@demlik/tea 0.5.1 → 0.7.0

package/dist/{chunk-EC6FO42Q.js.map → chunk-EUF7XOEE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/resilient-call/index.ts"],"names":[],"mappings":";;;;;;;;;;AAwUA,SAAS,cAAc,MAAA,EAAyB;AAC9C,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,MAAA,EAAW,OAAO,IAAA;AACzC,EAAA,OAAO;AAAA,IACL,gBAAA,EAAkB,OAAO,OAAA,CAAQ,SAAA;AAAA,IACjC,UAAA,EAAY,OAAO,OAAA,CAAQ,UAAA;AAAA,IAC3B,iBAAA,EAAmB,MAAA,CAAO,OAAA,CAAQ,iBAAA,IAAqB;AAAA,GACzD;AACF;AAIA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,OAAO,mBAAmB,GAAG,CAAA,CAAA;AAC/B;AACA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,OAAO,sBAAsB,GAAG,CAAA,CAAA;AAClC;AAmBO,SAAS,mBAAA,CACd,MAAA,EACA,GAAA,GAAoB,IAAA,CAAK,MAAA,EACzB;AACA,EAAA,MAAM,OAAA,GAAU,cAAc,MAAM,CAAA;AAKpC,EAAA,MAAM,UAAA,GAAa,MAAM,GAAG,CAAA;AAG5B,EAAA,SAAS,IAAA,GAA6B;AACpC,IAAA,OAAO;AAAA,MACL,SAAS,WAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMrB,MAAA,EAAQ,OAAO,SAAA,GACX,UAAA;AAAA,QACE,OAAO,SAAA,CAAU,QAAA;AAAA,QACjB,OAAO,SAAA,CAAU,YAAA;AAAA,QACjB;AAAA,OACF,GACA,UAAA,CAAW,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA;AAAA,MACtB,OAAO,EAAC;AAAA,MACR,OAAO,SAAA,EAAa;AAAA,MACpB,OAAO;AAAC,KACV;AAAA,EACF;AAGA,EAAA,SAAS,OAAA,CAAQ,GAAyB,GAAA,EAAyB;AACjE,IAAA,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,IAAK,SAAA,EAAU;AAAA,EACnC;AAGA,EAAA,SAAS,WAAW,EAAA,EAAoB;AACtC,IAAA,OAAO,MAAA,CAAO,QAAA,GAAW,EAAA,GAAK,MAAA,CAAO,SAAS,EAAA,GAAK,CAAA;AAAA,EACrD;AA2BA,EAAA,SAAS,IAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,IACA,YAAA,EACuD;AAEvD,IAAA,IAAI,MAAA,CAAO,UAAU,MAAA,EAAW;AAC9B,MAAA,MAAM,MAAA,GAAS,GAAA,CAAS,CAAA,CAAE,KAAA,EAAO,KAAK,EAAE,CAAA;AACxC,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,CAAA,EAAG,EAAE,CAAA;AAAA,MACrE;AAAA,IACF;AAMA,IAAA,IAAI,SAAS,CAAA,CAAE,MAAA;AACf,IAAA,IAAI,MAAA,CAAO,cAAc,MAAA,EAAW;AAClC,MAAA,MAAM,CAAC,IAAA,EAAM,QAAQ,CAAA,GAAI,UAAA,CAAW,QAAQ,EAAE,CAAA;AAC9C,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,IAAI,CAAC,QAAA,EAAU;AAGb,QAAA,OAAO,OAAA;AAAA,UACL,EAAE,GAAG,CAAA,EAAG,MAAA,EAAO;AAAA,UACf,GAAA;AAAA,UACA,KAAA;AAAA,UACA,cAAA;AAAA,UACA,EAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,UAAU,CAAA,CAAE,OAAA;AAChB,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,MAAM,CAAC,IAAA,EAAM,EAAE,IAAI,OAAA,CAAQ,OAAA,EAAS,SAAS,EAAE,CAAA;AAC/C,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,IAAI,CAAC,EAAA,EAAI;AACP,QAAA,OAAO;AAAA,UACL,EAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA,EAAG,MAAA,EAAQ,OAAA,EAAQ;AAAA,UACjE;AAAC,SACH;AAAA,MACF;AAAA,IACF;AAGA,IAAA,OAAO;AAAA,MACL;AAAA,QACE,GAAG,QAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,YAAA,EAAc,CAAA;AAAA,QAC5D,OAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,CAAC,EAAE,IAAA,EAAM,QAAQ,YAAA,EAAc,GAAA,EAAK,OAAO;AAAA,KAC7C;AAAA,EACF;AAeA,EAAA,SAAS,QACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,KAAA,EACA,IACA,YAAA,EACuD;AACvD,IAAA,IAAI,MAAA,CAAO,UAAU,MAAA,EAAW;AAC9B,MAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,IACzD;AACA,IAAA,MAAM,QAAQ,aAAA,CAAc,OAAA,CAAQ,GAAG,GAAG,CAAA,EAAG,OAAO,EAAE,CAAA;AACtD,IAAA,MAAM,SAAA,GAAY,EAAE,GAAG,CAAA,EAAG,KAAA,EAAO,EAAE,GAAG,CAAA,CAAE,KAAA,EAAO,CAAC,GAAG,GAAG,OAAM,EAAE;AAC9D,IAAA,IAAI,CAAC,WAAA,CAAY,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA,EAAG;AACzC,MAAA,OAAO,CAAC,OAAA,CAAQ,SAAA,EAAW,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,IACjE;AACA,IAAA,MAAM,YAAY,EAAA,GAAK,WAAA,CAAY,KAAA,EAAO,MAAA,CAAO,OAAO,UAAU,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,OAAA,CAAQ,WAAW,GAAA,EAAK;AAAA,QACtB,KAAA,EAAO,eAAA;AAAA,QACP,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,MACD;AAAC,KACH;AAAA,EACF;AAGA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACsB;AACtB,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,KAAA,EAAO,EAAE,GAAG,CAAA,CAAE,KAAA,EAAO,CAAC,GAAG,GAAG,KAAA,EAAM,EAAE;AAAA,EACrD;AAUA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,EAAA,EACuD;AACvD,IAAA,OAAO,KAAK,CAAA,EAAG,GAAA,EAAK,OAAO,EAAA,EAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAAA,EAC/C;AASA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,GAAA,EACuD;AACvD,IAAA,MAAM,OAAA,GACJ,YAAY,IAAA,GAAO,SAAA,CAAU,EAAE,OAAA,EAAS,OAAO,IAAI,CAAA,CAAE,OAAA;AACvD,IAAA,MAAM,QACJ,MAAA,CAAO,KAAA,KAAU,MAAA,GACb,GAAA,CAAS,EAAE,KAAA,EAAO,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,IAAI,EAAA,EAAI,MAAA,CAAO,KAAA,CAAM,KAAK,IAC7D,CAAA,CAAE,KAAA;AAER,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,CAAA,CAAE,KAAA,EAAO,GAAG,CAAA;AAClC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,GAAG,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,OAAO,WAAA,EAAa,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,CAAA;AAAA,QAC7D,OAAA;AAAA,QACA,KAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA;AAAC,KACH;AAAA,EACF;AAUA,EAAA,SAAS,IAAA,CACP,CAAA,EACA,GAAA,EACA,GAAA,EACuD;AACvD,IAAA,MAAM,OAAA,GACJ,OAAA,KAAY,IAAA,GAAO,SAAA,CAAU,CAAA,CAAE,SAAS,OAAA,EAAS,GAAA,CAAI,EAAE,CAAA,GAAI,CAAA,CAAE,OAAA;AAC/D,IAAA,MAAM,WAAA,GAAc,EAAE,GAAG,CAAA,EAAG,OAAA,EAAQ;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AACxB,IAAA,MAAM,KAAA,GAAQ,IAAA,EAAM,KAAA,KAAU,SAAA,GAAY,KAAK,KAAA,GAAQ,MAAA;AACvD,IAAA,MAAM,YAAA,GACJ,MAAM,KAAA,KAAU,SAAA,GAAY,KAAK,YAAA,GAAe,UAAA,CAAW,IAAI,EAAE,CAAA;AAGnE,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO;AAAA,QACL,OAAA,CAAQ,aAAa,GAAA,EAAK,EAAE,OAAO,QAAA,EAAU,KAAA,EAAO,GAAA,CAAI,KAAA,EAAO,CAAA;AAAA,QAC/D;AAAC,OACH;AAAA,IACF;AACA,IAAA,OAAO,OAAA,CAAQ,aAAa,GAAA,EAAK,KAAA,EAAO,IAAI,KAAA,EAAO,GAAA,CAAI,IAAI,YAAY,CAAA;AAAA,EACzE;AA6BA,EAAA,SAAS,YAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACuD;AACvD,IAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,EACzD;AAgBA,EAAA,SAAS,OAAA,CACP,GACA,GAAA,EACuD;AACvD,IAAA,KAAA,MAAW,CAAC,KAAK,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,CAAA,CAAE,KAAK,CAAA,EAAG;AACjD,MAAA,IAAI,GAAA,CAAI,EAAA,KAAO,YAAA,CAAa,GAAG,CAAA,EAAG;AAChC,QAAA,IAAI,KAAK,KAAA,KAAU,eAAA,SAAwB,CAAC,CAAA,EAAG,EAAE,CAAA;AACjD,QAAA,OAAO,IAAA,CAAK,GAAG,GAAA,EAAK,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,EAAM,KAAK,YAAY,CAAA;AAAA,MAC7D;AACA,MAAA,IAAI,GAAA,CAAI,EAAA,KAAO,eAAA,CAAgB,GAAG,CAAA,EAAG;AAGnC,QAAA,IAAI,IAAA,CAAK,KAAA,KAAU,SAAA,IAAa,IAAA,CAAK,KAAA,KAAU,eAAA;AAC7C,UAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAMf,QAAA,OAAO;AAAA,UACL,OAAA,CAAQ,GAAG,GAAA,EAAK;AAAA,YACd,KAAA,EAAO,QAAA;AAAA,YACP,KAAA,EAAO;AAAA,cACL,IAAA,EAAM,mBAAA;AAAA,cACN,IAAI,GAAA,CAAI,EAAA;AAAA,cACR,MAAM,GAAA,CAAI;AAAA;AACZ,WACD,CAAA;AAAA,UACD;AAAC,SACH;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACf;AAWA,EAAA,SAAS,KAAK,CAAA,EAAiD;AAC7D,IAAA,MAAM,MAAqB,EAAC;AAC5B,IAAA,KAAA,MAAW,CAAC,KAAK,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,CAAA,CAAE,KAAK,CAAA,EAAG;AACjD,MAAA,IAAI,IAAA,CAAK,UAAU,eAAA,EAAiB;AAClC,QAAA,GAAA,CAAI,KAAK,WAAA,CAAY,YAAA,CAAa,GAAG,CAAA,EAAG,IAAA,CAAK,SAAS,CAAC,CAAA;AAAA,MACzD;AACA,MAAA,IACE,MAAA,CAAO,QAAA,KAAa,MAAA,KACnB,IAAA,CAAK,KAAA,KAAU,SAAA,IAAa,IAAA,CAAK,KAAA,KAAU,eAAA,CAAA,IAC5C,IAAA,CAAK,YAAA,GAAe,CAAA,EACpB;AACA,QAAA,GAAA,CAAI,KAAK,WAAA,CAAY,eAAA,CAAgB,GAAG,CAAA,EAAG,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAaA,EAAA,SAAS,SAAS,KAAA,EAA6B;AAC7C,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,YAAA;AAAA,QASb,CAAC,GAAA,KAAQ,KAAA,CAAM,IAAI,GAAA,CAAI,KAAA,EAAO,IAAI,GAAG,CAAA;AAAA,QACrC,CAAC,QAAQ,GAAA,MAAwB;AAAA,UAC/B,MAAM,OAAA,CAAQ,WAAA;AAAA,UACd,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAA;AAAA,UACA,EAAA,EAAI,KAAK,GAAA;AAAI,SACf,CAAA;AAAA,QACA,CAAC,OAAO,GAAA,MAAkB;AAAA,UACxB,MAAM,OAAA,CAAQ,YAAA;AAAA,UACd,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,KAAA;AAAA,UACA,EAAA,EAAI,KAAK,GAAA;AAAI,SACf;AAAA;AACF,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,YAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAYO,SAAS,cAAA,CAMd,KAAA,EACA,CAAC,KAAA,EAAO,IAAI,CAAA,EACgB;AAC5B,EAAA,OAAO,CAAC,EAAE,GAAG,OAAO,UAAA,EAAY,KAAA,IAAS,IAAI,CAAA;AAC/C","file":"chunk-EC6FO42Q.js","sourcesContent":["/**\n * @packageDocumentation\n *\n * @deprecated `@demlik/tea/resilient-call` is deprecated in favor of\n * `@demlik/tea/with-resilience` — the higher-order `withResilience(base,\n * config)` wrapper (TEA-idiomatic: it wraps any existing machine instead of\n * forcing a bespoke embedded slice; epic consolidation verdict, survivor\n * `with-resilience`). The APIs are NOT drop-in; migration map:\n *\n *   - `createResilientCall(config, rng)` + hand-wiring `init` / the verbs /\n *     `subs` / `handlers` into your machine → `withResilience(base, { target,\n *     ...bricks }, rng)`. Nothing is wired by hand anymore: the wrapper\n *     intercepts the `target` base Cmd and routes it through the gate.\n *   - `ResilientConfig` bricks (`retry` / `circuit` / `rateLimit` / `cache` /\n *     `deadline`) → unchanged; `ResilienceConfig` extends the same knob and\n *     adds `target` (required), `keyOf?` (per-call key — was `attempt`'s `key`\n *     argument), and `at?` (time-as-data reader — REQUIRED with any\n *     time-sensitive brick; `withResilience` throws at construction without it).\n *   - The slice at your chosen Model field + `liftResilience` → the wrapper\n *     owns `model.$resilience`; there is nothing to lift.\n *   - Verbs `attempt` / `succeed` / `fail` / `onTimer` → internal to the\n *     wrapper; results route as `$resilience:ok` / `$resilience:err` /\n *     `$resilience:timer` Msgs through the merged `update` (the old\n *     `resilient_run` / `resilient_ok` / `resilient_err` vocabulary is renamed\n *     into the `$resilience:` namespace).\n *   - `settleFailed` → NO equivalent. It exists for embedded-slice consumers\n *     (`authed-call`, `paginated-walk`) that settle a call without touching the\n *     breaker; the wrapper exposes no caller-facing settle verb.\n *   - `handlers(ports)` / `subs(state)` / the `subscribeDeadline` re-export →\n *     handled by the wrapper; run the returned machine like any other.\n *\n * Removal window (\"deprecate, don't delete\"): the `./resilient-call` subpath\n * export survives one minor release after this deprecation ships, then is\n * removed. Internal sibling modules (`with-resilience` itself, `agent`,\n * `llm-call`, `authed-call`, `reconciler`, `paginated-walk`) intentionally keep\n * importing `../resilient-call` — the deprecation targets the PUBLISHED export,\n * not the module's internal role.\n *\n * @demlik/tea/resilient-call — the ROOT composition: a single resilience knob\n * that bundles cache → circuit-breaker → rate-limit → exponential-backoff retry\n * (with a deadline-driven retry timer) around any fallible `(input) => Promise`\n * port.\n *\n * This is `examples/resilient-fetch.ts`'s hand-wired `attempt()` generalized:\n *\n *   - It is **keyed**. The example tracked one URL at a time; this tracks N\n *     concurrent logical calls, each under a string `key`. The cache, the\n *     waiting-retry bookkeeping, and the retry timers are all per-key, while the\n *     circuit breaker and token bucket are shared (one downstream target, one\n *     breaker / one bucket — the example's implicit single-target assumption\n *     made explicit).\n *   - It is **config-driven**, not hand-wired. You hand `createResilientCall`\n *     a `ResilientConfig` and get back the uniform knob contract every L2\n *     composition exposes: `init()`, the four verbs (`attempt` / `succeed` /\n *     `fail` / `onTimer`), `subs(state)`, and `handlers(ports)`.\n *   - Every brick is **optional**. Omit `cache` and the cache gate disappears\n *     (`get` is never consulted); omit `circuit` and every call passes the\n *     breaker; omit `rateLimit` and the bucket never throttles; omit `retry`\n *     and a failure is terminal (no backoff, no timer); omit `deadline` and no\n *     overall wall-clock cap is armed. \"Omit a brick → omit its gate\" is the\n *     whole config story — there are no other modes.\n *\n * Four later compositions (`llm-call`, `paginated-walk`, `authed-call`,\n * `reconciler`) inherit THIS slice + verb shape, so the contract here is\n * load-bearing: the slice is a flat record of brick states, every verb returns\n * `readonly [State, Cmd[]]`, time is always an `at` / `now` parameter, and the\n * RNG used for jitter is injected on the config (never read inside a verb).\n *\n * ## The two non-negotiables (canon)\n *\n *   - **Durable** — the slice is a plain-data Model field (brick states are all\n *     JSON-serializable), so it survives DO eviction / reload.\n *   - **Replayable** — every transition is a verb returning new state + Cmds;\n *     `replay` reconstructs it exactly. Nothing here closes over time or RNG.\n *\n * ## Where the clock / RNG live\n *\n * Inside the verbs: nowhere. Time arrives as `at` on `attempt` / `onTimer` and\n * is carried on the result / timer Msgs the consumer dispatches. Jitter RNG is\n * injected once at `createResilientCall(config, rng)` and threaded into\n * `nextDelayMs` at the verb boundary — deterministic in tests, `Math.random`\n * by default. The ONLY clock read is `Date.now()` inside the `handlers` port\n * (the effect boundary), exactly as `resilient-fetch.ts` stamps its result Msgs.\n *\n * That same `at` is what makes a DURATION-bounded retry budget reachable here:\n * `recordFailure` / `shouldRetry` are fed the failure's observation instant,\n * so `config.retry` accepts any `AnyRetryPolicy` — a count, a wall-clock outage\n * budget (`maxElapsedMs`), or explicit `unbounded: true` — with no new argument\n * on any verb and no clock read inside one.\n *\n * ## Typical wiring\n *\n *   const rc = createResilientCall<string, Result>({\n *     cache: { ttlMs: 60_000 },\n *     circuit: { threshold: 5, cooldownMs: 30_000 },\n *     rateLimit: { capacity: 10, refillPerSec: 5 },\n *     retry: defaultRetryPolicy,\n *     deadline: { ms: 5_000 },\n *   });\n *\n *   // in the machine:\n *   init: () => [{ resilience: rc.init() }, []],\n *   update: {\n *     fetch:   (s, m) => lift(s, rc.attempt(s.resilience, m.key, m.input, m.at)),\n *     call_ok: (s, m) => lift(s, rc.succeed(s.resilience, m.key, m)),\n *     call_err:(s, m) => lift(s, rc.fail(s.resilience, m.key, m)),\n *     retry_due:(s, m) => lift(s, rc.onTimer(s.resilience, m)),\n *   },\n *   subscriptions: (s) => rc.subs(s.resilience),\n *   subscribe: { deadline: subscribeDeadline },\n *   interpret: rc.handlers({ run: ctx.call }),\n */\n\nimport {\n  get as cacheGet,\n  set as cacheSet,\n  initCache,\n  type TtlCache,\n} from \"../cache\";\nimport {\n  type CircuitState,\n  canPass,\n  initCircuit,\n  onFailure,\n  onSuccess,\n} from \"../circuit-breaker\";\nimport {\n  type DeadlineExceeded,\n  type DeadlineSub,\n  deadlineSub,\n  subscribeDeadline,\n} from \"../deadline\";\nimport { type Cmd, type NoCtx, tryInterpret } from \"../index\";\nimport { MsgType } from \"../protocol\";\nimport { without } from \"../pure/core\";\nimport { initBucket, type TokenBucket, tryConsume } from \"../rate-limit\";\nimport {\n  type AnyRetryPolicy,\n  asRng,\n  initRetry,\n  nextDelayMs,\n  type RetryState,\n  recordFailure,\n  shouldRetry,\n} from \"../retry-backoff\";\n\n// ===========================================================================\n// Config — the knob. Every brick optional; omit a brick → omit its gate.\n// ===========================================================================\n\n/** Circuit-breaker knob — only the two numbers a consumer ever tunes. */\nexport interface CircuitConfig {\n  /** Consecutive failures that trip the breaker open. */\n  readonly threshold: number;\n  /** How long the breaker stays open before admitting a probe, in ms. */\n  readonly cooldownMs: number;\n  /**\n   * Probes admitted in `half_open` before fast-failing the rest of the round.\n   * Defaults to 1 (a single probe decides recovery) — matches the circuit-\n   * breaker module's `defaultCircuitPolicy`.\n   */\n  readonly halfOpenMaxProbes?: number;\n}\n\n/** Token-bucket rate-limit knob. */\nexport interface RateLimitConfig {\n  /** Burst size — the bucket starts full at `capacity`. */\n  readonly capacity: number;\n  /** Steady-state refill rate, tokens per second. */\n  readonly refillPerSec: number;\n}\n\n/** Per-entry TTL cache knob. */\nexport interface CacheConfig {\n  /** How long a cached success stays fresh, in ms. */\n  readonly ttlMs: number;\n}\n\n/** Overall wall-clock deadline knob — an absolute cap per in-flight call. */\nexport interface DeadlineConfig {\n  /** Budget from the moment a call starts, in ms. */\n  readonly ms: number;\n}\n\n/**\n * The resilience knob. EVERY field is optional: omit a brick and its gate is\n * skipped entirely (the slice still carries a default brick state so the shape\n * stays uniform across configs, but the gate is never consulted). An empty\n * config `{}` is a valid pass-through — a bare effect with no resilience at all.\n */\nexport interface ResilientConfig {\n  /**\n   * The backoff brick. Omit and a failure is terminal (no backoff, no timer).\n   *\n   * Any bound the `../retry-backoff` union admits: a count (`RetryPolicy`), a\n   * wall-clock outage budget (`DurationRetryPolicy`), or explicit\n   * `unbounded: true`. A duration bound needs no extra wiring: every path that\n   * records a failure already holds the instant it was observed as DATA —\n   * `fail`'s `msg.at` (stamped at the interpret boundary) and `gate`'s `at`\n   * (the caller's `attempt` / the retry timer's `atMs`) — so the streak clock\n   * is fed from a Msg, never from a `Date.now()` inside a verb (invariant 2).\n   */\n  readonly retry?: AnyRetryPolicy;\n  readonly circuit?: CircuitConfig;\n  readonly rateLimit?: RateLimitConfig;\n  readonly cache?: CacheConfig;\n  readonly deadline?: DeadlineConfig;\n}\n\n// ===========================================================================\n// Slice — the Model field this knob owns. A flat record of brick states.\n// ===========================================================================\n\n/**\n * Per-key call phase. `key` indexes a logical call; several can be in flight at\n * once (the generalization of the example's single `url`). Discriminated on\n * `phase` so each phase carries only its own data (pattern 11):\n *\n *   - `idle`          — never attempted, or fully settled and forgotten.\n *   - `running`       — the effect Cmd is out; awaiting `succeed` / `fail`.\n *                       Carries `deadlineAtMs` (absolute cap, `0` if no deadline\n *                       brick) and the last `input` so a retry can re-issue it.\n *   - `waiting_retry` — a transient failure backed off; the retry timer is armed\n *                       for `retryAtMs`. Carries `input` for the re-attempt.\n *   - `circuit_open`  — the breaker fast-failed this attempt. Terminal for this\n *                       call until the consumer re-attempts after cooldown.\n *   - `succeeded`     — settled OK. `result` is the value the port produced.\n *   - `failed`        — settled Err (out of retries, or no retry brick). `error`\n *                       carries the last failure.\n */\nexport type CallPhase<I, R> =\n  | { readonly phase: \"idle\" }\n  | {\n      readonly phase: \"running\";\n      readonly input: I;\n      readonly deadlineAtMs: number;\n    }\n  | {\n      readonly phase: \"waiting_retry\";\n      readonly input: I;\n      readonly retryAtMs: number;\n      readonly deadlineAtMs: number;\n    }\n  | { readonly phase: \"circuit_open\" }\n  | { readonly phase: \"succeeded\"; readonly result: R }\n  | { readonly phase: \"failed\"; readonly error: unknown };\n\n/**\n * The slice. `circuit` / `bucket` are SHARED across keys (one downstream target\n * → one breaker, one bucket). `retry` and `cache` are PER KEY (each logical call\n * has its own backoff count + cached result), as is the per-call `CallPhase`.\n * Every field is plain data → the whole slice serializes into a `Store<S>`.\n *\n * `retry` / `cache` keep a default brick value even when the corresponding\n * config brick is omitted, so the slice shape is identical regardless of which\n * bricks the consumer enabled — the verbs simply never consult the unused brick.\n */\nexport interface ResilientState<I, R> {\n  readonly circuit: CircuitState;\n  readonly bucket: TokenBucket;\n  /**\n   * Per-key backoff counter. Entries minted by `backoff` are `TimedRetryState`s\n   * (they carry the streak's `firstFailureAtMs`, since every failure path holds\n   * the observation instant); the field is typed at the `RetryState` supertype\n   * because a key that has never failed has no streak, and a slice persisted\n   * before the origin existed rehydrates without one. Still plain data.\n   */\n  readonly retry: Readonly<Record<string, RetryState>>;\n  readonly cache: TtlCache<R>;\n  readonly calls: Readonly<Record<string, CallPhase<I, R>>>;\n}\n\n// ===========================================================================\n// Cmds + Msgs the knob speaks. Generic over the port input `I`.\n// ===========================================================================\n\n/**\n * The one effect this knob emits: \"run the port for `key` with `input`\". The\n * consumer's `handlers(ports)` interprets it; it carries no closure — `input`\n * is plain data (invariant 3).\n */\nexport type RunCmd<I> = Cmd<typeof MsgType.ResilientRun> & {\n  readonly key: string;\n  readonly input: I;\n};\n\n/** Settle Msgs the `handlers` port dispatches back. `at` is stamped at the boundary. */\nexport type SucceedMsg<R> = {\n  readonly type: typeof MsgType.ResilientOk;\n  readonly key: string;\n  readonly result: R;\n  readonly at: number;\n};\nexport type FailMsg = {\n  readonly type: typeof MsgType.ResilientErr;\n  readonly key: string;\n  readonly error: unknown;\n  readonly at: number;\n};\n\n/** The retry / deadline timer Msg — `DeadlineExceeded`, keyed by the call `key`. */\nexport type ResilientTimerMsg = DeadlineExceeded;\n\n/**\n * The plain-data error a deadline-failed call settles with. A `{_tag, ...}`\n * sentinel — NEVER a `new Error(...)` — so the slice stays JSON-serializable\n * (Error objects round-trip to `{}` and carry a stack trace, both of which break\n * the slice's durability invariant). `id` / `atMs` echo the timer that fired so\n * a consumer can attribute the failure to its deadline.\n */\nexport type DeadlineExceededError = {\n  readonly _tag: \"deadline_exceeded\";\n  readonly id: string;\n  readonly atMs: number;\n};\n\n/** Ports the consumer supplies to `handlers`. */\nexport interface ResilientPorts<I, R> {\n  /** The fallible work this knob wraps. Throws on failure → routed to `fail`. */\n  readonly run: (input: I, key: string) => Promise<R>;\n}\n\n// ===========================================================================\n// Internal brick-policy derivation — config → the L1 policy shapes.\n// ===========================================================================\n\n// A circuit policy is only built when the brick is configured; absence is\n// represented as `null` so the gate can short-circuit to \"always pass\".\nfunction circuitPolicy(config: ResilientConfig) {\n  if (config.circuit === undefined) return null;\n  return {\n    failureThreshold: config.circuit.threshold,\n    cooldownMs: config.circuit.cooldownMs,\n    halfOpenMaxProbes: config.circuit.halfOpenMaxProbes ?? 1,\n  };\n}\n\n// Sub-id families. Each call's retry timer is a deadline keyed by `key`, so a\n// machine running many concurrent calls reconciles each independently.\nfunction retryTimerId(key: string): string {\n  return `resilient:retry:${key}`;\n}\nfunction deadlineTimerId(key: string): string {\n  return `resilient:deadline:${key}`;\n}\n\n// ===========================================================================\n// The knob factory.\n// ===========================================================================\n\n/**\n * Build a resilient-call knob from `config`. `rng` is injected for retry\n * jitter — pass a fixed `() => 0.5` in tests to pin backoff; defaults to\n * `Math.random` (read at the verb boundary, never inside a brick op). It is\n * curried onto the factory rather than threaded through every verb so callers\n * spell the determinism choice once.\n *\n * Returns the uniform L2 knob contract. `I` is the port input type, `R` the\n * port result type.\n *\n * @deprecated Use `withResilience` from `@demlik/tea/with-resilience` — not\n * drop-in; see the migration map at the top of this module.\n */\nexport function createResilientCall<I, R>(\n  config: ResilientConfig,\n  rng: () => number = Math.random,\n) {\n  const cPolicy = circuitPolicy(config);\n  // Re-affirm the `[0, 1)` contract at the seam where the injected generator\n  // feeds the backoff math (brand from `../retry-backoff`). The factory's\n  // public param stays a plain `() => number` so transitive callers are\n  // unchanged; `asRng` is the single point it's branded for `nextDelayMs`.\n  const rngBranded = asRng(rng);\n\n  /** The starting slice. Bricks not in `config` still get a default value. */\n  function init(): ResilientState<I, R> {\n    return {\n      circuit: initCircuit(),\n      // The bucket carries a default value even without the rateLimit brick so\n      // the slice shape is uniform, but the rate-limit GATE is skipped entirely\n      // when the brick is absent (see `gate`) — the bucket is simply never\n      // consulted. A `0/0` placeholder bucket would be touched by `tryConsume`;\n      // a `1-cap` default is harmless because the gate never calls it.\n      bucket: config.rateLimit\n        ? initBucket(\n            config.rateLimit.capacity,\n            config.rateLimit.refillPerSec,\n            0,\n          )\n        : initBucket(1, 1, 0),\n      retry: {},\n      cache: initCache<R>(),\n      calls: {},\n    };\n  }\n\n  /** Read this key's retry state, defaulting to a fresh one. */\n  function retryOf(s: ResilientState<I, R>, key: string): RetryState {\n    return s.retry[key] ?? initRetry();\n  }\n\n  /** Compute the absolute deadline for a call starting at `at` (0 = no cap). */\n  function deadlineAt(at: number): number {\n    return config.deadline ? at + config.deadline.ms : 0;\n  }\n\n  /**\n   * The shared decision: cache → rate-limit → circuit gate, then either emit\n   * the effect or schedule a retry. `deadlineAtMs` is threaded so a re-attempt\n   * (from `onTimer`) keeps the ORIGINAL overall deadline rather than restarting\n   * it. PURE — `at` is the only clock; `rng` is the injected jitter source.\n   *\n   * Used by both `attempt` (fresh call) and `onTimer` (retry timer fired) so\n   * the gate logic lives in exactly one place — the example's shared `attempt`\n   * helper, lifted to a keyed knob.\n   *\n   * ## Why rate-limit is gated BEFORE the circuit probe\n   *\n   * The circuit-breaker's `canPass` is not a passive read: in `half_open` it\n   * *consumes* a probe slot (advancing `probes`), and the consumed slot is only\n   * released when a probe RESOLVES via `onSuccess` / `onFailure`. So a probe\n   * slot may only be taken when this attempt is actually going to reach the\n   * backend (i.e. emit the `resilient_run` Cmd). The rate-limit gate can reject\n   * an attempt and return a backoff WITHOUT any Cmd — no backend call, so no\n   * settle Msg ever comes back. If the circuit probe were consumed first, that\n   * rate-limited attempt would burn the half-open probe budget on a call that\n   * never happened, wedging the breaker `half_open` at its probe cap forever\n   * (nothing moves it out of `half_open` but a resolved probe). Running the\n   * rate-limit gate first means the circuit probe is consumed ONLY on the path\n   * that emits the effect.\n   */\n  function gate(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    at: number,\n    deadlineAtMs: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    // 1) Serve from cache if fresh — no effect at all. Skipped when no cache brick.\n    if (config.cache !== undefined) {\n      const cached = cacheGet(s.cache, key, at);\n      if (cached !== undefined) {\n        return [setCall(s, key, { phase: \"succeeded\", result: cached }), []];\n      }\n    }\n\n    // 2) Rate-limit gate FIRST — it may reject with no Cmd, so it must run\n    // before any circuit probe is consumed (see header note). Skipped entirely\n    // when no rateLimit brick — the bucket is never consulted, so the default\n    // placeholder bucket stays untouched.\n    let bucket = s.bucket;\n    if (config.rateLimit !== undefined) {\n      const [next, hasToken] = tryConsume(bucket, at);\n      bucket = next;\n      if (!hasToken) {\n        // Rate-limited: treat as a transient failure and back off via retry.\n        // The circuit is untouched — no probe is spent on a call that never ran.\n        return backoff(\n          { ...s, bucket },\n          key,\n          input,\n          \"rate_limited\",\n          at,\n          deadlineAtMs,\n        );\n      }\n    }\n\n    // 3) Circuit-breaker gate. `null` policy → no breaker → always pass. Reached\n    // only once a token is secured, so a half-open probe is consumed exclusively\n    // on the path that emits the effect below.\n    let circuit = s.circuit;\n    if (cPolicy !== null) {\n      const [next, ok] = canPass(circuit, cPolicy, at);\n      circuit = next;\n      if (!ok) {\n        return [\n          { ...setCall(s, key, { phase: \"circuit_open\" }), bucket, circuit },\n          [],\n        ];\n      }\n    }\n\n    // 4) All gates passed — emit the effect as data.\n    return [\n      {\n        ...setCall(s, key, { phase: \"running\", input, deadlineAtMs }),\n        circuit,\n        bucket,\n      },\n      [{ type: MsgType.ResilientRun, key, input }],\n    ];\n  }\n\n  /**\n   * Back off after a transient failure: record it, and if `retry` permits\n   * another attempt, enter `waiting_retry` with the retry timer armed; else\n   * settle `failed`. When no `retry` brick is configured the call fails on the\n   * first failure (no backoff, no timer). PURE.\n   *\n   * `at` is both the backoff anchor AND the streak clock: it is passed to\n   * `recordFailure` (which starts `firstFailureAtMs` on the streak's first\n   * failure and preserves it on every later one) and to `shouldRetry`, so a\n   * `DurationRetryPolicy` on `config.retry` is honoured with no extra wiring.\n   * A success drops `retry[key]` entirely, which drops the origin with it —\n   * only an unbroken run of failures grows toward a duration budget.\n   */\n  function backoff(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    error: unknown,\n    at: number,\n    deadlineAtMs: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    if (config.retry === undefined) {\n      return [setCall(s, key, { phase: \"failed\", error }), []];\n    }\n    const retry = recordFailure(retryOf(s, key), error, at);\n    const withRetry = { ...s, retry: { ...s.retry, [key]: retry } };\n    if (!shouldRetry(retry, config.retry, at)) {\n      return [setCall(withRetry, key, { phase: \"failed\", error }), []];\n    }\n    const retryAtMs = at + nextDelayMs(retry, config.retry, rngBranded);\n    return [\n      setCall(withRetry, key, {\n        phase: \"waiting_retry\",\n        input,\n        retryAtMs,\n        deadlineAtMs,\n      }),\n      [],\n    ];\n  }\n\n  // Set the phase for one key, leaving every other field untouched.\n  function setCall(\n    s: ResilientState<I, R>,\n    key: string,\n    phase: CallPhase<I, R>,\n  ): ResilientState<I, R> {\n    return { ...s, calls: { ...s.calls, [key]: phase } };\n  }\n\n  // === Verb: attempt =======================================================\n\n  /**\n   * Start (or restart) the call for `key` with `input` at time `at`. Runs the\n   * cache → circuit → rate-limit gate and either emits the `resilient_run`\n   * effect, schedules a retry, fast-fails (circuit open), or serves the cache.\n   * PURE.\n   */\n  function attempt(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    at: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    return gate(s, key, input, at, deadlineAt(at));\n  }\n\n  // === Verb: succeed =======================================================\n\n  /**\n   * Record a success for `key`: close the breaker, fill the cache (if a cache\n   * brick exists), reset this key's retry count, and settle `succeeded`. PURE —\n   * `msg.at` is the cache write clock.\n   */\n  function succeed(\n    s: ResilientState<I, R>,\n    key: string,\n    msg: SucceedMsg<R>,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    const circuit =\n      cPolicy !== null ? onSuccess(s.circuit, cPolicy) : s.circuit;\n    const cache =\n      config.cache !== undefined\n        ? cacheSet(s.cache, key, msg.result, msg.at, config.cache.ttlMs)\n        : s.cache;\n    // Drop this key's retry counter — a success ends the retry run.\n    const retry = without(s.retry, key);\n    return [\n      {\n        ...setCall(s, key, { phase: \"succeeded\", result: msg.result }),\n        circuit,\n        cache,\n        retry,\n      },\n      [],\n    ];\n  }\n\n  // === Verb: fail ==========================================================\n\n  /**\n   * Record a failure for `key`: trip the breaker (it may open), then back off —\n   * schedule a retry if `retry` permits, else settle `failed`. PURE — `msg.at`\n   * stamps the breaker trip + the retry delay base. Re-issues from the call's\n   * remembered `input` and preserves the original overall `deadlineAtMs`.\n   */\n  function fail(\n    s: ResilientState<I, R>,\n    key: string,\n    msg: FailMsg,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    const circuit =\n      cPolicy !== null ? onFailure(s.circuit, cPolicy, msg.at) : s.circuit;\n    const withCircuit = { ...s, circuit };\n    const call = s.calls[key];\n    const input = call?.phase === \"running\" ? call.input : undefined;\n    const deadlineAtMs =\n      call?.phase === \"running\" ? call.deadlineAtMs : deadlineAt(msg.at);\n    // No remembered input (e.g. a stray fail for a key not running) → just\n    // settle failed after tripping the breaker; nothing to re-issue.\n    if (input === undefined) {\n      return [\n        setCall(withCircuit, key, { phase: \"failed\", error: msg.error }),\n        [],\n      ];\n    }\n    return backoff(withCircuit, key, input, msg.error, msg.at, deadlineAtMs);\n  }\n\n  // === Verb: settleFailed ==================================================\n\n  /**\n   * Settle `key` to terminal `failed` with `error` WITHOUT touching the circuit\n   * breaker or this key's retry counter. PURE.\n   *\n   * This is the verb for a failure that is NOT a downstream-health signal: the\n   * call must end now, but the breaker must not trip and the backoff run must\n   * not advance. `fail` is the opposite — it records the failure against the\n   * breaker (it may open) and feeds the retry policy (it may back off). Use\n   * `settleFailed` when the *reason* the call cannot proceed has nothing to do\n   * with downstream health:\n   *\n   *   - `authed-call` settles a 401 it cannot fix (e.g. the refresh budget is\n   *     spent): a bad token is the caller's problem, not the backend's —\n   *     tripping the breaker on it would punish a healthy target, and backing\n   *     off would just retry a request that will 401 again.\n   *   - `paginated-walk` settles a terminal walk error (e.g. a malformed page\n   *     the consumer rejects) that should stop the walk without poisoning the\n   *     shared breaker the next page fetch passes through.\n   *\n   * Because it leaves `circuit` and `retry[key]` untouched, the breaker keeps\n   * its health view of the actual backend and a later `attempt` for this key\n   * starts a fresh retry run. Both sibling knobs previously hand-rolled this by\n   * splicing `calls` directly; this verb gives them one named, tested entry\n   * point so the slice's settle invariants live in exactly one place.\n   */\n  function settleFailed(\n    s: ResilientState<I, R>,\n    key: string,\n    error: unknown,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    return [setCall(s, key, { phase: \"failed\", error }), []];\n  }\n\n  // === Verb: onTimer =======================================================\n\n  /**\n   * A timer fired for some key. Two kinds, disambiguated by the Sub id:\n   *\n   *   - retry timer    → re-run the gate for that key's remembered input,\n   *                      re-checking the circuit + bucket at THIS time.\n   *   - deadline timer → the overall budget elapsed → settle `failed` with a\n   *                      deadline error, no matter the current phase.\n   *\n   * A timer for a key no longer `waiting_retry` (retry) / no longer in flight\n   * (deadline) is a no-op — the reconcile pass races the result; the verb must\n   * tolerate a stale fire. PURE.\n   */\n  function onTimer(\n    s: ResilientState<I, R>,\n    msg: ResilientTimerMsg,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    for (const [key, call] of Object.entries(s.calls)) {\n      if (msg.id === retryTimerId(key)) {\n        if (call.phase !== \"waiting_retry\") return [s, []];\n        return gate(s, key, call.input, msg.atMs, call.deadlineAtMs);\n      }\n      if (msg.id === deadlineTimerId(key)) {\n        // Deadline only fires for a still-active call. A settled call has no\n        // armed deadline Sub, but tolerate a stale fire defensively.\n        if (call.phase !== \"running\" && call.phase !== \"waiting_retry\")\n          return [s, []];\n        // Plain-data sentinel, NOT a `new Error(...)`: an Error object is not\n        // JSON-serializable (it round-trips to `{}`) and captures a stack trace,\n        // both of which break the slice's durability invariant once it is\n        // persisted into a `Store<S>` and reloaded. A `{_tag, ...}` record keeps\n        // the slice round-trip-equal under JSON.parse(JSON.stringify(...)).\n        return [\n          setCall(s, key, {\n            phase: \"failed\",\n            error: {\n              _tag: \"deadline_exceeded\",\n              id: msg.id,\n              atMs: msg.atMs,\n            } satisfies DeadlineExceededError,\n          }),\n          [],\n        ];\n      }\n    }\n    return [s, []];\n  }\n\n  // === Subs ================================================================\n\n  /**\n   * Pre-wired subscriptions: a retry timer for every `waiting_retry` call, and\n   * (when the `deadline` brick is configured) an overall deadline timer for\n   * every still-active call. Both are `DeadlineSub`s reconciled by id, so a\n   * phase change cancels the matching timer automatically — no manual\n   * `clearTimeout`. Wire `subscribe: { deadline: subscribeDeadline }`.\n   */\n  function subs(s: ResilientState<I, R>): readonly DeadlineSub[] {\n    const out: DeadlineSub[] = [];\n    for (const [key, call] of Object.entries(s.calls)) {\n      if (call.phase === \"waiting_retry\") {\n        out.push(deadlineSub(retryTimerId(key), call.retryAtMs));\n      }\n      if (\n        config.deadline !== undefined &&\n        (call.phase === \"running\" || call.phase === \"waiting_retry\") &&\n        call.deadlineAtMs > 0\n      ) {\n        out.push(deadlineSub(deadlineTimerId(key), call.deadlineAtMs));\n      }\n    }\n    return out;\n  }\n\n  // === Handlers ============================================================\n\n  /**\n   * Pre-wired interpret handler for `resilient_run`. Wraps the consumer's\n   * `run` port via `tryInterpret` (Railway): success → `resilient_ok`, failure\n   * → `resilient_err`, each stamped with `Date.now()` at the effect boundary —\n   * the ONE permitted clock read (interpret is impure; the reducer never reads\n   * the clock). Assign to the machine's `interpret`:\n   *\n   *   interpret: rc.handlers({ run: (input, key) => ctx.callBackend(input) })\n   */\n  function handlers(ports: ResilientPorts<I, R>) {\n    return {\n      resilient_run: tryInterpret<\n        RunCmd<I>,\n        R,\n        SucceedMsg<R> | FailMsg,\n        // The work fn reads nothing from ctx — it forwards `cmd.input` to the\n        // consumer-supplied `run` port. `NoCtx` (not `unknown`) marks this as a\n        // DELIBERATE context-free seam, so callers see intent, not looseness.\n        NoCtx\n      >(\n        (cmd) => ports.run(cmd.input, cmd.key),\n        (result, cmd): SucceedMsg<R> => ({\n          type: MsgType.ResilientOk,\n          key: cmd.key,\n          result,\n          at: Date.now(),\n        }),\n        (error, cmd): FailMsg => ({\n          type: MsgType.ResilientErr,\n          key: cmd.key,\n          error,\n          at: Date.now(),\n        }),\n      ),\n    };\n  }\n\n  return {\n    init,\n    attempt,\n    succeed,\n    fail,\n    settleFailed,\n    onTimer,\n    subs,\n    handlers,\n  };\n}\n\n/**\n * Lift a knob result `[slice, cmds]` into a host `[State, cmds]` where the\n * slice lives at `state.resilience`. A convenience for the common single-slice\n * host; consumers with a differently-named field spread by hand. Pure — a thin\n * record rebuild, no clock / RNG.\n *\n * @deprecated Use `withResilience` from `@demlik/tea/with-resilience` — the\n * wrapper owns `model.$resilience`, so there is nothing to lift; see the\n * migration map at the top of this module.\n */\nexport function liftResilience<\n  S extends { resilience: ResilientState<I, R> },\n  I,\n  R,\n  C extends Cmd,\n>(\n  state: S,\n  [slice, cmds]: readonly [ResilientState<I, R>, readonly C[]],\n): readonly [S, readonly C[]] {\n  return [{ ...state, resilience: slice }, cmds];\n}\n\n/**\n * Re-export the deadline Sub primitives so consumers (and tests) wire one\n * import: `subscribeDeadline` is the `subscribe` cell, `deadlineSub` builds the\n * Sub literal this knob's `subs` emits.\n */\nexport { subscribeDeadline, deadlineSub };\nexport type { DeadlineSub, DeadlineExceeded };\n"]}
+{"version":3,"sources":["../src/resilient-call/index.ts"],"names":[],"mappings":";;;;;;;;;;AAwUA,SAAS,cAAc,MAAA,EAAyB;AAC9C,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,MAAA,EAAW,OAAO,IAAA;AACzC,EAAA,OAAO;AAAA,IACL,gBAAA,EAAkB,OAAO,OAAA,CAAQ,SAAA;AAAA,IACjC,UAAA,EAAY,OAAO,OAAA,CAAQ,UAAA;AAAA,IAC3B,iBAAA,EAAmB,MAAA,CAAO,OAAA,CAAQ,iBAAA,IAAqB;AAAA,GACzD;AACF;AAIA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,OAAO,mBAAmB,GAAG,CAAA,CAAA;AAC/B;AACA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,OAAO,sBAAsB,GAAG,CAAA,CAAA;AAClC;AAmBO,SAAS,mBAAA,CACd,MAAA,EACA,GAAA,GAAoB,IAAA,CAAK,MAAA,EACzB;AACA,EAAA,MAAM,OAAA,GAAU,cAAc,MAAM,CAAA;AAKpC,EAAA,MAAM,UAAA,GAAa,MAAM,GAAG,CAAA;AAG5B,EAAA,SAAS,IAAA,GAA6B;AACpC,IAAA,OAAO;AAAA,MACL,SAAS,WAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMrB,MAAA,EAAQ,OAAO,SAAA,GACX,UAAA;AAAA,QACE,OAAO,SAAA,CAAU,QAAA;AAAA,QACjB,OAAO,SAAA,CAAU,YAAA;AAAA,QACjB;AAAA,OACF,GACA,UAAA,CAAW,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA;AAAA,MACtB,OAAO,EAAC;AAAA,MACR,OAAO,SAAA,EAAa;AAAA,MACpB,OAAO;AAAC,KACV;AAAA,EACF;AAGA,EAAA,SAAS,OAAA,CAAQ,GAAyB,GAAA,EAAyB;AACjE,IAAA,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,IAAK,SAAA,EAAU;AAAA,EACnC;AAGA,EAAA,SAAS,WAAW,EAAA,EAAoB;AACtC,IAAA,OAAO,MAAA,CAAO,QAAA,GAAW,EAAA,GAAK,MAAA,CAAO,SAAS,EAAA,GAAK,CAAA;AAAA,EACrD;AA2BA,EAAA,SAAS,IAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,IACA,YAAA,EACuD;AAEvD,IAAA,IAAI,MAAA,CAAO,UAAU,MAAA,EAAW;AAC9B,MAAA,MAAM,MAAA,GAAS,GAAA,CAAS,CAAA,CAAE,KAAA,EAAO,KAAK,EAAE,CAAA;AACxC,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,CAAA,EAAG,EAAE,CAAA;AAAA,MACrE;AAAA,IACF;AAMA,IAAA,IAAI,SAAS,CAAA,CAAE,MAAA;AACf,IAAA,IAAI,MAAA,CAAO,cAAc,MAAA,EAAW;AAClC,MAAA,MAAM,CAAC,IAAA,EAAM,QAAQ,CAAA,GAAI,UAAA,CAAW,QAAQ,EAAE,CAAA;AAC9C,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,IAAI,CAAC,QAAA,EAAU;AAGb,QAAA,OAAO,OAAA;AAAA,UACL,EAAE,GAAG,CAAA,EAAG,MAAA,EAAO;AAAA,UACf,GAAA;AAAA,UACA,KAAA;AAAA,UACA,cAAA;AAAA,UACA,EAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,UAAU,CAAA,CAAE,OAAA;AAChB,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,MAAM,CAAC,IAAA,EAAM,EAAE,IAAI,OAAA,CAAQ,OAAA,EAAS,SAAS,EAAE,CAAA;AAC/C,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,IAAI,CAAC,EAAA,EAAI;AACP,QAAA,OAAO;AAAA,UACL,EAAE,GAAG,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA,EAAG,MAAA,EAAQ,OAAA,EAAQ;AAAA,UACjE;AAAC,SACH;AAAA,MACF;AAAA,IACF;AAGA,IAAA,OAAO;AAAA,MACL;AAAA,QACE,GAAG,QAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,YAAA,EAAc,CAAA;AAAA,QAC5D,OAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,CAAC,EAAE,IAAA,EAAM,QAAQ,YAAA,EAAc,GAAA,EAAK,OAAO;AAAA,KAC7C;AAAA,EACF;AAeA,EAAA,SAAS,QACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,KAAA,EACA,IACA,YAAA,EACuD;AACvD,IAAA,IAAI,MAAA,CAAO,UAAU,MAAA,EAAW;AAC9B,MAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,IACzD;AACA,IAAA,MAAM,QAAQ,aAAA,CAAc,OAAA,CAAQ,GAAG,GAAG,CAAA,EAAG,OAAO,EAAE,CAAA;AACtD,IAAA,MAAM,SAAA,GAAY,EAAE,GAAG,CAAA,EAAG,KAAA,EAAO,EAAE,GAAG,CAAA,CAAE,KAAA,EAAO,CAAC,GAAG,GAAG,OAAM,EAAE;AAC9D,IAAA,IAAI,CAAC,WAAA,CAAY,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA,EAAG;AACzC,MAAA,OAAO,CAAC,OAAA,CAAQ,SAAA,EAAW,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,IACjE;AACA,IAAA,MAAM,YAAY,EAAA,GAAK,WAAA,CAAY,KAAA,EAAO,MAAA,CAAO,OAAO,UAAU,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,OAAA,CAAQ,WAAW,GAAA,EAAK;AAAA,QACtB,KAAA,EAAO,eAAA;AAAA,QACP,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,MACD;AAAC,KACH;AAAA,EACF;AAGA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACsB;AACtB,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,KAAA,EAAO,EAAE,GAAG,CAAA,CAAE,KAAA,EAAO,CAAC,GAAG,GAAG,KAAA,EAAM,EAAE;AAAA,EACrD;AAUA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACA,EAAA,EACuD;AACvD,IAAA,OAAO,KAAK,CAAA,EAAG,GAAA,EAAK,OAAO,EAAA,EAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAAA,EAC/C;AASA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,GAAA,EACA,GAAA,EACuD;AACvD,IAAA,MAAM,OAAA,GACJ,YAAY,IAAA,GAAO,SAAA,CAAU,EAAE,OAAA,EAAS,OAAO,IAAI,CAAA,CAAE,OAAA;AACvD,IAAA,MAAM,QACJ,MAAA,CAAO,KAAA,KAAU,MAAA,GACb,GAAA,CAAS,EAAE,KAAA,EAAO,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,IAAI,EAAA,EAAI,MAAA,CAAO,KAAA,CAAM,KAAK,IAC7D,CAAA,CAAE,KAAA;AAER,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,CAAA,CAAE,KAAA,EAAO,GAAG,CAAA;AAClC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,GAAG,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,OAAO,WAAA,EAAa,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,CAAA;AAAA,QAC7D,OAAA;AAAA,QACA,KAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA;AAAC,KACH;AAAA,EACF;AAUA,EAAA,SAAS,IAAA,CACP,CAAA,EACA,GAAA,EACA,GAAA,EACuD;AACvD,IAAA,MAAM,OAAA,GACJ,OAAA,KAAY,IAAA,GAAO,SAAA,CAAU,CAAA,CAAE,SAAS,OAAA,EAAS,GAAA,CAAI,EAAE,CAAA,GAAI,CAAA,CAAE,OAAA;AAC/D,IAAA,MAAM,WAAA,GAAc,EAAE,GAAG,CAAA,EAAG,OAAA,EAAQ;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA;AACxB,IAAA,MAAM,KAAA,GAAQ,IAAA,EAAM,KAAA,KAAU,SAAA,GAAY,KAAK,KAAA,GAAQ,MAAA;AACvD,IAAA,MAAM,YAAA,GACJ,MAAM,KAAA,KAAU,SAAA,GAAY,KAAK,YAAA,GAAe,UAAA,CAAW,IAAI,EAAE,CAAA;AAGnE,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO;AAAA,QACL,OAAA,CAAQ,aAAa,GAAA,EAAK,EAAE,OAAO,QAAA,EAAU,KAAA,EAAO,GAAA,CAAI,KAAA,EAAO,CAAA;AAAA,QAC/D;AAAC,OACH;AAAA,IACF;AACA,IAAA,OAAO,OAAA,CAAQ,aAAa,GAAA,EAAK,KAAA,EAAO,IAAI,KAAA,EAAO,GAAA,CAAI,IAAI,YAAY,CAAA;AAAA,EACzE;AA6BA,EAAA,SAAS,YAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACuD;AACvD,IAAA,OAAO,CAAC,OAAA,CAAQ,CAAA,EAAG,GAAA,EAAK,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA;AAAA,EACzD;AAgBA,EAAA,SAAS,OAAA,CACP,GACA,GAAA,EACuD;AACvD,IAAA,KAAA,MAAW,CAAC,KAAK,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,CAAA,CAAE,KAAK,CAAA,EAAG;AACjD,MAAA,IAAI,GAAA,CAAI,EAAA,KAAO,YAAA,CAAa,GAAG,CAAA,EAAG;AAChC,QAAA,IAAI,KAAK,KAAA,KAAU,eAAA,SAAwB,CAAC,CAAA,EAAG,EAAE,CAAA;AACjD,QAAA,OAAO,IAAA,CAAK,GAAG,GAAA,EAAK,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,EAAM,KAAK,YAAY,CAAA;AAAA,MAC7D;AACA,MAAA,IAAI,GAAA,CAAI,EAAA,KAAO,eAAA,CAAgB,GAAG,CAAA,EAAG;AAGnC,QAAA,IAAI,IAAA,CAAK,KAAA,KAAU,SAAA,IAAa,IAAA,CAAK,KAAA,KAAU,eAAA;AAC7C,UAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAMf,QAAA,OAAO;AAAA,UACL,OAAA,CAAQ,GAAG,GAAA,EAAK;AAAA,YACd,KAAA,EAAO,QAAA;AAAA,YACP,KAAA,EAAO;AAAA,cACL,IAAA,EAAM,mBAAA;AAAA,cACN,IAAI,GAAA,CAAI,EAAA;AAAA,cACR,MAAM,GAAA,CAAI;AAAA;AACZ,WACD,CAAA;AAAA,UACD;AAAC,SACH;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACf;AAWA,EAAA,SAAS,KAAK,CAAA,EAAiD;AAC7D,IAAA,MAAM,MAAqB,EAAC;AAC5B,IAAA,KAAA,MAAW,CAAC,KAAK,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,CAAA,CAAE,KAAK,CAAA,EAAG;AACjD,MAAA,IAAI,IAAA,CAAK,UAAU,eAAA,EAAiB;AAClC,QAAA,GAAA,CAAI,KAAK,WAAA,CAAY,YAAA,CAAa,GAAG,CAAA,EAAG,IAAA,CAAK,SAAS,CAAC,CAAA;AAAA,MACzD;AACA,MAAA,IACE,MAAA,CAAO,QAAA,KAAa,MAAA,KACnB,IAAA,CAAK,KAAA,KAAU,SAAA,IAAa,IAAA,CAAK,KAAA,KAAU,eAAA,CAAA,IAC5C,IAAA,CAAK,YAAA,GAAe,CAAA,EACpB;AACA,QAAA,GAAA,CAAI,KAAK,WAAA,CAAY,eAAA,CAAgB,GAAG,CAAA,EAAG,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAaA,EAAA,SAAS,SAAS,KAAA,EAA6B;AAC7C,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,YAAA;AAAA,QASb,CAAC,GAAA,KAAQ,KAAA,CAAM,IAAI,GAAA,CAAI,KAAA,EAAO,IAAI,GAAG,CAAA;AAAA,QACrC,CAAC,QAAQ,GAAA,MAAwB;AAAA,UAC/B,MAAM,OAAA,CAAQ,WAAA;AAAA,UACd,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAA;AAAA,UACA,EAAA,EAAI,KAAK,GAAA;AAAI,SACf,CAAA;AAAA,QACA,CAAC,OAAO,GAAA,MAAkB;AAAA,UACxB,MAAM,OAAA,CAAQ,YAAA;AAAA,UACd,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,KAAA;AAAA,UACA,EAAA,EAAI,KAAK,GAAA;AAAI,SACf;AAAA;AACF,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,YAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAYO,SAAS,cAAA,CAMd,KAAA,EACA,CAAC,KAAA,EAAO,IAAI,CAAA,EACgB;AAC5B,EAAA,OAAO,CAAC,EAAE,GAAG,OAAO,UAAA,EAAY,KAAA,IAAS,IAAI,CAAA;AAC/C","file":"chunk-EUF7XOEE.js","sourcesContent":["/**\n * @packageDocumentation\n *\n * @deprecated `@demlik/tea/resilient-call` is deprecated in favor of\n * `@demlik/tea/with-resilience` — the higher-order `withResilience(base,\n * config)` wrapper (TEA-idiomatic: it wraps any existing machine instead of\n * forcing a bespoke embedded slice; epic consolidation verdict, survivor\n * `with-resilience`). The APIs are NOT drop-in; migration map:\n *\n *   - `createResilientCall(config, rng)` + hand-wiring `init` / the verbs /\n *     `subs` / `handlers` into your machine → `withResilience(base, { target,\n *     ...bricks }, rng)`. Nothing is wired by hand anymore: the wrapper\n *     intercepts the `target` base Cmd and routes it through the gate.\n *   - `ResilientConfig` bricks (`retry` / `circuit` / `rateLimit` / `cache` /\n *     `deadline`) → unchanged; `ResilienceConfig` extends the same knob and\n *     adds `target` (required), `keyOf?` (per-call key — was `attempt`'s `key`\n *     argument), and `at?` (time-as-data reader — REQUIRED with any\n *     time-sensitive brick; `withResilience` throws at construction without it).\n *   - The slice at your chosen Model field + `liftResilience` → the wrapper\n *     owns `model.$resilience`; there is nothing to lift.\n *   - Verbs `attempt` / `succeed` / `fail` / `onTimer` → internal to the\n *     wrapper; results route as `$resilience:ok` / `$resilience:err` /\n *     `$resilience:timer` Msgs through the merged `update` (the old\n *     `resilient_run` / `resilient_ok` / `resilient_err` vocabulary is renamed\n *     into the `$resilience:` namespace).\n *   - `settleFailed` → NO equivalent. It exists for embedded-slice consumers\n *     (`authed-call`, `paginated-walk`) that settle a call without touching the\n *     breaker; the wrapper exposes no caller-facing settle verb.\n *   - `handlers(ports)` / `subs(state)` / the `subscribeDeadline` re-export →\n *     handled by the wrapper; run the returned machine like any other.\n *\n * Removal window (\"deprecate, don't delete\"): the `./resilient-call` subpath\n * export survives one minor release after this deprecation ships, then is\n * removed. Internal sibling modules (`with-resilience` itself, `agent`,\n * `llm-call`, `authed-call`, `reconciler`, `paginated-walk`) intentionally keep\n * importing `../resilient-call` — the deprecation targets the PUBLISHED export,\n * not the module's internal role.\n *\n * @demlik/tea/resilient-call — the ROOT composition: a single resilience knob\n * that bundles cache → circuit-breaker → rate-limit → exponential-backoff retry\n * (with a deadline-driven retry timer) around any fallible `(input) => Promise`\n * port.\n *\n * This is `examples/resilient-fetch.ts`'s hand-wired `attempt()` generalized:\n *\n *   - It is **keyed**. The example tracked one URL at a time; this tracks N\n *     concurrent logical calls, each under a string `key`. The cache, the\n *     waiting-retry bookkeeping, and the retry timers are all per-key, while the\n *     circuit breaker and token bucket are shared (one downstream target, one\n *     breaker / one bucket — the example's implicit single-target assumption\n *     made explicit).\n *   - It is **config-driven**, not hand-wired. You hand `createResilientCall`\n *     a `ResilientConfig` and get back the uniform knob contract every L2\n *     composition exposes: `init()`, the four verbs (`attempt` / `succeed` /\n *     `fail` / `onTimer`), `subs(state)`, and `handlers(ports)`.\n *   - Every brick is **optional**. Omit `cache` and the cache gate disappears\n *     (`get` is never consulted); omit `circuit` and every call passes the\n *     breaker; omit `rateLimit` and the bucket never throttles; omit `retry`\n *     and a failure is terminal (no backoff, no timer); omit `deadline` and no\n *     overall wall-clock cap is armed. \"Omit a brick → omit its gate\" is the\n *     whole config story — there are no other modes.\n *\n * Four later compositions (`llm-call`, `paginated-walk`, `authed-call`,\n * `reconciler`) inherit THIS slice + verb shape, so the contract here is\n * load-bearing: the slice is a flat record of brick states, every verb returns\n * `readonly [State, Cmd[]]`, time is always an `at` / `now` parameter, and the\n * RNG used for jitter is injected on the config (never read inside a verb).\n *\n * ## The two non-negotiables (canon)\n *\n *   - **Durable** — the slice is a plain-data Model field (brick states are all\n *     JSON-serializable), so it survives DO eviction / reload.\n *   - **Replayable** — every transition is a verb returning new state + Cmds;\n *     `replay` reconstructs it exactly. Nothing here closes over time or RNG.\n *\n * ## Where the clock / RNG live\n *\n * Inside the verbs: nowhere. Time arrives as `at` on `attempt` / `onTimer` and\n * is carried on the result / timer Msgs the consumer dispatches. Jitter RNG is\n * injected once at `createResilientCall(config, rng)` and threaded into\n * `nextDelayMs` at the verb boundary — deterministic in tests, `Math.random`\n * by default. The ONLY clock read is `Date.now()` inside the `handlers` port\n * (the effect boundary), exactly as `resilient-fetch.ts` stamps its result Msgs.\n *\n * That same `at` is what makes a DURATION-bounded retry budget reachable here:\n * `recordFailure` / `shouldRetry` are fed the failure's observation instant,\n * so `config.retry` accepts any `AnyRetryPolicy` — a count, a wall-clock outage\n * budget (`maxElapsedMs`), or explicit `unbounded: true` — with no new argument\n * on any verb and no clock read inside one.\n *\n * ## Typical wiring\n *\n *   const rc = createResilientCall<string, Result>({\n *     cache: { ttlMs: 60_000 },\n *     circuit: { threshold: 5, cooldownMs: 30_000 },\n *     rateLimit: { capacity: 10, refillPerSec: 5 },\n *     retry: defaultRetryPolicy,\n *     deadline: { ms: 5_000 },\n *   });\n *\n *   // in the machine:\n *   init: () => [{ resilience: rc.init() }, []],\n *   update: {\n *     fetch:   (s, m) => lift(s, rc.attempt(s.resilience, m.key, m.input, m.at)),\n *     call_ok: (s, m) => lift(s, rc.succeed(s.resilience, m.key, m)),\n *     call_err:(s, m) => lift(s, rc.fail(s.resilience, m.key, m)),\n *     retry_due:(s, m) => lift(s, rc.onTimer(s.resilience, m)),\n *   },\n *   subscriptions: (s) => rc.subs(s.resilience),\n *   subscribe: { deadline: subscribeDeadline },\n *   interpret: rc.handlers({ run: ctx.call }),\n */\n\nimport {\n  get as cacheGet,\n  set as cacheSet,\n  initCache,\n  type TtlCache,\n} from \"../cache\";\nimport {\n  type CircuitState,\n  canPass,\n  initCircuit,\n  onFailure,\n  onSuccess,\n} from \"../circuit-breaker\";\nimport {\n  type DeadlineExceeded,\n  type DeadlineSub,\n  deadlineSub,\n  subscribeDeadline,\n} from \"../deadline\";\nimport { type Cmd, type NoCtx, tryInterpret } from \"../index\";\nimport { MsgType } from \"../protocol\";\nimport { without } from \"../pure/core\";\nimport { initBucket, type TokenBucket, tryConsume } from \"../rate-limit\";\nimport {\n  type AnyRetryPolicy,\n  asRng,\n  initRetry,\n  nextDelayMs,\n  type RetryState,\n  recordFailure,\n  shouldRetry,\n} from \"../retry-backoff\";\n\n// ===========================================================================\n// Config — the knob. Every brick optional; omit a brick → omit its gate.\n// ===========================================================================\n\n/** Circuit-breaker knob — only the two numbers a consumer ever tunes. */\nexport interface CircuitConfig {\n  /** Consecutive failures that trip the breaker open. */\n  readonly threshold: number;\n  /** How long the breaker stays open before admitting a probe, in ms. */\n  readonly cooldownMs: number;\n  /**\n   * Probes admitted in `half_open` before fast-failing the rest of the round.\n   * Defaults to 1 (a single probe decides recovery) — matches the circuit-\n   * breaker module's `defaultCircuitPolicy`.\n   */\n  readonly halfOpenMaxProbes?: number;\n}\n\n/** Token-bucket rate-limit knob. */\nexport interface RateLimitConfig {\n  /** Burst size — the bucket starts full at `capacity`. */\n  readonly capacity: number;\n  /** Steady-state refill rate, tokens per second. */\n  readonly refillPerSec: number;\n}\n\n/** Per-entry TTL cache knob. */\nexport interface CacheConfig {\n  /** How long a cached success stays fresh, in ms. */\n  readonly ttlMs: number;\n}\n\n/** Overall wall-clock deadline knob — an absolute cap per in-flight call. */\nexport interface DeadlineConfig {\n  /** Budget from the moment a call starts, in ms. */\n  readonly ms: number;\n}\n\n/**\n * The resilience knob. EVERY field is optional: omit a brick and its gate is\n * skipped entirely (the slice still carries a default brick state so the shape\n * stays uniform across configs, but the gate is never consulted). An empty\n * config `{}` is a valid pass-through — a bare effect with no resilience at all.\n */\nexport interface ResilientConfig {\n  /**\n   * The backoff brick. Omit and a failure is terminal (no backoff, no timer).\n   *\n   * Any bound the `../retry-backoff` union admits: a count (`RetryPolicy`), a\n   * wall-clock outage budget (`DurationRetryPolicy`), or explicit\n   * `unbounded: true`. A duration bound needs no extra wiring: every path that\n   * records a failure already holds the instant it was observed as DATA —\n   * `fail`'s `msg.at` (stamped at the interpret boundary) and `gate`'s `at`\n   * (the caller's `attempt` / the retry timer's `atMs`) — so the streak clock\n   * is fed from a Msg, never from a `Date.now()` inside a verb (invariant 2).\n   */\n  readonly retry?: AnyRetryPolicy;\n  readonly circuit?: CircuitConfig;\n  readonly rateLimit?: RateLimitConfig;\n  readonly cache?: CacheConfig;\n  readonly deadline?: DeadlineConfig;\n}\n\n// ===========================================================================\n// Slice — the Model field this knob owns. A flat record of brick states.\n// ===========================================================================\n\n/**\n * Per-key call phase. `key` indexes a logical call; several can be in flight at\n * once (the generalization of the example's single `url`). Discriminated on\n * `phase` so each phase carries only its own data (pattern 11):\n *\n *   - `idle`          — never attempted, or fully settled and forgotten.\n *   - `running`       — the effect Cmd is out; awaiting `succeed` / `fail`.\n *                       Carries `deadlineAtMs` (absolute cap, `0` if no deadline\n *                       brick) and the last `input` so a retry can re-issue it.\n *   - `waiting_retry` — a transient failure backed off; the retry timer is armed\n *                       for `retryAtMs`. Carries `input` for the re-attempt.\n *   - `circuit_open`  — the breaker fast-failed this attempt. Terminal for this\n *                       call until the consumer re-attempts after cooldown.\n *   - `succeeded`     — settled OK. `result` is the value the port produced.\n *   - `failed`        — settled Err (out of retries, or no retry brick). `error`\n *                       carries the last failure.\n */\nexport type CallPhase<I, R> =\n  | { readonly phase: \"idle\" }\n  | {\n      readonly phase: \"running\";\n      readonly input: I;\n      readonly deadlineAtMs: number;\n    }\n  | {\n      readonly phase: \"waiting_retry\";\n      readonly input: I;\n      readonly retryAtMs: number;\n      readonly deadlineAtMs: number;\n    }\n  | { readonly phase: \"circuit_open\" }\n  | { readonly phase: \"succeeded\"; readonly result: R }\n  | { readonly phase: \"failed\"; readonly error: unknown };\n\n/**\n * The slice. `circuit` / `bucket` are SHARED across keys (one downstream target\n * → one breaker, one bucket). `retry` and `cache` are PER KEY (each logical call\n * has its own backoff count + cached result), as is the per-call `CallPhase`.\n * Every field is plain data → the whole slice serializes into a `Store<S>`.\n *\n * `retry` / `cache` keep a default brick value even when the corresponding\n * config brick is omitted, so the slice shape is identical regardless of which\n * bricks the consumer enabled — the verbs simply never consult the unused brick.\n */\nexport interface ResilientState<I, R> {\n  readonly circuit: CircuitState;\n  readonly bucket: TokenBucket;\n  /**\n   * Per-key backoff counter. Entries minted by `backoff` are `TimedRetryState`s\n   * (they carry the streak's `firstFailureAtMs`, since every failure path holds\n   * the observation instant); the field is typed at the `RetryState` supertype\n   * because a key that has never failed has no streak, and a slice persisted\n   * before the origin existed rehydrates without one. Still plain data.\n   */\n  readonly retry: Readonly<Record<string, RetryState>>;\n  readonly cache: TtlCache<R>;\n  readonly calls: Readonly<Record<string, CallPhase<I, R>>>;\n}\n\n// ===========================================================================\n// Cmds + Msgs the knob speaks. Generic over the port input `I`.\n// ===========================================================================\n\n/**\n * The one effect this knob emits: \"run the port for `key` with `input`\". The\n * consumer's `handlers(ports)` interprets it; it carries no closure — `input`\n * is plain data (invariant 3).\n */\nexport type RunCmd<I> = Cmd<typeof MsgType.ResilientRun> & {\n  readonly key: string;\n  readonly input: I;\n};\n\n/** Settle Msgs the `handlers` port dispatches back. `at` is stamped at the boundary. */\nexport type SucceedMsg<R> = {\n  readonly type: typeof MsgType.ResilientOk;\n  readonly key: string;\n  readonly result: R;\n  readonly at: number;\n};\nexport type FailMsg = {\n  readonly type: typeof MsgType.ResilientErr;\n  readonly key: string;\n  readonly error: unknown;\n  readonly at: number;\n};\n\n/** The retry / deadline timer Msg — `DeadlineExceeded`, keyed by the call `key`. */\nexport type ResilientTimerMsg = DeadlineExceeded;\n\n/**\n * The plain-data error a deadline-failed call settles with. A `{_tag, ...}`\n * sentinel — NEVER a `new Error(...)` — so the slice stays JSON-serializable\n * (Error objects round-trip to `{}` and carry a stack trace, both of which break\n * the slice's durability invariant). `id` / `atMs` echo the timer that fired so\n * a consumer can attribute the failure to its deadline.\n */\nexport type DeadlineExceededError = {\n  readonly _tag: \"deadline_exceeded\";\n  readonly id: string;\n  readonly atMs: number;\n};\n\n/** Ports the consumer supplies to `handlers`. */\nexport interface ResilientPorts<I, R> {\n  /** The fallible work this knob wraps. Throws on failure → routed to `fail`. */\n  readonly run: (input: I, key: string) => Promise<R>;\n}\n\n// ===========================================================================\n// Internal brick-policy derivation — config → the L1 policy shapes.\n// ===========================================================================\n\n// A circuit policy is only built when the brick is configured; absence is\n// represented as `null` so the gate can short-circuit to \"always pass\".\nfunction circuitPolicy(config: ResilientConfig) {\n  if (config.circuit === undefined) return null;\n  return {\n    failureThreshold: config.circuit.threshold,\n    cooldownMs: config.circuit.cooldownMs,\n    halfOpenMaxProbes: config.circuit.halfOpenMaxProbes ?? 1,\n  };\n}\n\n// Sub-id families. Each call's retry timer is a deadline keyed by `key`, so a\n// machine running many concurrent calls reconciles each independently.\nfunction retryTimerId(key: string): string {\n  return `resilient:retry:${key}`;\n}\nfunction deadlineTimerId(key: string): string {\n  return `resilient:deadline:${key}`;\n}\n\n// ===========================================================================\n// The knob factory.\n// ===========================================================================\n\n/**\n * Build a resilient-call knob from `config`. `rng` is injected for retry\n * jitter — pass a fixed `() => 0.5` in tests to pin backoff; defaults to\n * `Math.random` (read at the verb boundary, never inside a brick op). It is\n * curried onto the factory rather than threaded through every verb so callers\n * spell the determinism choice once.\n *\n * Returns the uniform L2 knob contract. `I` is the port input type, `R` the\n * port result type.\n *\n * @deprecated Use `withResilience` from `@demlik/tea/with-resilience` — not\n * drop-in; see the migration map at the top of this module.\n */\nexport function createResilientCall<I, R>(\n  config: ResilientConfig,\n  rng: () => number = Math.random,\n) {\n  const cPolicy = circuitPolicy(config);\n  // Re-affirm the `[0, 1)` contract at the seam where the injected generator\n  // feeds the backoff math (brand from `../retry-backoff`). The factory's\n  // public param stays a plain `() => number` so transitive callers are\n  // unchanged; `asRng` is the single point it's branded for `nextDelayMs`.\n  const rngBranded = asRng(rng);\n\n  /** The starting slice. Bricks not in `config` still get a default value. */\n  function init(): ResilientState<I, R> {\n    return {\n      circuit: initCircuit(),\n      // The bucket carries a default value even without the rateLimit brick so\n      // the slice shape is uniform, but the rate-limit GATE is skipped entirely\n      // when the brick is absent (see `gate`) — the bucket is simply never\n      // consulted. A `0/0` placeholder bucket would be touched by `tryConsume`;\n      // a `1-cap` default is harmless because the gate never calls it.\n      bucket: config.rateLimit\n        ? initBucket(\n            config.rateLimit.capacity,\n            config.rateLimit.refillPerSec,\n            0,\n          )\n        : initBucket(1, 1, 0),\n      retry: {},\n      cache: initCache<R>(),\n      calls: {},\n    };\n  }\n\n  /** Read this key's retry state, defaulting to a fresh one. */\n  function retryOf(s: ResilientState<I, R>, key: string): RetryState {\n    return s.retry[key] ?? initRetry();\n  }\n\n  /** Compute the absolute deadline for a call starting at `at` (0 = no cap). */\n  function deadlineAt(at: number): number {\n    return config.deadline ? at + config.deadline.ms : 0;\n  }\n\n  /**\n   * The shared decision: cache → rate-limit → circuit gate, then either emit\n   * the effect or schedule a retry. `deadlineAtMs` is threaded so a re-attempt\n   * (from `onTimer`) keeps the ORIGINAL overall deadline rather than restarting\n   * it. PURE — `at` is the only clock; `rng` is the injected jitter source.\n   *\n   * Used by both `attempt` (fresh call) and `onTimer` (retry timer fired) so\n   * the gate logic lives in exactly one place — the example's shared `attempt`\n   * helper, lifted to a keyed knob.\n   *\n   * ## Why rate-limit is gated BEFORE the circuit probe\n   *\n   * The circuit-breaker's `canPass` is not a passive read: in `half_open` it\n   * *consumes* a probe slot (advancing `probes`), and the consumed slot is only\n   * released when a probe RESOLVES via `onSuccess` / `onFailure`. So a probe\n   * slot may only be taken when this attempt is actually going to reach the\n   * backend (i.e. emit the `resilient_run` Cmd). The rate-limit gate can reject\n   * an attempt and return a backoff WITHOUT any Cmd — no backend call, so no\n   * settle Msg ever comes back. If the circuit probe were consumed first, that\n   * rate-limited attempt would burn the half-open probe budget on a call that\n   * never happened, wedging the breaker `half_open` at its probe cap forever\n   * (nothing moves it out of `half_open` but a resolved probe). Running the\n   * rate-limit gate first means the circuit probe is consumed ONLY on the path\n   * that emits the effect.\n   */\n  function gate(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    at: number,\n    deadlineAtMs: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    // 1) Serve from cache if fresh — no effect at all. Skipped when no cache brick.\n    if (config.cache !== undefined) {\n      const cached = cacheGet(s.cache, key, at);\n      if (cached !== undefined) {\n        return [setCall(s, key, { phase: \"succeeded\", result: cached }), []];\n      }\n    }\n\n    // 2) Rate-limit gate FIRST — it may reject with no Cmd, so it must run\n    // before any circuit probe is consumed (see header note). Skipped entirely\n    // when no rateLimit brick — the bucket is never consulted, so the default\n    // placeholder bucket stays untouched.\n    let bucket = s.bucket;\n    if (config.rateLimit !== undefined) {\n      const [next, hasToken] = tryConsume(bucket, at);\n      bucket = next;\n      if (!hasToken) {\n        // Rate-limited: treat as a transient failure and back off via retry.\n        // The circuit is untouched — no probe is spent on a call that never ran.\n        return backoff(\n          { ...s, bucket },\n          key,\n          input,\n          \"rate_limited\",\n          at,\n          deadlineAtMs,\n        );\n      }\n    }\n\n    // 3) Circuit-breaker gate. `null` policy → no breaker → always pass. Reached\n    // only once a token is secured, so a half-open probe is consumed exclusively\n    // on the path that emits the effect below.\n    let circuit = s.circuit;\n    if (cPolicy !== null) {\n      const [next, ok] = canPass(circuit, cPolicy, at);\n      circuit = next;\n      if (!ok) {\n        return [\n          { ...setCall(s, key, { phase: \"circuit_open\" }), bucket, circuit },\n          [],\n        ];\n      }\n    }\n\n    // 4) All gates passed — emit the effect as data.\n    return [\n      {\n        ...setCall(s, key, { phase: \"running\", input, deadlineAtMs }),\n        circuit,\n        bucket,\n      },\n      [{ type: MsgType.ResilientRun, key, input }],\n    ];\n  }\n\n  /**\n   * Back off after a transient failure: record it, and if `retry` permits\n   * another attempt, enter `waiting_retry` with the retry timer armed; else\n   * settle `failed`. When no `retry` brick is configured the call fails on the\n   * first failure (no backoff, no timer). PURE.\n   *\n   * `at` is both the backoff anchor AND the streak clock: it is passed to\n   * `recordFailure` (which starts `firstFailureAtMs` on the streak's first\n   * failure and preserves it on every later one) and to `shouldRetry`, so a\n   * `DurationRetryPolicy` on `config.retry` is honoured with no extra wiring.\n   * A success drops `retry[key]` entirely, which drops the origin with it —\n   * only an unbroken run of failures grows toward a duration budget.\n   */\n  function backoff(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    error: unknown,\n    at: number,\n    deadlineAtMs: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    if (config.retry === undefined) {\n      return [setCall(s, key, { phase: \"failed\", error }), []];\n    }\n    const retry = recordFailure(retryOf(s, key), error, at);\n    const withRetry = { ...s, retry: { ...s.retry, [key]: retry } };\n    if (!shouldRetry(retry, config.retry, at)) {\n      return [setCall(withRetry, key, { phase: \"failed\", error }), []];\n    }\n    const retryAtMs = at + nextDelayMs(retry, config.retry, rngBranded);\n    return [\n      setCall(withRetry, key, {\n        phase: \"waiting_retry\",\n        input,\n        retryAtMs,\n        deadlineAtMs,\n      }),\n      [],\n    ];\n  }\n\n  // Set the phase for one key, leaving every other field untouched.\n  function setCall(\n    s: ResilientState<I, R>,\n    key: string,\n    phase: CallPhase<I, R>,\n  ): ResilientState<I, R> {\n    return { ...s, calls: { ...s.calls, [key]: phase } };\n  }\n\n  // === Verb: attempt =======================================================\n\n  /**\n   * Start (or restart) the call for `key` with `input` at time `at`. Runs the\n   * cache → circuit → rate-limit gate and either emits the `resilient_run`\n   * effect, schedules a retry, fast-fails (circuit open), or serves the cache.\n   * PURE.\n   */\n  function attempt(\n    s: ResilientState<I, R>,\n    key: string,\n    input: I,\n    at: number,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    return gate(s, key, input, at, deadlineAt(at));\n  }\n\n  // === Verb: succeed =======================================================\n\n  /**\n   * Record a success for `key`: close the breaker, fill the cache (if a cache\n   * brick exists), reset this key's retry count, and settle `succeeded`. PURE —\n   * `msg.at` is the cache write clock.\n   */\n  function succeed(\n    s: ResilientState<I, R>,\n    key: string,\n    msg: SucceedMsg<R>,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    const circuit =\n      cPolicy !== null ? onSuccess(s.circuit, cPolicy) : s.circuit;\n    const cache =\n      config.cache !== undefined\n        ? cacheSet(s.cache, key, msg.result, msg.at, config.cache.ttlMs)\n        : s.cache;\n    // Drop this key's retry counter — a success ends the retry run.\n    const retry = without(s.retry, key);\n    return [\n      {\n        ...setCall(s, key, { phase: \"succeeded\", result: msg.result }),\n        circuit,\n        cache,\n        retry,\n      },\n      [],\n    ];\n  }\n\n  // === Verb: fail ==========================================================\n\n  /**\n   * Record a failure for `key`: trip the breaker (it may open), then back off —\n   * schedule a retry if `retry` permits, else settle `failed`. PURE — `msg.at`\n   * stamps the breaker trip + the retry delay base. Re-issues from the call's\n   * remembered `input` and preserves the original overall `deadlineAtMs`.\n   */\n  function fail(\n    s: ResilientState<I, R>,\n    key: string,\n    msg: FailMsg,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    const circuit =\n      cPolicy !== null ? onFailure(s.circuit, cPolicy, msg.at) : s.circuit;\n    const withCircuit = { ...s, circuit };\n    const call = s.calls[key];\n    const input = call?.phase === \"running\" ? call.input : undefined;\n    const deadlineAtMs =\n      call?.phase === \"running\" ? call.deadlineAtMs : deadlineAt(msg.at);\n    // No remembered input (e.g. a stray fail for a key not running) → just\n    // settle failed after tripping the breaker; nothing to re-issue.\n    if (input === undefined) {\n      return [\n        setCall(withCircuit, key, { phase: \"failed\", error: msg.error }),\n        [],\n      ];\n    }\n    return backoff(withCircuit, key, input, msg.error, msg.at, deadlineAtMs);\n  }\n\n  // === Verb: settleFailed ==================================================\n\n  /**\n   * Settle `key` to terminal `failed` with `error` WITHOUT touching the circuit\n   * breaker or this key's retry counter. PURE.\n   *\n   * This is the verb for a failure that is NOT a downstream-health signal: the\n   * call must end now, but the breaker must not trip and the backoff run must\n   * not advance. `fail` is the opposite — it records the failure against the\n   * breaker (it may open) and feeds the retry policy (it may back off). Use\n   * `settleFailed` when the *reason* the call cannot proceed has nothing to do\n   * with downstream health:\n   *\n   *   - `authed-call` settles a 401 it cannot fix (e.g. the refresh budget is\n   *     spent): a bad token is the caller's problem, not the backend's —\n   *     tripping the breaker on it would punish a healthy target, and backing\n   *     off would just retry a request that will 401 again.\n   *   - `paginated-walk` settles a terminal walk error (e.g. a malformed page\n   *     the consumer rejects) that should stop the walk without poisoning the\n   *     shared breaker the next page fetch passes through.\n   *\n   * Because it leaves `circuit` and `retry[key]` untouched, the breaker keeps\n   * its health view of the actual backend and a later `attempt` for this key\n   * starts a fresh retry run. Both sibling knobs previously hand-rolled this by\n   * splicing `calls` directly; this verb gives them one named, tested entry\n   * point so the slice's settle invariants live in exactly one place.\n   */\n  function settleFailed(\n    s: ResilientState<I, R>,\n    key: string,\n    error: unknown,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    return [setCall(s, key, { phase: \"failed\", error }), []];\n  }\n\n  // === Verb: onTimer =======================================================\n\n  /**\n   * A timer fired for some key. Two kinds, disambiguated by the Sub id:\n   *\n   *   - retry timer    → re-run the gate for that key's remembered input,\n   *                      re-checking the circuit + bucket at THIS time.\n   *   - deadline timer → the overall budget elapsed → settle `failed` with a\n   *                      deadline error, no matter the current phase.\n   *\n   * A timer for a key no longer `waiting_retry` (retry) / no longer in flight\n   * (deadline) is a no-op — the reconcile pass races the result; the verb must\n   * tolerate a stale fire. PURE.\n   */\n  function onTimer(\n    s: ResilientState<I, R>,\n    msg: ResilientTimerMsg,\n  ): readonly [ResilientState<I, R>, readonly RunCmd<I>[]] {\n    for (const [key, call] of Object.entries(s.calls)) {\n      if (msg.id === retryTimerId(key)) {\n        if (call.phase !== \"waiting_retry\") return [s, []];\n        return gate(s, key, call.input, msg.atMs, call.deadlineAtMs);\n      }\n      if (msg.id === deadlineTimerId(key)) {\n        // Deadline only fires for a still-active call. A settled call has no\n        // armed deadline Sub, but tolerate a stale fire defensively.\n        if (call.phase !== \"running\" && call.phase !== \"waiting_retry\")\n          return [s, []];\n        // Plain-data sentinel, NOT a `new Error(...)`: an Error object is not\n        // JSON-serializable (it round-trips to `{}`) and captures a stack trace,\n        // both of which break the slice's durability invariant once it is\n        // persisted into a `Store<S>` and reloaded. A `{_tag, ...}` record keeps\n        // the slice round-trip-equal under JSON.parse(JSON.stringify(...)).\n        return [\n          setCall(s, key, {\n            phase: \"failed\",\n            error: {\n              _tag: \"deadline_exceeded\",\n              id: msg.id,\n              atMs: msg.atMs,\n            } satisfies DeadlineExceededError,\n          }),\n          [],\n        ];\n      }\n    }\n    return [s, []];\n  }\n\n  // === Subs ================================================================\n\n  /**\n   * Pre-wired subscriptions: a retry timer for every `waiting_retry` call, and\n   * (when the `deadline` brick is configured) an overall deadline timer for\n   * every still-active call. Both are `DeadlineSub`s reconciled by id, so a\n   * phase change cancels the matching timer automatically — no manual\n   * `clearTimeout`. Wire `subscribe: { deadline: subscribeDeadline }`.\n   */\n  function subs(s: ResilientState<I, R>): readonly DeadlineSub[] {\n    const out: DeadlineSub[] = [];\n    for (const [key, call] of Object.entries(s.calls)) {\n      if (call.phase === \"waiting_retry\") {\n        out.push(deadlineSub(retryTimerId(key), call.retryAtMs));\n      }\n      if (\n        config.deadline !== undefined &&\n        (call.phase === \"running\" || call.phase === \"waiting_retry\") &&\n        call.deadlineAtMs > 0\n      ) {\n        out.push(deadlineSub(deadlineTimerId(key), call.deadlineAtMs));\n      }\n    }\n    return out;\n  }\n\n  // === Handlers ============================================================\n\n  /**\n   * Pre-wired interpret handler for `resilient_run`. Wraps the consumer's\n   * `run` port via `tryInterpret` (Railway): success → `resilient_ok`, failure\n   * → `resilient_err`, each stamped with `Date.now()` at the effect boundary —\n   * the ONE permitted clock read (interpret is impure; the reducer never reads\n   * the clock). Assign to the machine's `interpret`:\n   *\n   *   interpret: rc.handlers({ run: (input, key) => ctx.callBackend(input) })\n   */\n  function handlers(ports: ResilientPorts<I, R>) {\n    return {\n      resilient_run: tryInterpret<\n        RunCmd<I>,\n        R,\n        SucceedMsg<R> | FailMsg,\n        // The work fn reads nothing from ctx — it forwards `cmd.input` to the\n        // consumer-supplied `run` port. `NoCtx` (not `unknown`) marks this as a\n        // DELIBERATE context-free seam, so callers see intent, not looseness.\n        NoCtx\n      >(\n        (cmd) => ports.run(cmd.input, cmd.key),\n        (result, cmd): SucceedMsg<R> => ({\n          type: MsgType.ResilientOk,\n          key: cmd.key,\n          result,\n          at: Date.now(),\n        }),\n        (error, cmd): FailMsg => ({\n          type: MsgType.ResilientErr,\n          key: cmd.key,\n          error,\n          at: Date.now(),\n        }),\n      ),\n    };\n  }\n\n  return {\n    init,\n    attempt,\n    succeed,\n    fail,\n    settleFailed,\n    onTimer,\n    subs,\n    handlers,\n  };\n}\n\n/**\n * Lift a knob result `[slice, cmds]` into a host `[State, cmds]` where the\n * slice lives at `state.resilience`. A convenience for the common single-slice\n * host; consumers with a differently-named field spread by hand. Pure — a thin\n * record rebuild, no clock / RNG.\n *\n * @deprecated Use `withResilience` from `@demlik/tea/with-resilience` — the\n * wrapper owns `model.$resilience`, so there is nothing to lift; see the\n * migration map at the top of this module.\n */\nexport function liftResilience<\n  S extends { resilience: ResilientState<I, R> },\n  I,\n  R,\n  C extends Cmd,\n>(\n  state: S,\n  [slice, cmds]: readonly [ResilientState<I, R>, readonly C[]],\n): readonly [S, readonly C[]] {\n  return [{ ...state, resilience: slice }, cmds];\n}\n\n/**\n * Re-export the deadline Sub primitives so consumers (and tests) wire one\n * import: `subscribeDeadline` is the `subscribe` cell, `deadlineSub` builds the\n * Sub literal this knob's `subs` emits.\n */\nexport { subscribeDeadline, deadlineSub };\nexport type { DeadlineSub, DeadlineExceeded };\n"]}

package/dist/{chunk-XOAP3LOT.js → chunk-I5OV65MS.js}

@@ -1,5 +1,5 @@
 import { initPaginator, start, recordPage, drain, resume, isDone } from './chunk-SINXE47Y.js';
-import { createResilientCall } from './chunk-EC6FO42Q.js';
+import { createResilientCall } from './chunk-EUF7XOEE.js';
 import { MsgType } from './chunk-JELSZN25.js';
 
 // src/paginated-walk/index.ts
@@ -126,5 +126,5 @@ function liftWalk(state, [slice, cmds]) {
 }
 
 export { PAGE_KEY, createPaginatedWalk, liftWalk };
-//# sourceMappingURL=chunk-XOAP3LOT.js.map
-//# sourceMappingURL=chunk-XOAP3LOT.js.map
+//# sourceMappingURL=chunk-I5OV65MS.js.map
+//# sourceMappingURL=chunk-I5OV65MS.js.map

package/dist/{chunk-XOAP3LOT.js.map → chunk-I5OV65MS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/paginated-walk/index.ts"],"names":["start","drain","resume"],"mappings":";;;;;AAiPO,IAAM,QAAA,GAAW;AAiBjB,SAAS,mBAAA,CACd,MAAA,EACA,GAAA,GAAoB,IAAA,CAAK,MAAA,EACzB;AAGA,EAAA,MAAM,EAAA,GAAK,mBAAA;AAAA,IACT;AAAA,MACE,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,UAAU,MAAA,CAAO;AAAA,KACnB;AAAA,IACA;AAAA,GACF;AAIA,EAAA,MAAM,eAAA,GAA2C;AAAA,IAC/C,aAAa,MAAA,CAAO,SAAA;AAAA,IACpB,aAAA,EAAe,OAAO,aAAA,IAAiB;AAAA,GACzC;AAOA,EAAA,SAAS,cAAA,CACP,GACA,UAAA,EACkC;AAClC,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,UAAA,EAAW;AAAA,EAC5B;AAGA,EAAA,SAAS,IAAA,GAAyC;AAChD,IAAA,OAAO;AAAA,MACL,MAAM,aAAA,EAAsB;AAAA,MAC5B,UAAA,EAAY,GAAG,IAAA;AAAK,KACtB;AAAA,EACF;AASA,EAAA,SAAS,KAAA,CACP,CAAA,EACA,MAAA,EACA,EAAA,EAIA;AACA,IAAA,MAAM,CAAC,UAAA,EAAY,IAAI,CAAA,GAAI,EAAA,CAAG,QAAQ,CAAA,CAAE,UAAA,EAAY,QAAA,EAAU,MAAA,EAAQ,EAAE,CAAA;AACxE,IAAA,OAAO,CAAC,cAAA,CAAe,CAAA,EAAG,UAAU,GAAG,IAAI,CAAA;AAAA,EAC7C;AAiBA,EAAA,SAAS,WAAA,CACP,CAAA,EACA,IAAA,EACA,EAAA,EACgE;AAChE,IAAA,IAAI,IAAA,KAAS,CAAA,CAAE,IAAA,IAAQ,IAAA,CAAK,UAAU,UAAA,EAAY;AAChD,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,OAAO,KAAA,CAAM,EAAE,GAAG,CAAA,EAAG,MAAK,EAAG,IAAA,CAAK,QAAQ,EAAE,CAAA;AAAA,EAC9C;AAWA,EAAA,SAASA,MAAAA,CACP,GACA,EAAA,EACgE;AAGhE,IAAA,OAAO,YAAY,CAAA,EAAG,KAAA,CAAU,EAAE,IAAA,EAAM,eAAe,GAAG,EAAE,CAAA;AAAA,EAC9D;AAwBA,EAAA,SAAS,MAAA,CACP,CAAA,EACA,IAAA,EACA,EAAA,EACgE;AAEhE,IAAA,MAAM,CAAC,UAAU,CAAA,GAAI,GAAG,OAAA,CAAQ,CAAA,CAAE,YAAY,QAAA,EAAU;AAAA,MACtD,MAAM,OAAA,CAAQ,WAAA;AAAA,MACd,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,IAAA;AAAA,MACR;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,QAAQ,MAAA,CAAO,QAAA,GAAW,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,GAAI,CAAA;AACxD,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,UAAA,CAAW,IAAI,CAAA;AACnC,IAAA,MAAM,OAAO,UAAA,CAAW,CAAA,CAAE,IAAA,EAAM,KAAA,EAAO,MAAM,eAAe,CAAA;AAE5D,IAAA,MAAM,QAAA,GAA6C,EAAE,IAAA,EAAM,UAAA,EAAW;AAGtE,IAAA,MAAM,QAAA,GAAkC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAG1D,IAAA,IAAI,IAAA,CAAK,UAAU,UAAA,EAAY;AAC7B,MAAA,MAAM,CAAC,WAAW,SAAS,CAAA,GAAI,MAAM,QAAA,EAAU,IAAA,CAAK,QAAQ,EAAE,CAAA;AAC9D,MAAA,OAAO,CAAC,SAAA,EAAW,CAAC,GAAG,QAAA,EAAU,GAAG,SAAS,CAAC,CAAA;AAAA,IAChD;AAGA,IAAA,OAAO,CAAC,UAAU,QAAQ,CAAA;AAAA,EAC5B;AA2BA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,KAAA,EACA,EAAA,EACgE;AAIhE,IAAA,IAAI,CAAA,CAAE,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AAC/B,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,MAAM,CAAC,YAAY,IAAI,CAAA,GAAI,GAAG,IAAA,CAAK,CAAA,CAAE,YAAY,QAAA,EAAU;AAAA,MACzD,MAAM,OAAA,CAAQ,YAAA;AAAA,MACd,GAAA,EAAK,QAAA;AAAA,MACL,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,CAAC,cAAA,CAAe,CAAA,EAAG,UAAU,GAAG,IAAI,CAAA;AAAA,EAC7C;AAmBA,EAAA,SAAS,OAAA,CACP,GACA,GAAA,EACgE;AAChE,IAAA,IAAI,CAAA,CAAE,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AAC/B,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,MAAM,CAAC,YAAY,IAAI,CAAA,GAAI,GAAG,OAAA,CAAQ,CAAA,CAAE,YAAY,GAAG,CAAA;AACvD,IAAA,IAAI,UAAA,KAAe,EAAE,UAAA,EAAY;AAE/B,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,OAAO,CAAC,cAAA,CAAe,CAAA,EAAG,UAAU,GAAG,IAAI,CAAA;AAAA,EAC7C;AAgBA,EAAA,SAASC,MAAAA,CACP,GACA,CAAA,EACgE;AAChE,IAAA,MAAM,IAAA,GAAO,KAAA,CAAU,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAChC,IAAA,IAAI,IAAA,KAAS,EAAE,IAAA,EAAM;AAEnB,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,OAAO,CAAC,EAAE,GAAG,GAAG,IAAA,EAAK,EAAG,EAAE,CAAA;AAAA,EAC5B;AAoBA,EAAA,SAASC,OAAAA,CACP,GACA,EAAA,EACgE;AAIhE,IAAA,OAAO,YAAY,CAAA,EAAG,MAAA,CAAW,EAAE,IAAA,EAAM,eAAe,GAAG,EAAE,CAAA;AAAA,EAC/D;AAUA,EAAA,SAAS,WAAW,CAAA,EAA8C;AAChE,IAAA,OAAO,MAAA,CAAO,EAAE,IAAI,CAAA;AAAA,EACtB;AAaA,EAAA,SAAS,QAAQ,CAAA,EAA8C;AAC7D,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,UAAA,CAAW,KAAA,CAAM,QAAQ,CAAA;AACxC,IAAA,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,GAAW,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjD;AAcA,EAAA,SAAS,QAAQ,CAAA,EAA8C;AAC7D,IAAA,OAAO,CAAA,CAAE,UAAA,CAAW,KAAA,CAAM,QAAQ,CAAA,EAAG,UAAU,QAAA,IAAY,CAAC,MAAA,CAAO,CAAA,CAAE,IAAI,CAAA;AAAA,EAC3E;AAWA,EAAA,SAAS,KAAK,CAAA,EAA6D;AACzE,IAAA,OAAO,EAAA,CAAG,IAAA,CAAK,CAAA,CAAE,UAAU,CAAA;AAAA,EAC7B;AAgBA,EAAA,SAAS,SAAS,KAAA,EAAyC;AACzD,IAAA,OAAO,EAAA,CAAG,SAAS,KAAK,CAAA;AAAA,EAC1B;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,KAAA,EAAAF,MAAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA,EAAAC,MAAAA;AAAA,IACA,MAAA,EAAAC,OAAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAQO,SAAS,QAAA,CAMd,KAAA,EACA,CAAC,KAAA,EAAO,IAAI,CAAA,EACgB;AAC5B,EAAA,OAAO,CAAC,EAAE,GAAG,OAAO,IAAA,EAAM,KAAA,IAAS,IAAI,CAAA;AACzC","file":"chunk-XOAP3LOT.js","sourcesContent":["/**\n * @demlik/tea/paginated-walk — traverse a paginated API / sitemap end to end\n * WITHOUT a fake clock, without 429s, and resumable across a Durable-Object\n * eviction. The L2 composition that bolts `../resilient-call`'s resilience onto\n * `../paginator`'s cursor walk: each page is fetched as ONE keyed resilient\n * call (retry + backoff + rate-limit gate), and the cursor advances only once a\n * page settles `ok`.\n *\n * ## The recipe (the two siblings it composes)\n *\n *   - **`../paginator`** owns the walk loop: the opaque `Cursor`, the `seen` /\n *     `pages` counters, and the `idle → fetching → … → done` phase machine.\n *     `paginated-walk` never re-implements cursor advancement — it folds each\n *     settled page through `recordPage`, letting the paginator decide\n *     `done` / `fetching(next)` / `paused`. Backpressure is a TWO-way valve:\n *     `recordPage` parks the walk in `paused` once `seen >= highWaterMark`, and\n *     the `drain` / `resume` verbs (delegating to the paginator's own\n *     `drain` / `resume`) lower the gauge and re-open the parked fetch — without\n *     them `highWaterMark` would be a one-way valve that strands a paused walk.\n *   - **`../resilient-call`** owns the page fetch: the single `resilient_run`\n *     effect per page is gated through that knob's cache → circuit → rate-limit\n *     → retry pipeline. A transient page failure backs off and re-issues the\n *     SAME cursor (idempotent retry); the walk does not advance until the page\n *     genuinely settles.\n *\n * Those are the only two siblings this module calls into. The resilience knobs\n * (`retry` / `circuit` / `rateLimit` / `deadline`) are NOT separate bricks\n * `paginated-walk` composes — they belong to `resilient-call`, which owns the\n * rate-limit gate internally. This module merely passes them through to\n * `createResilientCall` and re-uses two config TYPES at the boundary:\n * `RateLimitConfig` (re-exported by `resilient-call`) and `RetryPolicy` (from\n * `../retry-backoff`). Pass a `rateLimit` and `resilient-call`'s token bucket\n * throttles page fetches (\"don't 429 the upstream\"); omit it and the walk runs\n * as fast as the upstream answers.\n *\n * Because the page-fetch resilience IS a `resilient-call` slice, this knob\n * **inherits that knob's contract verbatim**: the slice is a flat record, every\n * verb returns `readonly [State, Cmd[]]`, time is always an `at` parameter, and\n * the jitter RNG is injected once at `createPaginatedWalk(config, rng)` — never\n * read inside a verb (per the spec, `paginated-walk` *extends* `resilient-call`).\n *\n * ## The two non-negotiables (canon)\n *\n *   - **Durable** — the slice is plain data: the paginator phase + counters, and\n *     the resilient-call brick states (all JSON-serializable). The cursor lives\n *     in the Model, not a closure, so a walk survives eviction mid-traversal and\n *     resumes from the exact page it was fetching.\n *   - **Replayable** — every transition is a verb returning new state + Cmds.\n *     `nextCursor` / `onPage` are pure config functions applied at the verb\n *     boundary; the Cmds they yield are plain data. `replay` reconstructs the\n *     whole walk exactly.\n *\n * ## Where the clock / RNG live\n *\n * Inside the verbs: nowhere. `at` arrives on `start` / `pageOk` / `pageErr` /\n * `onTimer` and is threaded straight into the underlying resilient-call gate (so\n * a rate-limited or retried page measures backoff from that `at`). The jitter\n * RNG is injected at construction. The only clock read is `Date.now()` inside\n * the resilient-call `handlers` port (the effect boundary), inherited unchanged.\n *\n * ## The fixed fetch key\n *\n * A walk fetches one page at a time, so the resilient-call layer tracks exactly\n * one logical call under the constant key `PAGE_KEY`. The cursor being fetched\n * is the resilient call's `input`, so a post-eviction resume re-issues the same\n * page request. (`resilient-call` is keyed to support N concurrent calls; a walk\n * deliberately uses a single key — the paginator is the sequencer.)\n *\n * ## Typical wiring\n *\n *   const walk = createPaginatedWalk<PageToken, ApiPage>({\n *     firstPage: null,                          // the API's \"page one\" sentinel\n *     nextCursor: (page) => page.nextToken ?? null,\n *     onPage: (page) => [{ type: \"index_rows\", rows: page.items }],\n *     rateLimit: { capacity: 10, refillPerSec: 5 },\n *     retry: defaultRetryPolicy,\n *   });\n *\n *   // in the machine:\n *   init: () => [{ walk: walk.init() }, []],\n *   update: {\n *     start:    (s, m)  => lift(s, walk.start(s.walk, m.at)),\n *     page_ok:  (s, m)  => lift(s, walk.pageOk(s.walk, m.result, m.at)),\n *     page_err: (s, m)  => lift(s, walk.pageErr(s.walk, m.error, m.at)),\n *     retry_due:(s, m)  => lift(s, walk.onTimer(s.walk, m)),\n *     drained:  (s, m)  => lift(s, walk.drain(s.walk, m.n)),\n *     resume:   (s, m)  => lift(s, walk.resume(s.walk, m.at)),\n *   },\n *   subscriptions: (s) => walk.subs(s.walk),\n *   subscribe: { deadline: subscribeDeadline },\n *   interpret: walk.handlers({ run: (cursor) => api.fetchPage(cursor) }),\n */\n\nimport type { Cmd } from \"../index\";\nimport {\n  drain as drainWalk,\n  initPaginator,\n  isDone,\n  type PaginatorPolicy,\n  type PaginatorState,\n  recordPage,\n  resume as resumeWalk,\n  start as startWalk,\n} from \"../paginator\";\nimport { MsgType } from \"../protocol\";\nimport {\n  type CircuitConfig,\n  createResilientCall,\n  type DeadlineConfig,\n  type DeadlineSub,\n  deadlineSub,\n  type FailMsg,\n  type RateLimitConfig,\n  type ResilientPorts,\n  type ResilientState,\n  type ResilientTimerMsg,\n  type RunCmd,\n  type SucceedMsg,\n  subscribeDeadline,\n} from \"../resilient-call\";\nimport type { RetryPolicy } from \"../retry-backoff\";\n\n// ===========================================================================\n// Config — the knob. `firstPage` / `nextCursor` / `onPage` describe the walk;\n// the resilience bricks are inherited from resilient-call (every one optional —\n// omit a brick, omit its gate).\n// ===========================================================================\n\n/**\n * The paginated-walk knob. Generic in `Cursor` (the opaque page handle the\n * upstream API hands back — offset, page token, \"next\" URL, …) and `Page` (the\n * shape your fetch port resolves with).\n *\n * `nextCursor` and `onPage` are PURE config functions applied at the verb\n * boundary, never stored in the slice or in a Cmd (invariant 3 — Cmds are\n * plain data, not closures). `nextCursor(page)` extracts the API's next-page\n * handle (or `null` at the end); `onPage(page)` yields the Cmds the consumer\n * wants emitted for each successfully fetched page (index rows, write to R2,\n * dispatch a downstream Msg — whatever; an empty array is fine).\n *\n * The resilience bricks (`retry` / `circuit` / `rateLimit` / `deadline`) are\n * the SAME optional knobs `resilient-call` exposes — paginated-walk extends it.\n * `rateLimit` is the brick that keeps the walk from 429-ing the upstream.\n */\nexport interface PaginatedWalkConfig<Cursor, Page, EmittedCmd extends Cmd> {\n  /**\n   * The cursor the walk fetches first. For an offset API this is typically `0`;\n   * for a token API, whatever sentinel the API treats as \"page one\" (often\n   * `null` or `\"\"`). Threaded into `paginator`'s `firstCursor`.\n   */\n  readonly firstPage: Cursor;\n  /**\n   * Extract the next cursor from a just-fetched page. Return a `Cursor` to keep\n   * walking, or `null` when the API signalled the end (the walk finishes). PURE\n   * + consumer-specific (only the consumer knows the API's pagination shape).\n   */\n  readonly nextCursor: (page: Page) => Cursor | null;\n  /**\n   * The Cmds to emit for each successfully fetched page — the consumer's work\n   * per page (index, persist, fan out, …). Returns plain-data Cmds; `[]` is a\n   * valid \"I process the page synchronously elsewhere\" answer. PURE.\n   */\n  readonly onPage: (page: Page) => readonly EmittedCmd[];\n  /**\n   * How many items a page contributes to the paginator's backpressure gauge\n   * (`seen`). Defaults to `1` per page (count pages, not items) when omitted; a\n   * consumer that wants per-item backpressure returns `page.items.length`. PURE.\n   */\n  readonly pageSize?: (page: Page) => number;\n  /**\n   * Backpressure threshold handed to the paginator. `seen >= highWaterMark`\n   * parks the walk in `paused` instead of fetching the next page. Non-positive\n   * (the default `0`) disables backpressure — the walk runs flat out until the\n   * API exhausts. See `../paginator`'s `highWaterMark` docs.\n   */\n  readonly highWaterMark?: number;\n\n  // --- resilience bricks, inherited from resilient-call (all optional) ---\n  /** Exponential-backoff retry policy for a transient page-fetch failure. */\n  readonly retry?: RetryPolicy;\n  /** Circuit breaker around the page fetch (one upstream → one breaker). */\n  readonly circuit?: CircuitConfig;\n  /** Token-bucket rate limit — the \"don't 429 the upstream\" knob. */\n  readonly rateLimit?: RateLimitConfig;\n  /** Overall wall-clock deadline per individual page fetch. */\n  readonly deadline?: DeadlineConfig;\n}\n\n// ===========================================================================\n// Slice — the Model field this knob owns. The paginator walk state + the\n// resilient-call slice for the page fetch. Both are flat plain data.\n// ===========================================================================\n\n/**\n * The slice. `walk` is the cursor/phase/counters from `../paginator`;\n * `resilience` is the `../resilient-call` slice that gates the page fetch.\n * Every field is JSON-serializable, so the whole walk survives a reload.\n *\n * The two move in lockstep: `walk` decides WHICH cursor to fetch next, while\n * `resilience` decides HOW that fetch is attempted (gated, retried, backed\n * off). `pageOk` advances `walk`; `pageErr` defers to `resilience` and leaves\n * `walk` parked on the same cursor until the page truly settles.\n */\nexport interface PaginatedWalkState<Cursor, Page> {\n  readonly walk: PaginatorState<Cursor>;\n  readonly resilience: ResilientState<Cursor, Page>;\n}\n\n// ===========================================================================\n// Cmds + Msgs the knob speaks.\n// ===========================================================================\n\n/**\n * The page-fetch effect this knob emits: the inherited `resilient_run` Cmd from\n * resilient-call, whose `input` is the `Cursor` to fetch and whose `key` is the\n * fixed `PAGE_KEY`. The consumer's `handlers(ports)` interprets it.\n */\nexport type FetchPageCmd<Cursor> = RunCmd<Cursor>;\n\n/** Page-settled Msgs the `handlers` port dispatches back (inherited verbatim). */\nexport type PageOkMsg<Page> = SucceedMsg<Page>;\nexport type PageErrMsg = FailMsg;\n\n/** The retry / deadline timer Msg — inherited from resilient-call. */\nexport type PaginatedWalkTimerMsg = ResilientTimerMsg;\n\n/**\n * Ports the consumer supplies to `handlers`. `run(cursor)` fetches ONE page for\n * the given cursor; throwing routes to `pageErr` (and thus the resilience\n * backoff). Same shape as resilient-call's port, specialized to the page fetch.\n */\nexport interface PaginatedWalkPorts<Cursor, Page>\n  extends ResilientPorts<Cursor, Page> {}\n\n// ===========================================================================\n// The fixed key. A walk fetches one page at a time → exactly one logical\n// resilient call. The paginator is the sequencer; resilient-call's keying is\n// pinned to this single key.\n// ===========================================================================\n\n/** The single resilient-call key every page fetch runs under. */\nexport const PAGE_KEY = \"page\";\n\n// ===========================================================================\n// The knob factory.\n// ===========================================================================\n\n/**\n * Build a paginated-walk knob from `config`. `rng` is injected for the\n * underlying retry jitter — pass a fixed `() => 0` in tests to pin backoff;\n * defaults to `Math.random` (read at the verb boundary inside resilient-call,\n * never in a `paginated-walk` verb). Inherited straight from resilient-call.\n *\n * Returns the uniform L2 knob contract: `init()`, the verbs `start` / `pageOk`\n * / `pageErr` / `onTimer`, `subs(state)`, and `handlers(ports)`. `Cursor` is\n * the page handle, `Page` the fetch result, `EmittedCmd` the consumer's\n * per-page Cmds plus the inherited `FetchPageCmd`.\n */\nexport function createPaginatedWalk<Cursor, Page, EmittedCmd extends Cmd = Cmd>(\n  config: PaginatedWalkConfig<Cursor, Page, EmittedCmd>,\n  rng: () => number = Math.random,\n) {\n  // The page fetch is a resilient call keyed by Cursor input → Page result.\n  // We feed it only the resilience bricks; the walk-loop knobs are ours.\n  const rc = createResilientCall<Cursor, Page>(\n    {\n      retry: config.retry,\n      circuit: config.circuit,\n      rateLimit: config.rateLimit,\n      deadline: config.deadline,\n    },\n    rng,\n  );\n\n  // The paginator policy: our firstPage is the paginator's firstCursor; the\n  // high-water mark gates backpressure (0 / omitted → unbounded).\n  const paginatorPolicy: PaginatorPolicy<Cursor> = {\n    firstCursor: config.firstPage,\n    highWaterMark: config.highWaterMark ?? 0,\n  };\n\n  // The combined Cmd type the verbs can emit: the inherited page-fetch effect\n  // plus whatever `onPage` yields.\n  type OutCmd = FetchPageCmd<Cursor> | EmittedCmd;\n\n  /** Replace the resilience slice, leaving `walk` untouched. */\n  function withResilience(\n    s: PaginatedWalkState<Cursor, Page>,\n    resilience: ResilientState<Cursor, Page>,\n  ): PaginatedWalkState<Cursor, Page> {\n    return { ...s, resilience };\n  }\n\n  /** The starting slice: an idle paginator + a fresh resilient-call slice. */\n  function init(): PaginatedWalkState<Cursor, Page> {\n    return {\n      walk: initPaginator<Cursor>(),\n      resilience: rc.init(),\n    };\n  }\n\n  /**\n   * Issue a resilient page fetch for `cursor` at `at`. The cursor is the\n   * resilient call's `input` (so a retry / resume re-fetches the same page) and\n   * `PAGE_KEY` is the fixed key. Returns the advanced resilience slice + the\n   * `resilient_run` Cmd (or none, if the gate cached / fast-failed / backed off).\n   * PURE — `at` is the only clock. Shared by `start` and `pageOk`'s advance.\n   */\n  function fetch(\n    s: PaginatedWalkState<Cursor, Page>,\n    cursor: Cursor,\n    at: number,\n  ): readonly [\n    PaginatedWalkState<Cursor, Page>,\n    readonly FetchPageCmd<Cursor>[],\n  ] {\n    const [resilience, cmds] = rc.attempt(s.resilience, PAGE_KEY, cursor, at);\n    return [withResilience(s, resilience), cmds];\n  }\n\n  /**\n   * Issue the page fetch for a freshly-armed paginator transition, else a pure\n   * no-op. `walk` is the result of a paginator verb (`startWalk` / `resumeWalk`)\n   * applied to `s.walk`; this states the arm-and-fetch contract ONCE for the two\n   * verbs that share it (`start`, `resume`).\n   *\n   * A paginator verb is a pure no-op on any phase it does not act on — it returns\n   * the SAME state object. Reference identity (not phase) is the honest \"did the\n   * verb arm a fresh fetch?\" check: a walk already `fetching` would also satisfy\n   * `phase === \"fetching\"` yet must NOT re-issue a fetch (page-one skip /\n   * double-fetch). So we proceed ONLY when the verb produced a fresh state. The\n   * `phase === \"fetching\"` narrow that follows is therefore always true here\n   * (both verbs only ever produce a `fetching` arm), and also narrows `.cursor`\n   * for the type checker. PURE — `at` threads into the fetch gate.\n   */\n  function armAndFetch(\n    s: PaginatedWalkState<Cursor, Page>,\n    walk: PaginatorState<Cursor>,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    if (walk === s.walk || walk.phase !== \"fetching\") {\n      return [s, []];\n    }\n    return fetch({ ...s, walk }, walk.cursor, at);\n  }\n\n  // === Verb: start =========================================================\n\n  /**\n   * Begin the walk: arm the paginator's first cursor and issue the first page\n   * fetch (gated through resilience). On any non-`idle` paginator phase this is\n   * a no-op — re-starting a walk in flight would skip back to page one and\n   * double-count, so a stray `start` after launch is absorbed (the paginator's\n   * own `start` guard). PURE — `at` threads into the fetch gate.\n   */\n  function start(\n    s: PaginatedWalkState<Cursor, Page>,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // `startWalk` is a pure no-op on any non-`idle` phase (same reference); a\n    // fresh `fetching(firstCursor)` arm → issue the first page fetch.\n    return armAndFetch(s, startWalk(s.walk, paginatorPolicy), at);\n  }\n\n  // === Verb: pageOk ========================================================\n\n  /**\n   * Record a successfully fetched `page` and decide what comes next. PURE —\n   * `at` is the cache / next-fetch clock.\n   *\n   *   1. Settle the resilient call OK (closes the breaker, fills the cache,\n   *      resets the page-fetch retry counter) — inherited from resilient-call.\n   *   2. Fold the page through the paginator: add `pageSize(page)` to `seen`,\n   *      bump `pages`, and branch on `nextCursor(page)`:\n   *        - `null`     → the API is exhausted → paginator goes `done`.\n   *        - a cursor   → advance, then either fetch it (backpressure room) or\n   *                       park in `paused` (high-water mark reached).\n   *   3. Emit the consumer's `onPage(page)` Cmds either way, PLUS the next\n   *      page-fetch effect when the paginator stays `fetching`.\n   *\n   * A `pageOk` that arrives when the paginator is not `fetching` (a late\n   * duplicate, a double-dispatch) is absorbed by `recordPage` — the cursor does\n   * not advance and `seen` is not double-counted; only the resilient settle +\n   * `onPage` Cmds happen. The walk is a coordination aid, not a correctness\n   * gate.\n   */\n  function pageOk(\n    s: PaginatedWalkState<Cursor, Page>,\n    page: Page,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // 1) Settle the underlying resilient call as a success.\n    const [resilience] = rc.succeed(s.resilience, PAGE_KEY, {\n      type: MsgType.ResilientOk,\n      key: PAGE_KEY,\n      result: page,\n      at,\n    });\n\n    // 2) Advance the paginator with the page's contribution + the next cursor.\n    const count = config.pageSize ? config.pageSize(page) : 1;\n    const next = config.nextCursor(page);\n    const walk = recordPage(s.walk, count, next, paginatorPolicy);\n\n    const advanced: PaginatedWalkState<Cursor, Page> = { walk, resilience };\n\n    // 3) The consumer's per-page work, always emitted on a successful page.\n    const pageCmds: readonly EmittedCmd[] = config.onPage(page);\n\n    // If the paginator stayed `fetching`, issue the next page fetch (gated).\n    if (walk.phase === \"fetching\") {\n      const [withFetch, fetchCmds] = fetch(advanced, walk.cursor, at);\n      return [withFetch, [...pageCmds, ...fetchCmds]];\n    }\n\n    // `done` (exhausted) or `paused` (backpressure) → no further fetch now.\n    return [advanced, pageCmds];\n  }\n\n  // === Verb: pageErr =======================================================\n\n  /**\n   * Record a failed page fetch and back off via resilience. PURE — `at` stamps\n   * the breaker trip + the retry-delay base.\n   *\n   * Defers to the resilient-call `fail` verb: it trips the breaker and either\n   * schedules a retry (paginator stays parked on the SAME cursor — no advance)\n   * or settles the resilient call `failed` once retries are exhausted. The\n   * paginator is deliberately untouched: a failed fetch must NOT advance the\n   * cursor or skip a page. When the retry timer later fires, `onTimer` re-issues\n   * the same page fetch.\n   *\n   * GUARDED by the paginator phase, exactly as `pageOk` is guarded by\n   * `recordPage`'s `fetching`-only check. A `pageErr` only makes sense while a\n   * page fetch is outstanding (`walk.phase === \"fetching\"`). A stray `pageErr`\n   * that arrives after the walk has settled — `done` (exhausted), `paused`\n   * (backpressure), or `idle` (not started) — has NO outstanding fetch to fail.\n   * Without this guard it would still call `rc.fail`, which trips the SHARED\n   * circuit breaker (dinging a healthy upstream) and overwrites the settled\n   * `PAGE_KEY` resilient slot with `failed` (clobbering the succeeded result a\n   * resume would otherwise observe). So a stray `pageErr` is absorbed as a pure\n   * no-op — identity preserved — matching `pageOk`'s \"the walk is a coordination\n   * aid, not a correctness gate\" stance.\n   */\n  function pageErr(\n    s: PaginatedWalkState<Cursor, Page>,\n    error: unknown,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // Only a `fetching` paginator has an outstanding page fetch to fail. On any\n    // other phase the fail would corrupt shared resilience state for a fetch\n    // that is not in flight — absorb it as a pure no-op.\n    if (s.walk.phase !== \"fetching\") {\n      return [s, []];\n    }\n    const [resilience, cmds] = rc.fail(s.resilience, PAGE_KEY, {\n      type: MsgType.ResilientErr,\n      key: PAGE_KEY,\n      error,\n      at,\n    });\n    return [withResilience(s, resilience), cmds];\n  }\n\n  // === Verb: onTimer =======================================================\n\n  /**\n   * A retry / deadline timer fired. Defers to resilient-call's `onTimer`: a\n   * retry timer re-runs the gate for the page-fetch's remembered cursor (re-\n   * issuing the SAME page); a deadline timer settles the resilient call failed.\n   * The paginator stays parked on its cursor throughout — only `pageOk` advances\n   * it. A stale fire is a no-op (inherited). PURE.\n   *\n   * GUARDED by the paginator phase, for the same reason as `pageErr`. A timer is\n   * only meaningful while a page fetch is outstanding (`walk.phase ===\n   * \"fetching\"`). A stray timer that fires after the walk has settled (`done` /\n   * `paused` / `idle`) would otherwise re-enter `rc.onTimer` — re-issuing a fetch\n   * the paginator no longer wants (a deadline timer could even overwrite the\n   * settled `PAGE_KEY` slot with a deadline `failed`). On any non-`fetching`\n   * phase the timer is absorbed as a pure no-op.\n   */\n  function onTimer(\n    s: PaginatedWalkState<Cursor, Page>,\n    msg: PaginatedWalkTimerMsg,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    if (s.walk.phase !== \"fetching\") {\n      return [s, []];\n    }\n    const [resilience, cmds] = rc.onTimer(s.resilience, msg);\n    if (resilience === s.resilience) {\n      // Inherited no-op identity → keep our slice identity too (pure no-op).\n      return [s, []];\n    }\n    return [withResilience(s, resilience), cmds];\n  }\n\n  // === Verb: drain =========================================================\n\n  /**\n   * Acknowledge that the consumer finished processing `n` items, lowering the\n   * paginator's backpressure gauge (`seen`). PURE — no clock. Delegates to\n   * `paginator.drain`: subtracts `n` (floored at 0), leaves the phase untouched.\n   *\n   * The OTHER half of the backpressure valve `highWaterMark` opens: `recordPage`\n   * parks the walk in `paused` once `seen >= highWaterMark`, and `drain` is how a\n   * consumer lowers `seen` back below the mark so `resume` can re-open the fetch.\n   * Without it `highWaterMark` would be a one-way valve — a walk could pause but\n   * never continue. Emits no Cmds: draining only frees headroom; `resume` is the\n   * separate, explicit \"continue now\" decision.\n   */\n  function drain(\n    s: PaginatedWalkState<Cursor, Page>,\n    n: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    const walk = drainWalk(s.walk, n);\n    if (walk === s.walk) {\n      // Pure no-op identity (n <= 0, or seen already at floor).\n      return [s, []];\n    }\n    return [{ ...s, walk }, []];\n  }\n\n  // === Verb: resume ========================================================\n\n  /**\n   * Re-open the backpressure valve after a `drain`: if the walk is `paused` and\n   * `seen` has dropped below `highWaterMark`, re-arm the parked cursor and issue\n   * its page fetch (gated through resilience). PURE — `at` threads into the fetch\n   * gate. Delegates the phase decision to `paginator.resume`:\n   *\n   *   - `paused` AND `seen < highWaterMark` → `fetching(cursor)` → emit the fetch.\n   *   - `paused` but still over the mark    → no-op (the valve stays shut until a\n   *                                           further `drain` frees real headroom).\n   *   - any other phase                     → no-op (nothing to resume).\n   *\n   * Together with `drain` this completes the valve: `recordPage` shuts it\n   * (`paused`), `drain` lowers the gauge, `resume` re-opens it and fires the next\n   * page fetch — the same `fetch` helper `start` / `pageOk` use, so a resumed\n   * fetch is gated identically (cache / circuit / rate-limit / retry).\n   */\n  function resume(\n    s: PaginatedWalkState<Cursor, Page>,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // `resumeWalk` is a pure no-op (same reference) on any phase but `paused`, or\n    // when `seen` is still at/over the mark. Only a fresh `fetching` arm means\n    // the valve actually re-opened — issue the page fetch only then.\n    return armAndFetch(s, resumeWalk(s.walk, paginatorPolicy), at);\n  }\n\n  // === Derived predicates ==================================================\n\n  /**\n   * Whether the walk has finished — the API returned a null next cursor and the\n   * paginator is `done`. PURE, read-only. Lets a consumer's reducer fire a\n   * \"walk complete\" Cmd (`if (walk.isDone(s.walk)) …`) without re-checking the\n   * paginator phase by hand.\n   */\n  function isComplete(s: PaginatedWalkState<Cursor, Page>): boolean {\n    return isDone(s.walk);\n  }\n\n  /**\n   * The terminal page-fetch failure that stranded the walk, or `undefined` if no\n   * page has terminally failed. PURE, read-only. Errors are data: a page that\n   * exhausts its retries (or trips the deadline) settles the `PAGE_KEY` resilient\n   * slot to `failed` while the paginator stays parked on its cursor — the walk is\n   * stuck and will never advance on its own. Without a way to read that phase the\n   * failure is unobservable: the walk simply stops emitting fetches with no\n   * signal. `failure(s)` surfaces the settled error (the same plain-data sentinel\n   * resilient-call records) so a consumer can fire a \"walk dead\" Cmd, alert, or\n   * re-`start` a fresh walk.\n   */\n  function failure(s: PaginatedWalkState<Cursor, Page>): unknown {\n    const call = s.resilience.calls[PAGE_KEY];\n    return call?.phase === \"failed\" ? call.error : undefined;\n  }\n\n  /**\n   * Whether the walk is STUCK: a page fetch has terminally `failed` yet the\n   * paginator is still parked on a cursor (not `done`), so no further fetch will\n   * ever be issued without intervention. PURE, read-only.\n   *\n   * This is the dead-walk predicate the consumer polls (`if (walk.isStuck(s)) …`)\n   * to distinguish a healthy finish (`isComplete`) from a silent death. A walk is\n   * stuck precisely when the resilient slot settled `failed` AND the paginator\n   * has NOT reached `done` — a terminal failure on the final page that also\n   * finished the walk is `isComplete`, not stuck. Pairs with `failure(s)`, which\n   * hands back the error that stuck it.\n   */\n  function isStuck(s: PaginatedWalkState<Cursor, Page>): boolean {\n    return s.resilience.calls[PAGE_KEY]?.phase === \"failed\" && !isDone(s.walk);\n  }\n\n  // === Subs ================================================================\n\n  /**\n   * Pre-wired subscriptions: exactly the resilient-call subs for the page\n   * fetch — a retry timer while the fetch is `waiting_retry`, and (with the\n   * `deadline` brick) a per-fetch deadline timer while it is active. Reconciled\n   * by id, so a phase change cancels the matching timer automatically. Wire\n   * `subscribe: { deadline: subscribeDeadline }` (re-exported below).\n   */\n  function subs(s: PaginatedWalkState<Cursor, Page>): readonly DeadlineSub[] {\n    return rc.subs(s.resilience);\n  }\n\n  // === Handlers ============================================================\n\n  /**\n   * Pre-wired interpret handler for the page-fetch effect. Inherited from\n   * resilient-call (`resilient_run`): wraps the consumer's `run(cursor)` port\n   * via `tryInterpret` (Railway) — success → `resilient_ok` (handled by\n   * `pageOk`), failure → `resilient_err` (handled by `pageErr`), each stamped\n   * with `Date.now()` at the effect boundary (the ONE permitted clock read).\n   *\n   *   interpret: walk.handlers({ run: (cursor) => api.fetchPage(cursor) })\n   *\n   * The consumer maps the inherited Msg types to their `pageOk` / `pageErr`\n   * reducer cells (the wire shape is `resilient_ok` / `resilient_err`).\n   */\n  function handlers(ports: PaginatedWalkPorts<Cursor, Page>) {\n    return rc.handlers(ports);\n  }\n\n  return {\n    init,\n    start,\n    pageOk,\n    pageErr,\n    onTimer,\n    drain,\n    resume,\n    isComplete,\n    failure,\n    isStuck,\n    subs,\n    handlers,\n  };\n}\n\n/**\n * Lift a knob result `[slice, cmds]` into a host `[State, cmds]` where the slice\n * lives at `state.walk`. A convenience for the common single-slice host;\n * consumers with a differently-named field spread by hand. Pure — a thin record\n * rebuild, no clock / RNG.\n */\nexport function liftWalk<\n  S extends { walk: PaginatedWalkState<Cursor, Page> },\n  Cursor,\n  Page,\n  C extends Cmd,\n>(\n  state: S,\n  [slice, cmds]: readonly [PaginatedWalkState<Cursor, Page>, readonly C[]],\n): readonly [S, readonly C[]] {\n  return [{ ...state, walk: slice }, cmds];\n}\n\n/**\n * Re-export the deadline Sub primitives (inherited from resilient-call) so\n * consumers wire one import: `subscribeDeadline` is the `subscribe` cell,\n * `deadlineSub` builds the Sub literal this knob's `subs` emits.\n */\nexport { subscribeDeadline, deadlineSub };\nexport type { DeadlineSub };\n"]}
+{"version":3,"sources":["../src/paginated-walk/index.ts"],"names":["start","drain","resume"],"mappings":";;;;;AAiPO,IAAM,QAAA,GAAW;AAiBjB,SAAS,mBAAA,CACd,MAAA,EACA,GAAA,GAAoB,IAAA,CAAK,MAAA,EACzB;AAGA,EAAA,MAAM,EAAA,GAAK,mBAAA;AAAA,IACT;AAAA,MACE,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,UAAU,MAAA,CAAO;AAAA,KACnB;AAAA,IACA;AAAA,GACF;AAIA,EAAA,MAAM,eAAA,GAA2C;AAAA,IAC/C,aAAa,MAAA,CAAO,SAAA;AAAA,IACpB,aAAA,EAAe,OAAO,aAAA,IAAiB;AAAA,GACzC;AAOA,EAAA,SAAS,cAAA,CACP,GACA,UAAA,EACkC;AAClC,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,UAAA,EAAW;AAAA,EAC5B;AAGA,EAAA,SAAS,IAAA,GAAyC;AAChD,IAAA,OAAO;AAAA,MACL,MAAM,aAAA,EAAsB;AAAA,MAC5B,UAAA,EAAY,GAAG,IAAA;AAAK,KACtB;AAAA,EACF;AASA,EAAA,SAAS,KAAA,CACP,CAAA,EACA,MAAA,EACA,EAAA,EAIA;AACA,IAAA,MAAM,CAAC,UAAA,EAAY,IAAI,CAAA,GAAI,EAAA,CAAG,QAAQ,CAAA,CAAE,UAAA,EAAY,QAAA,EAAU,MAAA,EAAQ,EAAE,CAAA;AACxE,IAAA,OAAO,CAAC,cAAA,CAAe,CAAA,EAAG,UAAU,GAAG,IAAI,CAAA;AAAA,EAC7C;AAiBA,EAAA,SAAS,WAAA,CACP,CAAA,EACA,IAAA,EACA,EAAA,EACgE;AAChE,IAAA,IAAI,IAAA,KAAS,CAAA,CAAE,IAAA,IAAQ,IAAA,CAAK,UAAU,UAAA,EAAY;AAChD,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,OAAO,KAAA,CAAM,EAAE,GAAG,CAAA,EAAG,MAAK,EAAG,IAAA,CAAK,QAAQ,EAAE,CAAA;AAAA,EAC9C;AAWA,EAAA,SAASA,MAAAA,CACP,GACA,EAAA,EACgE;AAGhE,IAAA,OAAO,YAAY,CAAA,EAAG,KAAA,CAAU,EAAE,IAAA,EAAM,eAAe,GAAG,EAAE,CAAA;AAAA,EAC9D;AAwBA,EAAA,SAAS,MAAA,CACP,CAAA,EACA,IAAA,EACA,EAAA,EACgE;AAEhE,IAAA,MAAM,CAAC,UAAU,CAAA,GAAI,GAAG,OAAA,CAAQ,CAAA,CAAE,YAAY,QAAA,EAAU;AAAA,MACtD,MAAM,OAAA,CAAQ,WAAA;AAAA,MACd,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,IAAA;AAAA,MACR;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,QAAQ,MAAA,CAAO,QAAA,GAAW,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,GAAI,CAAA;AACxD,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,UAAA,CAAW,IAAI,CAAA;AACnC,IAAA,MAAM,OAAO,UAAA,CAAW,CAAA,CAAE,IAAA,EAAM,KAAA,EAAO,MAAM,eAAe,CAAA;AAE5D,IAAA,MAAM,QAAA,GAA6C,EAAE,IAAA,EAAM,UAAA,EAAW;AAGtE,IAAA,MAAM,QAAA,GAAkC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAG1D,IAAA,IAAI,IAAA,CAAK,UAAU,UAAA,EAAY;AAC7B,MAAA,MAAM,CAAC,WAAW,SAAS,CAAA,GAAI,MAAM,QAAA,EAAU,IAAA,CAAK,QAAQ,EAAE,CAAA;AAC9D,MAAA,OAAO,CAAC,SAAA,EAAW,CAAC,GAAG,QAAA,EAAU,GAAG,SAAS,CAAC,CAAA;AAAA,IAChD;AAGA,IAAA,OAAO,CAAC,UAAU,QAAQ,CAAA;AAAA,EAC5B;AA2BA,EAAA,SAAS,OAAA,CACP,CAAA,EACA,KAAA,EACA,EAAA,EACgE;AAIhE,IAAA,IAAI,CAAA,CAAE,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AAC/B,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,MAAM,CAAC,YAAY,IAAI,CAAA,GAAI,GAAG,IAAA,CAAK,CAAA,CAAE,YAAY,QAAA,EAAU;AAAA,MACzD,MAAM,OAAA,CAAQ,YAAA;AAAA,MACd,GAAA,EAAK,QAAA;AAAA,MACL,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,CAAC,cAAA,CAAe,CAAA,EAAG,UAAU,GAAG,IAAI,CAAA;AAAA,EAC7C;AAmBA,EAAA,SAAS,OAAA,CACP,GACA,GAAA,EACgE;AAChE,IAAA,IAAI,CAAA,CAAE,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AAC/B,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,MAAM,CAAC,YAAY,IAAI,CAAA,GAAI,GAAG,OAAA,CAAQ,CAAA,CAAE,YAAY,GAAG,CAAA;AACvD,IAAA,IAAI,UAAA,KAAe,EAAE,UAAA,EAAY;AAE/B,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,OAAO,CAAC,cAAA,CAAe,CAAA,EAAG,UAAU,GAAG,IAAI,CAAA;AAAA,EAC7C;AAgBA,EAAA,SAASC,MAAAA,CACP,GACA,CAAA,EACgE;AAChE,IAAA,MAAM,IAAA,GAAO,KAAA,CAAU,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAChC,IAAA,IAAI,IAAA,KAAS,EAAE,IAAA,EAAM;AAEnB,MAAA,OAAO,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,IACf;AACA,IAAA,OAAO,CAAC,EAAE,GAAG,GAAG,IAAA,EAAK,EAAG,EAAE,CAAA;AAAA,EAC5B;AAoBA,EAAA,SAASC,OAAAA,CACP,GACA,EAAA,EACgE;AAIhE,IAAA,OAAO,YAAY,CAAA,EAAG,MAAA,CAAW,EAAE,IAAA,EAAM,eAAe,GAAG,EAAE,CAAA;AAAA,EAC/D;AAUA,EAAA,SAAS,WAAW,CAAA,EAA8C;AAChE,IAAA,OAAO,MAAA,CAAO,EAAE,IAAI,CAAA;AAAA,EACtB;AAaA,EAAA,SAAS,QAAQ,CAAA,EAA8C;AAC7D,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,UAAA,CAAW,KAAA,CAAM,QAAQ,CAAA;AACxC,IAAA,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,GAAW,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,EACjD;AAcA,EAAA,SAAS,QAAQ,CAAA,EAA8C;AAC7D,IAAA,OAAO,CAAA,CAAE,UAAA,CAAW,KAAA,CAAM,QAAQ,CAAA,EAAG,UAAU,QAAA,IAAY,CAAC,MAAA,CAAO,CAAA,CAAE,IAAI,CAAA;AAAA,EAC3E;AAWA,EAAA,SAAS,KAAK,CAAA,EAA6D;AACzE,IAAA,OAAO,EAAA,CAAG,IAAA,CAAK,CAAA,CAAE,UAAU,CAAA;AAAA,EAC7B;AAgBA,EAAA,SAAS,SAAS,KAAA,EAAyC;AACzD,IAAA,OAAO,EAAA,CAAG,SAAS,KAAK,CAAA;AAAA,EAC1B;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,KAAA,EAAAF,MAAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA,EAAAC,MAAAA;AAAA,IACA,MAAA,EAAAC,OAAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAQO,SAAS,QAAA,CAMd,KAAA,EACA,CAAC,KAAA,EAAO,IAAI,CAAA,EACgB;AAC5B,EAAA,OAAO,CAAC,EAAE,GAAG,OAAO,IAAA,EAAM,KAAA,IAAS,IAAI,CAAA;AACzC","file":"chunk-I5OV65MS.js","sourcesContent":["/**\n * @demlik/tea/paginated-walk — traverse a paginated API / sitemap end to end\n * WITHOUT a fake clock, without 429s, and resumable across a Durable-Object\n * eviction. The L2 composition that bolts `../resilient-call`'s resilience onto\n * `../paginator`'s cursor walk: each page is fetched as ONE keyed resilient\n * call (retry + backoff + rate-limit gate), and the cursor advances only once a\n * page settles `ok`.\n *\n * ## The recipe (the two siblings it composes)\n *\n *   - **`../paginator`** owns the walk loop: the opaque `Cursor`, the `seen` /\n *     `pages` counters, and the `idle → fetching → … → done` phase machine.\n *     `paginated-walk` never re-implements cursor advancement — it folds each\n *     settled page through `recordPage`, letting the paginator decide\n *     `done` / `fetching(next)` / `paused`. Backpressure is a TWO-way valve:\n *     `recordPage` parks the walk in `paused` once `seen >= highWaterMark`, and\n *     the `drain` / `resume` verbs (delegating to the paginator's own\n *     `drain` / `resume`) lower the gauge and re-open the parked fetch — without\n *     them `highWaterMark` would be a one-way valve that strands a paused walk.\n *   - **`../resilient-call`** owns the page fetch: the single `resilient_run`\n *     effect per page is gated through that knob's cache → circuit → rate-limit\n *     → retry pipeline. A transient page failure backs off and re-issues the\n *     SAME cursor (idempotent retry); the walk does not advance until the page\n *     genuinely settles.\n *\n * Those are the only two siblings this module calls into. The resilience knobs\n * (`retry` / `circuit` / `rateLimit` / `deadline`) are NOT separate bricks\n * `paginated-walk` composes — they belong to `resilient-call`, which owns the\n * rate-limit gate internally. This module merely passes them through to\n * `createResilientCall` and re-uses two config TYPES at the boundary:\n * `RateLimitConfig` (re-exported by `resilient-call`) and `RetryPolicy` (from\n * `../retry-backoff`). Pass a `rateLimit` and `resilient-call`'s token bucket\n * throttles page fetches (\"don't 429 the upstream\"); omit it and the walk runs\n * as fast as the upstream answers.\n *\n * Because the page-fetch resilience IS a `resilient-call` slice, this knob\n * **inherits that knob's contract verbatim**: the slice is a flat record, every\n * verb returns `readonly [State, Cmd[]]`, time is always an `at` parameter, and\n * the jitter RNG is injected once at `createPaginatedWalk(config, rng)` — never\n * read inside a verb (per the spec, `paginated-walk` *extends* `resilient-call`).\n *\n * ## The two non-negotiables (canon)\n *\n *   - **Durable** — the slice is plain data: the paginator phase + counters, and\n *     the resilient-call brick states (all JSON-serializable). The cursor lives\n *     in the Model, not a closure, so a walk survives eviction mid-traversal and\n *     resumes from the exact page it was fetching.\n *   - **Replayable** — every transition is a verb returning new state + Cmds.\n *     `nextCursor` / `onPage` are pure config functions applied at the verb\n *     boundary; the Cmds they yield are plain data. `replay` reconstructs the\n *     whole walk exactly.\n *\n * ## Where the clock / RNG live\n *\n * Inside the verbs: nowhere. `at` arrives on `start` / `pageOk` / `pageErr` /\n * `onTimer` and is threaded straight into the underlying resilient-call gate (so\n * a rate-limited or retried page measures backoff from that `at`). The jitter\n * RNG is injected at construction. The only clock read is `Date.now()` inside\n * the resilient-call `handlers` port (the effect boundary), inherited unchanged.\n *\n * ## The fixed fetch key\n *\n * A walk fetches one page at a time, so the resilient-call layer tracks exactly\n * one logical call under the constant key `PAGE_KEY`. The cursor being fetched\n * is the resilient call's `input`, so a post-eviction resume re-issues the same\n * page request. (`resilient-call` is keyed to support N concurrent calls; a walk\n * deliberately uses a single key — the paginator is the sequencer.)\n *\n * ## Typical wiring\n *\n *   const walk = createPaginatedWalk<PageToken, ApiPage>({\n *     firstPage: null,                          // the API's \"page one\" sentinel\n *     nextCursor: (page) => page.nextToken ?? null,\n *     onPage: (page) => [{ type: \"index_rows\", rows: page.items }],\n *     rateLimit: { capacity: 10, refillPerSec: 5 },\n *     retry: defaultRetryPolicy,\n *   });\n *\n *   // in the machine:\n *   init: () => [{ walk: walk.init() }, []],\n *   update: {\n *     start:    (s, m)  => lift(s, walk.start(s.walk, m.at)),\n *     page_ok:  (s, m)  => lift(s, walk.pageOk(s.walk, m.result, m.at)),\n *     page_err: (s, m)  => lift(s, walk.pageErr(s.walk, m.error, m.at)),\n *     retry_due:(s, m)  => lift(s, walk.onTimer(s.walk, m)),\n *     drained:  (s, m)  => lift(s, walk.drain(s.walk, m.n)),\n *     resume:   (s, m)  => lift(s, walk.resume(s.walk, m.at)),\n *   },\n *   subscriptions: (s) => walk.subs(s.walk),\n *   subscribe: { deadline: subscribeDeadline },\n *   interpret: walk.handlers({ run: (cursor) => api.fetchPage(cursor) }),\n */\n\nimport type { Cmd } from \"../index\";\nimport {\n  drain as drainWalk,\n  initPaginator,\n  isDone,\n  type PaginatorPolicy,\n  type PaginatorState,\n  recordPage,\n  resume as resumeWalk,\n  start as startWalk,\n} from \"../paginator\";\nimport { MsgType } from \"../protocol\";\nimport {\n  type CircuitConfig,\n  createResilientCall,\n  type DeadlineConfig,\n  type DeadlineSub,\n  deadlineSub,\n  type FailMsg,\n  type RateLimitConfig,\n  type ResilientPorts,\n  type ResilientState,\n  type ResilientTimerMsg,\n  type RunCmd,\n  type SucceedMsg,\n  subscribeDeadline,\n} from \"../resilient-call\";\nimport type { RetryPolicy } from \"../retry-backoff\";\n\n// ===========================================================================\n// Config — the knob. `firstPage` / `nextCursor` / `onPage` describe the walk;\n// the resilience bricks are inherited from resilient-call (every one optional —\n// omit a brick, omit its gate).\n// ===========================================================================\n\n/**\n * The paginated-walk knob. Generic in `Cursor` (the opaque page handle the\n * upstream API hands back — offset, page token, \"next\" URL, …) and `Page` (the\n * shape your fetch port resolves with).\n *\n * `nextCursor` and `onPage` are PURE config functions applied at the verb\n * boundary, never stored in the slice or in a Cmd (invariant 3 — Cmds are\n * plain data, not closures). `nextCursor(page)` extracts the API's next-page\n * handle (or `null` at the end); `onPage(page)` yields the Cmds the consumer\n * wants emitted for each successfully fetched page (index rows, write to R2,\n * dispatch a downstream Msg — whatever; an empty array is fine).\n *\n * The resilience bricks (`retry` / `circuit` / `rateLimit` / `deadline`) are\n * the SAME optional knobs `resilient-call` exposes — paginated-walk extends it.\n * `rateLimit` is the brick that keeps the walk from 429-ing the upstream.\n */\nexport interface PaginatedWalkConfig<Cursor, Page, EmittedCmd extends Cmd> {\n  /**\n   * The cursor the walk fetches first. For an offset API this is typically `0`;\n   * for a token API, whatever sentinel the API treats as \"page one\" (often\n   * `null` or `\"\"`). Threaded into `paginator`'s `firstCursor`.\n   */\n  readonly firstPage: Cursor;\n  /**\n   * Extract the next cursor from a just-fetched page. Return a `Cursor` to keep\n   * walking, or `null` when the API signalled the end (the walk finishes). PURE\n   * + consumer-specific (only the consumer knows the API's pagination shape).\n   */\n  readonly nextCursor: (page: Page) => Cursor | null;\n  /**\n   * The Cmds to emit for each successfully fetched page — the consumer's work\n   * per page (index, persist, fan out, …). Returns plain-data Cmds; `[]` is a\n   * valid \"I process the page synchronously elsewhere\" answer. PURE.\n   */\n  readonly onPage: (page: Page) => readonly EmittedCmd[];\n  /**\n   * How many items a page contributes to the paginator's backpressure gauge\n   * (`seen`). Defaults to `1` per page (count pages, not items) when omitted; a\n   * consumer that wants per-item backpressure returns `page.items.length`. PURE.\n   */\n  readonly pageSize?: (page: Page) => number;\n  /**\n   * Backpressure threshold handed to the paginator. `seen >= highWaterMark`\n   * parks the walk in `paused` instead of fetching the next page. Non-positive\n   * (the default `0`) disables backpressure — the walk runs flat out until the\n   * API exhausts. See `../paginator`'s `highWaterMark` docs.\n   */\n  readonly highWaterMark?: number;\n\n  // --- resilience bricks, inherited from resilient-call (all optional) ---\n  /** Exponential-backoff retry policy for a transient page-fetch failure. */\n  readonly retry?: RetryPolicy;\n  /** Circuit breaker around the page fetch (one upstream → one breaker). */\n  readonly circuit?: CircuitConfig;\n  /** Token-bucket rate limit — the \"don't 429 the upstream\" knob. */\n  readonly rateLimit?: RateLimitConfig;\n  /** Overall wall-clock deadline per individual page fetch. */\n  readonly deadline?: DeadlineConfig;\n}\n\n// ===========================================================================\n// Slice — the Model field this knob owns. The paginator walk state + the\n// resilient-call slice for the page fetch. Both are flat plain data.\n// ===========================================================================\n\n/**\n * The slice. `walk` is the cursor/phase/counters from `../paginator`;\n * `resilience` is the `../resilient-call` slice that gates the page fetch.\n * Every field is JSON-serializable, so the whole walk survives a reload.\n *\n * The two move in lockstep: `walk` decides WHICH cursor to fetch next, while\n * `resilience` decides HOW that fetch is attempted (gated, retried, backed\n * off). `pageOk` advances `walk`; `pageErr` defers to `resilience` and leaves\n * `walk` parked on the same cursor until the page truly settles.\n */\nexport interface PaginatedWalkState<Cursor, Page> {\n  readonly walk: PaginatorState<Cursor>;\n  readonly resilience: ResilientState<Cursor, Page>;\n}\n\n// ===========================================================================\n// Cmds + Msgs the knob speaks.\n// ===========================================================================\n\n/**\n * The page-fetch effect this knob emits: the inherited `resilient_run` Cmd from\n * resilient-call, whose `input` is the `Cursor` to fetch and whose `key` is the\n * fixed `PAGE_KEY`. The consumer's `handlers(ports)` interprets it.\n */\nexport type FetchPageCmd<Cursor> = RunCmd<Cursor>;\n\n/** Page-settled Msgs the `handlers` port dispatches back (inherited verbatim). */\nexport type PageOkMsg<Page> = SucceedMsg<Page>;\nexport type PageErrMsg = FailMsg;\n\n/** The retry / deadline timer Msg — inherited from resilient-call. */\nexport type PaginatedWalkTimerMsg = ResilientTimerMsg;\n\n/**\n * Ports the consumer supplies to `handlers`. `run(cursor)` fetches ONE page for\n * the given cursor; throwing routes to `pageErr` (and thus the resilience\n * backoff). Same shape as resilient-call's port, specialized to the page fetch.\n */\nexport interface PaginatedWalkPorts<Cursor, Page>\n  extends ResilientPorts<Cursor, Page> {}\n\n// ===========================================================================\n// The fixed key. A walk fetches one page at a time → exactly one logical\n// resilient call. The paginator is the sequencer; resilient-call's keying is\n// pinned to this single key.\n// ===========================================================================\n\n/** The single resilient-call key every page fetch runs under. */\nexport const PAGE_KEY = \"page\";\n\n// ===========================================================================\n// The knob factory.\n// ===========================================================================\n\n/**\n * Build a paginated-walk knob from `config`. `rng` is injected for the\n * underlying retry jitter — pass a fixed `() => 0` in tests to pin backoff;\n * defaults to `Math.random` (read at the verb boundary inside resilient-call,\n * never in a `paginated-walk` verb). Inherited straight from resilient-call.\n *\n * Returns the uniform L2 knob contract: `init()`, the verbs `start` / `pageOk`\n * / `pageErr` / `onTimer`, `subs(state)`, and `handlers(ports)`. `Cursor` is\n * the page handle, `Page` the fetch result, `EmittedCmd` the consumer's\n * per-page Cmds plus the inherited `FetchPageCmd`.\n */\nexport function createPaginatedWalk<Cursor, Page, EmittedCmd extends Cmd = Cmd>(\n  config: PaginatedWalkConfig<Cursor, Page, EmittedCmd>,\n  rng: () => number = Math.random,\n) {\n  // The page fetch is a resilient call keyed by Cursor input → Page result.\n  // We feed it only the resilience bricks; the walk-loop knobs are ours.\n  const rc = createResilientCall<Cursor, Page>(\n    {\n      retry: config.retry,\n      circuit: config.circuit,\n      rateLimit: config.rateLimit,\n      deadline: config.deadline,\n    },\n    rng,\n  );\n\n  // The paginator policy: our firstPage is the paginator's firstCursor; the\n  // high-water mark gates backpressure (0 / omitted → unbounded).\n  const paginatorPolicy: PaginatorPolicy<Cursor> = {\n    firstCursor: config.firstPage,\n    highWaterMark: config.highWaterMark ?? 0,\n  };\n\n  // The combined Cmd type the verbs can emit: the inherited page-fetch effect\n  // plus whatever `onPage` yields.\n  type OutCmd = FetchPageCmd<Cursor> | EmittedCmd;\n\n  /** Replace the resilience slice, leaving `walk` untouched. */\n  function withResilience(\n    s: PaginatedWalkState<Cursor, Page>,\n    resilience: ResilientState<Cursor, Page>,\n  ): PaginatedWalkState<Cursor, Page> {\n    return { ...s, resilience };\n  }\n\n  /** The starting slice: an idle paginator + a fresh resilient-call slice. */\n  function init(): PaginatedWalkState<Cursor, Page> {\n    return {\n      walk: initPaginator<Cursor>(),\n      resilience: rc.init(),\n    };\n  }\n\n  /**\n   * Issue a resilient page fetch for `cursor` at `at`. The cursor is the\n   * resilient call's `input` (so a retry / resume re-fetches the same page) and\n   * `PAGE_KEY` is the fixed key. Returns the advanced resilience slice + the\n   * `resilient_run` Cmd (or none, if the gate cached / fast-failed / backed off).\n   * PURE — `at` is the only clock. Shared by `start` and `pageOk`'s advance.\n   */\n  function fetch(\n    s: PaginatedWalkState<Cursor, Page>,\n    cursor: Cursor,\n    at: number,\n  ): readonly [\n    PaginatedWalkState<Cursor, Page>,\n    readonly FetchPageCmd<Cursor>[],\n  ] {\n    const [resilience, cmds] = rc.attempt(s.resilience, PAGE_KEY, cursor, at);\n    return [withResilience(s, resilience), cmds];\n  }\n\n  /**\n   * Issue the page fetch for a freshly-armed paginator transition, else a pure\n   * no-op. `walk` is the result of a paginator verb (`startWalk` / `resumeWalk`)\n   * applied to `s.walk`; this states the arm-and-fetch contract ONCE for the two\n   * verbs that share it (`start`, `resume`).\n   *\n   * A paginator verb is a pure no-op on any phase it does not act on — it returns\n   * the SAME state object. Reference identity (not phase) is the honest \"did the\n   * verb arm a fresh fetch?\" check: a walk already `fetching` would also satisfy\n   * `phase === \"fetching\"` yet must NOT re-issue a fetch (page-one skip /\n   * double-fetch). So we proceed ONLY when the verb produced a fresh state. The\n   * `phase === \"fetching\"` narrow that follows is therefore always true here\n   * (both verbs only ever produce a `fetching` arm), and also narrows `.cursor`\n   * for the type checker. PURE — `at` threads into the fetch gate.\n   */\n  function armAndFetch(\n    s: PaginatedWalkState<Cursor, Page>,\n    walk: PaginatorState<Cursor>,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    if (walk === s.walk || walk.phase !== \"fetching\") {\n      return [s, []];\n    }\n    return fetch({ ...s, walk }, walk.cursor, at);\n  }\n\n  // === Verb: start =========================================================\n\n  /**\n   * Begin the walk: arm the paginator's first cursor and issue the first page\n   * fetch (gated through resilience). On any non-`idle` paginator phase this is\n   * a no-op — re-starting a walk in flight would skip back to page one and\n   * double-count, so a stray `start` after launch is absorbed (the paginator's\n   * own `start` guard). PURE — `at` threads into the fetch gate.\n   */\n  function start(\n    s: PaginatedWalkState<Cursor, Page>,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // `startWalk` is a pure no-op on any non-`idle` phase (same reference); a\n    // fresh `fetching(firstCursor)` arm → issue the first page fetch.\n    return armAndFetch(s, startWalk(s.walk, paginatorPolicy), at);\n  }\n\n  // === Verb: pageOk ========================================================\n\n  /**\n   * Record a successfully fetched `page` and decide what comes next. PURE —\n   * `at` is the cache / next-fetch clock.\n   *\n   *   1. Settle the resilient call OK (closes the breaker, fills the cache,\n   *      resets the page-fetch retry counter) — inherited from resilient-call.\n   *   2. Fold the page through the paginator: add `pageSize(page)` to `seen`,\n   *      bump `pages`, and branch on `nextCursor(page)`:\n   *        - `null`     → the API is exhausted → paginator goes `done`.\n   *        - a cursor   → advance, then either fetch it (backpressure room) or\n   *                       park in `paused` (high-water mark reached).\n   *   3. Emit the consumer's `onPage(page)` Cmds either way, PLUS the next\n   *      page-fetch effect when the paginator stays `fetching`.\n   *\n   * A `pageOk` that arrives when the paginator is not `fetching` (a late\n   * duplicate, a double-dispatch) is absorbed by `recordPage` — the cursor does\n   * not advance and `seen` is not double-counted; only the resilient settle +\n   * `onPage` Cmds happen. The walk is a coordination aid, not a correctness\n   * gate.\n   */\n  function pageOk(\n    s: PaginatedWalkState<Cursor, Page>,\n    page: Page,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // 1) Settle the underlying resilient call as a success.\n    const [resilience] = rc.succeed(s.resilience, PAGE_KEY, {\n      type: MsgType.ResilientOk,\n      key: PAGE_KEY,\n      result: page,\n      at,\n    });\n\n    // 2) Advance the paginator with the page's contribution + the next cursor.\n    const count = config.pageSize ? config.pageSize(page) : 1;\n    const next = config.nextCursor(page);\n    const walk = recordPage(s.walk, count, next, paginatorPolicy);\n\n    const advanced: PaginatedWalkState<Cursor, Page> = { walk, resilience };\n\n    // 3) The consumer's per-page work, always emitted on a successful page.\n    const pageCmds: readonly EmittedCmd[] = config.onPage(page);\n\n    // If the paginator stayed `fetching`, issue the next page fetch (gated).\n    if (walk.phase === \"fetching\") {\n      const [withFetch, fetchCmds] = fetch(advanced, walk.cursor, at);\n      return [withFetch, [...pageCmds, ...fetchCmds]];\n    }\n\n    // `done` (exhausted) or `paused` (backpressure) → no further fetch now.\n    return [advanced, pageCmds];\n  }\n\n  // === Verb: pageErr =======================================================\n\n  /**\n   * Record a failed page fetch and back off via resilience. PURE — `at` stamps\n   * the breaker trip + the retry-delay base.\n   *\n   * Defers to the resilient-call `fail` verb: it trips the breaker and either\n   * schedules a retry (paginator stays parked on the SAME cursor — no advance)\n   * or settles the resilient call `failed` once retries are exhausted. The\n   * paginator is deliberately untouched: a failed fetch must NOT advance the\n   * cursor or skip a page. When the retry timer later fires, `onTimer` re-issues\n   * the same page fetch.\n   *\n   * GUARDED by the paginator phase, exactly as `pageOk` is guarded by\n   * `recordPage`'s `fetching`-only check. A `pageErr` only makes sense while a\n   * page fetch is outstanding (`walk.phase === \"fetching\"`). A stray `pageErr`\n   * that arrives after the walk has settled — `done` (exhausted), `paused`\n   * (backpressure), or `idle` (not started) — has NO outstanding fetch to fail.\n   * Without this guard it would still call `rc.fail`, which trips the SHARED\n   * circuit breaker (dinging a healthy upstream) and overwrites the settled\n   * `PAGE_KEY` resilient slot with `failed` (clobbering the succeeded result a\n   * resume would otherwise observe). So a stray `pageErr` is absorbed as a pure\n   * no-op — identity preserved — matching `pageOk`'s \"the walk is a coordination\n   * aid, not a correctness gate\" stance.\n   */\n  function pageErr(\n    s: PaginatedWalkState<Cursor, Page>,\n    error: unknown,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // Only a `fetching` paginator has an outstanding page fetch to fail. On any\n    // other phase the fail would corrupt shared resilience state for a fetch\n    // that is not in flight — absorb it as a pure no-op.\n    if (s.walk.phase !== \"fetching\") {\n      return [s, []];\n    }\n    const [resilience, cmds] = rc.fail(s.resilience, PAGE_KEY, {\n      type: MsgType.ResilientErr,\n      key: PAGE_KEY,\n      error,\n      at,\n    });\n    return [withResilience(s, resilience), cmds];\n  }\n\n  // === Verb: onTimer =======================================================\n\n  /**\n   * A retry / deadline timer fired. Defers to resilient-call's `onTimer`: a\n   * retry timer re-runs the gate for the page-fetch's remembered cursor (re-\n   * issuing the SAME page); a deadline timer settles the resilient call failed.\n   * The paginator stays parked on its cursor throughout — only `pageOk` advances\n   * it. A stale fire is a no-op (inherited). PURE.\n   *\n   * GUARDED by the paginator phase, for the same reason as `pageErr`. A timer is\n   * only meaningful while a page fetch is outstanding (`walk.phase ===\n   * \"fetching\"`). A stray timer that fires after the walk has settled (`done` /\n   * `paused` / `idle`) would otherwise re-enter `rc.onTimer` — re-issuing a fetch\n   * the paginator no longer wants (a deadline timer could even overwrite the\n   * settled `PAGE_KEY` slot with a deadline `failed`). On any non-`fetching`\n   * phase the timer is absorbed as a pure no-op.\n   */\n  function onTimer(\n    s: PaginatedWalkState<Cursor, Page>,\n    msg: PaginatedWalkTimerMsg,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    if (s.walk.phase !== \"fetching\") {\n      return [s, []];\n    }\n    const [resilience, cmds] = rc.onTimer(s.resilience, msg);\n    if (resilience === s.resilience) {\n      // Inherited no-op identity → keep our slice identity too (pure no-op).\n      return [s, []];\n    }\n    return [withResilience(s, resilience), cmds];\n  }\n\n  // === Verb: drain =========================================================\n\n  /**\n   * Acknowledge that the consumer finished processing `n` items, lowering the\n   * paginator's backpressure gauge (`seen`). PURE — no clock. Delegates to\n   * `paginator.drain`: subtracts `n` (floored at 0), leaves the phase untouched.\n   *\n   * The OTHER half of the backpressure valve `highWaterMark` opens: `recordPage`\n   * parks the walk in `paused` once `seen >= highWaterMark`, and `drain` is how a\n   * consumer lowers `seen` back below the mark so `resume` can re-open the fetch.\n   * Without it `highWaterMark` would be a one-way valve — a walk could pause but\n   * never continue. Emits no Cmds: draining only frees headroom; `resume` is the\n   * separate, explicit \"continue now\" decision.\n   */\n  function drain(\n    s: PaginatedWalkState<Cursor, Page>,\n    n: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    const walk = drainWalk(s.walk, n);\n    if (walk === s.walk) {\n      // Pure no-op identity (n <= 0, or seen already at floor).\n      return [s, []];\n    }\n    return [{ ...s, walk }, []];\n  }\n\n  // === Verb: resume ========================================================\n\n  /**\n   * Re-open the backpressure valve after a `drain`: if the walk is `paused` and\n   * `seen` has dropped below `highWaterMark`, re-arm the parked cursor and issue\n   * its page fetch (gated through resilience). PURE — `at` threads into the fetch\n   * gate. Delegates the phase decision to `paginator.resume`:\n   *\n   *   - `paused` AND `seen < highWaterMark` → `fetching(cursor)` → emit the fetch.\n   *   - `paused` but still over the mark    → no-op (the valve stays shut until a\n   *                                           further `drain` frees real headroom).\n   *   - any other phase                     → no-op (nothing to resume).\n   *\n   * Together with `drain` this completes the valve: `recordPage` shuts it\n   * (`paused`), `drain` lowers the gauge, `resume` re-opens it and fires the next\n   * page fetch — the same `fetch` helper `start` / `pageOk` use, so a resumed\n   * fetch is gated identically (cache / circuit / rate-limit / retry).\n   */\n  function resume(\n    s: PaginatedWalkState<Cursor, Page>,\n    at: number,\n  ): readonly [PaginatedWalkState<Cursor, Page>, readonly OutCmd[]] {\n    // `resumeWalk` is a pure no-op (same reference) on any phase but `paused`, or\n    // when `seen` is still at/over the mark. Only a fresh `fetching` arm means\n    // the valve actually re-opened — issue the page fetch only then.\n    return armAndFetch(s, resumeWalk(s.walk, paginatorPolicy), at);\n  }\n\n  // === Derived predicates ==================================================\n\n  /**\n   * Whether the walk has finished — the API returned a null next cursor and the\n   * paginator is `done`. PURE, read-only. Lets a consumer's reducer fire a\n   * \"walk complete\" Cmd (`if (walk.isDone(s.walk)) …`) without re-checking the\n   * paginator phase by hand.\n   */\n  function isComplete(s: PaginatedWalkState<Cursor, Page>): boolean {\n    return isDone(s.walk);\n  }\n\n  /**\n   * The terminal page-fetch failure that stranded the walk, or `undefined` if no\n   * page has terminally failed. PURE, read-only. Errors are data: a page that\n   * exhausts its retries (or trips the deadline) settles the `PAGE_KEY` resilient\n   * slot to `failed` while the paginator stays parked on its cursor — the walk is\n   * stuck and will never advance on its own. Without a way to read that phase the\n   * failure is unobservable: the walk simply stops emitting fetches with no\n   * signal. `failure(s)` surfaces the settled error (the same plain-data sentinel\n   * resilient-call records) so a consumer can fire a \"walk dead\" Cmd, alert, or\n   * re-`start` a fresh walk.\n   */\n  function failure(s: PaginatedWalkState<Cursor, Page>): unknown {\n    const call = s.resilience.calls[PAGE_KEY];\n    return call?.phase === \"failed\" ? call.error : undefined;\n  }\n\n  /**\n   * Whether the walk is STUCK: a page fetch has terminally `failed` yet the\n   * paginator is still parked on a cursor (not `done`), so no further fetch will\n   * ever be issued without intervention. PURE, read-only.\n   *\n   * This is the dead-walk predicate the consumer polls (`if (walk.isStuck(s)) …`)\n   * to distinguish a healthy finish (`isComplete`) from a silent death. A walk is\n   * stuck precisely when the resilient slot settled `failed` AND the paginator\n   * has NOT reached `done` — a terminal failure on the final page that also\n   * finished the walk is `isComplete`, not stuck. Pairs with `failure(s)`, which\n   * hands back the error that stuck it.\n   */\n  function isStuck(s: PaginatedWalkState<Cursor, Page>): boolean {\n    return s.resilience.calls[PAGE_KEY]?.phase === \"failed\" && !isDone(s.walk);\n  }\n\n  // === Subs ================================================================\n\n  /**\n   * Pre-wired subscriptions: exactly the resilient-call subs for the page\n   * fetch — a retry timer while the fetch is `waiting_retry`, and (with the\n   * `deadline` brick) a per-fetch deadline timer while it is active. Reconciled\n   * by id, so a phase change cancels the matching timer automatically. Wire\n   * `subscribe: { deadline: subscribeDeadline }` (re-exported below).\n   */\n  function subs(s: PaginatedWalkState<Cursor, Page>): readonly DeadlineSub[] {\n    return rc.subs(s.resilience);\n  }\n\n  // === Handlers ============================================================\n\n  /**\n   * Pre-wired interpret handler for the page-fetch effect. Inherited from\n   * resilient-call (`resilient_run`): wraps the consumer's `run(cursor)` port\n   * via `tryInterpret` (Railway) — success → `resilient_ok` (handled by\n   * `pageOk`), failure → `resilient_err` (handled by `pageErr`), each stamped\n   * with `Date.now()` at the effect boundary (the ONE permitted clock read).\n   *\n   *   interpret: walk.handlers({ run: (cursor) => api.fetchPage(cursor) })\n   *\n   * The consumer maps the inherited Msg types to their `pageOk` / `pageErr`\n   * reducer cells (the wire shape is `resilient_ok` / `resilient_err`).\n   */\n  function handlers(ports: PaginatedWalkPorts<Cursor, Page>) {\n    return rc.handlers(ports);\n  }\n\n  return {\n    init,\n    start,\n    pageOk,\n    pageErr,\n    onTimer,\n    drain,\n    resume,\n    isComplete,\n    failure,\n    isStuck,\n    subs,\n    handlers,\n  };\n}\n\n/**\n * Lift a knob result `[slice, cmds]` into a host `[State, cmds]` where the slice\n * lives at `state.walk`. A convenience for the common single-slice host;\n * consumers with a differently-named field spread by hand. Pure — a thin record\n * rebuild, no clock / RNG.\n */\nexport function liftWalk<\n  S extends { walk: PaginatedWalkState<Cursor, Page> },\n  Cursor,\n  Page,\n  C extends Cmd,\n>(\n  state: S,\n  [slice, cmds]: readonly [PaginatedWalkState<Cursor, Page>, readonly C[]],\n): readonly [S, readonly C[]] {\n  return [{ ...state, walk: slice }, cmds];\n}\n\n/**\n * Re-export the deadline Sub primitives (inherited from resilient-call) so\n * consumers wire one import: `subscribeDeadline` is the `subscribe` cell,\n * `deadlineSub` builds the Sub literal this knob's `subs` emits.\n */\nexport { subscribeDeadline, deadlineSub };\nexport type { DeadlineSub };\n"]}

package/dist/{chunk-ASX7PL2K.js → chunk-JGVL3WPL.js}

@@ -1,5 +1,5 @@
 import { fromTimeout } from './chunk-2YFLOCWX.js';
-import { subId } from './chunk-O7ED34JH.js';
+import { subId } from './chunk-B5VXOFMZ.js';
 
 // src/deadline/index.ts
 function deadlineSub(id, atMs, opts) {
@@ -22,5 +22,5 @@ function deadlineExceeded(id, atMs) {
 }
 
 export { deadlineExceeded, deadlineSub, setTimeoutArmTimer, subscribeDeadline, subscribeWith };
-//# sourceMappingURL=chunk-ASX7PL2K.js.map
-//# sourceMappingURL=chunk-ASX7PL2K.js.map
+//# sourceMappingURL=chunk-JGVL3WPL.js.map
+//# sourceMappingURL=chunk-JGVL3WPL.js.map

package/dist/{chunk-ASX7PL2K.js.map → chunk-JGVL3WPL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/deadline/index.ts"],"names":[],"mappings":";;;;AA6HO,SAAS,WAAA,CACd,EAAA,EACA,IAAA,EACA,IAAA,EACa;AACb,EAAA,OAAO,EAAE,GAAG,IAAA,EAAM,EAAA,EAAI,MAAM,EAAE,CAAA,EAAG,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAC1D;AA6CO,SAAS,cACd,QAAA,EAC0D;AAC1D,EAAA,OAAO,CAAC,GAAA,EAAK,IAAA,EAAM,QAAA,KACjB,SAAS,GAAA,CAAI,EAAA,EAAI,GAAA,CAAI,IAAA,EAAM,iBAAiB,GAAA,CAAI,EAAA,EAAI,GAAA,CAAI,IAAI,GAAG,QAAQ,CAAA;AAC3E;AAeO,SAAS,kBAAA,GAAiD;AAC/D,EAAA,OAAO,CAAC,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,QAAA,KAAa;AAGlC,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,GAAG,IAAA,GAAO,IAAA,CAAK,KAAK,CAAA;AAC7C,IAAA,OAAO,WAAA;AAAA,MACL,MAAM;AAAA,KACR,CAAE,EAAE,EAAA,EAAI,IAAA,EAAM,YAAY,OAAA,EAAQ,EAAG,QAAW,QAAQ,CAAA;AAAA,EAC1D,CAAA;AACF;AAkBO,IAAM,iBAAA,GAIT,aAAA,CAAc,kBAAA,EAAoB;AAO/B,SAAS,gBAAA,CAAiB,IAAY,IAAA,EAAgC;AAC3E,EAAA,OAAO,EAAE,IAAA,EAAM,mBAAA,EAAqB,EAAA,EAAI,IAAA,EAAK;AAC/C","file":"chunk-ASX7PL2K.js","sourcesContent":["/**\n * @demlik/tea/deadline — a one-shot Sub that fires when an ABSOLUTE wall-clock\n * deadline is reached.\n *\n * Generalizes the recurring \"auto-fail a machine at T+N\" / \"15-minute stale\n * guard\" pattern: a Sub whose `subscriptions(state)` returns it only while the\n * deadline should be armed, and which dispatches a single `DeadlineExceeded`\n * Msg when the wall clock crosses `atMs`.\n *\n * Difference from `fromTimeout` (relative — \"fire after N ms\"): a deadline is\n * an ABSOLUTE target. The delay is computed at subscribe time as\n * `max(0, atMs - Date.now())`. The consequence that matters: subscribing LATE —\n * e.g. after a `Store` rehydrate that resumes a machine whose deadline was set\n * before the page reloaded — still fires at the correct absolute moment,\n * because the remaining delay is recomputed from the current clock, not stored\n * in the Sub. A deadline already in the past at subscribe time yields delay `0`,\n * so `setTimeout(fn, 0)` fires on the NEXT tick (never synchronously inside the\n * reconcile pass — the substrate must finish wiring all subs before any Msg\n * lands).\n *\n * Composition over reinvention: the timer lifecycle is `fromTimeout`'s, not\n * redrawn here. `deadlineSub` produces the Sub literal carrying `atMs`; the\n * `subscribe` cell (`subscribeDeadline`) translates `atMs` → a relative delay\n * and delegates the `setTimeout` / `clearTimeout` to `fromTimeout`. The clock\n * read (`Date.now()`) lives only in the subscribe handler — never in a reducer\n * (invariant 2) — and is exercised in tests via vitest fake timers, matching\n * the no-injection convention of the `fromTimeout` / `fromInterval` exemplars.\n *\n * WHAT BACKS THE TIMER IS THE HOST'S CHOICE. `setTimeout` is the universal\n * default, but it is not universal: a Durable Object that hibernates has no\n * live `setTimeout` to wake it, so its deadline must be backed by a `do_alarm`\n * registered on the alarm registry; a test host wants a fake-timer schedule.\n * That backing is the `ArmTimer` seam — `subscribeWith(armTimer)` builds the\n * `subscribe.deadline` cell from a host-plugged timer, and `subscribeDeadline`\n * IS `subscribeWith(setTimeoutArmTimer())`. One deadline surface, three hosts;\n * there is no second Sub type and no second `atMs` anchor to keep in sync.\n *\n * The anchor is what makes the seam safe. `atMs` is ABSOLUTE, so whatever backs\n * it arms to a fixed wall-clock instant: the host computes the gap itself\n * (`atMs - Date.now()`), and on a host that just rehydrated after hibernation\n * that gap is the SHRUNKEN remainder — the deadline honours the original target\n * rather than resetting to a fresh full-length window.\n *\n * Strengthens invariant 4 (external time is a subscription — the deadline is a\n * `Sub` the runtime reconciles, never a `setTimeout` leaked into a reducer) and\n * invariant 7 (identity is explicit — the Sub carries a stable `SubId`, so the\n * reconcile pass leaves it running across transitions instead of churning it).\n */\n\nimport { type Sub, type SubId, subId } from \"../index\";\nimport { fromTimeout } from \"../subs/from-timeout\";\nimport type { SubscribeHandler } from \"../subs/types\";\n\n/**\n * The Sub variant a deadline produces. `atMs` is the absolute target — epoch\n * milliseconds (the `Date.now()` / `Date.parse(...)` scale), NOT a relative\n * delay. It rides on the Sub so the reconcile pass keys identity by `id`\n * alone: the same `id` across transitions means the same armed timer, even if\n * a later `subscriptions(state)` recomputes the literal.\n *\n * Lowercase `\"deadline\"` discriminant per the Sub naming convention (a source\n * noun that doubles as the SubId family); same shape family as the\n * `TimeoutSubData` the `fromTimeout` factory consumes.\n */\nexport type DeadlineSub = Sub<\"deadline\"> & {\n  readonly atMs: number;\n} & DeadlineOpts;\n\n/**\n * Additive options the `deadlineSub` factory folds onto the Sub literal. This\n * is the extension seam (invariant 5 — composition by reduction): future fields\n * — `repeatMs` for a re-arming deadline, `jitterMs` for spread, etc. — land HERE\n * as optional members, and every existing call site keeps compiling because the\n * factory's third parameter is optional and the fields are `readonly` optionals\n * on `DeadlineSub`. Callers are insulated from the concrete `DeadlineSub` shape:\n * they ask for what they need by name, never positionally, so a shape extension\n * never rewrites the ~13 `deadlineSub(id, atMs)` call sites.\n *\n * Empty today on purpose — the seam exists before the first extension does, so\n * the first field is a one-line additive change, not a 13-site migration.\n */\n// biome-ignore lint/complexity/noBannedTypes: intentional empty extension seam — fields are added additively (see doc above).\nexport type DeadlineOpts = {};\n\n/**\n * The Msg the deadline dispatches when the wall clock crosses `atMs`. Exported\n * as a tagged shape so consumers can union it into their machine's Msg type and\n * handle it in a reducer cell. `id` lets a reducer disambiguate WHICH deadline\n * fired when a machine arms several at once; `atMs` echoes the target the timer\n * was scheduled against (useful for assertions / observability).\n *\n * Snake-shaped `\"deadline_exceeded\"` matches the tagged-Msg style this module's\n * orchestrator requested; the actor-in-name PascalCase convention\n * (`TimerFiredDeadline`) is the consumer's to apply at their own boundary if\n * they prefer — `deadlineExceeded(...)` only fixes the wire shape, not the\n * consumer's local dialect.\n */\nexport type DeadlineExceeded = {\n  readonly type: \"deadline_exceeded\";\n  readonly id: string;\n  readonly atMs: number;\n};\n\n/**\n * Build a deadline Sub literal. Pure data — no clock read, no timer; the timer\n * is armed later by the `subscribe` cell. `id` is branded via `subId(...)` so\n * accidental raw-string drift fails at the type level (invariant 7).\n *\n * Return the result directly from `subscriptions(state)` while the deadline\n * should be armed; drop it (return `[]`, or stop returning this id) to disarm —\n * the reconcile pass calls the cleanup, clearing the pending timer before it\n * fires. That is the \"cancel on state exit\" lifecycle, identical to\n * `fromTimeout`'s.\n *\n * @param id   Stable identity for this deadline. Same `id` across transitions =\n *             same armed timer (no churn). Use distinct ids for distinct\n *             deadlines on the same machine.\n * @param atMs Absolute target in epoch milliseconds (e.g. `Date.now() + 900_000`\n *             for a 15-minute guard, or a persisted `expiresAt`).\n * @param opts Optional additive fields folded onto the Sub literal (see\n *             {@link DeadlineOpts}). Omit it for the common case; pass it when a\n *             future field (e.g. `repeatMs`) needs to ride on the deadline. The\n *             optionality is the future-proofing seam — extending the shape\n *             never breaks an existing `deadlineSub(id, atMs)` call site.\n */\nexport function deadlineSub(\n  id: string,\n  atMs: number,\n  opts?: DeadlineOpts,\n): DeadlineSub {\n  return { ...opts, id: subId(id), type: \"deadline\", atMs };\n}\n\n/**\n * The host-plugged timer backing. Given the deadline's stable `id`, its\n * absolute `atMs`, and the Msg to fire, arm the platform-appropriate timer\n * (DO alarm registry, `setTimeout`, fake timer) and return a cleanup that\n * cancels the pending fire.\n *\n * `id` is the Sub's reconcile id — a registry-backed host (the DO alarm slot)\n * keys its entry on `id` so the cleanup deletes the EXACT entry the substrate\n * reconciled. A `setTimeout`-backed host ignores `id` (the closure holds the\n * handle).\n *\n * The host computes the gap itself: `atMs - Date.now()` is the REMAINING time.\n * On a host that just rehydrated after hibernation that gap is the shrunken\n * remainder — the deadline is NOT reset to its full length. That recomputation\n * is the reason `atMs` rides on the Sub as an absolute instant rather than a\n * delay: the anchor is what every backing agrees on.\n */\nexport type ArmTimer<M> = (\n  id: SubId,\n  atMs: number,\n  msg: M,\n  dispatch: (msg: M) => void,\n) => () => void;\n\n/**\n * Build the `subscribe[\"deadline\"]` cell from a host-plugged `armTimer`. This\n * module owns the Sub shape, the anchor, and the Msg; the HOST owns what backs\n * the timer. The returned handler reads `id` + `atMs` off the Sub, builds the\n * `deadlineExceeded(...)` Msg, and hands all three to `armTimer`.\n *\n * Use it when `setTimeout` is the wrong backing — most concretely a Durable\n * Object, which hibernates and must register a `do_alarm` instead:\n *\n *   subscribe: {\n *     deadline: subscribeWith((id, atMs, msg, dispatch) =>\n *       alarms.register(id, atMs, () => dispatch(msg)),\n *     ),\n *   }\n *\n * For the `setTimeout` default, use {@link subscribeDeadline} — it is exactly\n * `subscribeWith(setTimeoutArmTimer())`, so there is one deadline surface and\n * one anchor, not a second one per host.\n */\nexport function subscribeWith(\n  armTimer: ArmTimer<DeadlineExceeded>,\n): SubscribeHandler<DeadlineSub, DeadlineExceeded, unknown> {\n  return (sub, _ctx, dispatch) =>\n    armTimer(sub.id, sub.atMs, deadlineExceeded(sub.id, sub.atMs), dispatch);\n}\n\n/**\n * The `setTimeout` timer backing — for node / browser / any host whose timer is\n * a plain `setTimeout`. Arms for the REMAINING time (`max(0, atMs - Date.now())`,\n * floored at 0 so an already-past deadline fires on the NEXT tick rather than\n * synchronously inside the reconcile pass), so a deadline re-derived after a\n * rehydrate fires at the original instant, not a fresh full window.\n *\n * Composes on `fromTimeout` rather than redrawing `setTimeout` /\n * `clearTimeout`: this package has ONE timer lifecycle, and the arm-timer seam\n * plugs into it instead of forking it. A hibernating host does NOT use this —\n * it plugs its own `armTimer` (a `do_alarm` registration) into\n * {@link subscribeWith}.\n */\nexport function setTimeoutArmTimer(): ArmTimer<DeadlineExceeded> {\n  return (id, atMs, msg, dispatch) => {\n    // Recompute the remaining delay from the CURRENT clock so a late subscribe\n    // (post-rehydrate) still targets the correct absolute moment.\n    const delayMs = Math.max(0, atMs - Date.now());\n    return fromTimeout<Sub<\"deadline\"> & { delayMs: number }, DeadlineExceeded>(\n      () => msg,\n    )({ id, type: \"deadline\", delayMs }, undefined, dispatch);\n  };\n}\n\n/**\n * The `subscribe[\"deadline\"]` cell for the DEFAULT `setTimeout` backing. Arms a\n * one-shot timer for the remaining delay `max(0, atMs - Date.now())` and\n * dispatches `deadlineExceeded(...)` when it fires; returns a cleanup that\n * clears the pending timer.\n *\n * It is `subscribeWith(setTimeoutArmTimer())` — the default backing named, not\n * a separate implementation, so the host-plugged path and the default path can\n * never disagree about the anchor.\n *\n * Assign directly to a `Subscribe` cell:\n *\n *   subscribe: {\n *     deadline: subscribeDeadline,\n *   }\n */\nexport const subscribeDeadline: SubscribeHandler<\n  DeadlineSub,\n  DeadlineExceeded,\n  unknown\n> = subscribeWith(setTimeoutArmTimer());\n\n/**\n * Construct the Msg the deadline dispatches. Exported so consumers can build /\n * assert the same shape (and so the subscribe cell and tests share one\n * constructor rather than two literals that can drift).\n */\nexport function deadlineExceeded(id: string, atMs: number): DeadlineExceeded {\n  return { type: \"deadline_exceeded\", id, atMs };\n}\n"]}
+{"version":3,"sources":["../src/deadline/index.ts"],"names":[],"mappings":";;;;AA6HO,SAAS,WAAA,CACd,EAAA,EACA,IAAA,EACA,IAAA,EACa;AACb,EAAA,OAAO,EAAE,GAAG,IAAA,EAAM,EAAA,EAAI,MAAM,EAAE,CAAA,EAAG,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAC1D;AA6CO,SAAS,cACd,QAAA,EAC0D;AAC1D,EAAA,OAAO,CAAC,GAAA,EAAK,IAAA,EAAM,QAAA,KACjB,SAAS,GAAA,CAAI,EAAA,EAAI,GAAA,CAAI,IAAA,EAAM,iBAAiB,GAAA,CAAI,EAAA,EAAI,GAAA,CAAI,IAAI,GAAG,QAAQ,CAAA;AAC3E;AAeO,SAAS,kBAAA,GAAiD;AAC/D,EAAA,OAAO,CAAC,EAAA,EAAI,IAAA,EAAM,GAAA,EAAK,QAAA,KAAa;AAGlC,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,GAAG,IAAA,GAAO,IAAA,CAAK,KAAK,CAAA;AAC7C,IAAA,OAAO,WAAA;AAAA,MACL,MAAM;AAAA,KACR,CAAE,EAAE,EAAA,EAAI,IAAA,EAAM,YAAY,OAAA,EAAQ,EAAG,QAAW,QAAQ,CAAA;AAAA,EAC1D,CAAA;AACF;AAkBO,IAAM,iBAAA,GAIT,aAAA,CAAc,kBAAA,EAAoB;AAO/B,SAAS,gBAAA,CAAiB,IAAY,IAAA,EAAgC;AAC3E,EAAA,OAAO,EAAE,IAAA,EAAM,mBAAA,EAAqB,EAAA,EAAI,IAAA,EAAK;AAC/C","file":"chunk-JGVL3WPL.js","sourcesContent":["/**\n * @demlik/tea/deadline — a one-shot Sub that fires when an ABSOLUTE wall-clock\n * deadline is reached.\n *\n * Generalizes the recurring \"auto-fail a machine at T+N\" / \"15-minute stale\n * guard\" pattern: a Sub whose `subscriptions(state)` returns it only while the\n * deadline should be armed, and which dispatches a single `DeadlineExceeded`\n * Msg when the wall clock crosses `atMs`.\n *\n * Difference from `fromTimeout` (relative — \"fire after N ms\"): a deadline is\n * an ABSOLUTE target. The delay is computed at subscribe time as\n * `max(0, atMs - Date.now())`. The consequence that matters: subscribing LATE —\n * e.g. after a `Store` rehydrate that resumes a machine whose deadline was set\n * before the page reloaded — still fires at the correct absolute moment,\n * because the remaining delay is recomputed from the current clock, not stored\n * in the Sub. A deadline already in the past at subscribe time yields delay `0`,\n * so `setTimeout(fn, 0)` fires on the NEXT tick (never synchronously inside the\n * reconcile pass — the substrate must finish wiring all subs before any Msg\n * lands).\n *\n * Composition over reinvention: the timer lifecycle is `fromTimeout`'s, not\n * redrawn here. `deadlineSub` produces the Sub literal carrying `atMs`; the\n * `subscribe` cell (`subscribeDeadline`) translates `atMs` → a relative delay\n * and delegates the `setTimeout` / `clearTimeout` to `fromTimeout`. The clock\n * read (`Date.now()`) lives only in the subscribe handler — never in a reducer\n * (invariant 2) — and is exercised in tests via vitest fake timers, matching\n * the no-injection convention of the `fromTimeout` / `fromInterval` exemplars.\n *\n * WHAT BACKS THE TIMER IS THE HOST'S CHOICE. `setTimeout` is the universal\n * default, but it is not universal: a Durable Object that hibernates has no\n * live `setTimeout` to wake it, so its deadline must be backed by a `do_alarm`\n * registered on the alarm registry; a test host wants a fake-timer schedule.\n * That backing is the `ArmTimer` seam — `subscribeWith(armTimer)` builds the\n * `subscribe.deadline` cell from a host-plugged timer, and `subscribeDeadline`\n * IS `subscribeWith(setTimeoutArmTimer())`. One deadline surface, three hosts;\n * there is no second Sub type and no second `atMs` anchor to keep in sync.\n *\n * The anchor is what makes the seam safe. `atMs` is ABSOLUTE, so whatever backs\n * it arms to a fixed wall-clock instant: the host computes the gap itself\n * (`atMs - Date.now()`), and on a host that just rehydrated after hibernation\n * that gap is the SHRUNKEN remainder — the deadline honours the original target\n * rather than resetting to a fresh full-length window.\n *\n * Strengthens invariant 4 (external time is a subscription — the deadline is a\n * `Sub` the runtime reconciles, never a `setTimeout` leaked into a reducer) and\n * invariant 7 (identity is explicit — the Sub carries a stable `SubId`, so the\n * reconcile pass leaves it running across transitions instead of churning it).\n */\n\nimport { type Sub, type SubId, subId } from \"../index\";\nimport { fromTimeout } from \"../subs/from-timeout\";\nimport type { SubscribeHandler } from \"../subs/types\";\n\n/**\n * The Sub variant a deadline produces. `atMs` is the absolute target — epoch\n * milliseconds (the `Date.now()` / `Date.parse(...)` scale), NOT a relative\n * delay. It rides on the Sub so the reconcile pass keys identity by `id`\n * alone: the same `id` across transitions means the same armed timer, even if\n * a later `subscriptions(state)` recomputes the literal.\n *\n * Lowercase `\"deadline\"` discriminant per the Sub naming convention (a source\n * noun that doubles as the SubId family); same shape family as the\n * `TimeoutSubData` the `fromTimeout` factory consumes.\n */\nexport type DeadlineSub = Sub<\"deadline\"> & {\n  readonly atMs: number;\n} & DeadlineOpts;\n\n/**\n * Additive options the `deadlineSub` factory folds onto the Sub literal. This\n * is the extension seam (invariant 5 — composition by reduction): future fields\n * — `repeatMs` for a re-arming deadline, `jitterMs` for spread, etc. — land HERE\n * as optional members, and every existing call site keeps compiling because the\n * factory's third parameter is optional and the fields are `readonly` optionals\n * on `DeadlineSub`. Callers are insulated from the concrete `DeadlineSub` shape:\n * they ask for what they need by name, never positionally, so a shape extension\n * never rewrites the ~13 `deadlineSub(id, atMs)` call sites.\n *\n * Empty today on purpose — the seam exists before the first extension does, so\n * the first field is a one-line additive change, not a 13-site migration.\n */\n// biome-ignore lint/complexity/noBannedTypes: intentional empty extension seam — fields are added additively (see doc above).\nexport type DeadlineOpts = {};\n\n/**\n * The Msg the deadline dispatches when the wall clock crosses `atMs`. Exported\n * as a tagged shape so consumers can union it into their machine's Msg type and\n * handle it in a reducer cell. `id` lets a reducer disambiguate WHICH deadline\n * fired when a machine arms several at once; `atMs` echoes the target the timer\n * was scheduled against (useful for assertions / observability).\n *\n * Snake-shaped `\"deadline_exceeded\"` matches the tagged-Msg style this module's\n * orchestrator requested; the actor-in-name PascalCase convention\n * (`TimerFiredDeadline`) is the consumer's to apply at their own boundary if\n * they prefer — `deadlineExceeded(...)` only fixes the wire shape, not the\n * consumer's local dialect.\n */\nexport type DeadlineExceeded = {\n  readonly type: \"deadline_exceeded\";\n  readonly id: string;\n  readonly atMs: number;\n};\n\n/**\n * Build a deadline Sub literal. Pure data — no clock read, no timer; the timer\n * is armed later by the `subscribe` cell. `id` is branded via `subId(...)` so\n * accidental raw-string drift fails at the type level (invariant 7).\n *\n * Return the result directly from `subscriptions(state)` while the deadline\n * should be armed; drop it (return `[]`, or stop returning this id) to disarm —\n * the reconcile pass calls the cleanup, clearing the pending timer before it\n * fires. That is the \"cancel on state exit\" lifecycle, identical to\n * `fromTimeout`'s.\n *\n * @param id   Stable identity for this deadline. Same `id` across transitions =\n *             same armed timer (no churn). Use distinct ids for distinct\n *             deadlines on the same machine.\n * @param atMs Absolute target in epoch milliseconds (e.g. `Date.now() + 900_000`\n *             for a 15-minute guard, or a persisted `expiresAt`).\n * @param opts Optional additive fields folded onto the Sub literal (see\n *             {@link DeadlineOpts}). Omit it for the common case; pass it when a\n *             future field (e.g. `repeatMs`) needs to ride on the deadline. The\n *             optionality is the future-proofing seam — extending the shape\n *             never breaks an existing `deadlineSub(id, atMs)` call site.\n */\nexport function deadlineSub(\n  id: string,\n  atMs: number,\n  opts?: DeadlineOpts,\n): DeadlineSub {\n  return { ...opts, id: subId(id), type: \"deadline\", atMs };\n}\n\n/**\n * The host-plugged timer backing. Given the deadline's stable `id`, its\n * absolute `atMs`, and the Msg to fire, arm the platform-appropriate timer\n * (DO alarm registry, `setTimeout`, fake timer) and return a cleanup that\n * cancels the pending fire.\n *\n * `id` is the Sub's reconcile id — a registry-backed host (the DO alarm slot)\n * keys its entry on `id` so the cleanup deletes the EXACT entry the substrate\n * reconciled. A `setTimeout`-backed host ignores `id` (the closure holds the\n * handle).\n *\n * The host computes the gap itself: `atMs - Date.now()` is the REMAINING time.\n * On a host that just rehydrated after hibernation that gap is the shrunken\n * remainder — the deadline is NOT reset to its full length. That recomputation\n * is the reason `atMs` rides on the Sub as an absolute instant rather than a\n * delay: the anchor is what every backing agrees on.\n */\nexport type ArmTimer<M> = (\n  id: SubId,\n  atMs: number,\n  msg: M,\n  dispatch: (msg: M) => void,\n) => () => void;\n\n/**\n * Build the `subscribe[\"deadline\"]` cell from a host-plugged `armTimer`. This\n * module owns the Sub shape, the anchor, and the Msg; the HOST owns what backs\n * the timer. The returned handler reads `id` + `atMs` off the Sub, builds the\n * `deadlineExceeded(...)` Msg, and hands all three to `armTimer`.\n *\n * Use it when `setTimeout` is the wrong backing — most concretely a Durable\n * Object, which hibernates and must register a `do_alarm` instead:\n *\n *   subscribe: {\n *     deadline: subscribeWith((id, atMs, msg, dispatch) =>\n *       alarms.register(id, atMs, () => dispatch(msg)),\n *     ),\n *   }\n *\n * For the `setTimeout` default, use {@link subscribeDeadline} — it is exactly\n * `subscribeWith(setTimeoutArmTimer())`, so there is one deadline surface and\n * one anchor, not a second one per host.\n */\nexport function subscribeWith(\n  armTimer: ArmTimer<DeadlineExceeded>,\n): SubscribeHandler<DeadlineSub, DeadlineExceeded, unknown> {\n  return (sub, _ctx, dispatch) =>\n    armTimer(sub.id, sub.atMs, deadlineExceeded(sub.id, sub.atMs), dispatch);\n}\n\n/**\n * The `setTimeout` timer backing — for node / browser / any host whose timer is\n * a plain `setTimeout`. Arms for the REMAINING time (`max(0, atMs - Date.now())`,\n * floored at 0 so an already-past deadline fires on the NEXT tick rather than\n * synchronously inside the reconcile pass), so a deadline re-derived after a\n * rehydrate fires at the original instant, not a fresh full window.\n *\n * Composes on `fromTimeout` rather than redrawing `setTimeout` /\n * `clearTimeout`: this package has ONE timer lifecycle, and the arm-timer seam\n * plugs into it instead of forking it. A hibernating host does NOT use this —\n * it plugs its own `armTimer` (a `do_alarm` registration) into\n * {@link subscribeWith}.\n */\nexport function setTimeoutArmTimer(): ArmTimer<DeadlineExceeded> {\n  return (id, atMs, msg, dispatch) => {\n    // Recompute the remaining delay from the CURRENT clock so a late subscribe\n    // (post-rehydrate) still targets the correct absolute moment.\n    const delayMs = Math.max(0, atMs - Date.now());\n    return fromTimeout<Sub<\"deadline\"> & { delayMs: number }, DeadlineExceeded>(\n      () => msg,\n    )({ id, type: \"deadline\", delayMs }, undefined, dispatch);\n  };\n}\n\n/**\n * The `subscribe[\"deadline\"]` cell for the DEFAULT `setTimeout` backing. Arms a\n * one-shot timer for the remaining delay `max(0, atMs - Date.now())` and\n * dispatches `deadlineExceeded(...)` when it fires; returns a cleanup that\n * clears the pending timer.\n *\n * It is `subscribeWith(setTimeoutArmTimer())` — the default backing named, not\n * a separate implementation, so the host-plugged path and the default path can\n * never disagree about the anchor.\n *\n * Assign directly to a `Subscribe` cell:\n *\n *   subscribe: {\n *     deadline: subscribeDeadline,\n *   }\n */\nexport const subscribeDeadline: SubscribeHandler<\n  DeadlineSub,\n  DeadlineExceeded,\n  unknown\n> = subscribeWith(setTimeoutArmTimer());\n\n/**\n * Construct the Msg the deadline dispatches. Exported so consumers can build /\n * assert the same shape (and so the subscribe cell and tests share one\n * constructor rather than two literals that can drift).\n */\nexport function deadlineExceeded(id: string, atMs: number): DeadlineExceeded {\n  return { type: \"deadline_exceeded\", id, atMs };\n}\n"]}

package/dist/{chunk-S6Y3RNX4.js → chunk-JP5D6GSL.js}

@@ -1,5 +1,5 @@
-import { replay } from './chunk-ZH454CR5.js';
-import { applyCell } from './chunk-O7ED34JH.js';
+import { replay } from './chunk-5EHLEUTL.js';
+import { applyCell } from './chunk-B5VXOFMZ.js';
 import * as fc from 'fast-check';
 
 // src/pbt/runners/replay-fold.ts
@@ -67,5 +67,5 @@ function propertyTrace(machine, ctx, seqArb, predicate, opts) {
 }
 
 export { foldEvents, propertyInvariant, propertyTerminates, propertyTrace };
-//# sourceMappingURL=chunk-S6Y3RNX4.js.map
-//# sourceMappingURL=chunk-S6Y3RNX4.js.map
+//# sourceMappingURL=chunk-JP5D6GSL.js.map
+//# sourceMappingURL=chunk-JP5D6GSL.js.map

package/dist/{chunk-S6Y3RNX4.js.map → chunk-JP5D6GSL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/pbt/runners/replay-fold.ts","../src/pbt/runners/property.ts"],"names":[],"mappings":";;;;;AAiEO,SAAS,UAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,IAAA,EAKA;AAKA,EAAA,MAAM,EAAE,KAAA,EAAO,YAAA,EAAa,GAAI,OAAO,OAAA,EAAS;AAAA,IAC9C,MAAM,EAAC;AAAA,IACP,GAAA;AAAA,IACA,QAAQ,MAAA,IAAU;AAAA,GACnB,CAAA;AAKD,EAAA,MAAM,MAAA,GAAc,CAAC,YAAY,CAAA;AACjC,EAAA,MAAM,QAAyB,EAAC;AAChC,EAAA,IAAI,OAAA,GAAU,YAAA;AAEd,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,CAAC,IAAA,EAAM,OAAO,IAAI,SAAA,CAAmB,OAAA,EAAS,SAAS,GAAG,CAAA;AAChE,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,IAAA,EAAM,IAAA,EAAM,CAAC,GAAG,OAAO,CAAA,EAAG,CAAA;AAC3D,IAAA,MAAA,CAAO,KAAK,IAAI,CAAA;AAChB,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,UAAA,EAAY,OAAA,EAAQ;AAC9C;;;AC5DA,SAAS,gBACP,IAAA,EAC+B;AAC/B,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,MAAM,OAAA,IAAW,GAAA;AAAA,IAC1B,GAAI,MAAM,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,GAAI;AAAC,GACxD;AACF;AAQA,SAAS,WAAA,CAOP,OAAA,EACA,GAAA,EACA,MAAA,EACA,MACA,KAAA,EACM;AACN,EAAG,EAAA,CAAA,MAAA;AAAA,IACE,EAAA,CAAA,QAAA,CAAS,MAAA,EAAQ,CAAC,IAAA,KAAS;AAC5B,MAAA,KAAA,CAAM,WAAW,OAAA,EAAS,GAAA,EAAK,MAAM,MAAA,IAAU,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,IAC5D,CAAC,CAAA;AAAA,IACD,gBAAmB,IAAI;AAAA,GACzB;AACF;AAoBO,SAAS,kBAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,UACA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,SAAS,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAC,EAAE,YAAW,KAAM;AAC1D,IAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AAIzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,yEAAA,EACY,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,OACxC;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH;AAuBO,SAAS,iBAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,WACA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,SAAS,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAC,EAAE,OAAM,KAAM;AACrD,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,CAAC,SAAA,CAAU,IAAI,CAAA,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,sCAAA,EAAyC,KAAK,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC,CAAA,MAAA,EACvD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,MAAA,EAAS,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,SAC3D,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,SACrC;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH;AAiBO,SAAS,aAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,WAIA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,OAAA,EAAS,KAAK,MAAA,EAAQ,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,YAAW,KAAM;AACjE,IAAA,IAAI,CAAC,SAAA,CAAU,KAAA,EAAO,UAAU,CAAA,EAAG;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,mDAAmD,KAAA,CAAM,MAAM,WACpD,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,OACvC;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH","file":"chunk-S6Y3RNX4.js","sourcesContent":["// ---------------------------------------------------------------------------\n// `foldEvents` — pure deterministic fold over a Msg sequence.\n//\n// PBT needs the per-step (prev/msg/next/cmds) structure to assert\n// step-shaped invariants. The substrate's `replay(machine, opts)` returns\n// only final state + cumulative cmds — insufficient. We use `replay` for\n// the boot step (calls `machine.init(loaded, ctx)` faithfully) then walk\n// msgs ourselves through `applyCell`, the substrate's own cell dispatch.\n//\n// Why walk cells directly instead of looping `replay` once per msg with\n// `loaded: prevState`? Because `init(loaded)` runs every call, and on\n// machines with non-trivial init transforms (e.g. the audit machine's\n// `auditing → attach_debugger` resume cell) that would either (a) re-fire\n// the transform on every step, or (b) require fragile cmd-subtraction to\n// isolate this step's cmds. Calling the cells directly keeps the fold pure\n// and the cmds per-step exactly.\n//\n// Dispatches through `applyCell` — the single primitive `run`/`replay` use —\n// so form classification agrees with production by construction (#275).\n//\n// `foldEvents` does NOT call `interpret`, does NOT touch a Store, does NOT\n// start Subs. The reducer surface is the contract.\n// ---------------------------------------------------------------------------\n\nimport {\n  applyCell,\n  type Cmd,\n  type Machine,\n  replay,\n  type Sub,\n} from \"../../index\";\n\n/**\n * One unit in a fold trace — the four pieces of data a property\n * invariant typically asserts on. `prev` is the state before the msg\n * applied; `next` is the state after; `cmds` is the cmds emitted by this\n * single step (NOT the running total).\n */\nexport interface Step<S, M, C> {\n  readonly prev: S;\n  readonly msg: M;\n  readonly next: S;\n  readonly cmds: readonly C[];\n}\n\n/**\n * Fold a Msg sequence through a machine's pure reducer, returning the\n * per-step trace, every state in order, and the final state. Initial\n * state comes from `replay(machine, { msgs: [], ctx, loaded })` — i.e.\n * `machine.init(loaded ?? null, ctx)` faithfully. Init's emitted cmds\n * are NOT included in any `Step` (they're the boot moment, not a Msg).\n *\n * @param machine  The machine under test.\n * @param ctx      The Ctx — typically `stubCtxThrowingProxy<Ctx>()` when\n *                 init is pure. Pass a real ctx if init reads from it.\n * @param loaded   Optional pre-init snapshot (the `loaded` arg to\n *                 `machine.init`). Defaults to `null` (fresh boot).\n * @param msgs     The Msg sequence to fold.\n *\n * @example\n *   const { states, steps, finalState } = foldEvents(machine, ctx, null, [\n *     { type: \"start\" }, { type: \"tick\" }, { type: \"stop\" },\n *   ]);\n *   // steps[1] = { prev: { type: \"counting\", n: 0 }, msg: { type: \"tick\" }, ... }\n */\nexport function foldEvents<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  loaded: NoInfer<S> | null,\n  msgs: readonly NoInfer<M>[],\n): {\n  readonly states: readonly S[];\n  readonly steps: readonly Step<S, M, C>[];\n  readonly finalState: S;\n} {\n  // Boot through `replay` so `init` runs faithfully and we honor the\n  // substrate's loaded-snapshot contract (init may transform the loaded\n  // value before the first Msg lands — e.g. the audit machine flips\n  // `debuggerAttached: false` on resume).\n  const { state: initialState } = replay(machine, {\n    msgs: [],\n    ctx,\n    loaded: loaded ?? null,\n  });\n\n  // Per-msg dispatch goes through `applyCell` — the same primitive `run` and\n  // `replay` use — so this runner classifies the update form identically to\n  // production (`formOf` honors the `__form` tag; #275).\n  const states: S[] = [initialState];\n  const steps: Step<S, M, C>[] = [];\n  let current = initialState;\n\n  for (const msg of msgs) {\n    const [next, emitted] = applyCell<S, M, C>(machine, current, msg);\n    steps.push({ prev: current, msg, next, cmds: [...emitted] });\n    states.push(next);\n    current = next;\n  }\n\n  return { states, steps, finalState: current };\n}\n","// ---------------------------------------------------------------------------\n// Property runners — three thin wrappers over `fc.assert(fc.property(...))`\n// that fold a generated Msg sequence through the machine via `foldEvents`\n// and pipe the result into a TEA-shaped predicate.\n//\n//   - `propertyTerminates` — every sequence ends in a terminal state.\n//   - `propertyInvariant`  — predicate holds on every (prev, msg, next, cmds) step.\n//   - `propertyTrace`      — predicate holds on the full (trace, final) shape.\n//\n// Each runner accepts `numRuns` (passed through to fast-check), an optional\n// `loaded` snapshot (forwarded to `foldEvents`), and the Msg-sequence\n// arbitrary. They return `void`; failures throw via fast-check's standard\n// shrinking output.\n//\n// Default shrinker is fast-check's built-in (open question 4): drop-msg /\n// prefix shrinkers can be layered later but are opt-in, not default. The\n// built-in shrinker handles array-shape shrinking + per-element variant\n// shrinking automatically.\n// ---------------------------------------------------------------------------\n\nimport * as fc from \"fast-check\";\nimport type { Cmd, Machine, Sub } from \"../../index\";\nimport { foldEvents, type Step } from \"./replay-fold\";\n\n/** Common options shared by every property runner. */\ninterface PropertyOpts<S> {\n  /** Pre-init snapshot — passed to `machine.init(loaded, ctx)`. Default `null`. */\n  readonly loaded?: S | null;\n  /** Number of generated sequences to test. Forwarded to `fc.assert`. */\n  readonly numRuns?: number;\n  /** Optional fast-check seed for reproducibility. */\n  readonly seed?: number;\n}\n\n/** The `foldEvents` result a runner's `check` inspects. */\ntype FoldResult<S, M, C> = {\n  readonly states: readonly S[];\n  readonly steps: readonly Step<S, M, C>[];\n  readonly finalState: S;\n};\n\n/**\n * Build the fast-check parameters shared by every runner: the 200-default\n * `numRuns` plus an optional `seed`. Single source of truth so a change to\n * the default lands in one place.\n */\nfunction resolveFcParams<M>(\n  opts: PropertyOpts<unknown> | undefined,\n): fc.Parameters<[readonly M[]]> {\n  return {\n    numRuns: opts?.numRuns ?? 200,\n    ...(opts?.seed !== undefined ? { seed: opts.seed } : {}),\n  };\n}\n\n/**\n * The fold+assert core every runner shares: assert `check` over each\n * generated Msg sequence, folded once through the machine via `foldEvents`.\n * `check` throws on failure so the error message carries the offending\n * shape into fast-check's shrunk counter-example.\n */\nfunction runProperty<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: Ctx,\n  seqArb: fc.Arbitrary<readonly M[]>,\n  opts: PropertyOpts<S> | undefined,\n  check: (result: FoldResult<S, M, C>) => void,\n): void {\n  fc.assert(\n    fc.property(seqArb, (msgs) => {\n      check(foldEvents(machine, ctx, opts?.loaded ?? null, msgs));\n    }),\n    resolveFcParams<M>(opts),\n  );\n}\n\n/**\n * Assert every generated Msg sequence ends in a terminal state. `terminal`\n * is the predicate that names the acceptable final states (often\n * `(s) => s.type === \"done\" || s.type === \"idle\"`).\n *\n * The \"every sequence\" property catches stuck states (machine gets to a\n * non-terminal state and no further msg can escape) AND silent loops\n * (every msg variant is a noop from a given state).\n *\n * @example\n *   propertyTerminates(\n *     auditBackgroundMachine,\n *     stubCtxThrowingProxy<BackgroundCtx>(),\n *     arbMsgSequence(msgArb, { minLength: 1, maxLength: 30 }),\n *     (s) => s.type === \"done\" || s.type === \"idle\",\n *     { loaded: auditingState, numRuns: 500 },\n *   );\n */\nexport function propertyTerminates<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  terminal: (state: NoInfer<S>) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ finalState }) => {\n    if (!terminal(finalState)) {\n      // Throwing here (vs returning false) lets the error message carry\n      // the offending final state — fast-check pretty-prints it inside\n      // the shrunk counter-example.\n      throw new Error(\n        `propertyTerminates: final state did not match terminal predicate. ` +\n          `Final: ${JSON.stringify(finalState)}`,\n      );\n    }\n  });\n}\n\n/**\n * Assert a predicate holds on EVERY transition step in a generated\n * sequence. The predicate sees `{ prev, msg, next, cmds }` per step;\n * return true to accept, false (or throw) to fail.\n *\n * Use to pin a \"when X happens in state Y, cmd Z must be emitted\" rule.\n * The shrinker minimizes the offending sequence to the smallest Msg list\n * that still violates the predicate.\n *\n * @example\n *   // Pin the resume-handshake fix: `ws:client:hello` in auditing must\n *   // emit `send_ws { client:ready }`.\n *   propertyInvariant(\n *     auditBackgroundMachine, ctx,\n *     arbMsgSequence(msgArb, { prefix: [{ type: \"ws:client:hello\" }] }),\n *     ({ prev, msg, cmds }) =>\n *       !(prev.type === \"auditing\" && msg.type === \"ws:client:hello\") ||\n *       cmds.some((c) => c.type === \"send_ws\" && c.msg.type === \"client:ready\"),\n *     { loaded: auditingState, numRuns: 200 },\n *   );\n */\nexport function propertyInvariant<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  invariant: (step: Step<NoInfer<S>, NoInfer<M>, NoInfer<C>>) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ steps }) => {\n    for (const step of steps) {\n      if (!invariant(step)) {\n        throw new Error(\n          `propertyInvariant: failed at step msg=${JSON.stringify(step.msg)} ` +\n            `prev=${JSON.stringify(step.prev)} next=${JSON.stringify(step.next)} ` +\n            `cmds=${JSON.stringify(step.cmds)}`,\n        );\n      }\n    }\n  });\n}\n\n/**\n * Assert a predicate over the full trace plus the final state. Use when\n * the property is \"some Msg appeared in the trace before reaching the\n * final state\" or \"no two consecutive steps had the same state.type\" —\n * predicates that need the full sequence, not a single step.\n *\n * @example\n *   propertyTrace(\n *     machine, ctx, seqArb,\n *     (steps, final) =>\n *       final.type !== \"done\" ||\n *       steps.some((step) => step.msg.type === \"ws:audit:done\"),\n *     { loaded: auditingState, numRuns: 500 },\n *   );\n */\nexport function propertyTrace<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  predicate: (\n    steps: readonly Step<NoInfer<S>, NoInfer<M>, NoInfer<C>>[],\n    finalState: NoInfer<S>,\n  ) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ steps, finalState }) => {\n    if (!predicate(steps, finalState)) {\n      throw new Error(\n        `propertyTrace: predicate failed on trace length=${steps.length}, ` +\n          `final=${JSON.stringify(finalState)}`,\n      );\n    }\n  });\n}\n"]}
+{"version":3,"sources":["../src/pbt/runners/replay-fold.ts","../src/pbt/runners/property.ts"],"names":[],"mappings":";;;;;AAiEO,SAAS,UAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,IAAA,EAKA;AAKA,EAAA,MAAM,EAAE,KAAA,EAAO,YAAA,EAAa,GAAI,OAAO,OAAA,EAAS;AAAA,IAC9C,MAAM,EAAC;AAAA,IACP,GAAA;AAAA,IACA,QAAQ,MAAA,IAAU;AAAA,GACnB,CAAA;AAKD,EAAA,MAAM,MAAA,GAAc,CAAC,YAAY,CAAA;AACjC,EAAA,MAAM,QAAyB,EAAC;AAChC,EAAA,IAAI,OAAA,GAAU,YAAA;AAEd,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,MAAM,CAAC,IAAA,EAAM,OAAO,IAAI,SAAA,CAAmB,OAAA,EAAS,SAAS,GAAG,CAAA;AAChE,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,IAAA,EAAM,IAAA,EAAM,CAAC,GAAG,OAAO,CAAA,EAAG,CAAA;AAC3D,IAAA,MAAA,CAAO,KAAK,IAAI,CAAA;AAChB,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,UAAA,EAAY,OAAA,EAAQ;AAC9C;;;AC5DA,SAAS,gBACP,IAAA,EAC+B;AAC/B,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,MAAM,OAAA,IAAW,GAAA;AAAA,IAC1B,GAAI,MAAM,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,GAAI;AAAC,GACxD;AACF;AAQA,SAAS,WAAA,CAOP,OAAA,EACA,GAAA,EACA,MAAA,EACA,MACA,KAAA,EACM;AACN,EAAG,EAAA,CAAA,MAAA;AAAA,IACE,EAAA,CAAA,QAAA,CAAS,MAAA,EAAQ,CAAC,IAAA,KAAS;AAC5B,MAAA,KAAA,CAAM,WAAW,OAAA,EAAS,GAAA,EAAK,MAAM,MAAA,IAAU,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,IAC5D,CAAC,CAAA;AAAA,IACD,gBAAmB,IAAI;AAAA,GACzB;AACF;AAoBO,SAAS,kBAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,UACA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,SAAS,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAC,EAAE,YAAW,KAAM;AAC1D,IAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AAIzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,yEAAA,EACY,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,OACxC;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH;AAuBO,SAAS,iBAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,WACA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,SAAS,GAAA,EAAK,MAAA,EAAQ,MAAM,CAAC,EAAE,OAAM,KAAM;AACrD,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,CAAC,SAAA,CAAU,IAAI,CAAA,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,sCAAA,EAAyC,KAAK,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC,CAAA,MAAA,EACvD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,MAAA,EAAS,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,SAC3D,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,SACrC;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH;AAiBO,SAAS,aAAA,CAOd,OAAA,EACA,GAAA,EACA,MAAA,EACA,WAIA,IAAA,EACM;AACN,EAAA,WAAA,CAAY,OAAA,EAAS,KAAK,MAAA,EAAQ,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,YAAW,KAAM;AACjE,IAAA,IAAI,CAAC,SAAA,CAAU,KAAA,EAAO,UAAU,CAAA,EAAG;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,mDAAmD,KAAA,CAAM,MAAM,WACpD,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA;AAAA,OACvC;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACH","file":"chunk-JP5D6GSL.js","sourcesContent":["// ---------------------------------------------------------------------------\n// `foldEvents` — pure deterministic fold over a Msg sequence.\n//\n// PBT needs the per-step (prev/msg/next/cmds) structure to assert\n// step-shaped invariants. The substrate's `replay(machine, opts)` returns\n// only final state + cumulative cmds — insufficient. We use `replay` for\n// the boot step (calls `machine.init(loaded, ctx)` faithfully) then walk\n// msgs ourselves through `applyCell`, the substrate's own cell dispatch.\n//\n// Why walk cells directly instead of looping `replay` once per msg with\n// `loaded: prevState`? Because `init(loaded)` runs every call, and on\n// machines with non-trivial init transforms (e.g. the audit machine's\n// `auditing → attach_debugger` resume cell) that would either (a) re-fire\n// the transform on every step, or (b) require fragile cmd-subtraction to\n// isolate this step's cmds. Calling the cells directly keeps the fold pure\n// and the cmds per-step exactly.\n//\n// Dispatches through `applyCell` — the single primitive `run`/`replay` use —\n// so form classification agrees with production by construction (#275).\n//\n// `foldEvents` does NOT call `interpret`, does NOT touch a Store, does NOT\n// start Subs. The reducer surface is the contract.\n// ---------------------------------------------------------------------------\n\nimport {\n  applyCell,\n  type Cmd,\n  type Machine,\n  replay,\n  type Sub,\n} from \"../../index\";\n\n/**\n * One unit in a fold trace — the four pieces of data a property\n * invariant typically asserts on. `prev` is the state before the msg\n * applied; `next` is the state after; `cmds` is the cmds emitted by this\n * single step (NOT the running total).\n */\nexport interface Step<S, M, C> {\n  readonly prev: S;\n  readonly msg: M;\n  readonly next: S;\n  readonly cmds: readonly C[];\n}\n\n/**\n * Fold a Msg sequence through a machine's pure reducer, returning the\n * per-step trace, every state in order, and the final state. Initial\n * state comes from `replay(machine, { msgs: [], ctx, loaded })` — i.e.\n * `machine.init(loaded ?? null, ctx)` faithfully. Init's emitted cmds\n * are NOT included in any `Step` (they're the boot moment, not a Msg).\n *\n * @param machine  The machine under test.\n * @param ctx      The Ctx — typically `stubCtxThrowingProxy<Ctx>()` when\n *                 init is pure. Pass a real ctx if init reads from it.\n * @param loaded   Optional pre-init snapshot (the `loaded` arg to\n *                 `machine.init`). Defaults to `null` (fresh boot).\n * @param msgs     The Msg sequence to fold.\n *\n * @example\n *   const { states, steps, finalState } = foldEvents(machine, ctx, null, [\n *     { type: \"start\" }, { type: \"tick\" }, { type: \"stop\" },\n *   ]);\n *   // steps[1] = { prev: { type: \"counting\", n: 0 }, msg: { type: \"tick\" }, ... }\n */\nexport function foldEvents<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  loaded: NoInfer<S> | null,\n  msgs: readonly NoInfer<M>[],\n): {\n  readonly states: readonly S[];\n  readonly steps: readonly Step<S, M, C>[];\n  readonly finalState: S;\n} {\n  // Boot through `replay` so `init` runs faithfully and we honor the\n  // substrate's loaded-snapshot contract (init may transform the loaded\n  // value before the first Msg lands — e.g. the audit machine flips\n  // `debuggerAttached: false` on resume).\n  const { state: initialState } = replay(machine, {\n    msgs: [],\n    ctx,\n    loaded: loaded ?? null,\n  });\n\n  // Per-msg dispatch goes through `applyCell` — the same primitive `run` and\n  // `replay` use — so this runner classifies the update form identically to\n  // production (`formOf` honors the `__form` tag; #275).\n  const states: S[] = [initialState];\n  const steps: Step<S, M, C>[] = [];\n  let current = initialState;\n\n  for (const msg of msgs) {\n    const [next, emitted] = applyCell<S, M, C>(machine, current, msg);\n    steps.push({ prev: current, msg, next, cmds: [...emitted] });\n    states.push(next);\n    current = next;\n  }\n\n  return { states, steps, finalState: current };\n}\n","// ---------------------------------------------------------------------------\n// Property runners — three thin wrappers over `fc.assert(fc.property(...))`\n// that fold a generated Msg sequence through the machine via `foldEvents`\n// and pipe the result into a TEA-shaped predicate.\n//\n//   - `propertyTerminates` — every sequence ends in a terminal state.\n//   - `propertyInvariant`  — predicate holds on every (prev, msg, next, cmds) step.\n//   - `propertyTrace`      — predicate holds on the full (trace, final) shape.\n//\n// Each runner accepts `numRuns` (passed through to fast-check), an optional\n// `loaded` snapshot (forwarded to `foldEvents`), and the Msg-sequence\n// arbitrary. They return `void`; failures throw via fast-check's standard\n// shrinking output.\n//\n// Default shrinker is fast-check's built-in (open question 4): drop-msg /\n// prefix shrinkers can be layered later but are opt-in, not default. The\n// built-in shrinker handles array-shape shrinking + per-element variant\n// shrinking automatically.\n// ---------------------------------------------------------------------------\n\nimport * as fc from \"fast-check\";\nimport type { Cmd, Machine, Sub } from \"../../index\";\nimport { foldEvents, type Step } from \"./replay-fold\";\n\n/** Common options shared by every property runner. */\ninterface PropertyOpts<S> {\n  /** Pre-init snapshot — passed to `machine.init(loaded, ctx)`. Default `null`. */\n  readonly loaded?: S | null;\n  /** Number of generated sequences to test. Forwarded to `fc.assert`. */\n  readonly numRuns?: number;\n  /** Optional fast-check seed for reproducibility. */\n  readonly seed?: number;\n}\n\n/** The `foldEvents` result a runner's `check` inspects. */\ntype FoldResult<S, M, C> = {\n  readonly states: readonly S[];\n  readonly steps: readonly Step<S, M, C>[];\n  readonly finalState: S;\n};\n\n/**\n * Build the fast-check parameters shared by every runner: the 200-default\n * `numRuns` plus an optional `seed`. Single source of truth so a change to\n * the default lands in one place.\n */\nfunction resolveFcParams<M>(\n  opts: PropertyOpts<unknown> | undefined,\n): fc.Parameters<[readonly M[]]> {\n  return {\n    numRuns: opts?.numRuns ?? 200,\n    ...(opts?.seed !== undefined ? { seed: opts.seed } : {}),\n  };\n}\n\n/**\n * The fold+assert core every runner shares: assert `check` over each\n * generated Msg sequence, folded once through the machine via `foldEvents`.\n * `check` throws on failure so the error message carries the offending\n * shape into fast-check's shrunk counter-example.\n */\nfunction runProperty<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: Ctx,\n  seqArb: fc.Arbitrary<readonly M[]>,\n  opts: PropertyOpts<S> | undefined,\n  check: (result: FoldResult<S, M, C>) => void,\n): void {\n  fc.assert(\n    fc.property(seqArb, (msgs) => {\n      check(foldEvents(machine, ctx, opts?.loaded ?? null, msgs));\n    }),\n    resolveFcParams<M>(opts),\n  );\n}\n\n/**\n * Assert every generated Msg sequence ends in a terminal state. `terminal`\n * is the predicate that names the acceptable final states (often\n * `(s) => s.type === \"done\" || s.type === \"idle\"`).\n *\n * The \"every sequence\" property catches stuck states (machine gets to a\n * non-terminal state and no further msg can escape) AND silent loops\n * (every msg variant is a noop from a given state).\n *\n * @example\n *   propertyTerminates(\n *     auditBackgroundMachine,\n *     stubCtxThrowingProxy<BackgroundCtx>(),\n *     arbMsgSequence(msgArb, { minLength: 1, maxLength: 30 }),\n *     (s) => s.type === \"done\" || s.type === \"idle\",\n *     { loaded: auditingState, numRuns: 500 },\n *   );\n */\nexport function propertyTerminates<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  terminal: (state: NoInfer<S>) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ finalState }) => {\n    if (!terminal(finalState)) {\n      // Throwing here (vs returning false) lets the error message carry\n      // the offending final state — fast-check pretty-prints it inside\n      // the shrunk counter-example.\n      throw new Error(\n        `propertyTerminates: final state did not match terminal predicate. ` +\n          `Final: ${JSON.stringify(finalState)}`,\n      );\n    }\n  });\n}\n\n/**\n * Assert a predicate holds on EVERY transition step in a generated\n * sequence. The predicate sees `{ prev, msg, next, cmds }` per step;\n * return true to accept, false (or throw) to fail.\n *\n * Use to pin a \"when X happens in state Y, cmd Z must be emitted\" rule.\n * The shrinker minimizes the offending sequence to the smallest Msg list\n * that still violates the predicate.\n *\n * @example\n *   // Pin the resume-handshake fix: `ws:client:hello` in auditing must\n *   // emit `send_ws { client:ready }`.\n *   propertyInvariant(\n *     auditBackgroundMachine, ctx,\n *     arbMsgSequence(msgArb, { prefix: [{ type: \"ws:client:hello\" }] }),\n *     ({ prev, msg, cmds }) =>\n *       !(prev.type === \"auditing\" && msg.type === \"ws:client:hello\") ||\n *       cmds.some((c) => c.type === \"send_ws\" && c.msg.type === \"client:ready\"),\n *     { loaded: auditingState, numRuns: 200 },\n *   );\n */\nexport function propertyInvariant<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  invariant: (step: Step<NoInfer<S>, NoInfer<M>, NoInfer<C>>) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ steps }) => {\n    for (const step of steps) {\n      if (!invariant(step)) {\n        throw new Error(\n          `propertyInvariant: failed at step msg=${JSON.stringify(step.msg)} ` +\n            `prev=${JSON.stringify(step.prev)} next=${JSON.stringify(step.next)} ` +\n            `cmds=${JSON.stringify(step.cmds)}`,\n        );\n      }\n    }\n  });\n}\n\n/**\n * Assert a predicate over the full trace plus the final state. Use when\n * the property is \"some Msg appeared in the trace before reaching the\n * final state\" or \"no two consecutive steps had the same state.type\" —\n * predicates that need the full sequence, not a single step.\n *\n * @example\n *   propertyTrace(\n *     machine, ctx, seqArb,\n *     (steps, final) =>\n *       final.type !== \"done\" ||\n *       steps.some((step) => step.msg.type === \"ws:audit:done\"),\n *     { loaded: auditingState, numRuns: 500 },\n *   );\n */\nexport function propertyTrace<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  ctx: NoInfer<Ctx>,\n  seqArb: fc.Arbitrary<readonly NoInfer<M>[]>,\n  predicate: (\n    steps: readonly Step<NoInfer<S>, NoInfer<M>, NoInfer<C>>[],\n    finalState: NoInfer<S>,\n  ) => boolean,\n  opts?: NoInfer<PropertyOpts<S>>,\n): void {\n  runProperty(machine, ctx, seqArb, opts, ({ steps, finalState }) => {\n    if (!predicate(steps, finalState)) {\n      throw new Error(\n        `propertyTrace: predicate failed on trace length=${steps.length}, ` +\n          `final=${JSON.stringify(finalState)}`,\n      );\n    }\n  });\n}\n"]}

package/dist/{chunk-ERYY5P6W.js → chunk-ND3DH6KM.js}

@@ -1,4 +1,4 @@
-import { createResilientCall, liftResilience } from './chunk-EC6FO42Q.js';
+import { createResilientCall, liftResilience } from './chunk-EUF7XOEE.js';
 import { MsgType } from './chunk-JELSZN25.js';
 import { describeError } from './chunk-G5E74IJB.js';
 
@@ -84,5 +84,5 @@ function liftLlmCall(state, result) {
 }
 
 export { createLlmCall, liftLlmCall };
-//# sourceMappingURL=chunk-ERYY5P6W.js.map
-//# sourceMappingURL=chunk-ERYY5P6W.js.map
+//# sourceMappingURL=chunk-ND3DH6KM.js.map
+//# sourceMappingURL=chunk-ND3DH6KM.js.map