This is\n   * the safe default — `await dispatch(msg)` means \"the consequences have run\",\n   * not \"one transition fired and the rest are racing\". Pass\n   * `{ settle: \"once\" }` (or call `dispatchOnce`) for the rare single-step\n   * case where the caller will await the tail itself.\n   *\n   * Rejection ordering: the ONE dispatched transition's own failure (a reducer\n   * / save / sub-start / interpret throw) surfaces first, on this promise. If\n   * that transition succeeds but the follow-up chain never stabilizes, the\n   * quiescent drain rejects with `QuiescenceTimeoutError` (same cap and same\n   * no-silent-give-up contract as `idle()` — issue #51). Follow-up Msg\n   * rejections themselves route to the `onError` sink, never here.\n   */\n  dispatch(msg: M, opts?: { readonly settle?: DispatchSettle }): Promise<void>;\n  /**\n   * Dispatch `msg` and resolve after exactly ONE transition's effects settle,\n   * WITHOUT draining the follow-up chain. Equivalent to\n   * `dispatch(msg, { settle: \"once\" })`.\n   *\n   * This is the old (pre-#50) `dispatch` behavior, kept as an explicit escape\n   * hatch: a caller that wants to interleave its own work between the first\n   * transition and its follow-ups, then `await runtime.idle()` itself. Prefer\n   * plain `dispatch` (run-to-quiescence) unless you specifically need the\n   * single step — the un-awaited follow-up chain is exactly the footgun #50\n   * removed from the default.\n   */\n  dispatchOnce(msg: M): Promise<void>;\n}\n\n// === BootingRuntime: handle returned SYNCHRONOUSLY from run() ===\n//\n// `run()` returns a `BootingRuntime<S, M>` the instant it is called — boot\n// (store.load → init → save → reconcile → interpret-of-init-cmds → first\n// fanout) is still in flight. A BootingRuntime exposes exactly the surface\n// that is TOTAL before boot completes: you may queue a dispatch, subscribe a\n// listener, attach an observer, wire a Port, or stop the runtime — none of\n// those need the initial State to exist yet. What you may NOT do is read the\n// State (`getState`) or wait for quiescence (`idle`): there is no State to\n// read until boot has run `init`, and a half-booted runtime has no meaningful\n// \"quiescence\" to await. Those two are the difference between a BootingRuntime\n// and a `Runtime` — and that difference is enforced at the type level.\n//\n// `ready` resolves to the FULL `Runtime<S, M>` once boot completes (or rejects\n// with the boot error). It is the ONLY way to obtain a `Runtime`:\n//\n//   const runtime = await run(machine, opts).ready;\n//   runtime.getState(); // total — boot has run, State exists\n//\n// This closes issue #45: `getState(): S` used to be declared on the handle\n// `run()` returned synchronously, yet it THREW before boot under a store. The\n// type claimed total; the value was partial, and only JSDoc told you to await.\n// Splitting the booting handle from the ready runtime makes \"read State before\n// boot\" a COMPILE error rather than a runtime throw — the type no longer lies.\n//\n// `subscribe(listener)` is the React-shaped change notifier (zero-arg, paired\n// with `getState()` via `useSyncExternalStore` on the ready Runtime).\n// `observe(observer)` is the devtools-shaped trace hook: it receives `(msg,\n// state)` for every COMPLETED, APPLIED transition. The boot transition is NOT\n// an applied Msg — there is no event there, only the initial State — so it does\n// NOT flow through `observe`. It is delivered once via `onBoot(handler)`\n// instead, so `observe`'s `msg` is total (`M`, never `null`): a consumer no\n// longer carries a `| null` boot arm it then ignores (#47). Both `observe` and\n// `onBoot` fire from the same point in the dispatch loop (after save →\n// reconcile → interpret), so what they see is consistent with what a subscriber\n// sees via the ready Runtime's `getState()`.\n//\n// Observe is separate from subscribe because the contracts differ: React\n// consumers want \"something changed, re-read state\"; devtools consumers want\n// \"here is the exact (msg, state) pair, append it to a log\". Folding them\n// would force every React subscriber to type-check a `msg` arg they will never\n// use, and would couple `useSyncExternalStore` to a particular Msg type at the\n// substrate.\n//\n// `on(type, handler)` is the SEMANTIC event channel (#47): a typed subscription\n// to the machine-level `AgentEvent`-style union `E` a machine projects off its\n// transitions (via `run`'s `events` projector). Where `observe` hands every\n// consumer the raw `(M, S)` firehose to hand-filter — coupling a UI to the\n// machine's PRIVATE Msg vocabulary (e.g. a retry plumbing's `resilient_ok`) —\n// `on` delivers only the public, named events, narrowed to the requested\n// `type`. `E` defaults to `never`: a machine that wires no `events` projector\n// has an empty event surface and `on` is uncallable (no `E[\"type\"]` to pass).\nexport interface BootingRuntime<\n  S,\n  M extends { type: string },\n  E extends { type: string } = never,\n> extends RuntimeRef<M> {\n  dispatch(msg: M, opts?: { readonly settle?: DispatchSettle }): Promise<void>;\n  dispatchOnce(msg: M): Promise<void>;\n  subscribe(listener: () => void): () => void;\n  observe(observer: (msg: M, state: S) => void): () => void;\n  /**\n   * Subscribe to the INITIAL State — the boot transition the old `observe`\n   * `msg === null` arm carried (#47). Fires exactly once: immediately if boot\n   * has already completed when `onBoot` is called (so a late subscriber never\n   * misses it), otherwise on the boot fanout. Returns a cleanup that detaches\n   * the handler (a no-op once it has fired).\n   *\n   * This is where the boot case the `observe` firehose used to fold in went\n   * once `observe`'s `msg` became total: a consumer that needs to seed a view\n   * from the initial State wires `onBoot`; a consumer that only folds events\n   * (the common case) wires `observe` (or `on`) and is no longer handed a boot\n   * arm to skip.\n   */\n  onBoot(handler: (state: S) => void): () => void;\n  /**\n   * Subscribe to a SEMANTIC event of `type` (#47). Typed narrowing: the handler\n   * receives exactly the `E` member whose `type` matches `K`, so a consumer\n   * built on `on(\"TurnSettled\", …)` never touches another event's shape and —\n   * critically — never references the machine's PRIVATE Msg names. Returns a\n   * cleanup that detaches the handler. Multiple handlers per type are\n   * supported; fanout is synchronous and throw-isolated (same discipline as\n   * `observe`). Fires only when the machine's `events` projector (wired on\n   * `run`) emits an event of that type for a transition.\n   */\n  on<K extends E[\"type\"]>(\n    type: K,\n    handler: (event: Extract<E, { type: K }>) => void,\n  ): () => void;\n  /**\n   * Subscribe to a typed Port. Returns a cleanup function that removes the\n   * listener. Multiple listeners per port are supported; fanout is synchronous\n   * (same shape as `observe`) and isolated — one listener throw does not strand\n   * the others.\n   *\n   * Ports are for \"data leaving the runtime selectively\" — see `definePort`.\n   * Distinct from `observe` (every transition) and from State (the world).\n   */\n  subscribePort<T>(port: Port<T>, listener: (value: T) => void): () => void;\n  /**\n   * Emit a value on a Port from OUTSIDE an interpret handler. Same synchronous\n   * fanout discipline as `ctx.emit` inside interpret — every subscriber\n   * receives the value immediately; emitting to a port with no subscribers is\n   * a no-op; listener throws are isolated.\n   *\n   * Use this for `observe`-driven Port emission: the canonical case is one\n   * runtime publishing a state-derived signal (e.g. \"am I idle?\") that\n   * another runtime subscribes to via `subscribePort`. Without\n   * `runtime.emitPort`, the only way to emit a Port is from inside an\n   * `interpret` handler — which forces the reducer to spawn a \"tell the\n   * outside world\" Cmd on every transition that should signal. With it,\n   * `runtime.observe((msg, state) => runtime.emitPort(port, derive(state)))`\n   * keeps the reducer free of Port-plumbing Cmds and matches the \"every\n   * transition is observable\" contract this invariant set already commits to.\n   *\n   * Strengthens invariant 6 (runtime is small and inspectable — Port emission\n   * is no longer privileged to interpret handlers; `observe`-driven emission\n   * is structurally supported).\n   */\n  emitPort<T>(port: Port<T>, value: T): void;\n  /**\n   * Resolves to the booted `Runtime<S, M>` after boot completes — i.e. after\n   * `store.load()` (if any), `init`, `store.save()` of the initial state,\n   * `reconcileSubs`, `interpret` of any init-emitted cmds, and the initial\n   * listener / observer fanout. Rejects with the boot error if boot fails (the\n   * same error every subsequent `dispatch` call rejects with).\n   *\n   * This is the ONLY way to obtain a `Runtime<S, M>` — and a `Runtime` is the\n   * only handle whose `getState()` is total. Awaiting `ready` is therefore the\n   * single gate between \"boot in flight\" and \"State exists\":\n   *\n   * ```ts\n   * const runtime = await run(machine, opts).ready;\n   * runtime.getState(); // total — never throws-before-boot\n   * ```\n   *\n   * Idempotent — subsequent reads return the same settled promise. The runtime\n   * holds exactly one `ready` promise per `run()` call; it resolves to the same\n   * `Runtime` object every time.\n   *\n   * Closes issue #45 (the `getState()` lie) and the v1 boot-await gap once\n   * documented in `stepBootEffects`: components that need synchronous initial\n   * state under a store (e.g. `useSyncExternalStore` consumers) await `ready`\n   * for the booted runtime instead of dispatching a no-op Msg.\n   *\n   * Expresses canon §2.3 (the `init` contract — boot is a named, awaitable\n   * moment). Strengthens invariant 6 (runtime is small and inspectable).\n   */\n  ready: Promise<Runtime<S, M, E>>;\n  stop(): Promise<void>;\n}\n\n// === Runtime: the BOOTED handle `ready` resolves to ===\n//\n// A `Runtime<S, M>` is a `BootingRuntime<S, M>` whose boot has completed. It\n// adds the two members that are only meaningful once the initial State exists:\n// `getState()` (total — boot ran `init`, so State is always present) and\n// `idle()` (quiescence is only definable on a runtime that has booted). It\n// also narrows `ready` to `Promise<Runtime<S, M>>` resolving to itself — a\n// booted runtime awaited again hands back the same booted runtime, so consumer\n// code that re-awaits (e.g. a cached `getRuntime()` accessor) keeps a total\n// `getState`.\n//\n// You never construct a `Runtime` directly from `run()`; you obtain it via\n// `await bootingRuntime.ready`. That asymmetry is the whole fix for #45 —\n// \"read State before boot\" is now unrepresentable, not merely discouraged.\nexport interface Runtime<\n  S,\n  M extends { type: string },\n  E extends { type: string } = never,\n> extends BootingRuntime<S, M, E> {\n  /**\n   * The current State. TOTAL — never throws. Obtaining a `Runtime` requires\n   * awaiting `ready`, which only resolves AFTER boot has run `init` and set the\n   * initial State; a `Runtime` therefore always has a State to return. (Before\n   * #45 this was declared on the synchronously-returned handle and threw under\n   * a store until boot finished — the type lied. It no longer does.)\n   */\n  getState(): S;\n  /**\n   * Resolves to this same `Runtime` once boot completes. Idempotent.\n   */\n  ready: Promise<Runtime<S, M, E>>;\n  /**\n   * Resolves once the runtime has reached QUIESCENCE — every dispatched Msg AND\n   * every follow-up Msg an interpret handler returned has been processed, with\n   * no further step pending on the serial tail.\n   *\n   * Since #50, plain `dispatch(msg)` already runs to quiescence (it awaits this\n   * same drain after its own transition), so a caller rarely needs `idle()`\n   * directly. `idle()` is still the right tool to (a) settle follow-ups left in\n   * flight by a `dispatchOnce` / `dispatch(msg, { settle: \"once\" })` single\n   * step, or (b) wait out a follow-up chain kicked off by a Sub or by boot\n   * `init` cmds where there was no `dispatch` call to await. It chains onto the\n   * current tail and re-checks until the tail stops advancing, draining the\n   * entire transitive follow-up chain.\n   *\n   * Idempotent and re-entrant-safe: each call reads the live tail; a tail that\n   * advanced during the await (a follow-up landed) is awaited again until\n   * stable. Tail rejections are NOT surfaced here — a failing dispatch\n   * surfaces on its OWN returned promise (and follow-up rejections route to\n   * the `onError` sink). The ONE rejection `idle()` itself produces is a\n   * `QuiescenceTimeoutError` when the wait hits its iteration cap without the\n   * tail stabilizing: that replaces the old silent fall-through-resolve so a\n   * livelocking machine is distinguishable from a genuinely quiesced one\n   * (invariant 6 — no silent failures).\n   *\n   * Use `idle()` for runtime-internal follow-ups; a poll is still correct when\n   * waiting on an EXTERNAL event (a WS reply) the runtime cannot enqueue itself.\n   *\n   * Strengthens invariant 6 (runtime is small and inspectable — quiescence is a\n   * first-class awaitable moment, not a poll the consumer re-derives).\n   */\n  idle(): Promise<void>;\n  /**\n   * The terminal State of the run, or `undefined` while it is still in flight.\n   * A run is \"terminal\" exactly when the `terminal` predicate passed to `run()`\n   * returns `true` for the current State; with no predicate supplied a run is\n   * never terminal and this always returns `undefined`.\n   *\n   * This is the FIRST-CLASS result read (issue #46): the outcome of running the\n   * thing, off the State the machine already owns — NOT scraped off the\n   * `observe` firehose by matching an internal Msg name (`resilient_ok`) and\n   * racing a state-clear. The consumer reads the run's product (e.g. an agent's\n   * `state.output`) off the returned `S`, with no coupling to the machine's\n   * private retry / loop vocabulary.\n   *\n   * Total — never throws (a `Runtime` always has a State; see `getState`).\n   */\n  result(): S | undefined;\n  /**\n   * Resolves with the terminal State the first time the run reaches a terminal\n   * State (per the `terminal` predicate passed to `run()`). If the run is\n   * ALREADY terminal when `done()` is called, resolves immediately with the\n   * current State; otherwise resolves on the transition that first makes\n   * `terminal` hold.\n   *\n   * The awaitable companion to `result()` — \"wait for the run to finish, then\n   * hand me what it produced\" in one call, instead of polling `result()` or\n   * hand-rolling an `observe` loop that watches for a private terminal Msg.\n   * With no `terminal` predicate supplied the run is never terminal, so this\n   * promise never resolves (a non-terminating machine has no result to await).\n   *\n   * Idempotent and multi-caller safe: every call observes the live State, so a\n   * call made after the run already terminated resolves at once, and concurrent\n   * callers all settle on the same terminal transition.\n   */\n  done(): Promise<S>;\n}\n\n// === defineMachine: identity-typed pass-through ===\n//\n// Overloads enforce exactly one `update` shape per call so consumers see a\n// concrete type for `update`, not the substrate-internal union. Implementation\n// is identity at runtime — the runtime (`run`) branches on the structural\n// shape of `update` (Reducer vs Transitions) when dispatching.\n//\n// - Reducer-form overload: `update: Reducer<S, M, C>` — flat record keyed by\n//   Msg.type. Exhaustiveness is enforced by the mapped type; adding a Msg\n//   variant without a matching key is a compile error.\n// - Transitions-form overload: `update: Transitions<S, M, C>` — 2D table\n//   keyed by State.type then Msg.type. Only available when `S extends {\n//   type: string }`.\n//\n// Distinguishing the two: TS overload resolution checks the literal shape of\n// the argument. Reducer values are functions; Transitions values are records\n// (of functions). Structurally distinct, so overload resolution picks the\n// right branch.\n//\n// Strengthens invariant 2 (record forms have no fall-through default) and\n// invariant 7 (the Msg variant set — and, for Transitions, the State variant\n// set — is load-bearing at the type level).\n\n// Transitions-form overload — `update` is a 2D table keyed by State.type\n// then Msg.type. Declared FIRST (most specific): the value shape (record of\n// records of functions) is structurally distinct from Reducer (record of\n// functions), so TS overload resolution picks this branch only when the\n// literal matches the table shape.\n//\n// The S constraint is expressed via a conditional `S extends { type: string\n// } ? Transitions<S, M, C> : never` instead of a generic-parameter\n// constraint. The conditional approach keeps `S` unconstrained at the\n// overload signature, so `Parameters<typeof defineMachine<NonDiscriminatedS,\n// ...>>` (the public `satisfies` pattern) doesn't fail at the first\n// overload — it just skips to the next one because `update` becomes\n// `never`.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  m: Omit<Machine<S, M, C, U, Ctx>, \"update\"> & {\n    // `[S]` tuple-wrap disables distributive conditional behavior — see\n    // the comment on `Machine.update` for why distribution is wrong here.\n    update: [S] extends [{ type: string }] ? Transitions<S, M, C> : never;\n  },\n): Machine<S, M, C, U, Ctx>;\n// Reducer-form overload — `update` is a flat record keyed by Msg.type.\n// Object literals where every property is a function match this shape.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  m: Omit<Machine<S, M, C, U, Ctx>, \"update\"> & {\n    update: Reducer<S, M, C>;\n  },\n): Machine<S, M, C, U, Ctx>;\n// Implementation signature — accepts both via the union on `Machine.update`.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(m: Machine<S, M, C, U, Ctx>): Machine<S, M, C, U, Ctx> {\n  // Tag the update form ONCE, here at the typed construction boundary, so no\n  // downstream reader (`run`, `replay`, the `withX` wrappers) re-derives it\n  // structurally. Non-enumerable: it must not serialize, must not show up in\n  // `Object.keys(machine)`, and must not collide with any Msg.type key on a\n  // flattened surface. Idempotent under re-wrap (`defineMachine(defineMachine(m))`).\n  if (m.__form === undefined) {\n    Object.defineProperty(m, \"__form\", {\n      value: detectUpdateForm(m.update as object),\n      enumerable: false,\n      writable: false,\n      configurable: true,\n    });\n  }\n  return m;\n}\n\n// === asReducer: the validated minting path for a reducer (ADR 0003 #5) ===\n//\n// The single entry point that turns a raw record of handlers into a branded\n// `Reducer<S, M, C>` — the exact role `asRng` plays for `Rng` in\n// `retry-backoff`. The parameter type is `Reducer<S, M, C>`, whose every cell\n// returns the non-thenable `SyncReturn<S, C>`, so the reentrancy guard fires\n// HERE, at construction: an `async` cell (or one that inline-`await`s) returns\n// `Promise<...>`, which is not assignable to `SyncReturn`, and `tsc` rejects the\n// call at the offending cell. A pure synchronous reducer passes through\n// untouched and gains the phantom `ReducerBrand`.\n//\n// PURE: identity at runtime (the brand is phantom). `defineMachine` brands its\n// `update` internally the same way, so callers that pass an object literal\n// straight to `defineMachine` never need to call `asReducer` — it exists for\n// the standalone `const update = asReducer<...>({ ... })` form, mirroring how a\n// caller can mint an `Rng` with `asRng` before wiring it.\nexport function asReducer<S, M extends { type: string }, C extends Cmd>(\n  reducer: Reducer<S, M, C>,\n): Branded<Reducer<S, M, C>> {\n  return reducer as Branded<Reducer<S, M, C>>;\n}\n\n// === run: implemented in task 2 ===\n//\n// Returns a `Runtime<S, M>` synchronously. Boot (`store?.load()` + `init`) runs\n// asynchronously as the FIRST entry on the serial dispatch tail; every public\n// runtime method (`dispatch`, `stop`, `getState`) awaits the boot phase\n// implicitly through the queue. Failures inside `store.load` propagate via the\n// boot promise — subsequent calls reject/throw with that error. There is no\n// \"synchronous load\" branch because `Store#load` is async by contract.\n//\n// Save-then-effects ordering is structural: every transition mutates state,\n// awaits `store.save(newState)`, then reconciles subscriptions, then runs\n// `interpret` for emitted cmds, then fires external listeners. A throw in any\n// effect phase leaves the persisted state ahead of the host's belief about\n// what executed — the Railway discipline (`tryInterpret` in handlers) makes\n// that safe in practice.\n\n// === CtxArg<Ctx>: the `ctx` field of `run`'s opts, conditionally optional ===\n//\n// A PURE machine reads nothing from `ctx` — its `Ctx` is `NoCtx`\n// (`Record<never, never>`), `Record<string, never>` (the vortex arena grain,\n// #182), or `unknown`. Forcing such a machine to write `ctx: {}` is ceremony\n// for a value the type already pins as empty — the same friction the\n// `Machine.interpret` field removed for cmdless machines. So `ctx` is\n// CONDITIONALLY optional: when the empty object satisfies `Ctx` it may be\n// OMITTED (the runtime defaults it to `{}`), so a pure reducer runs as\n// `run(machine)`; when `Ctx` carries a field a handler reads, `ctx` stays\n// REQUIRED so a context-bearing machine can't silently forget it.\n//\n// `[Record<never, never>] extends [Ctx]` reads as \"is `{}` assignable to\n// `Ctx`\" — true for the context-free shapes above, false for `{ db: … }`. The\n// tuple-wrap disables distributive conditional behavior, the same trick the\n// `Machine.interpret`/`update` fields use. Existing callers that pass `ctx`\n// are unaffected — an optional field still accepts a present value.\nexport type CtxArg<Ctx> = [Record<never, never>] extends [Ctx]\n  ? { ctx?: Ctx }\n  : { ctx: Ctx };\n\nexport function run<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n  E extends { type: string } = never,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  opts: CtxArg<Ctx> & {\n    store?: Store<S>;\n    onError?: OnError;\n    /**\n     * The SEMANTIC event projector (#47). Maps one APPLIED transition `(msg,\n     * state)` to zero-or-more public events of the machine-level union `E`.\n     * Returning `[]` skips the transition (it produced no event the consumer's\n     * `on(type, …)` cares about). This is where a machine maps its PRIVATE Msg\n     * vocabulary (a retry plumbing's `resilient_ok`, a tool loop's\n     * `agent_tool_ok`) to NAMED events — the private names live only inside this\n     * closure and never reach `on`'s `E` surface. Omit → the run has no event\n     * surface (`E = never`) and `on` is uncallable.\n     *\n     * PURE — called inside the dispatch loop on the freshly-folded `(msg,\n     * state)`; it must not read the clock, mutate, or throw (a throw is\n     * isolated like an observer throw, never stranding the transition).\n     */\n    events?: (msg: M, state: S) => readonly E[];\n    /**\n     * Declared policy for when the pure `update` (reducer) throws. The reducer\n     * throw is always surfaced via `onError` (`phase: \"reduce\"`); the strategy\n     * decides what the runtime does next. Defaults to `\"stop\"` — the explicit,\n     * safe choice (surface + halt, never a silent resume). See `Supervision`.\n     */\n    supervision?: Supervision<S, M>;\n    /**\n     * The run-terminality predicate — what makes the run's outcome first-class\n     * (issue #46). Returns `true` for a State the run has finished in (e.g. an\n     * agent's `state.run.phase === \"done\"`). The runtime feeds it to\n     * `Runtime.result()` (the terminal State, or `undefined` in flight) and\n     * `Runtime.done()` (resolves with the terminal State when it first holds).\n     *\n     * PURE — the runtime calls it inside the dispatch loop on the freshly-folded\n     * State; it must not read the clock, mutate, or throw. Omit → the run is\n     * never terminal: `result()` always returns `undefined` and `done()` never\n     * resolves (the right behavior for a machine with no natural completion).\n     */\n    terminal?: (state: S) => boolean;\n    /**\n     * Iteration cap for `idle()`'s quiescence wait. Defaults to 100_000. Test\n     * seam only — lets a livelock test trip the `QuiescenceTimeoutError` reject\n     * path in a handful of iterations instead of 100k. Production code must not\n     * set it.\n     *\n     * @internal test-only\n     */\n    __idleCap?: number;\n  },\n): BootingRuntime<S, M, E> {\n  const { store } = opts;\n  // `ctx` is conditionally optional (see `CtxArg`): a pure machine omits it.\n  // Default the absent/nullish case to an empty object so the augmented-ctx\n  // spread and `init(loaded, ctx)` get a value, never `undefined`. Callers that\n  // pass a real `ctx` (or `ctx: undefined` for a `Ctx = undefined` machine that\n  // ignores it) are unchanged.\n  const ctx = (opts.ctx ?? {}) as Ctx;\n  const idleCap = opts.__idleCap ?? 100_000;\n  // The semantic-event projector (#47). Defaults to \"no events\" — a machine\n  // that wires none has an empty event surface (`E = never`), so `on` is\n  // uncallable and this projector never runs.\n  const projectEvents: (msg: M, state: S) => readonly E[] =\n    opts.events ?? (() => []);\n  // The run-terminality predicate (#46). Defaults to \"never terminal\" so a\n  // machine with no natural completion has a sound `result()`/`done()` (always\n  // undefined / never resolves) rather than a missing one.\n  const isTerminal: (state: S) => boolean = opts.terminal ?? (() => false);\n  // The error sink for paths with no caller to reject at (follow-up dispatch\n  // rejections, the final stop-save). Optional on `run`; when absent we fall\n  // back to `defaultOnError`, which re-throws on a macrotask so the failure\n  // still surfaces. Invariant 6: no silent failures.\n  const onError: OnError = opts.onError ?? defaultOnError;\n  // The sink must itself be total. If a consumer's sink throws, route THAT\n  // throw through `defaultOnError` so a buggy sink can't re-create a silent\n  // failure (or strand a teardown loop).\n  const reportError = (error: unknown, context: RuntimeErrorContext): void => {\n    try {\n      onError(error, context);\n    } catch (sinkError) {\n      defaultOnError(sinkError, context);\n    }\n  };\n  // The declared policy for a reducer throw (ADR 0003 #4). Default `stop`:\n  // surface via `onError` + halt, never a silent resume. Normalized once here\n  // so `stepDispatch` branches on `.strategy` without re-parsing the shorthand.\n  const supervision = normalizeSupervision<S, M>(opts.supervision);\n\n  // Holders are intentionally late-initialized: `state` is set inside the boot\n  // step, which runs as the head of the tail. `getState()` before boot throws.\n  let state: S | undefined;\n  let bootError: unknown = null;\n  let stopped = false;\n\n  const subRegistry = new Map<string, () => void>();\n  const listeners = new Set<() => void>();\n  // Observers receive (msg, state) for every completed, APPLIED transition. The\n  // boot transition has no applied Msg — it is delivered via `onBoot`, not here\n  // — so `msg` is total (`M`, never `null`) (#47). Same throw-isolation\n  // contract as listeners.\n  const observers = new Set<(msg: M, state: S) => void>();\n  // `onBoot` handlers receive the initial State once (#47). The boot case the\n  // old `observe(msg === null)` arm carried lives here now. `booted` flips on\n  // the boot fanout so a handler registered AFTER boot fires immediately with\n  // the captured initial State (never misses it).\n  const bootHandlers = new Set<(state: S) => void>();\n  let booted = false;\n  // Semantic-event handlers, keyed by event `type` (#47). Each `on(type, fn)`\n  // adds `fn` to its type's bucket; the dispatch loop projects each transition\n  // to `E[]` via `projectEvents` and fans each event to its type's handlers.\n  // Stored as `(event: { type: string }) => void` to keep the registry\n  // monomorphic; per-type safety lives at the `on` call site (the handler's `K`\n  // narrows the event via `Extract<E, { type: K }>`).\n  const eventHandlers = new Map<string, Set<(event: E) => void>>();\n  // `done()` waiters (#46): each open `done()` call parks its resolver here.\n  // The first transition that makes `isTerminal(state)` hold drains the set,\n  // resolving every parked promise with the terminal State. A `done()` call\n  // made AFTER the run is already terminal resolves immediately and never\n  // parks (so it can never miss the terminal transition).\n  const doneWaiters = new Set<(state: S) => void>();\n\n  // Port subscriber registry. Keyed by Port reference (NOT name) — port\n  // identity is nominal/by-reference per Elm semantics. Each port can have\n  // many listeners; emissions fan out synchronously to all of them.\n  // `Set<(value: unknown) => void>` is the storage shape; per-port type\n  // safety is enforced at the `subscribePort` / `emit` call sites via the\n  // phantom `__t` field on `Port<T>`.\n  const portRegistry = new Map<Port<unknown>, Set<(value: unknown) => void>>();\n\n  // The `emit` function injected onto ctx. Synchronous fanout — same shape as\n  // `observe`. No-op when the port has no subscribers. Listener throws are\n  // isolated (one bad subscriber does not strand the others) and routed to\n  // the error sink (invariant 6; #277).\n  function portEmit<T>(port: Port<T>, value: T): void {\n    const subscribers = portRegistry.get(port as Port<unknown>);\n    if (!subscribers || subscribers.size === 0) return;\n    for (const listener of subscribers) {\n      try {\n        listener(value);\n      } catch (err) {\n        reportError(err, { phase: \"port-emit\" });\n      }\n    }\n  }\n\n  // Augmented ctx passed to every Cmd handler. `ctx` is intentionally spread\n  // into a fresh object so handlers receive a Ctx & PortEmitter without\n  // mutating the caller's ctx (which may be shared across runtimes / tests).\n  const augmentedCtx: Ctx & PortEmitter = { ...ctx, emit: portEmit };\n\n  // === update dispatch ===\n  //\n  // The substrate accepts two `update` shapes (see `defineMachine` overloads);\n  // dispatch goes through `applyCell`, the single reducer-vs-transitions\n  // primitive keyed on `formOf` (see `pure/core.ts`, #275).\n  function applyUpdate(state: S, msg: M): readonly [S, readonly C[]] {\n    if (__DEV__) deepFreeze(state);\n    const result = applyCell<S, M, C>(machine, state, msg);\n    if (__DEV__) assertPureResult(result, msg.type);\n    return result;\n  }\n\n  // The serial dispatch queue: every step is chained onto `tail`. New dispatch\n  // calls (and re-entrant ones from interpret follow-ups) wait for the\n  // previous step to fully resolve before running their reducer. This is the\n  // single concurrency gate.\n  let tail: Promise<void> = Promise.resolve();\n\n  /**\n   * Reconcile subscriptions against `state`. Called after every save.\n   *\n   * - Same id present in old + new → leave running.\n   * - Removed id → call cleanup. Cleanup throws are isolated and routed to\n   *   the error sink (`phase: \"sub-cleanup\"`; #277).\n   * - New id → call subscribe[type]; on success store cleanup. On throw, the\n   *   sub is NOT registered; throw is remembered and re-thrown after the loop\n   *   so all other new subs still register.\n   */\n  function reconcileSubs(): void {\n    if (!machine.subscriptions) return;\n    const desired = machine.subscriptions(state as S);\n    const desiredIds = new Set<string>();\n\n    // Collision assert: within a single desired set, two subs sharing an id\n    // but declaring different types is the silent class of bug that Elm's\n    // sub diffing relies on the user to avoid — we catch it explicitly here.\n    // (Same id + same type within the desired set is a redundant declaration\n    // — harmless, and the `subRegistry.has` check below dedupes it on the\n    // start path. Same id across transitions is the no-churn case the\n    // reconcile pass is designed for and MUST NOT throw.)\n    const desiredTypeById = new Map<string, string>();\n    for (const sub of desired) {\n      const existing = desiredTypeById.get(sub.id);\n      if (existing !== undefined && existing !== sub.type) {\n        throw new Error(\n          `@demlik/tea: Sub.id collision: id=\"${sub.id}\" declared as type=\"${existing}\" and type=\"${sub.type}\"`,\n        );\n      }\n      desiredTypeById.set(sub.id, sub.type);\n    }\n\n    // Removals first — anything in the registry not in `desired` should stop.\n    for (const sub of desired) desiredIds.add(sub.id);\n    for (const [id, cleanup] of subRegistry) {\n      if (!desiredIds.has(id)) {\n        try {\n          cleanup();\n        } catch (err) {\n          reportError(err, { phase: \"sub-cleanup\" });\n        }\n        subRegistry.delete(id);\n      }\n    }\n\n    // Additions — anything in `desired` not in the registry should start.\n    let firstStartError: unknown = null;\n    for (const sub of desired) {\n      if (subRegistry.has(sub.id)) continue;\n      const handler = machine.subscribe?.[sub.type as U[\"type\"]];\n      if (!handler) {\n        // No handler for this sub type — programmer error; skip. (TS would\n        // normally forbid this at compile time when `subscribe` is provided\n        // and U has variants, but a runtime guard is cheap.)\n        continue;\n      }\n      try {\n        const cleanup = handler(\n          sub as Extract<U, { type: U[\"type\"] }>,\n          ctx,\n          enqueueDispatch,\n        );\n        subRegistry.set(sub.id, cleanup);\n      } catch (err) {\n        if (firstStartError === null) firstStartError = err;\n        // Do NOT register; continue to next sub so other starts still run.\n      }\n    }\n    if (firstStartError !== null) throw firstStartError;\n  }\n\n  // `interpret` is optional at the type level when `C extends Cmd<never>`\n  // (see `Machine<...>`). The runtime safely defaults a missing map to `{}`\n  // because such a machine never emits cmds — the cmd loop below never\n  // dereferences a handler. The defensive default also guards against a\n  // miswired non-Cmd<never> consumer reaching this code path; the per-cmd\n  // `if (!handler) continue` then preserves invariant-6 forward progress\n  // instead of throwing on `undefined.foo`.\n  type InterpretMap = {\n    [K in C[\"type\"]]: (\n      cmd: Extract<C, { type: K }>,\n      ctx: Ctx & PortEmitter,\n      // biome-ignore lint/suspicious/noConfusingVoidType: an interpret handler returns a follow-up Msg or nothing; `void` permits no-return bodies that `M | undefined` would reject\n    ) => Promise<M | void>;\n  };\n  const interpretMap: InterpretMap =\n    (machine as { interpret?: InterpretMap }).interpret ?? ({} as InterpretMap);\n\n  /**\n   * Run `interpret` for each emitted cmd. Each handler may return a follow-up\n   * Msg — that Msg is enqueued onto the tail (NOT dispatched re-entrantly\n   * inside the current transition).\n   *\n   * Throws propagate to the caller of `step`. The first error stops further\n   * handlers in this transition.\n   */\n  async function runInterpret(cmds: readonly C[]): Promise<void> {\n    for (const cmd of cmds) {\n      const handler = interpretMap[cmd.type as C[\"type\"]];\n      if (!handler) continue;\n      const follow = await handler(\n        cmd as Extract<C, { type: C[\"type\"] }>,\n        augmentedCtx,\n      );\n      if (follow !== undefined && follow !== null) {\n        // Schedule follow-up Msg on the tail. The current step resolves\n        // first; the follow-up runs after, as a fresh transition. The\n        // returned rejection has no caller (the original dispatcher already\n        // resolved), so route it to the error sink instead of swallowing it —\n        // invariant 6: no silent failures. If you want this failure folded\n        // back into state, name a failure Msg via `tryInterpret` (Railway);\n        // the sink is the last-resort observability hook for the rest.\n        enqueueDispatch(follow as M).catch((error: unknown) => {\n          reportError(error, { phase: \"follow-up\" });\n        });\n      }\n    }\n  }\n\n  /**\n   * Fire every external listener. Listener throws are isolated — one bad\n   * listener does not strand the others. This is the dual of cleanup\n   * semantics: the runtime guarantees forward progress for unrelated\n   * observers.\n   */\n  function fireListeners(): void {\n    for (const listener of listeners) {\n      try {\n        listener();\n      } catch (err) {\n        reportError(err, { phase: \"listener\" });\n      }\n    }\n  }\n\n  /**\n   * Fire every observer with the just-applied msg + post-transition state.\n   * Same throw-isolation contract as `fireListeners`. Called immediately\n   * after `fireListeners` so observers see exactly what subscribers see. Only\n   * called for APPLIED transitions — `msg` is total (the boot case routes to\n   * `fireBoot`, not here) (#47).\n   */\n  function fireObservers(msg: M): void {\n    if (observers.size === 0 || state === undefined) return;\n    const snapshot = state;\n    for (const observer of observers) {\n      try {\n        observer(msg, snapshot);\n      } catch (err) {\n        reportError(err, { phase: \"observer\" });\n      }\n    }\n  }\n\n  /**\n   * Project the just-applied transition to semantic events and fan each to its\n   * type's `on(...)` handlers (#47). The projector maps the machine's private\n   * Msg vocabulary to public events; a throw in the projector OR a handler is\n   * isolated (errors-are-data) so it never strands the transition. Called right\n   * after `fireObservers` so an `on` handler sees the same post-transition State\n   * an observer would.\n   */\n  function fireEvents(msg: M): void {\n    if (eventHandlers.size === 0 || state === undefined) return;\n    let events: readonly E[];\n    try {\n      events = projectEvents(msg, state);\n    } catch (err) {\n      reportError(err, { phase: \"event\" });\n      return;\n    }\n    for (const event of events) {\n      const bucket = eventHandlers.get(event.type);\n      if (bucket === undefined) continue;\n      for (const handler of bucket) {\n        try {\n          handler(event);\n        } catch (err) {\n          reportError(err, { phase: \"event\" });\n        }\n      }\n    }\n  }\n\n  /**\n   * Fire every `onBoot` handler with the initial State, ONCE, and flip `booted`\n   * (#47). This carries the case the old `observe(msg === null)` arm did. Same\n   * throw-isolation contract. A handler registered after this runs fires\n   * immediately at its `onBoot` call site instead (it reads `booted`).\n   */\n  function fireBoot(): void {\n    booted = true;\n    if (bootHandlers.size === 0 || state === undefined) return;\n    const snapshot = state;\n    for (const handler of bootHandlers) {\n      try {\n        handler(snapshot);\n      } catch (err) {\n        reportError(err, { phase: \"boot\" });\n      }\n    }\n  }\n\n  /**\n   * Resolve every parked `done()` waiter iff the just-folded State is terminal\n   * (#46). Called once per completed transition (including boot), right after\n   * the observer fanout, so a `done()` promise settles on the SAME transition a\n   * synchronous `result()` would first return non-`undefined`. Drains the set\n   * before resolving (a resolver enqueued anew during the drain belongs to the\n   * next call, not this one — but a terminal State stays terminal, so the new\n   * waiter's own `done()` call already resolved it immediately).\n   */\n  function settleDoneWaiters(): void {\n    if (doneWaiters.size === 0 || state === undefined) return;\n    if (!isTerminal(state)) return;\n    const snapshot = state;\n    const parked = [...doneWaiters];\n    doneWaiters.clear();\n    for (const resolve of parked) resolve(snapshot);\n  }\n\n  /**\n   * The post-transition commit tail: install the new state, then save →\n   * reconcile subs → interpret → fire fanout → settle done-waiters.\n   * Save-before-effects is the hard ordering; tests pin it. Both the normal\n   * transition and the `restart` supervision branch end here, so\n   * `fireEvents`/`settleDoneWaiters` live on exactly one path (#279).\n   */\n  async function commit(next: S, msg: M, cmds: readonly C[]): Promise<void> {\n    state = next;\n    if (store) await store.save(next);\n    // Subscriptions reconcile against the new state; throws propagate AFTER\n    // the entire diff pass completes (so other subs still register / clean\n    // up correctly). Cleanup throws are swallowed inside reconcileSubs.\n    reconcileSubs();\n    await runInterpret(cmds);\n    fireListeners();\n    fireObservers(msg);\n    fireEvents(msg);\n    settleDoneWaiters();\n  }\n\n  /**\n   * One full transition: update → save → reconcile subs → interpret → fire\n   * listeners. Save-before-effects is the hard ordering; tests pin it.\n   *\n   * Throws from `update` propagate immediately (state unchanged). Throws from\n   * `save` propagate after the in-memory `state` is advanced (PRD row: \"state\n   * advanced; persisted state did not\"). Throws from reconcile or interpret\n   * propagate after `save` has succeeded (PRD row: \"state already saved\").\n   */\n  async function stepDispatch(msg: M): Promise<void> {\n    if (state === undefined) {\n      // This should never happen — boot always runs before any dispatch.\n      throw new Error(\"@demlik/tea: runtime not booted\");\n    }\n    // The reducer is the only synchronous user code in the step, and #71's\n    // brand guarantees it cannot suspend — so a throw here is a clean,\n    // catchable synchronous throw with `state` still at its pre-transition\n    // value. Route it to the declared supervision strategy (ADR 0003 #4).\n    let next: S;\n    let cmds: readonly C[];\n    try {\n      [next, cmds] = applyUpdate(state, msg);\n    } catch (reduceError) {\n      // Invariant 6 — surface the failure as data FIRST, for every strategy.\n      reportError(reduceError, { phase: \"reduce\" });\n      switch (supervision.strategy) {\n        case \"restart\": {\n          // Host supplies last-known-good state; core installs it and KEEPS\n          // FOLDING from there. State did not advance to the (never-produced)\n          // reducer result — it is replaced by the rehydrated value. The\n          // transition continues below with no cmds, since the throwing reduce\n          // produced none. A throw inside `rehydrate` itself is NOT caught here\n          // — it propagates as a genuine recovery failure (the host's\n          // last-good source is broken), surfacing to the dispatch caller.\n          // No cmds to interpret — the reducer never returned a result.\n          await commit(supervision.rehydrate(state, msg, reduceError), msg, []);\n          return;\n        }\n        case \"escalate\":\n          // Surface + propagate. The runtime stays live (a parent supervisor\n          // may keep dispatching); the failure bubbles out the dispatch\n          // promise so the caller above sees it.\n          throw reduceError;\n        default:\n          // `stop` (the safe default): halt the runtime. State is NOT advanced;\n          // every subsequent dispatch rejects (\"runtime stopped\"). Propagate so\n          // THIS dispatch promise also rejects — the halt is observable, never\n          // a silent resume.\n          stopped = true;\n          throw reduceError;\n      }\n    }\n    await commit(next, msg, cmds);\n  }\n\n  /**\n   * Boot is split into two phases.\n   *\n   * - **Synchronous (`run()` call):** when `store` is absent, we know `loaded\n   *   = null` without an await — run `init(null, ctx)` IMMEDIATELY so that\n   *   `getState()` is observable synchronously. This is what\n   *   `useSyncExternalStore` consumers (e.g. `@demlik/tea/react`) need to render\n   *   on the first commit without an undefined-state flicker.\n   * - **Asynchronous (`stepBootEffects` on the tail):** save + sub reconcile\n   *   + interpret-of-init-cmds + listener fire. These run as the first tail\n   *   entry; subsequent dispatches queue behind them.\n   *\n   * When `store` IS present we cannot do `init` synchronously (we'd be\n   *  inventing a loaded value), so we keep the full async path. Components\n   * that want synchronous initial state in that case should omit the store\n   * for the React mount and persist via a different mechanism (or accept the\n   * default-snapshot story in a future v2).\n   *\n   * `store.load` throws propagate via the boot promise; subsequent calls\n   * reject with the load error. (The PRD row \"run() throws synchronously\" is\n   * imprecise relative to Store#load being async — we honor the intent: no\n   * usable runtime is ever observable on load failure.)\n   */\n  // Synchronous init when there is NO store: `getState()` is observable\n  // synchronously by `useSyncExternalStore` consumers. When a store IS\n  // present, `init` must run AFTER `store.load()` (the contract: `init`\n  // receives the loaded snapshot), and callers must await boot before\n  // calling `getState()` — they do so implicitly via the first `dispatch()`\n  // (which queues behind the boot step).\n  //\n  // The asymmetry is the substrate being honest about a real constraint: a\n  // store is, by definition, an async boundary. Components that need\n  // synchronous initial state under a store should await the runtime's boot\n  // before mounting — `await runtime.ready` (not provided in v1; use `await\n  // runtime.dispatch(noopMsg)` if needed, or a parent-level loading state).\n  let pendingInitCmds: readonly C[] = [];\n  if (!store) {\n    const [initialState, initCmds] = machine.init(null, ctx);\n    state = initialState;\n    pendingInitCmds = initCmds;\n  }\n\n  async function stepBootEffects(): Promise<void> {\n    if (store) {\n      // Boundary parse (invariant 8). `store.load()` returns `unknown`\n      // because storage doesn't know `S`; `store.migrate(raw)` is the\n      // substrate's required parse — `S` on recognized shape, `null` on\n      // unrecognized (which boots fresh, a known-good path). `migrate` MUST\n      // NOT throw per its contract; if it does we surface the error via the\n      // boot promise (same as a `load` throw — `runtime.ready` rejects and\n      // every subsequent `dispatch` surfaces `bootError`).\n      const raw = await store.load();\n      const parsed = store.migrate(raw);\n      const [initialState, initCmds] = machine.init(parsed, ctx);\n      state = initialState;\n      pendingInitCmds = initCmds;\n      await store.save(state);\n    }\n    reconcileSubs();\n    await runInterpret(pendingInitCmds);\n    fireListeners();\n    // The boot transition has no applied Msg — deliver the initial State via\n    // `onBoot`, not `observe` (#47). No `fireEvents` either: boot is not an\n    // applied event, so it projects no semantic event.\n    fireBoot();\n    // A rehydrated boot can land in a terminal State (the run finished before\n    // the last eviction) — settle any `done()` waiter parked before boot.\n    settleDoneWaiters();\n  }\n\n  /**\n   * Enqueue a dispatch on the tail. Re-entrant calls from interpret or\n   * subscribe handlers go through this same gate — guaranteeing serial\n   * execution across the entire system.\n   *\n   * `dispatch` rejects when:\n   * - the runtime is stopped (next dispatch always rejects after stop);\n   * - boot failed (every dispatch surfaces the boot error);\n   * - the reducer, save, sub start, or interpret throws.\n   */\n  function enqueueDispatch(msg: M): Promise<void> {\n    if (stopped)\n      return Promise.reject(new Error(\"@demlik/tea: runtime stopped\"));\n    const next = tail.then(() => {\n      if (bootError !== null) throw bootError;\n      return stepDispatch(msg);\n    });\n    // Swallow the rejection on the tail so a single failing dispatch does NOT\n    // poison every subsequent one. The original `next` promise still rejects\n    // for the dispatch caller.\n    tail = next.catch(() => {});\n    return next;\n  }\n\n  /**\n   * Drain the serial tail to quiescence. Quiescence = the tail stopped\n   * advancing: every interpret follow-up calls `enqueueDispatch`, which\n   * reassigns `tail` SYNCHRONOUSLY (before the parent step resolves), so\n   * awaiting the current `tail` and re-reading it catches every transitively\n   * enqueued follow-up. We loop until the reference is stable across an await.\n   *\n   * Bounded by `idleCap` — on cap we REJECT with `QuiescenceTimeoutError`\n   * (never a silent fall-through-resolve), so a livelocking machine stays\n   * distinguishable from a genuinely quiesced one (invariant 6 — issue #51).\n   *\n   * Shared by `runtime.idle()` and the quiescent `dispatch` default (#50): one\n   * drain definition, one cap, one reject contract.\n   */\n  async function drainToQuiescence(): Promise<void> {\n    for (let i = 0; i < idleCap; i++) {\n      const observed = tail;\n      await observed;\n      if (tail === observed) return;\n    }\n    throw new QuiescenceTimeoutError(idleCap);\n  }\n\n  /**\n   * The public `dispatch`: run-to-quiescence by default (#50). Enqueue the Msg\n   * on the tail, await its OWN transition first (so a reducer / save / interpret\n   * throw on THIS Msg surfaces here, before any drain), then — unless the caller\n   * asked for a single step — drain the transitive follow-up chain.\n   *\n   * `{ settle: \"once\" }` (and the `dispatchOnce` alias) skip the drain: resolve\n   * after the one transition and leave the follow-up chain racing on the tail\n   * for a caller that will `await runtime.idle()` itself.\n   */\n  async function dispatchToQuiescence(\n    msg: M,\n    opts?: { readonly settle?: DispatchSettle },\n  ): Promise<void> {\n    await enqueueDispatch(msg);\n    if (opts?.settle === \"once\") return;\n    await drainToQuiescence();\n  }\n\n  // Kick off boot-effects immediately. Boot rejections are remembered on\n  // `bootError`; they surface on every subsequent dispatch call. Note: when\n  // `store` is absent the synchronous-init step above already set `state` —\n  // `stepBootEffects` only runs save/sub/interpret/listener-fire. When\n  // `store` is present, the full async path runs here.\n  //\n  // `bootPromise` is the original (un-swallowed) promise — it is what\n  // `runtime.ready` chains off so callers see the boot error directly. `tail`\n  // gets the swallowed branch so a boot failure does NOT poison every\n  // subsequent dispatch's `.then` chain (each dispatch surfaces `bootError`\n  // explicitly inside `enqueueDispatch`).\n  const bootPromise = stepBootEffects();\n  tail = bootPromise.catch((err) => {\n    bootError = err;\n  });\n\n  // `ready` resolves to the booted `Runtime` (issue #45). It chains off the\n  // un-swallowed `bootPromise` so boot failures reject it directly — meaning a\n  // failed boot never hands out a `Runtime`, which is what keeps `getState()`\n  // total. The `runtime` reference resolves at `.then` time (a later\n  // microtask), well after the object literal below finishes initializing, so\n  // the forward reference is safe. Built once → idempotent: the same settled\n  // promise comes back on every `ready` read.\n  const readyPromise: Promise<Runtime<S, M, E>> = bootPromise.then(\n    () => runtime,\n  );\n\n  const runtime: Runtime<S, M, E> = {\n    dispatch: dispatchToQuiescence,\n    dispatchOnce: enqueueDispatch,\n    getState(): S {\n      // TOTAL (issue #45). A `Runtime` is only obtainable by awaiting `ready`,\n      // which resolves AFTER boot has run `init` and set `state` — so by the\n      // time any holder of this object can call `getState()`, `state` is\n      // defined. No `state === undefined` throw branch: that was the old lie\n      // (declared total on the synchronously-returned handle, threw under a\n      // store pre-boot). Boot failures never reach here either — `ready`\n      // rejects, so no `Runtime` is ever handed out on a failed boot.\n      //\n      // The cast encodes that invariant. The lone way to reach it with `state`\n      // still undefined would be to cast the BootingRuntime to Runtime and call\n      // `getState()` before `ready` — which the type system now forbids without\n      // an explicit, deliberate cast.\n      return state as S;\n    },\n    subscribe(listener: () => void): () => void {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    observe(observer: (msg: M, state: S) => void): () => void {\n      observers.add(observer);\n      return () => {\n        observers.delete(observer);\n      };\n    },\n    onBoot(handler: (state: S) => void): () => void {\n      // Already booted → fire immediately with the captured initial State so a\n      // late subscriber never misses the one-shot boot (#47). It does not park\n      // (boot is a single past event), so the returned cleanup is a no-op.\n      if (booted && state !== undefined) {\n        try {\n          handler(state);\n        } catch (err) {\n          reportError(err, { phase: \"boot\" });\n        }\n        return () => {};\n      }\n      bootHandlers.add(handler);\n      return () => {\n        bootHandlers.delete(handler);\n      };\n    },\n    on<K extends E[\"type\"]>(\n      type: K,\n      handler: (event: Extract<E, { type: K }>) => void,\n    ): () => void {\n      // The registry is monomorphic (`Set<(event: E) => void>`); the per-type\n      // narrowing lives at THIS call site — `handler` accepts the `K`-narrowed\n      // event, and `fireEvents` only ever routes an event to its own type's\n      // bucket, so the erased call is sound.\n      let bucket = eventHandlers.get(type);\n      if (bucket === undefined) {\n        bucket = new Set<(event: E) => void>();\n        eventHandlers.set(type, bucket);\n      }\n      const erased = handler as (event: E) => void;\n      bucket.add(erased);\n      return () => {\n        const set = eventHandlers.get(type);\n        if (set === undefined) return;\n        set.delete(erased);\n        if (set.size === 0) eventHandlers.delete(type);\n      };\n    },\n    subscribePort<T>(port: Port<T>, listener: (value: T) => void): () => void {\n      const key = port as Port<unknown>;\n      let bucket = portRegistry.get(key);\n      if (!bucket) {\n        bucket = new Set<(value: unknown) => void>();\n        portRegistry.set(key, bucket);\n      }\n      // The bucket stores `(value: unknown) => void` to keep the registry\n      // monomorphic; per-port type safety lives at this call site (the\n      // listener's `T` is bound to the port's phantom `__t`).\n      const erased = listener as (value: unknown) => void;\n      bucket.add(erased);\n      return () => {\n        const set = portRegistry.get(key);\n        if (!set) return;\n        set.delete(erased);\n        if (set.size === 0) portRegistry.delete(key);\n      };\n    },\n    emitPort<T>(port: Port<T>, value: T): void {\n      // Same closure as `ctx.emit` inside interpret — synchronous fanout,\n      // no-op on no subscribers, listener-throw isolation. Exposing it on\n      // the Runtime interface lets `observe`-driven Port emission work\n      // without spawning a \"tell the outside world\" Cmd per transition.\n      portEmit(port, value);\n    },\n    // `ready` is assigned just below (it must resolve to `runtime` itself,\n    // which can't be referenced inside its own object literal). See the\n    // assignment + rationale after this block.\n    ready: readyPromise,\n    idle(): Promise<void> {\n      // Quiescence = the tail stopped advancing (full rationale on\n      // `drainToQuiescence`). `idle()` is the direct await of that drain; the\n      // quiescent `dispatch` default reuses the SAME helper after its own\n      // transition. The cap + `QuiescenceTimeoutError` reject (no silent\n      // fall-through-resolve) keeps \"quiesced\" and \"gave up\" distinguishable —\n      // invariant 6: no silent failures.\n      return drainToQuiescence();\n    },\n    result(): S | undefined {\n      // TOTAL — `state` is defined for any holder of a `Runtime` (see\n      // `getState`). The terminal predicate is the ONLY thing that decides\n      // \"finished\"; with none supplied `isTerminal` is `() => false`, so a\n      // non-terminating machine reads `undefined` forever (#46).\n      const current = state as S;\n      return isTerminal(current) ? current : undefined;\n    },\n    done(): Promise<S> {\n      // Already terminal → resolve at once with the live State (never parks, so\n      // a post-termination call can't miss the terminal transition).\n      const current = state as S;\n      if (isTerminal(current)) return Promise.resolve(current);\n      // Otherwise park a resolver; `settleDoneWaiters` drains it on the\n      // transition that first makes `isTerminal` hold. With no predicate this\n      // promise never resolves — the documented \"no natural completion\" case.\n      return new Promise<S>((resolve) => {\n        doneWaiters.add(resolve);\n      });\n    },\n    async stop(): Promise<void> {\n      stopped = true;\n      // Drain whatever is in flight before tearing down. Any rejections in\n      // the tail were already swallowed at enqueue time, so this await\n      // always resolves.\n      await tail;\n      // Run every active sub cleanup. Throws are isolated (one bad cleanup\n      // does not strand the others) and routed to the error sink (#277).\n      for (const [id, cleanup] of subRegistry) {\n        try {\n          cleanup();\n        } catch (err) {\n          reportError(err, { phase: \"sub-cleanup\" });\n        }\n        subRegistry.delete(id);\n      }\n      // Flush final state. A save throw here does not reject `stop()` — the\n      // contract is \"returns a resolved Promise\" — but it IS the loss of the\n      // last write, so route it to the error sink rather than swallowing it\n      // with a bare console.error. Invariant 6: no silent failures.\n      if (store && state !== undefined && bootError === null) {\n        try {\n          await store.save(state);\n        } catch (error) {\n          reportError(error, { phase: \"stop-save\" });\n        }\n      }\n    },\n  };\n\n  return runtime;\n}\n\n// === historyTracker: composable observability helper ===\n//\n// A bounded ring buffer of recent `(msg, state)` transitions, built on the\n// Runtime's public `observe` API. The substrate itself stays minimal — it\n// has no notion of history, no opt to enable one, no method on the Runtime\n// interface to read one. Anything that wants \"recent transitions\" composes\n// via this helper. The substrate provides the primitive (`observe`); this\n// is the bookkeeping that builds on it.\n//\n// Use cases:\n//   - Bridge backlog replay for late subscribers (see `@demlik/tea/extension`).\n//   - Debug inspectors showing recent traffic on attach.\n//   - Sentry breadcrumb collection.\n//   - Property/contract tests that want to assert \"these N transitions\n//     happened in this order.\"\n//\n// Discipline:\n//   - One-line creation: `const tr = historyTracker(runtime, 100);`\n//   - Snapshot at any time: `tr.snapshot()` — shallow copy, oldest first.\n//   - Detach when done: `tr.stop()` — unsubscribes the observer; the buffer\n//     freezes at its current contents (snapshot() still works, useful for\n//     post-hoc inspection in tests).\n//\n// Why not put this on the Runtime interface as `runtime.history()`?\n// Because history is derivable. Putting it on the Runtime privileges one\n// use case (debug inspectors) at the substrate level and grows the\n// interface for everyone. The composition shape stays out of the dispatch\n// loop entirely — the substrate's hot path doesn't pay any cost for a\n// feature it doesn't need to provide.\n// =============================================================================\n\nexport interface HistoryTracker<S, M extends { type: string }> {\n  /**\n   * Snapshot of recorded transitions, oldest first. Each entry is\n   * `{ msg, state }` exactly as the underlying `observe` callback received\n   * it — `msg` is `null` for the boot transition, a Msg for every other.\n   *\n   * Returns a shallow copy: the array is fresh on every call (callers may\n   * iterate, slice, or replay without affecting the tracker's buffer).\n   * Entry values are references to the originals (TEA states/msgs are\n   * conventionally immutable; do not mutate them if your S/M is not).\n   */\n  snapshot(): readonly { readonly msg: M | null; readonly state: S }[];\n  /**\n   * Detach the underlying observer. After `stop()`:\n   *   - No new transitions are recorded.\n   *   - `snapshot()` continues to work and returns the buffer's contents\n   *     at the moment of stop (useful for post-hoc inspection in tests).\n   *   - The tracker holds no references that would prevent GC of the\n   *     `runtime` argument other than the entries already buffered.\n   *\n   * Idempotent — subsequent calls are no-ops.\n   */\n  stop(): void;\n}\n\n/**\n * Create a bounded history tracker over a Runtime. The tracker subscribes\n * to the runtime via `observe(...)` and retains the last `size` `(msg,\n * state)` transitions in a FIFO ring buffer.\n *\n * @param runtime  Any `BootingRuntime<S, M>` (a full `Runtime` satisfies it).\n *                 The tracker uses only `observe`, which is total before boot —\n *                 attach it to the synchronous `run()` handle to record the\n *                 boot transition.\n * @param size     Buffer cap. `size <= 0` produces an inert no-op tracker:\n *                 no observer is attached to the runtime, `snapshot()` is\n *                 always `[]`, and `stop()` is a no-op. (Prefer skipping the\n *                 tracker entirely in that case — this arm just makes a\n *                 non-positive `size` harmless rather than an error.)\n *\n * Memory cost: O(size × avg(msg + state size)). For audit-extension's\n * inspector use case (size 100, audit state ~5KB), ~500KB max — held\n * in-memory only, no persistence.\n */\nexport function historyTracker<S, M extends { type: string }>(\n  runtime: BootingRuntime<S, M>,\n  size: number,\n): HistoryTracker<S, M> {\n  const buffer: { msg: M | null; state: S }[] = [];\n  let stopped = false;\n\n  const push = (entry: { msg: M | null; state: S }): void => {\n    buffer.push(entry);\n    if (buffer.length > size) buffer.shift();\n  };\n\n  // The boot transition (the `{ msg: null, state }` head entry the old\n  // `observe(msg === null)` arm recorded) now arrives via `onBoot` (#47);\n  // applied transitions arrive via `observe` with a total `msg`. The public\n  // snapshot shape (`msg: M | null`) is unchanged — boot is still `msg: null`.\n  const unobserve =\n    size <= 0\n      ? (): void => {}\n      : runtime.observe((msg, state) => {\n          push({ msg, state });\n        });\n  const unboot =\n    size <= 0\n      ? (): void => {}\n      : runtime.onBoot((state) => {\n          push({ msg: null, state });\n        });\n\n  return {\n    snapshot() {\n      // Shallow copy — callers may freely iterate or mutate the returned\n      // array. Entry values are references; see HistoryTracker docs.\n      return buffer.slice();\n    },\n    stop() {\n      if (stopped) return;\n      stopped = true;\n      unobserve();\n      unboot();\n    },\n  };\n}\n\n// === replay: pure unit-test helper ===\n//\n// Composes `init(loaded ?? null, ctx)` then `update(state, msg)` for each msg.\n// Returns the final state plus the cmds that *would* have been emitted and the\n// subs that *would* have been desired at the final state.\n//\n// Crucially:\n// - does NOT call any `interpret[type]` handler\n// - does NOT touch `Store`\n// - does NOT start any subscription via `machine.subscribe?.[type]`\n//\n// `subscriptions` (the description function) IS called to derive the returned\n// `subs` array. That's intentional — it lets tests assert what would be wired\n// up without actually wiring it.\nexport function replay<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  opts: { msgs: readonly M[]; ctx: Ctx; loaded?: S | null },\n): { state: S; cmds: C[]; subs: U[] } {\n  // `init` is `(loaded: S | null, ctx) => ...`; coerce undefined → null so the\n  // AC \"`replay` with `loaded: undefined` calls `init(null, ctx)`\" holds.\n  const loaded = opts.loaded ?? null;\n  const [initialState, initCmds] = machine.init(loaded, opts.ctx);\n\n  if (loaded !== null && initCmds.length > 0) {\n    throw new Error(\n      \"TEA contract violation: machine.init must return [state, []] (no Cmds) \" +\n        \"when `loaded` is non-null. Init's rehydrate branch is a pure state \" +\n        \"passthrough — the migration/parse boundary, not the boot-effect hook.\\n\\n\" +\n        \"Routes for boot effects:\\n\" +\n        \"  - Stateless infrastructure (e.g. chrome.alarms ensure) → host module \" +\n        \"top level, outside TEA.\\n\" +\n        \"  - State-conditional resume (e.g. re-attach a session) → a `boot` Msg \" +\n        \"dispatched once from the host after `run(...)` returns, handled in update.\\n\\n\" +\n        \"See .patterns/tea/tea-invariants.md (Invariant 2).\",\n    );\n  }\n\n  // `replay` and `foldMsgs` share ONE internal fold (`foldUpdates`), keyed on\n  // `formOf` — the same reader `run` uses — so all three agree on the\n  // reducer-vs-transitions form by construction. `replay` wraps it with the\n  // `init` entry + Cmd/Sub collection; `foldMsgs` calls it from a base state\n  // and returns the state only.\n  const { state, cmds: foldedCmds } = foldUpdates<S, M, C>(\n    machine,\n    initialState,\n    opts.msgs,\n  );\n  const cmds: C[] = [...initCmds, ...foldedCmds];\n\n  const subs: U[] = machine.subscriptions\n    ? [...machine.subscriptions(state)]\n    : [];\n\n  return { state, cmds, subs };\n}\n\n// === tryInterpret: Railway sugar over `Result.tryPromise` ===\n//\n// Wraps a fallible `(cmd, ctx) => Promise<Ok>` and returns a handler suitable\n// for `interpret[type]`. On success the returned function resolves with\n// `onOk(value, cmd)`; on rejection it resolves with `onErr(error, cmd)`. It\n// NEVER rejects (assuming `onOk`/`onErr` are total — that's the caller's\n// contract).\n//\n// Implementation note: we use the `{try, catch: (e) => e}` form of\n// `Result.tryPromise` rather than the one-arg `(thunk)` form so the original\n// error passes through untouched. The one-arg form wraps errors in\n// `UnhandledException`, which would prevent callers from `instanceof`-checking\n// their own error types inside `onErr`.\n//\n// M is a Msg type (not a Cmd) — the helper routes Ok/Err to two Msg constructors.\nexport function tryInterpret<C extends Cmd, Ok, M, Ctx>(\n  work: (cmd: C, ctx: Ctx) => Promise<Ok>,\n  onOk: (value: Ok, cmd: C) => M,\n  onErr: (error: unknown, cmd: C) => M,\n): (cmd: C, ctx: Ctx) => Promise<M> {\n  return async (cmd, ctx) => {\n    const result = await Result.tryPromise({\n      try: () => work(cmd, ctx),\n      catch: (error: unknown): unknown => error,\n    });\n    return result.match({\n      ok: (value) => onOk(value, cmd),\n      err: (error) => onErr(error, cmd),\n    });\n  };\n}\n"]}

package/dist/chunk-DYRKDCJI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/pure/core.ts"],"names":["cell"],"mappings":";AA4BO,IAAM,WAAoB,MAAM;AACrC,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA;AACb,IAAA,IAAI,IAAA,CAAK,GAAA,EAAK,GAAA,KAAQ,KAAA,CAAA,EAAW;AAC/B,MAAA,OAAO,KAAK,GAAA,CAAI,GAAA;AAAA,IAClB;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,OACE,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,KAAK,QAAA,KAAa,YAAA;AAAA,EAEhE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEO,SAAS,UAAA,CAAc,KAAQ,IAAA,EAA2B;AAC/D,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,UAAU,OAAO,GAAA;AACpD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,cAAA,CAAe,GAAG,CAAA;AACvC,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,IAAa,KAAA,KAAU,KAAA,CAAM,aAAa,KAAA,KAAU,IAAA;AACvE,IAAA,OAAO,GAAA;AACT,EAAA,MAAM,OAAA,GAAU,IAAA,oBAAQ,IAAI,OAAA,EAAQ;AACpC,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAa,CAAA,EAAG,OAAO,GAAA;AACvC,EAAA,OAAA,CAAQ,IAAI,GAAa,CAAA;AACzB,EAAA,MAAA,CAAO,OAAO,GAAG,CAAA;AACjB,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,MAAA,CAAO,GAA8B,CAAA;AAC1D,IAAA,UAAA,CAAW,GAAG,OAAO,CAAA;AACvB,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,kBAAkB,GAAA,EAA6B;AAC7D,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,UAAU,OAAO,IAAA;AACpD,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AACzE,IAAA,IAAI,OAAO,KAAA,KAAU,UAAA,EAAY,OAAO,GAAA;AAAA,EAC1C;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,gBAAA,CAAiB,QAAiB,OAAA,EAAuB;AACvE,EAAA,IAAI,MAAA,IAAU,OAAQ,MAAA,CAA8B,IAAA,KAAS,UAAA,EAAY;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,6BAA6B,OAAO,CAAA,+EAAA;AAAA,KAEtC;AAAA,EACF;AACA,EAAA,IACE,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,KACrB,MAAA,CAAO,MAAA,GAAS,CAAA,IAChB,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAC,CAAA,EACxB;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,0BAAA,EAA6B,OAAO,CAAA,qDAAA,EACF,OAAO,MAAM,CAAA,CAAA;AAAA,KACjD;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,OAAA,GAAU,kBAAkB,GAAG,CAAA;AACrC,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,GAAA,CAAI,IAAI,CAAA,sBAAA,EAAyB,OAAO,CAAA,yCAAA;AAAA,OAE/D;AAAA,IACF;AAAA,EACF;AACF;AA4DO,SAAS,iBAAiB,MAAA,EAA4B;AAC3D,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,CAAC,CAAA;AACtC,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,SAAA;AACnC,EAAA,MAAM,UAAA,GAAc,OAAmC,QAAQ,CAAA;AAC/D,EAAA,OAAO,OAAO,UAAA,KAAe,UAAA,GAAa,SAAA,GAAY,aAAA;AACxD;AAOO,SAAS,OAAO,OAAA,EAGR;AACb,EAAA,OAAO,OAAA,CAAQ,MAAA,IAAU,gBAAA,CAAiB,OAAA,CAAQ,MAAM,CAAA;AAC1D;AAUO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EAErC,WAAA,CACkB,SACA,SAAA,EAChB;AACA,IAAA,KAAA;AAAA,MACE,CAAA,0CAAA,EAA6C,OAAO,CAAA,YAAA,EAC9C,SAAS,CAAA,2IAAA;AAAA,KAGjB;AARgB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAQlB;AAAA,EAXkB,IAAA,GAAO,aAAA;AAY3B;AAIA,SAAS,YAAY,KAAA,EAAwB;AAC3C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,IAAQ,UAAU,KAAA,EAAO;AAClE,IAAA,MAAM,IAAK,KAAA,CAA4B,IAAA;AACvC,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,kBAAA;AACT;AAYO,SAAS,SAAA,CACd,OAAA,EACA,KAAA,EACA,GAAA,EAC4B;AAE5B,EAAA,IAAI,MAAA,CAAO,OAAO,CAAA,KAAM,SAAA,EAAW;AACjC,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAMA,KAAAA,GAAO,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC5B,IAAA,IAAI,OAAOA,UAAS,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,WAAA,CAAY,KAAK,CAAC,CAAA;AAAA,IACpD;AACA,IAAA,OAAOA,KAAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AACA,EAAA,MAAM,QAAQ,OAAA,CAAQ,MAAA;AAStB,EAAA,MAAM,WAAY,KAAA,CAAsC,IAAA;AACxD,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAI,IAAI,CAAA;AACvC,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,IAAI,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AACxB;AASO,SAAS,UAAU,OAAA,EAGJ;AACpB,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AACvC,EAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AACvB,EAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,EAAC;AACpC,EAAA,IAAI,MAAA,CAAO,OAAO,CAAA,KAAM,SAAA,EAAW,OAAO,IAAA;AAC1C,EAAA,MAAM,UAAA,GAAc,OAAA,CAAQ,MAAA,CAAmC,QAAQ,CAAA;AACvE,EAAA,OAAO,MAAA,CAAO,KAAK,UAAoB,CAAA;AACzC;AA8FO,IAAM,GAAA,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBjB,IAAA,EAAM,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAetB,KAAA,EAAO,IACF,IAAA,KACc;AACjB,IAAA,MAAM,MAAW,EAAC;AAClB,IAAA,KAAA,MAAW,GAAA,IAAO,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,GAAG,GAAG,CAAA;AACvC,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAA,EAAM,CAAsB,IAAA,EAAe,GAAA,KACzC,OAAO,CAAC,GAAG,IAAI,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,WAAA,EAAa,CACX,KAAA,EACA,KAAA,KACkB,KAAA,KAAU,MAAA,GAAY,CAAC,KAAA,CAAM,KAAK,CAAC,CAAA,GAAI;AAC7D;AAyBO,SAAS,MAAM,CAAA,EAAkB;AACtC,EAAA,OAAO,CAAA;AACT;AAyNO,SAAS,WAAA,CACd,OAAA,EACA,YAAA,EACA,IAAA,EACyB;AACzB,EAAA,IAAI,KAAA,GAAW,YAAA;AACf,EAAA,MAAM,OAAY,EAAC;AAEnB,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,IAAI,OAAA,aAAoB,KAAK,CAAA;AAE7B,IAAA,MAAM,MAAA,GAAS,SAAA,CAAmB,OAAA,EAAS,KAAA,EAAO,GAAG,CAAA;AAErD,IAAA,IAAI,OAAA,EAAS,gBAAA,CAAiB,MAAA,EAAQ,GAAA,CAAI,IAAI,CAAA;AAE9C,IAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAI,MAAA;AACxB,IAAA,KAAA,GAAQ,IAAA;AACR,IAAA,IAAA,CAAK,IAAA,CAAK,GAAG,OAAO,CAAA;AAAA,EACtB;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AA8BO,SAAS,QAAA,CAMd,OAAA,EAAmC,IAAA,EAAS,IAAA,EAAuB;AACnE,EAAA,OAAO,WAAA,CAAqB,OAAA,EAAS,IAAA,EAAM,IAAI,CAAA,CAAE,KAAA;AACnD","file":"chunk-DYRKDCJI.js","sourcesContent":["/**\n * @demlik/tea — pure-core leaf (ADR 0006).\n *\n * This is the runtime-free pure core of the substrate. It holds the\n * client-prediction fold seam (`foldMsgs`), the form reader\n * (`formOf`/`detectUpdateForm`), and the pure type vocabulary (`Machine`,\n * `Reducer`, `Transitions`, `Cmd`, `Sub`, `Port`, …).\n *\n * **Dependency direction (the actual decoupling):** this module imports\n * NOTHING from the runtime — no `better-result`, no `run`/host/`Store`. The\n * runtime (`run`, the host, interpret, `Store`, subscribe — all in\n * `../index.ts`) imports *from* here; never the reverse. The\n * `@demlik/tea/pure` subpath re-exports this surface, and\n * `pure/import-graph.test.ts` is the regression fence asserting the pure\n * entrypoint's import graph never reaches `run`.\n */\n\n// === Dev-mode invariant enforcement ===\n//\n// Three runtime guards that catch TEA invariant violations during development.\n// Dead-code-eliminated in production by any bundler that replaces\n// `import.meta.env.DEV` (Vite) or `process.env.NODE_ENV` (webpack/esbuild).\n//\n// 1. deepFreeze(state) before passing to update — catches mutation\n// 2. Thenable check on return value — catches async update\n// 3. Walk cmd fields for function types — catches closures-as-data\n//\n// These enforce invariants 1 and 2 at runtime where the type system cannot.\nexport const __DEV__: boolean = (() => {\n  try {\n    const meta = import.meta as unknown as { env?: { DEV?: boolean } };\n    if (meta.env?.DEV !== undefined) {\n      return meta.env.DEV;\n    }\n  } catch {\n    // import.meta not available (Node CJS, service workers)\n  }\n  try {\n    return (\n      typeof process !== \"undefined\" && process.env?.NODE_ENV !== \"production\"\n    );\n  } catch {\n    return false;\n  }\n})();\n\nexport function deepFreeze<T>(obj: T, seen?: WeakSet<object>): T {\n  if (obj === null || typeof obj !== \"object\") return obj;\n  const proto = Object.getPrototypeOf(obj);\n  if (proto !== Object.prototype && proto !== Array.prototype && proto !== null)\n    return obj;\n  const visited = seen ?? new WeakSet();\n  if (visited.has(obj as object)) return obj;\n  visited.add(obj as object);\n  Object.freeze(obj);\n  for (const v of Object.values(obj as Record<string, unknown>))\n    deepFreeze(v, visited);\n  return obj;\n}\n\nexport function hasFunctionValues(obj: unknown): string | null {\n  if (obj === null || typeof obj !== \"object\") return null;\n  for (const [key, value] of Object.entries(obj as Record<string, unknown>)) {\n    if (typeof value === \"function\") return key;\n  }\n  return null;\n}\n\nexport function assertPureResult(result: unknown, msgType: string): void {\n  if (result && typeof (result as { then?: unknown }).then === \"function\") {\n    throw new Error(\n      `@demlik/tea: update cell \"${msgType}\" returned a Promise. ` +\n        `update must be synchronous. Move async work to interpret.`,\n    );\n  }\n  if (\n    !Array.isArray(result) ||\n    result.length < 2 ||\n    !Array.isArray(result[1])\n  ) {\n    throw new Error(\n      `@demlik/tea: update cell \"${msgType}\" returned a non-tuple. ` +\n        `Expected [State, Cmd[]], got ${typeof result}.`,\n    );\n  }\n  const cmds = result[1] as readonly { type: string }[];\n  for (const cmd of cmds) {\n    const fnField = hasFunctionValues(cmd);\n    if (fnField !== null) {\n      throw new Error(\n        `@demlik/tea: Cmd \"${cmd.type}\" has function field \"${fnField}\". ` +\n          `Cmds must be plain data, not closures.`,\n      );\n    }\n  }\n}\n\n// === Cmd: tagged-union, one-shot effect ===\nexport type Cmd<T extends string = string> = { type: T };\n\n// === SyncReturn<S, C>: the compile-time reentrancy guard (ADR 0003 #5) ===\n//\n// The canon rule (`.patterns/tea-do/reentrancy.md`,\n// `.patterns/tea-do/reentrancy-deadlock.md`): a reducer must never\n// inline-`await` a re-entrant result. \"Non-reentrant by default\" ≡ \"the reducer\n// is pure AND synchronous\": a reducer that returns a `Promise` (because it is\n// `async`, or inline-`await`s) is the suspended-but-still-blocking turn Orleans\n// serializes against — it occupies the single-writer slot across a suspension\n// point and can be re-entered mid-flight → deadlock.\n//\n// So the guard is purely type-level: every reducer/transition cell returns\n// `SyncReturn<S, C>` — the synchronous result tuple, intersected with `{ then?:\n// never }` to make it *non-thenable*. A `Promise<readonly [S, readonly C[]]>`\n// is an object with a `then` method, so it fails to satisfy `then?: never`; an\n// `async (s, m) => [...]` (or one that inline-`await`s) is therefore\n// unrepresentable at compile time — `tsc` rejects it *at the cell*, not at a\n// runtime hang. A plain synchronous tuple `[next, cmds]` has no `then` property,\n// so the optional-absent `then?: never` is satisfied and existing pure reducers\n// compile unchanged. `SyncReturn<S, C>` is also assignable *to* `readonly [S,\n// readonly C[]]` (the intersection is narrower), so the runtime dispatch in\n// `run`/`replay` consumes a cell result exactly as before.\n//\n// This mirrors `retry-backoff`'s `Rng` brand (#63): the obligation lives in the\n// type at the construction boundary (\"parse, don't validate\"), not in a comment.\nexport type SyncReturn<S, C extends Cmd> = readonly [S, readonly C[]] & {\n  // A thenable carries a callable `then`; forbidding it rejects every Promise.\n  // Optional + `never` means \"absent on a sync tuple, impossible on a Promise\".\n  readonly then?: never;\n};\n\n// === update form: Reducer vs Transitions, tagged once ===\n//\n// The substrate accepts two `update` shapes (see the `Machine.update` union and\n// the `defineMachine` overloads):\n//\n//   - \"reducer\"     — flat record keyed by Msg.type, every cell a function.\n//   - \"transitions\" — 2D table keyed by State.type then Msg.type, every cell a\n//                     record of functions.\n//\n// Which one a given machine is must be known at runtime by `run`, `replay`, and\n// the `withX` wrappers (their dispatch / key-enumeration / reserved-namespace\n// scans differ per form). Rather than re-derive it structurally at every reader\n// — a `typeof update[firstKey] === \"function\"` heuristic that breaks the day a\n// reducer cell is itself an object-with-a-call — `defineMachine` computes the\n// form ONCE at construction and stamps it on the machine as a non-enumerable\n// `__form` (so it never serializes, never collides with a Msg.type key, never\n// shows up in `Object.keys(machine)`). Every reader calls `formOf(machine)`.\nexport type UpdateForm = \"reducer\" | \"transitions\";\n\n// The single structural heuristic, defined ONCE. Used only by `defineMachine`\n// (and `formOf`'s fallback for machines built without it, e.g. a plain object\n// literal annotated as `Machine`). A Reducer's first own value is a function; a\n// Transitions table's first own value is a record (of functions). An empty\n// record (`M` is `never`) can never dispatch a Msg, so the form is irrelevant —\n// \"reducer\" is returned arbitrarily.\nexport function detectUpdateForm(update: object): UpdateForm {\n  const firstKey = Object.keys(update)[0];\n  if (firstKey === undefined) return \"reducer\";\n  const firstValue = (update as Record<string, unknown>)[firstKey];\n  return typeof firstValue === \"function\" ? \"reducer\" : \"transitions\";\n}\n\n// The single reader every form-sensitive site goes through. Prefers the\n// `__form` tag stamped by `defineMachine` (authoritative — computed once at the\n// typed construction boundary); falls back to `detectUpdateForm` only for a\n// machine that never passed through `defineMachine`. No reader re-implements the\n// heuristic.\nexport function formOf(machine: {\n  update: object;\n  __form?: UpdateForm;\n}): UpdateForm {\n  return machine.__form ?? detectUpdateForm(machine.update);\n}\n\n// === NoCellError: the named cell-lookup failure (#276) ===\n//\n// An unknown `msg.type` (wire data reaching dispatch) or a type-bypassed\n// missing cell used to surface as a bare `TypeError: ... is not a function`\n// deep inside dispatch — no msg.type, no state name, nothing actionable. The\n// guard lives in `applyCell` because it is the single dispatch primitive\n// every stepping site goes through (#275), so one guard covers `run`,\n// replay/foldMsgs, the PBT fold runner, and the withX wrappers.\nexport class NoCellError extends Error {\n  override readonly name = \"NoCellError\";\n  constructor(\n    public readonly msgType: string,\n    public readonly stateName: string,\n  ) {\n    super(\n      `@demlik/tea: no update cell for msg.type \"${msgType}\" in state ` +\n        `\"${stateName}\" — the machine's update does not handle this Msg ` +\n        `(an unknown wire msg.type, or a missing cell reached by bypassing ` +\n        `the mapped types).`,\n    );\n  }\n}\n\n// Reducer-form State carries no mandatory discriminant; best-effort read of a\n// string `state.type` for the error, else a placeholder.\nfunction stateNameOf(state: unknown): string {\n  if (typeof state === \"object\" && state !== null && \"type\" in state) {\n    const t = (state as { type: unknown }).type;\n    if (typeof t === \"string\") return t;\n  }\n  return \"(untagged state)\";\n}\n\n// === applyCell: THE single reducer-vs-transitions dispatch primitive ===\n//\n// Applies the one update cell selected by `(formOf(machine), state, msg)` and\n// returns its `[nextState, cmds]` verbatim. Every site that steps a machine —\n// `run`'s applyUpdate, `foldUpdates` (replay/foldMsgs), the PBT fold runner,\n// and the withX wrappers — dispatches through THIS function, so production and\n// the verification tools agree on the update form by construction (#275).\n// Pure and dev-check-free: `deepFreeze`/`assertPureResult` stay at the call\n// sites that want them. A missing cell throws `NoCellError` (#276), never a\n// bare TypeError.\nexport function applyCell<S, M extends { type: string }, C extends Cmd>(\n  machine: { update: object; __form?: UpdateForm },\n  state: S,\n  msg: M,\n): readonly [S, readonly C[]] {\n  type CellFn = (state: S, msg: M) => readonly [S, readonly C[]];\n  if (formOf(machine) === \"reducer\") {\n    const record = machine.update as Record<string, CellFn | undefined>;\n    const cell = record[msg.type];\n    if (typeof cell !== \"function\") {\n      throw new NoCellError(msg.type, stateNameOf(state));\n    }\n    return cell(state, msg);\n  }\n  const table = machine.update as Record<\n    string,\n    Record<string, CellFn | undefined> | undefined\n  >;\n  // The ONE sanctioned `state as unknown as { type }` read: the Transitions\n  // overload constrains S to `{ type: string }` at the `defineMachine`\n  // boundary, but that constraint is erased on the runtime-facing `object`\n  // here — every former per-site copy of this double-cast collapsed into\n  // this line (#275).\n  const stateKey = (state as unknown as { type: string }).type;\n  const cell = table[stateKey]?.[msg.type];\n  if (typeof cell !== \"function\") {\n    throw new NoCellError(msg.type, String(stateKey));\n  }\n  return cell(state, msg);\n}\n\n// === msgKeysOf: recover the Msg.type set from either update form ===\n//\n// A Reducer's own keys ARE the Msg.type set. A Transitions table's keys are\n// state.type; its INNER keys are the Msg.type set (uniform across phases by\n// the mapped-type contract), so the first phase's inner keys are read. An\n// empty update (`M` is `never`) yields `[]`. Keyed on `formOf` — the withX\n// wrappers and the PBT `msgTypeKeys` all read through this one helper (#275).\nexport function msgKeysOf(machine: {\n  update: object;\n  __form?: UpdateForm;\n}): readonly string[] {\n  const keys = Object.keys(machine.update);\n  const firstKey = keys[0];\n  if (firstKey === undefined) return [];\n  if (formOf(machine) === \"reducer\") return keys;\n  const firstValue = (machine.update as Record<string, unknown>)[firstKey];\n  return Object.keys(firstValue as object);\n}\n\n// === Reducer<S, M, C>: record-of-handlers form of `update` ===\n//\n// Flat dispatch table keyed by `Msg.type`. Each cell is a pure transition for\n// a single Msg variant, narrowed via `Extract<M, { type: K }>`. The mapped type\n// is *load-bearing*: adding a Msg variant without a matching key in the\n// Reducer record is a compile error — no `absurd()` helper at call sites, no\n// silent fall-through, no default branch hiding impurity.\n//\n// Strengthens invariant 2 (pure transitions — the record form has no\n// fall-through default to hide impurity behind) and invariant 7 (identity is\n// explicit — the Msg variant set is load-bearing at the type level).\n//\n// `defineMachine` accepts the Reducer record form via overload. The runtime\n// dispatches via `update[msg.type](state, msg)`.\nexport type Reducer<S, M extends { type: string }, C extends Cmd> = {\n  [K in M[\"type\"]]: (\n    state: S,\n    msg: Extract<M, { type: K }>,\n    // `SyncReturn<S, C>` (not `readonly [S, readonly C[]]`) is the reentrancy\n    // guard: a non-thenable return type, so an `async`/inline-`await`ing cell —\n    // which returns `Promise<...>` — fails to compile at the cell. See the\n    // `SyncReturn` doc above.\n  ) => SyncReturn<S, C>;\n};\n\n// === Transitions<S, M, C>: table form of `update` for state-machine-shaped machines ===\n//\n// When `State` is itself a discriminated union (`State.type` is the active\n// phase), the table form makes every (state.type × msg.type) cell explicit at\n// the type level. Missing a cell — e.g. forgetting how `phase: \"settling\"`\n// handles `msg.type: \"tab_stepped\"` — fails to compile. No nested switch, no\n// fall-through, no `_ -> (state, [])` default branch hiding regressions.\n//\n// Each cell receives the narrowed `State` for its phase and the narrowed\n// `Msg` for its variant via two `Extract` lookups. Phantom-narrow at the\n// type level; pure data at runtime.\n//\n// `defineMachine` accepts a third `update` form for `Transitions<S, M, C>` —\n// the runtime dispatches via `update[state.type][msg.type](state, msg)`.\n//\n// Strengthens invariant 2 (table form has no fall-through default),\n// invariant 6 (runtime walks the table predictably, no hidden dispatch\n// fallback), and invariant 7 (both state.type and msg.type are load-bearing\n// at the type level).\nexport type Transitions<\n  S extends { type: string },\n  M extends { type: string },\n  C extends Cmd,\n> = {\n  [P in S[\"type\"]]: {\n    [K in M[\"type\"]]: (\n      state: Extract<S, { type: P }>,\n      msg: Extract<M, { type: K }>,\n      // Same reentrancy guard as `Reducer`: a transition cell that returns a\n      // Promise (async / inline-await) is the suspended-blocking turn the canon\n      // forbids, so its return is the non-thenable `SyncReturn<S, C>`.\n    ) => SyncReturn<S, C>;\n  };\n};\n\n// === Cmd: namespace for conditional Cmd emission ===\n//\n// Two recurring frictions in reducer cells:\n//\n//   1. \"Emit cmd X only when condition Y holds.\"\n//      Hand-rolled: `cond ? [{ type: \"x\", ... }] : []`\n//      With Cmd:    `Cmd.when(cond, { type: \"x\", ... })`\n//\n//   2. \"Emit cmd X carrying a value that may be undefined; if undefined,\n//      emit nothing.\"\n//      Hand-rolled: `value !== undefined ? [{ type: \"x\", value }] : []`\n//      With Cmd:    `Cmd.whenDefined(value, (v) => ({ type: \"x\", value: v }))`\n//\n// Both forms return `readonly C[]` so they spread cleanly into the cmds\n// array returned by a Transitions cell:\n//\n//   return [next, [\n//     ...Cmd.when(state.tabId !== undefined, { type: \"detach_debugger\", tabId: state.tabId }),\n//     ...Cmd.whenDefined(state.queueItemId, (id) => ({\n//       type: \"queue:complete\", queueItemId: id, status: \"done\",\n//     })),\n//   ]];\n//\n// `Cmd` as a value namespace coexists with `Cmd<T>` as a type — TypeScript's\n// declaration merging puts them in different name spaces (type vs. value).\n// The reader sees `Cmd<...>` in type position and `Cmd.when(...)` in\n// expression position; no ambiguity at use sites.\n//\n// Why a namespace and not top-level `when` / `whenDefined`: `when` at module\n// scope reads as a generic conditional, but these helpers are specifically\n// for *Cmd emission* (return `readonly C[]`, the cmds-array contract of\n// every Transitions cell). The namespace pins that intent at the call site.\nexport const Cmd = {\n  /**\n   * The empty Cmd array. Typed `readonly never[]` so it's assignable to any\n   * `readonly C[]` for any `C extends Cmd`. Use in `init` returns and\n   * Transitions cells that emit zero effects:\n   *\n   *   init: (loaded) => [loaded ?? initial, Cmd.none],\n   *   tick: (state) => [state, Cmd.none],\n   *\n   * Elm's `Cmd.none` analogue. Cultural signal alongside the runtime help:\n   * `[state, Cmd.none]` reads as intent (\"this transition emits nothing\"),\n   * `[state, []]` reads as \"empty array of what\".\n   *\n   * Frozen at runtime so a downstream consumer can't `.push()` into the\n   * shared reference.\n   */\n  none: Object.freeze([]) as readonly never[],\n\n  /**\n   * Flat concat of cmd arrays. Use when a cell composes effects from\n   * multiple conditional sources:\n   *\n   *   return [next, Cmd.batch(\n   *     Cmd.whenDefined(state.queueItemId, (id) => ({ type: \"complete\", id })),\n   *     Cmd.when(state.windowId !== undefined, { type: \"close_window\", windowId }),\n   *     [{ type: \"detach_debugger\", tabId: state.tabId }],\n   *   )];\n   *\n   * `<const C>` keeps inline cmd literals' discriminants narrow (same\n   * rationale as `when` / `whenDefined` above).\n   */\n  batch: <const C extends Cmd>(\n    ...arrs: readonly (readonly C[])[]\n  ): readonly C[] => {\n    const out: C[] = [];\n    for (const arr of arrs) out.push(...arr);\n    return out;\n  },\n\n  /**\n   * Emit `cmd` wrapped in a single-element array iff `cond` is true.\n   * Otherwise return the empty array. Spreads cleanly into the cmds array\n   * returned by a Transitions cell.\n   *\n   * `const C` (TypeScript 5.0+) keeps the inferred `type:` discriminator\n   * literal narrow when called with an object literal — so `Cmd.when(b,\n   * { type: \"x\", ... })` infers as `{ type: \"x\", ... }`, not `{ type:\n   * string, ... }`, and stays assignable to a discriminated-union arm\n   * without `as const` at the call site.\n   */\n  when: <const C extends Cmd>(cond: boolean, cmd: C): readonly C[] =>\n    cond ? [cmd] : [],\n\n  /**\n   * If `value` is defined, call `build(value)` and emit the resulting cmd\n   * wrapped in a single-element array. If `value` is `undefined`, return\n   * the empty array. `value` is narrowed to `T` inside `build`.\n   *\n   * `const C` on the return type keeps the callback's object-literal\n   * `type:` field narrow (see `when` above for the full rationale).\n   */\n  whenDefined: <T, const C extends Cmd>(\n    value: T | undefined,\n    build: (value: T) => C,\n  ): readonly C[] => (value !== undefined ? [build(value)] : []),\n} as const;\n\n// === SubId: branded string for Sub identity ===\n//\n// Subs are reconciled by id on every transition (canon §2.5, invariant 7).\n// Before branding, `Sub.id` was a raw `string` — a typo at one call site and a\n// different typo at another would silently produce two distinct subs that\n// looked identical to a human reader. The brand makes id construction explicit\n// (`subId(\"...\")`) and catches accidental string-where-SubId at the type\n// level.\n//\n// The brand is structural: `string & { __brand: \"SubId\" }`. The `subId(s)`\n// constructor is the ONE permitted cast in the substrate — every other call\n// site must go through it.\nexport type SubId = string & { readonly __brand: \"SubId\" };\n\n/**\n * Construct a `SubId` from a string. Use this everywhere a Sub literal is\n * built — including ids derived from runtime data (`subId(\\`ws:${auditId}\\`)`).\n * The brand is structural, not nominal, so dynamic ids are permitted; the\n * constructor's job is to make the identity decision explicit at every call\n * site so the type system can catch accidental raw-string drift.\n *\n * Strengthens invariant 7 (identity is explicit).\n */\nexport function subId(s: string): SubId {\n  return s as SubId;\n}\n\n// === Sub: tagged-union, continuous source of msgs; stable id used for diff/reconcile ===\nexport type Sub<T extends string = string> = { id: SubId; type: T };\n\n// === Port<T>: typed escape hatch for \"data leaving the runtime\" ===\n//\n// A Port is a named, typed channel that Cmd handlers can `emit` to via the\n// augmented `ctx.emit(port, value)`. Subscribers attach via\n// `runtime.subscribePort(port, listener)` and receive every emitted value\n// synchronously (same fanout discipline as `runtime.observe`).\n//\n// Why Ports are a substrate primitive, distinct from State and Observe:\n// - **State** is \"the world as the program sees it.\" Folding outgoing\n//   announcements into State turns ephemeral signals into persisted facts —\n//   the classic anti-pattern that motivated this primitive.\n// - **Observe** sees every transition `(msg, state)`. That's the right channel\n//   for devtools and logging, but it forces every consumer to filter the\n//   entire firehose for a single signal.\n// - **Ports** are typed and selective: one channel per concept, subscribers\n//   only see what the handler chose to emit. Mirrors Elm's outgoing-port\n//   semantics — a typed declaration with `port` keyword whose values flow\n//   out of the program to the host.\n//\n// Port identity is **by reference** — the returned object IS the identity.\n// Name is metadata for debugging. To prevent the \"two modules definePort the\n// same name expecting to share a channel, silently get distinct ports\" class\n// of bug, `definePort` asserts the name has not been seen in this process —\n// the symmetric runtime check to `SubId` (canon §2.12, invariant 7). Each\n// definePort call must use a unique name; if two modules need the same port,\n// one module exports it and the other imports it.\nexport interface Port<T> {\n  readonly __brand: \"port\";\n  readonly name: string;\n  // Phantom field — never assigned, never read at runtime. Carries `T` for\n  // inference at `ctx.emit` and `subscribePort` call sites. Using `?` so\n  // `definePort` can produce a Port without constructing a value of `T`.\n  readonly __t?: T;\n}\n\n/**\n * Augmentation injected onto `ctx` inside Cmd handlers. Handlers receive\n * `ctx & PortEmitter` so they can call `ctx.emit(port, value)` synchronously.\n * Subscribers registered via `runtime.subscribePort(port, listener)` receive\n * the value immediately.\n *\n * Emitting to a port with no subscribers is a no-op (does not throw).\n */\nexport interface PortEmitter {\n  emit<T>(port: Port<T>, value: T): void;\n}\n\n// === NoCtx: the context-free marker ===\n//\n// A handler, Sub, or machine that reads NOTHING from `ctx` says so by using\n// `NoCtx` for its Ctx slot. This is the DELIBERATE absence of context — not\n// the accidental `unknown` looseness that erodes a boundary (see issue #64).\n//\n// `unknown` at a Ctx seam is ambiguous: it can mean \"I intentionally need no\n// context\" OR \"I gave up tightening this type.\" `NoCtx` resolves that\n// ambiguity at the type level. A reader (and the next agent) sees `NoCtx` and\n// knows the context-free-ness is a choice the author made, not a hole.\n//\n// Shape: an empty readonly record. A `Ctx & PortEmitter` is-a `NoCtx`, so a\n// context-free handler still composes at a richer call site. It carries no\n// own fields, so the name's claim (\"reads nothing from ctx\") is what callers\n// read at the seam.\n//\n// Strengthens invariant 6 (no silent looseness — a context-free seam is named,\n// not inferred) and invariant 8 (the boundary is legible; `unknown` stays\n// reserved for genuine wire-edge erasure, not for \"didn't bother\").\nexport type NoCtx = Readonly<Record<never, never>>;\n\n/** Spelled-out alias for `NoCtx`, for sites that prefer the long name. */\nexport type ContextFree = NoCtx;\n\n// === Interpret<M, C, Ctx>: record-of-handlers form of `interpret` ===\n//\n// Flat dispatch table keyed by `Cmd.type`. Each cell receives the narrowed Cmd\n// and the runtime-augmented Ctx (`Ctx & PortEmitter`) and resolves to a\n// follow-up Msg or `void` (fire-and-forget). The mapped type makes a missing\n// handler a compile error — `defineMachine` cannot accept the dictionary until\n// every Cmd variant has one.\n//\n// Hoisted out of `Machine.interpret` so consumers can type a free-standing\n// handler dictionary with `Interpret<MyMsg, MyCmd, MyCtx>` instead of\n// re-declaring the mapped type at every effects module.\n//\n// Strengthens invariant 2 (the record form has no fall-through default to\n// hide impurity behind) and invariant 7 (identity is explicit — the Cmd\n// variant set is load-bearing at the type level).\nexport type Interpret<M extends { type: string }, C extends Cmd, Ctx> = {\n  [K in C[\"type\"]]: (\n    cmd: Extract<C, { type: K }>,\n    ctx: Ctx & PortEmitter,\n    // biome-ignore lint/suspicious/noConfusingVoidType: an interpret handler returns a follow-up Msg or nothing; `void` permits no-return bodies that `M | undefined` would reject\n  ) => Promise<M | void>;\n};\n\n// === Subscribe<M, U, Ctx>: record-of-handlers form of `subscribe` ===\n//\n// Flat dispatch table keyed by `Sub.type`. Each cell receives the narrowed\n// Sub, the Ctx, and a `dispatch` to fire follow-up Msgs. Returns a cleanup\n// function the substrate calls when the Sub is reconciled out (state\n// transitioned away). The mapped type guarantees every Sub variant has a\n// handler at the type level; runtime dispatch is a single property lookup.\n//\n// Hoisted out of `Machine.subscribe` so consumers can type a free-standing\n// handler dictionary with `Subscribe<MyMsg, MySub, MyCtx>` instead of\n// re-declaring the mapped type at every subs module.\n//\n// Strengthens invariant 7 (identity is explicit — the Sub variant set is\n// load-bearing at the type level).\nexport type Subscribe<M extends { type: string }, U extends Sub, Ctx> = {\n  [K in U[\"type\"]]: (\n    sub: Extract<U, { type: K }>,\n    ctx: Ctx,\n    dispatch: (msg: M) => void,\n  ) => () => void;\n};\n\n// === Machine: pure data, host-agnostic ===\n//\n// `update` is stored as a union of the two record forms — the runtime branches\n// on shape at dispatch time. The public `defineMachine` overloads enforce one\n// shape per call so consumers never see the union themselves.\n//\n// - Reducer form: `Reducer<S, M, C>` — flat record keyed by Msg.type;\n//   exhaustiveness enforced by the mapped type.\n// - Transitions form: `Transitions<S, M, C>` — 2D table keyed by\n//   `state.type` then `msg.type`; only available when `S extends { type:\n//   string }`. Conditional in the union so machines without a discriminated\n//   State don't widen to include this branch.\n//\n// `M` is constrained to `{ type: string }` because both record forms require\n// a string discriminant.\n//\n// `interpret` is conditionally optional: when `C` is `Cmd<never>` the\n// interpret map is keyed by `never`, so the only valid value is `{}`. Forcing\n// every cmdless machine to write `interpret: {} as never` is ceremony for a\n// shape the type already pins. The tuple-wrap (`[C] extends [Cmd<never>]`)\n// disables distributive conditional so a real cmd union (e.g.\n// `Cmd<\"a\"> | Cmd<\"b\">`) doesn't degrade to optional just because one arm\n// happens to be `Cmd<never>`. Same trick the `update` field uses.\nexport type Machine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n> = {\n  /**\n   * Boot the runtime. Called once by `run(...)` with whatever `Store.load()`\n   * returned: `null` on fresh boot, the persisted state on rehydrate.\n   *\n   * **Contract:** when `loaded !== null`, init MUST return `[loaded, []]` —\n   * no Cmds. Init's rehydrate branch is the migration / parse boundary, not\n   * the boot-effect hook. See Invariant 2 in `.patterns/tea/tea-invariants.md`.\n   *\n   * Boot effects routes:\n   *   - Stateless infrastructure → host module top, outside TEA.\n   *   - State-conditional resume → a `boot` Msg the host dispatches once\n   *     after `run(...)` returns.\n   *\n   * Violations are caught at runtime by `replay` (which throws with a\n   * pointer to the alternatives).\n   */\n  init: (loaded: S | null, ctx: Ctx) => readonly [S, readonly C[]];\n  update:\n    | Reducer<S, M, C>\n    // Wrap in tuple to disable distributive conditional behavior. Without\n    // `[S]`, TS distributes the conditional across `S`'s union members,\n    // producing `Transitions<A,...> | Transitions<B,...>` instead of the\n    // desired `Transitions<A|B,...>` — the table form needs a single\n    // mapping over the full union of state types, not separate tables per\n    // member.\n    | ([S] extends [{ type: string }] ? Transitions<S, M, C> : never);\n  subscriptions?: (state: S) => readonly U[];\n  subscribe?: Subscribe<M, U, Ctx>;\n  /**\n   * The update form (\"reducer\" | \"transitions\"), stamped non-enumerably by\n   * `defineMachine` at construction (see `UpdateForm` / `formOf`). Optional in\n   * the type so the structural `Machine` annotation form keeps accepting plain\n   * object literals; readers go through `formOf`, which falls back to\n   * `detectUpdateForm` when the tag is absent. Never written by hand.\n   */\n  readonly __form?: UpdateForm;\n} & ([C] extends [Cmd<never>]\n  ? { interpret?: Interpret<M, C, Ctx> }\n  : { interpret: Interpret<M, C, Ctx> }) &\n  // `subscribe`/`subscriptions` are conditionally REQUIRED the same way\n  // `interpret` is (#276): a machine declaring a real Sub union without a\n  // subscribe map compiled and silently wired no subs (`reconcileSubs` skips\n  // undefined handlers) — the exact silent-failure class the `interpret`\n  // conditional prevents. The optional declarations above stay as U's\n  // inference sites (a conditional type is not an inference site); this\n  // intersection only adds requiredness when U is a real union. Same\n  // tuple-wrap trick as `interpret` to disable distribution.\n  ([U] extends [Sub<never>]\n    ? unknown\n    : {\n        subscriptions: (state: S) => readonly U[];\n        subscribe: Subscribe<M, U, Ctx>;\n      });\n\n// === foldUpdates: the single internal fold `replay` and `foldMsgs` share ===\n//\n// Folds `machine.update` over `msgs` from `initialState`, dispatching each\n// Msg through `applyCell` — the same primitive `run` uses — so every fold site\n// agrees on the reducer-vs-transitions form by construction (no second copy of\n// the dispatch to drift). Returns the final state plus the Cmds the cells emitted\n// along the way; the caller keeps them (`replay`) or discards them (`foldMsgs`).\n//\n// Touches no `Store`, no `interpret` handler, and starts no subscription — it\n// only calls `update` cells. The two public folds differ only in how they\n// enter and what they return: `replay` enters via `init` and returns\n// `{ state, cmds, subs }`; `foldMsgs` enters from a base state and returns `S`.\nexport function foldUpdates<S, M extends { type: string }, C extends Cmd>(\n  machine: { update: object; __form?: UpdateForm },\n  initialState: S,\n  msgs: readonly M[],\n): { state: S; cmds: C[] } {\n  let state: S = initialState;\n  const cmds: C[] = [];\n\n  for (const msg of msgs) {\n    if (__DEV__) deepFreeze(state);\n\n    const result = applyCell<S, M, C>(machine, state, msg);\n\n    if (__DEV__) assertPureResult(result, msg.type);\n\n    const [next, emitted] = result;\n    state = next;\n    cmds.push(...emitted);\n  }\n\n  return { state, cmds };\n}\n\n// === foldMsgs: runtime-free client-prediction fold seam (ADR 0006, #211) ===\n//\n// Folds `machine.update` over an ordered `Msg[]` starting from a caller-supplied\n// `base` state and returns the resulting state ONLY. This is the client-side\n// replay primitive a prediction loop needs (the Gambetta/Valve\n// authoritative-server reconcile step): re-simulate a queue of un-acked inputs\n// on top of an authoritative snapshot —\n// `foldMsgs(machine, snapshot, pendingInputs)`.\n//\n// Distinct from `replay` (the test idiom), by design (ADR 0006):\n// - Enters from a direct `base` parameter, NOT via `init`/`loaded` — so\n//   reconciliation correctness never depends on the machine author's `init`\n//   rehydrate discipline. Takes no `ctx` (the fold calls `update` only).\n// - Returns just the final `S` — not `{ state, cmds, subs }`. During prediction\n//   the inputs' effects were already sent to the server; re-emitting their Cmds\n//   on the client would double-fire, and `subs` are a runtime concern. Returning\n//   only `S` makes \"replay fires no effects\" structural, not caller discipline.\n//   A caller that wants the emitted Cmds for assertions uses `replay`.\n//\n// Invokes no `Store`, no `interpret` handler, and starts no subscription — it\n// shares `replay`'s `foldUpdates` fold, which only calls `update` cells, and\n// reads the reducer-vs-transitions form via the same `formOf(machine)` reader\n// `run`/`replay` use, so it agrees with them by construction.\n//\n// Per ADR 0006 the runtime-free *guarantee* lives on a dedicated\n// `@demlik/tea/pure` subpath whose module graph never reaches `run`; that\n// subpath export + import-graph guard are #213's scope. Here `foldMsgs` ships\n// as a reachable public API from root; #213 formalizes the boundary.\nexport function foldMsgs<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(machine: Machine<S, M, C, U, Ctx>, base: S, msgs: readonly M[]): S {\n  return foldUpdates<S, M, C>(machine, base, msgs).state;\n}\n"]}