@mooloo-ai/eutaxy 0.0.0-stage → 0.2.0

package/dist/src-BrCsF5RZ.mjs

@@ -0,0 +1,1286 @@
+import { i as canonicalJson, n as digestLog, r as emptyLog, t as appendEffect } from "./src-s6uYyC0B.mjs";
+// packages/core/src/prng.ts
+function rotl(x, k) {
+	return (x << k | x >>> 32 - k) >>> 0;
+}
+/** splitmix32: expands a 32-bit seed into well-mixed words for seeding. */
+function splitmix32(seed) {
+	let a = seed >>> 0;
+	return () => {
+		a = a + 2654435769 >>> 0;
+		let t = a;
+		t = Math.imul(t ^ t >>> 16, 569420461);
+		t = Math.imul(t ^ t >>> 15, 1935289751);
+		return (t ^ t >>> 15) >>> 0;
+	};
+}
+/** FNV-1a over UTF-16 code units, so string seeds are stable across runtimes. */
+function hashString(s) {
+	let h = 2166136261;
+	for (let i = 0; i < s.length; i++) {
+		h ^= s.charCodeAt(i);
+		h = Math.imul(h, 16777619);
+	}
+	return h >>> 0;
+}
+/** Derive an initial state from a number (taken modulo 2^32) or a string. */
+function seedPrng(seed) {
+	const next = splitmix32(typeof seed === "string" ? hashString(seed) : seed >>> 0);
+	const s = [
+		next(),
+		next(),
+		next(),
+		next()
+	];
+	if (s[0] === 0 && s[1] === 0 && s[2] === 0 && s[3] === 0) s[0] = 1;
+	return s;
+}
+/** Next 32-bit unsigned integer and the state that follows it. */
+function nextU32(state) {
+	const [s0, s1, s2, s3] = state;
+	const result = Math.imul(rotl(Math.imul(s1, 5) >>> 0, 7), 9) >>> 0;
+	const t = s1 << 9 >>> 0;
+	let n2 = (s2 ^ s0) >>> 0;
+	let n3 = (s3 ^ s1) >>> 0;
+	const n1 = (s1 ^ n2) >>> 0;
+	const n0 = (s0 ^ n3) >>> 0;
+	n2 = (n2 ^ t) >>> 0;
+	n3 = rotl(n3, 11);
+	return [result, [
+		n0,
+		n1,
+		n2,
+		n3
+	]];
+}
+/** Next float in [0, 1) with 24 bits of precision. */
+function nextFloat(state) {
+	const [u, next] = nextU32(state);
+	return [(u >>> 8) * 2 ** -24, next];
+}
+/**
+* Next integer in [0, bound). Uses rejection sampling, so every value is
+* equally likely; a bound of 1 always yields 0 without consuming state.
+*/
+function nextInt(state, bound) {
+	if (!Number.isInteger(bound) || bound < 1 || bound > 4294967296) throw new RangeError(`nextInt bound must be an integer in [1, 2^32], got ${bound}`);
+	if (bound === 1) return [0, state];
+	const limit = 4294967296 - 4294967296 % bound;
+	let s = state;
+	for (;;) {
+		const [u, next] = nextU32(s);
+		s = next;
+		if (u < limit) return [u % bound, s];
+	}
+}
+// packages/core/src/faults.ts
+/**
+* The fault model and the schedule. A schedule is the complete, replayable
+* record of which fault was injected at which effect point in one run.
+*/
+/**
+* Decide whether to inject a fault at an effect point during exploration.
+* Pure: the same state and inputs always give the same decision. The PRNG is
+* only consumed when a fault is possible, so adding an ineligible point does
+* not perturb later decisions.
+*/
+function decideFault(state, allowed, faultsSoFar, policy) {
+	if (allowed.length === 0 || faultsSoFar >= policy.maxFaultsPerRun) return [null, state];
+	const [p, s1] = nextFloat(state);
+	if (p >= policy.faultProbability) return [null, s1];
+	const [i, s2] = nextInt(s1, allowed.length);
+	return [allowed[i] ?? null, s2];
+}
+// packages/core/src/invariants.ts
+/**
+* Invariants are plain data describing a property of the effect log; checkers
+* are pure functions from (log, invariant) to a violation or null. The
+* library starts with what the first planted bug needs and grows from there.
+*/
+/** Re-derive `expected` for per-message invariants from the bodies that remain. */
+function recomputePerMessageExpected(invariants, bodies) {
+	return invariants.map((inv) => {
+		if (inv.kind !== "atLeastOnce" || !inv.perMessage) return inv;
+		const bodyKey = inv.perMessage.bodyKey;
+		const expected = [];
+		for (const b of bodies) {
+			const v = getPath(b, bodyKey);
+			if (v !== void 0) expected.push(v);
+		}
+		return {
+			...inv,
+			expected
+		};
+	});
+}
+/** The tables in the last snapshot recorded for a target, or undefined when none was. */
+function lastSnapshot(log, target) {
+	for (let i = log.entries.length - 1; i >= 0; i--) {
+		const e = log.entries[i];
+		if (e.kind === "snapshot" && e.target === target) {
+			const tables = getPath(e.payload, "tables");
+			if (tables && typeof tables === "object" && !Array.isArray(tables)) return tables;
+			return {};
+		}
+	}
+}
+function rowMatches(row, condition) {
+	const v = row[condition.column];
+	switch (condition.op) {
+		case "eq": return v !== void 0 && jsonEqual(v, condition.value);
+		case "neq": return v === void 0 || !jsonEqual(v, condition.value);
+		case "gt": return typeof v === "number" && v > condition.value;
+		case "gte": return typeof v === "number" && v >= condition.value;
+		case "lt": return typeof v === "number" && v < condition.value;
+		case "lte": return typeof v === "number" && v <= condition.value;
+		case "in": return v !== void 0 && condition.value.some((c) => jsonEqual(v, c));
+		case "notNull": return v !== void 0 && v !== null;
+	}
+}
+/** Rows a state query selects from the log's last snapshot; undefined when there is no snapshot. */
+function queryRows(log, query) {
+	const tables = lastSnapshot(log, query.target);
+	if (!tables) return void 0;
+	const rows = tables[query.table] ?? [];
+	const where = query.where ?? [];
+	return rows.filter((r) => where.every((c) => rowMatches(r, c)));
+}
+function snapshotSeq(log, target) {
+	let last;
+	for (const e of log.entries) if (e.kind === "snapshot" && e.target === target) last = e.seq;
+	return last === void 0 ? [] : [last];
+}
+/** True when two violations are of the same invariant for the same keys, whatever the traces. */
+function sameViolation(a, b) {
+	return a.invariant === b.invariant && a.keys.length === b.keys.length && a.keys.every((k, i) => k === b.keys[i]);
+}
+/** Read a dot path such as "args.params.0" out of JSON data; undefined when absent. */
+function getPath(value, path) {
+	let cur = value;
+	if (path === "") return cur;
+	for (const part of path.split(".")) {
+		if (cur === null || typeof cur !== "object") return void 0;
+		if (Array.isArray(cur)) {
+			const i = Number(part);
+			if (!Number.isInteger(i) || i < 0) return void 0;
+			cur = cur[i];
+		} else cur = cur[part];
+		if (cur === void 0) return void 0;
+	}
+	return cur;
+}
+function jsonEqual(a, b) {
+	if (a === void 0) return false;
+	if (a === b) return true;
+	if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+	if (Array.isArray(a) !== Array.isArray(b)) return false;
+	if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((x, i) => jsonEqual(x, b[i]));
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao).sort();
+	const bk = Object.keys(bo).sort();
+	return ak.length === bk.length && ak.every((k, i) => k === bk[i] && jsonEqual(ao[k], bo[k]));
+}
+function matches(record, sel) {
+	if (record.target !== sel.target) return false;
+	if (sel.op !== void 0 && record.op !== sel.op) return false;
+	if (sel.kind !== void 0 && record.kind !== sel.kind) return false;
+	if (sel.where) {
+		for (const [path, want] of Object.entries(sel.where)) if (!jsonEqual(getPath(record.payload, path), want)) return false;
+	}
+	if (sel.atLeast) for (const [path, min] of Object.entries(sel.atLeast)) {
+		const v = getPath(record.payload, path);
+		if (typeof v !== "number" || v < min) return false;
+	}
+	return true;
+}
+function selectEffects(log, sel) {
+	return log.entries.filter((e) => matches(e, sel));
+}
+/** Canonical form of a key, so equal JSON values compare equal whatever their key order. */
+function keyOf(record, path) {
+	const v = getPath(record.payload, path);
+	return v === void 0 ? void 0 : canonicalJson(v);
+}
+function checkInvariant(log, inv) {
+	switch (inv.kind) {
+		case "everyRow": return checkEveryRow(log, inv);
+		case "implies": return checkImplies(log, inv);
+		case "atMostOncePerKey": {
+			const seen = /* @__PURE__ */ new Map();
+			for (const e of selectEffects(log, inv.effect)) {
+				const k = keyOf(e, inv.key);
+				if (k === void 0) continue;
+				const first = seen.get(k);
+				if (first !== void 0) return {
+					invariant: inv.name,
+					message: `${inv.effect.target} ${inv.effect.op ?? "*"} happened twice for key ${k} (seq ${first} and ${e.seq})`,
+					keys: [k],
+					evidence: [first, e.seq]
+				};
+				seen.set(k, e.seq);
+			}
+			return null;
+		}
+		case "atLeastOnce": {
+			const present = /* @__PURE__ */ new Set();
+			const selected = selectEffects(log, inv.effect);
+			for (const e of selected) {
+				const k = keyOf(e, inv.key);
+				if (k !== void 0) present.add(k);
+			}
+			const missing = inv.expected.map((v) => canonicalJson(v)).filter((k) => !present.has(k));
+			if (missing.length === 0) return null;
+			return {
+				invariant: inv.name,
+				message: `${inv.effect.target} ${inv.effect.op ?? "*"} never happened for key(s) ${missing.join(", ")}`,
+				keys: missing,
+				evidence: selected.map((e) => e.seq)
+			};
+		}
+	}
+}
+function checkEveryRow(log, inv) {
+	const rows = queryRows(log, inv.query);
+	if (rows === void 0) return {
+		invariant: inv.name,
+		message: `no snapshot of ${inv.query.target} was recorded`,
+		keys: [],
+		evidence: []
+	};
+	const failing = rows.filter((r) => !inv.holds.every((c) => rowMatches(r, c)));
+	if (failing.length === 0) return null;
+	const keys = failing.map((r) => canonicalJson(r));
+	const shown = keys.slice(0, 3).join(", ") + (failing.length > 3 ? ", …" : "");
+	return {
+		invariant: inv.name,
+		message: `${failing.length} row(s) of ${inv.query.table} in ${inv.query.target} violate the condition: ${shown}`,
+		keys,
+		evidence: snapshotSeq(log, inv.query.target)
+	};
+}
+function checkImplies(log, inv) {
+	const rows = queryRows(log, inv.state);
+	if (rows === void 0) return {
+		invariant: inv.name,
+		message: `no snapshot of ${inv.state.target} was recorded`,
+		keys: [],
+		evidence: []
+	};
+	const present = /* @__PURE__ */ new Set();
+	for (const r of rows) {
+		const v = r[inv.column];
+		if (v !== void 0) present.add(canonicalJson(v));
+	}
+	const missing = [];
+	const evidence = [];
+	for (const e of selectEffects(log, inv.when)) {
+		const k = keyOf(e, inv.key);
+		if (k === void 0 || present.has(k)) continue;
+		if (!missing.includes(k)) missing.push(k);
+		evidence.push(e.seq);
+	}
+	if (missing.length === 0) return null;
+	return {
+		invariant: inv.name,
+		message: `${inv.when.target} ${inv.when.op ?? "*"} happened for key(s) ${missing.join(", ")} but ${inv.state.table}.${inv.column} in ${inv.state.target} has no such row`,
+		keys: missing,
+		evidence
+	};
+}
+function checkInvariants(log, invariants) {
+	const out = [];
+	for (const inv of invariants) {
+		const v = checkInvariant(log, inv);
+		if (v) out.push(v);
+	}
+	return out;
+}
+// packages/core/src/scenario.ts
+const defaultBounds = {
+	maxFaultsPerRun: 1,
+	maxRedeliveries: 2,
+	maxConcurrentInvocations: 1,
+	budgetMs: 2e3
+};
+function isPositiveInt(n) {
+	return typeof n === "number" && Number.isInteger(n) && n > 0;
+}
+/** Every reason a spec is not usable; empty when it is. */
+function validateScenario(spec) {
+	const errors = [];
+	if (spec.version !== 1) errors.push(`version must be 1, got ${String(spec.version)}`);
+	if (!spec.name.trim()) errors.push("name must not be empty");
+	if (spec.platform !== void 0 && !spec.platform) errors.push("platform must not be empty when given");
+	if (!/^[a-z0-9][a-z0-9-]*$/.test(spec.name)) errors.push(`name must be lowercase letters, digits and dashes: ${JSON.stringify(spec.name)}`);
+	if (!spec.worker.entry) errors.push("worker.entry must not be empty");
+	if (!spec.worker.config) errors.push("worker.config must not be empty");
+	if (!spec.drive.kind) errors.push("drive.kind must not be empty");
+	spec.setup.forEach((s, i) => {
+		if (!s.kind) errors.push(`setup[${i}].kind must not be empty`);
+	});
+	if (spec.invariants.length === 0) errors.push("at least one invariant is required");
+	const names = /* @__PURE__ */ new Set();
+	for (const inv of spec.invariants) {
+		if (!inv.name) errors.push("every invariant needs a name");
+		else if (names.has(inv.name)) errors.push(`duplicate invariant name ${JSON.stringify(inv.name)}`);
+		names.add(inv.name);
+	}
+	const ext = /* @__PURE__ */ new Set();
+	for (const e of spec.externals) {
+		if (!e.name) errors.push("every external needs a name");
+		if (ext.has(e.name)) errors.push(`duplicate external ${JSON.stringify(e.name)}`);
+		ext.add(e.name);
+		if (!e.host) errors.push(`external ${JSON.stringify(e.name)} needs a host`);
+		(e.responses ?? []).forEach((r, i) => {
+			if (!(Number.isInteger(r.status) && r.status >= 100 && r.status <= 599)) errors.push(`external ${JSON.stringify(e.name)} responses[${i}].status must be an HTTP status`);
+		});
+	}
+	for (const k of [
+		"maxFaultsPerRun",
+		"maxRedeliveries",
+		"maxConcurrentInvocations",
+		"budgetMs"
+	]) if (k === "maxFaultsPerRun" || k === "maxRedeliveries") {
+		const v = spec.bounds[k];
+		if (!(Number.isInteger(v) && v >= 0)) errors.push(`bounds.${k} must be a non-negative integer`);
+	} else if (!isPositiveInt(spec.bounds[k])) errors.push(`bounds.${k} must be a positive integer`);
+	return errors;
+}
+// packages/core/src/shrink.ts
+/** One-step candidates: each single fault removed, then each single event removed. */
+function shrinkCandidates(state) {
+	const out = [];
+	state.schedule.faults.forEach((_, i) => {
+		out.push({
+			schedule: {
+				seed: state.schedule.seed,
+				faults: state.schedule.faults.filter((_, j) => j !== i)
+			},
+			keepIds: state.keepIds
+		});
+	});
+	if (state.keepIds.length > 1) state.keepIds.forEach((id) => {
+		out.push({
+			schedule: {
+				seed: state.schedule.seed,
+				faults: state.schedule.faults.filter((f) => !f.invocation.startsWith(`${id}#`))
+			},
+			keepIds: state.keepIds.filter((k) => k !== id)
+		});
+	});
+	return out;
+}
+// packages/engine/src/clock.ts
+/**
+* The virtual clock and the globals patch. Within a run, Date, Math.random,
+* crypto.randomUUID, crypto.getRandomValues, performance.now and the timer
+* functions are replaced by deterministic versions driven by the run's seed
+* and by a clock that starts at a fixed epoch and advances only when the
+* engine says so: one millisecond per effect, and to each timer's due time
+* when the timer fires. Timers fire only while the invocation is idle (no
+* effect in flight), in due order, so they never race real I/O.
+*/
+/** 2026-01-01T00:00:00.000Z. Every run starts here. */
+const virtualEpoch = Date.UTC(2026, 0, 1);
+const realSetTimeout = globalThis.setTimeout.bind(globalThis);
+const realSetInterval = globalThis.setInterval.bind(globalThis);
+const realClearTimeout = globalThis.clearTimeout.bind(globalThis);
+const realClearInterval = globalThis.clearInterval.bind(globalThis);
+const libraryScope = (() => {
+	const mod = typeof process !== "undefined" ? process?.getBuiltinModule?.("node:async_hooks") : void 0;
+	return mod?.AsyncLocalStorage ? new mod.AsyncLocalStorage() : null;
+})();
+var VirtualClock = class {
+	time = virtualEpoch;
+	timers = [];
+	nextId = 1;
+	/** The invocation whose code is running; timers scheduled now belong to it. */
+	owner = null;
+	now() {
+		return this.time;
+	}
+	advance(ms) {
+		if (ms > 0) this.time += ms;
+	}
+	schedule(callback, delay, args, interval) {
+		const ms = Number.isFinite(delay) && delay > 0 ? Math.floor(delay) : 0;
+		const timer = {
+			id: this.nextId++,
+			due: this.time + ms,
+			callback,
+			args,
+			interval,
+			owner: this.owner
+		};
+		this.timers.push(timer);
+		return timer.id;
+	}
+	setTimeout(callback, delay = 0, ...args) {
+		return this.schedule(callback, delay, args, null);
+	}
+	setInterval(callback, delay = 0, ...args) {
+		return this.schedule(callback, delay, args, Math.max(1, Math.floor(delay)));
+	}
+	clear(id) {
+		this.timers = this.timers.filter((t) => t.id !== id);
+	}
+	/** Whether this clock issued the handle (and the timer is still pending). */
+	owns(id) {
+		return typeof id === "number" && this.timers.some((t) => t.id === id);
+	}
+	pendingTimers() {
+		return this.timers.length;
+	}
+	/** Drop every timer an invocation scheduled: a crashed invocation's code must never run again. */
+	cancelOwner(owner) {
+		this.timers = this.timers.filter((t) => t.owner !== owner);
+	}
+	/** Advance to the earliest due timer and run it. False when none is pending. */
+	fireNext() {
+		if (this.timers.length === 0) return false;
+		let earliest = this.timers[0];
+		for (const t of this.timers) if (t.due < earliest.due || t.due === earliest.due && t.id < earliest.id) earliest = t;
+		if (earliest.due > this.time) this.time = earliest.due;
+		if (earliest.interval === null) this.timers = this.timers.filter((t) => t !== earliest);
+		else earliest.due = this.time + earliest.interval;
+		try {
+			earliest.callback(...earliest.args);
+		} catch {}
+		return true;
+	}
+};
+/** Deterministic randomness for a run: Math.random, UUIDs and random bytes from one seeded stream. */
+var VirtualRandom = class {
+	state;
+	constructor(seed) {
+		this.state = seedPrng(`random:${seed}`);
+	}
+	float() {
+		const [f, next] = nextFloat(this.state);
+		this.state = next;
+		return f;
+	}
+	u32() {
+		const [u, next] = nextU32(this.state);
+		this.state = next;
+		return u;
+	}
+	fill(view) {
+		const bytes = new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
+		for (let i = 0; i < bytes.length; i += 4) {
+			const u = this.u32();
+			for (let j = 0; j < 4 && i + j < bytes.length; j++) bytes[i + j] = u >>> 8 * j & 255;
+		}
+		return view;
+	}
+	/** A version-4 UUID from the stream. */
+	uuid() {
+		const b = this.fill(/* @__PURE__ */ new Uint8Array(16));
+		b[6] = b[6] & 15 | 64;
+		b[8] = b[8] & 63 | 128;
+		const hex = [...b].map((x) => x.toString(16).padStart(2, "0")).join("");
+		return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+	}
+};
+/** Replace the nondeterministic globals for one run. Returns the handle that restores them. */
+function patchGlobals(seed) {
+	const clock = new VirtualClock();
+	const random = new VirtualRandom(seed);
+	const g = globalThis;
+	const saved = /* @__PURE__ */ new Map();
+	const define = (target, key, value) => {
+		const owner = target === g ? g : target;
+		saved.set(key, Object.getOwnPropertyDescriptor(owner, key));
+		Object.defineProperty(owner, key, {
+			value,
+			configurable: true,
+			writable: true,
+			enumerable: false
+		});
+	};
+	const RealDate = Date;
+	const VirtualDate = function(...args) {
+		if (new.target === void 0) return new RealDate(clock.now()).toString();
+		return Reflect.construct(RealDate, args.length === 0 ? [clock.now()] : args, new.target);
+	};
+	Object.setPrototypeOf(VirtualDate, RealDate);
+	Object.defineProperty(VirtualDate, "prototype", {
+		value: RealDate.prototype,
+		writable: false
+	});
+	Object.defineProperty(VirtualDate, "now", {
+		value: () => clock.now(),
+		configurable: true,
+		writable: true
+	});
+	Object.defineProperty(VirtualDate, "name", { value: "Date" });
+	define(g, "Date", VirtualDate);
+	define(Math, "random", () => random.float());
+	const inLibrary = () => libraryScope?.getStore() === true;
+	define(g, "setTimeout", (cb, ms, ...args) => inLibrary() ? realSetTimeout(cb, ms, ...args) : clock.setTimeout(cb, ms, ...args));
+	define(g, "setInterval", (cb, ms, ...args) => inLibrary() ? realSetInterval(cb, ms, ...args) : clock.setInterval(cb, ms, ...args));
+	define(g, "clearTimeout", (id) => {
+		if (clock.owns(id)) clock.clear(id);
+		else realClearTimeout(id);
+	});
+	define(g, "clearInterval", (id) => {
+		if (clock.owns(id)) clock.clear(id);
+		else realClearInterval(id);
+	});
+	const perf = g["performance"];
+	if (perf && typeof perf === "object") define(perf, "now", () => clock.now() - virtualEpoch);
+	const cryptoObj = g["crypto"];
+	if (cryptoObj && typeof cryptoObj === "object") {
+		define(cryptoObj, "randomUUID", () => random.uuid());
+		define(cryptoObj, "getRandomValues", (view) => random.fill(view));
+	}
+	let restored = false;
+	const targets = {
+		Date: g,
+		random: Math,
+		setTimeout: g,
+		setInterval: g,
+		clearTimeout: g,
+		clearInterval: g
+	};
+	if (perf && typeof perf === "object") targets["now"] = perf;
+	if (cryptoObj && typeof cryptoObj === "object") {
+		targets["randomUUID"] = cryptoObj;
+		targets["getRandomValues"] = cryptoObj;
+	}
+	return {
+		clock,
+		random,
+		libraryIo(perform) {
+			return libraryScope ? libraryScope.run(true, perform) : perform();
+		},
+		restore() {
+			if (restored) return;
+			restored = true;
+			for (const [key, descriptor] of saved) {
+				const target = targets[key];
+				if (descriptor) Object.defineProperty(target, key, descriptor);
+				else delete target[key];
+			}
+		}
+	};
+}
+/** Yield to the real event loop so microtasks and pending I/O can make progress. */
+function realTick() {
+	return new Promise((resolve) => realSetTimeout(() => resolve(), 0));
+}
+/**
+* Wait for a promise under the virtual clock: while it is pending, let real
+* I/O complete, and when the invocation is idle fire the next due timer.
+*/
+async function settleOn(promise, ctx) {
+	let done = false;
+	let failed = false;
+	let value;
+	let error;
+	const tracked = promise.then((v) => {
+		done = true;
+		value = v;
+	}, (e) => {
+		done = true;
+		failed = true;
+		error = e;
+	});
+	for (;;) {
+		await Promise.race([tracked, realTick()]);
+		if (done) {
+			if (failed) throw error;
+			return value;
+		}
+		if (ctx.crashed()) return new Promise(() => {});
+		if (ctx.inFlight() > 0) continue;
+		if (ctx.clock.fireNext()) continue;
+		ctx.stuck();
+		return new Promise(() => {});
+	}
+}
+// packages/engine/src/fetch.ts
+const FAULTS = [
+	"crash_before",
+	"crash_after",
+	"ambiguous",
+	"error"
+];
+/** Match a host against an exact host or a "*.suffix" pattern. */
+function hostMatches(pattern, host) {
+	if (pattern.startsWith("*.")) {
+		const suffix = pattern.slice(1);
+		return host.endsWith(suffix) && host.length > suffix.length;
+	}
+	return pattern === host;
+}
+function findExternal(externals, host) {
+	return externals.find((e) => hostMatches(e.host, host));
+}
+function findResponse(external, method, path) {
+	if (!external.responses) return null;
+	return external.responses.find((r) => {
+		if (r.method && r.method.toUpperCase() !== method) return false;
+		if (r.path === void 0) return true;
+		return r.path.endsWith("*") ? path.startsWith(r.path.slice(0, -1)) : r.path === path;
+	});
+}
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+function replyOf(r) {
+	if (r === null) return {
+		status: 200,
+		headers: {},
+		body: ""
+	};
+	const json = r.body !== void 0 && typeof r.body !== "string";
+	const headers = {};
+	for (const [name, value] of Object.entries(r.headers ?? {})) headers[name.toLowerCase()] = value;
+	if (json && !("content-type" in headers)) headers["content-type"] = "application/json";
+	const body = r.body === void 0 ? "" : json ? JSON.stringify(r.body) : r.body;
+	return {
+		status: r.status,
+		headers,
+		body
+	};
+}
+function toResponse(reply) {
+	return new Response(reply.body === "" ? null : reply.body, {
+		status: reply.status,
+		headers: reply.headers
+	});
+}
+function parseBody(text) {
+	if (text === "") return null;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return text;
+	}
+}
+/**
+* Build the replacement `fetch`. With `hooks`, every request is an effect
+* point recorded as `Fetch:<external>` with the method as op; the result
+* summary carries `status`, `effective` and the dedupe key.
+*/
+function createScriptedFetch(externals, hooks, unsupported, afterRequest = () => {}) {
+	const dedupe = /* @__PURE__ */ new Map();
+	const scripted = (async (input, init) => {
+		const request = new Request(input, init);
+		const url = new URL(request.url);
+		const method = request.method.toUpperCase();
+		const external = findExternal(externals, url.host);
+		if (!external) {
+			unsupported(`fetch to undeclared host ${url.host}; declare it as an external in the scenario`);
+			throw new TypeError(`fetch failed: ${url.host} is not a declared external`);
+		}
+		const headers = {};
+		request.headers.forEach((value, name) => {
+			headers[name.toLowerCase()] = value;
+		});
+		const dedupeHeader = external.guarantees.dedupeBy?.toLowerCase();
+		const dedupeKey = dedupeHeader ? headers[dedupeHeader] ?? null : null;
+		const body = parseBody(await request.text());
+		const args = {
+			url: request.url,
+			method,
+			headers,
+			body,
+			dedupeKey
+		};
+		const perform = async () => {
+			const memo = dedupeKey === null ? null : `${external.name}\u0000${dedupeKey}`;
+			if (memo !== null) {
+				const earlier = dedupe.get(memo);
+				if (earlier) return {
+					reply: earlier,
+					effective: false
+				};
+			}
+			const script = findResponse(external, method, url.pathname);
+			if (script === void 0) {
+				unsupported(`no scripted response in external ${external.name} for ${method} ${url.pathname}`);
+				throw new TypeError(`fetch failed: no scripted response for ${method} ${url.pathname}`);
+			}
+			const reply = replyOf(script);
+			if (REDIRECTS.has(reply.status) && request.redirect !== "manual") {
+				unsupported(`external ${external.name} answers ${method} ${url.pathname} with a ${reply.status} redirect; script the final reply or fetch with redirect: "manual"`);
+				throw new TypeError(`fetch failed: redirects are not modelled (${reply.status} from ${url.host})`);
+			}
+			if (memo !== null) dedupe.set(memo, reply);
+			return {
+				reply,
+				effective: true
+			};
+		};
+		if (!hooks) {
+			const { reply } = await perform();
+			afterRequest();
+			return toResponse(reply);
+		}
+		const { reply } = await hooks.hooks.effect({
+			invocation: hooks.invocation(),
+			target: `Fetch:${external.name}`,
+			op: method,
+			args,
+			allowed: FAULTS
+		}, perform, (r) => ({
+			status: r.reply.status,
+			effective: r.effective,
+			dedupeKey
+		}));
+		return toResponse(reply);
+	});
+	return {
+		fetch: scripted,
+		dedupe
+	};
+}
+/** Replace the global `fetch` for a run; returns the function that restores it. */
+function installScriptedFetch(externals, hooks, unsupported, afterRequest) {
+	const g = globalThis;
+	const saved = Object.getOwnPropertyDescriptor(globalThis, "fetch");
+	const { fetch: scripted } = createScriptedFetch(externals, hooks, unsupported, afterRequest);
+	Object.defineProperty(globalThis, "fetch", {
+		value: scripted,
+		configurable: true,
+		writable: true
+	});
+	let restored = false;
+	return () => {
+		if (restored) return;
+		restored = true;
+		if (saved) Object.defineProperty(globalThis, "fetch", saved);
+		else delete g.fetch;
+	};
+}
+// packages/engine/src/run.ts
+/**
+* One run of a scenario: the effect log being built, the fault decisions
+* (drawn during exploration, looked up during replay), and the invocations
+* in flight. Proxies in the platform package call `effect`/`effectSync`
+* around every real effect; everything else is engine-internal.
+*/
+/** Thrown into user code by a synchronous effect that crashes the invocation. */
+var CrashSignal = class extends Error {
+	name = "CrashSignal";
+	invocation;
+	constructor(invocation) {
+		super(`invocation ${invocation} crashed by an injected fault`);
+		this.invocation = invocation;
+	}
+};
+/** The error user code sees for an injected `error` or `ambiguous` fault. */
+var InjectedEffectError = class extends Error {
+	name = "InjectedEffectError";
+	point;
+	fault;
+	constructor(point, fault) {
+		super(`${point.target} ${point.op} failed (injected ${fault})`);
+		this.point = point;
+		this.fault = fault;
+	}
+};
+var InvocationState = class {
+	crashed;
+	onCrash;
+	/** Effect points seen so far in this invocation; the next effect's ordinal. */
+	ordinal = 0;
+	crashedFlag = false;
+	resolveCrashed = () => {};
+	id;
+	constructor(id, onCrash) {
+		this.id = id;
+		this.onCrash = onCrash;
+		this.crashed = new Promise((resolve) => {
+			this.resolveCrashed = resolve;
+		});
+	}
+	isCrashed() {
+		return this.crashedFlag;
+	}
+	crash() {
+		if (this.crashedFlag) return;
+		this.crashedFlag = true;
+		this.onCrash();
+		this.resolveCrashed();
+	}
+};
+/** A promise that never settles: how an abandoned invocation experiences a crash. */
+function hang() {
+	return new Promise(() => {});
+}
+var Run = class {
+	logState = emptyLog;
+	faults = [];
+	effectIndex = 0;
+	prng;
+	invocations = /* @__PURE__ */ new Map();
+	reasons = [];
+	inFlight = 0;
+	patched = null;
+	restoreFetch = null;
+	/** The invocation whose code is running (one at a time); outbound fetches are attributed to it. */
+	current = "";
+	options;
+	constructor(options) {
+		this.options = options;
+		this.prng = seedPrng(options.schedule.seed);
+	}
+	get log() {
+		return this.logState;
+	}
+	/** The schedule as actually executed: input decisions during replay, drawn ones during exploration. */
+	get schedule() {
+		return {
+			seed: this.options.schedule.seed,
+			faults: [...this.faults]
+		};
+	}
+	get effectPoints() {
+		return this.effectIndex;
+	}
+	get faultsInjected() {
+		return this.faults.length;
+	}
+	get unsupportedReasons() {
+		return this.reasons;
+	}
+	/** Replace the nondeterministic globals and `fetch` for this run. Call `uninstall` in a finally. */
+	install(externals = []) {
+		if (!this.patched) this.patched = patchGlobals(this.options.schedule.seed);
+		if (!this.restoreFetch) this.restoreFetch = installScriptedFetch(externals, {
+			hooks: this,
+			invocation: () => this.current
+		}, (reason) => this.unsupported(reason));
+	}
+	uninstall() {
+		this.restoreFetch?.();
+		this.restoreFetch = null;
+		this.patched?.restore();
+		this.patched = null;
+	}
+	/** Virtual milliseconds since the epoch, or the real clock when the globals are not installed. */
+	now() {
+		return this.patched ? this.patched.clock.now() : Date.now();
+	}
+	/** Timers scheduled and not yet fired or cancelled (0 when the globals are not installed). */
+	pendingTimers() {
+		return this.patched?.clock.pendingTimers() ?? 0;
+	}
+	startInvocation(id) {
+		if (this.invocations.has(id)) throw new Error(`invocation ${id} already started`);
+		const inv = new InvocationState(id, () => this.patched?.clock.cancelOwner(id));
+		this.invocations.set(id, inv);
+		if (this.patched) this.patched.clock.owner = id;
+		this.current = id;
+		return inv;
+	}
+	invocation(id) {
+		const inv = this.invocations.get(id);
+		if (!inv) throw new Error(`effect from unknown invocation ${id}`);
+		return inv;
+	}
+	decide(point, ordinal) {
+		if (this.options.mode === "replay") {
+			const d = this.options.schedule.faults.find((f) => f.invocation === point.invocation && f.ordinal === ordinal);
+			return d && point.allowed.includes(d.fault) ? d.fault : null;
+		}
+		const [fault, next] = decideFault(this.prng, point.allowed, this.faults.length, {
+			maxFaultsPerRun: this.options.bounds.maxFaultsPerRun,
+			faultProbability: this.options.faultProbability
+		});
+		this.prng = next;
+		return fault;
+	}
+	record(point, kind, payload) {
+		this.logState = appendEffect(this.logState, {
+			kind,
+			invocation: point.invocation,
+			target: point.target,
+			op: point.op,
+			payload
+		});
+	}
+	/** Open an effect point: record the call and decide the fault. */
+	open(point, inv) {
+		this.effectIndex++;
+		const ordinal = inv.ordinal++;
+		this.record(point, "call", { args: point.args });
+		const fault = this.decide(point, ordinal);
+		if (fault) this.faults.push({
+			invocation: point.invocation,
+			ordinal,
+			fault,
+			target: point.target,
+			op: point.op
+		});
+		return fault;
+	}
+	async effect(point, perform, summarize) {
+		const inv = this.invocation(point.invocation);
+		if (inv.isCrashed()) return hang();
+		const fault = this.open(point, inv);
+		if (fault === "crash_before" || fault === "cut_off") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			inv.crash();
+			return hang();
+		}
+		if (fault === "error") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			throw new InjectedEffectError(point, fault);
+		}
+		let value;
+		this.inFlight++;
+		try {
+			value = await (this.patched ? this.patched.libraryIo(perform) : perform());
+		} catch (err) {
+			this.record(point, "result", {
+				args: point.args,
+				result: null,
+				error: String(err)
+			});
+			throw err;
+		} finally {
+			this.inFlight--;
+			this.patched?.clock.advance(1);
+		}
+		this.record(point, "result", {
+			args: point.args,
+			result: summarize(value)
+		});
+		if (inv.isCrashed()) return hang();
+		if (fault === "crash_after") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			inv.crash();
+			return hang();
+		}
+		if (fault === "ambiguous") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			throw new InjectedEffectError(point, fault);
+		}
+		return value;
+	}
+	effectSync(point, perform, summarize) {
+		const inv = this.invocation(point.invocation);
+		if (inv.isCrashed()) throw new CrashSignal(inv.id);
+		const fault = this.open(point, inv);
+		if (fault === "crash_before" || fault === "cut_off") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			inv.crash();
+			throw new CrashSignal(inv.id);
+		}
+		if (fault === "error") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			throw new InjectedEffectError(point, fault);
+		}
+		let value;
+		try {
+			value = perform();
+		} catch (err) {
+			this.record(point, "result", {
+				args: point.args,
+				result: null,
+				error: String(err)
+			});
+			throw err;
+		}
+		this.record(point, "result", {
+			args: point.args,
+			result: summarize(value)
+		});
+		if (fault === "crash_after") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			inv.crash();
+			throw new CrashSignal(inv.id);
+		}
+		if (fault === "ambiguous") {
+			this.record(point, "fault", {
+				args: point.args,
+				fault
+			});
+			throw new InjectedEffectError(point, fault);
+		}
+		return value;
+	}
+	unsupported(reason) {
+		this.reasons.push(reason);
+	}
+	settle(promise, invocation) {
+		const inv = this.invocation(invocation);
+		const patched = this.patched;
+		if (patched) patched.clock.owner = invocation;
+		this.current = invocation;
+		if (!patched) return Promise.race([promise, inv.crashed.then(() => new Promise(() => {}))]);
+		return settleOn(promise, {
+			clock: patched.clock,
+			inFlight: () => this.inFlight,
+			crashed: () => inv.isCrashed(),
+			stuck: () => {
+				this.unsupported(`invocation ${invocation} is waiting on something Eutaxy cannot see (no effect in flight, no timer due)`);
+				inv.crash();
+			}
+		});
+	}
+	snapshot(invocation, target, payload) {
+		this.logState = appendEffect(this.logState, {
+			kind: "snapshot",
+			invocation,
+			target,
+			op: "snapshot",
+			payload
+		});
+	}
+};
+// packages/engine/src/shrink.ts
+/**
+* Shrinking, the loop: try the pure candidates in order, replay each, keep
+* the first that still violates the same invariant for the same keys, and
+* repeat from there until nothing smaller works or the budget is spent.
+*/
+/** The scenario restricted to the kept events, with per-message invariants re-derived. */
+function restrictSpec(platform, spec, keepIds) {
+	const restricted = platform.restrictEvents(spec, keepIds);
+	const bodies = platform.initialEvents(restricted).map((e) => e.data);
+	return {
+		...restricted,
+		invariants: recomputePerMessageExpected(restricted.invariants, bodies)
+	};
+}
+async function shrink(spec, platform, schedule, violation, trace, options) {
+	const allIds = platform.initialEvents(spec).map((e) => e.id);
+	let state = {
+		schedule,
+		keepIds: allIds
+	};
+	let best = {
+		trace,
+		violation
+	};
+	let runs = 0;
+	let improved = true;
+	while (improved && runs < options.maxRuns && options.now() < options.deadline) {
+		improved = false;
+		for (const candidate of shrinkCandidates(state)) {
+			if (runs >= options.maxRuns || options.now() >= options.deadline) break;
+			const candidateSpec = restrictSpec(platform, spec, candidate.keepIds);
+			const run = await replayRun(candidateSpec, platform, candidate.schedule);
+			const log = run.log;
+			runs++;
+			if (run.unsupportedReasons.length > 0) continue;
+			const found = checkInvariants(log, candidateSpec.invariants).find((v) => sameViolation(v, violation));
+			if (found) {
+				state = candidate;
+				best = {
+					trace: log,
+					violation: found
+				};
+				improved = true;
+				break;
+			}
+		}
+	}
+	return {
+		spec: restrictSpec(platform, spec, state.keepIds),
+		schedule: state.schedule,
+		keptEvents: state.keepIds,
+		trace: best.trace,
+		violation: best.violation,
+		runs,
+		faultsRemoved: schedule.faults.length - state.schedule.faults.length,
+		eventsRemoved: allIds.length - state.keepIds.length
+	};
+}
+// packages/engine/src/explore.ts
+/**
+* The exploration loop: run the scenario under seeded fault injection until
+* an invariant breaks or the budget is spent; replay any violation before
+* reporting it.
+*/
+const engineAssumptions = [
+	"schedule points are effect boundaries: proxied bindings, patched timers and fetch; other awaits run in program order",
+	"faults: crash_before, crash_after, ambiguous, error at any effect point; redelivery per the platform's queue model",
+	"one invocation at a time (maxConcurrentInvocations = 1)",
+	"Date, Math.random, crypto.randomUUID, crypto.getRandomValues, performance.now and timers are virtualised per run from the seed; time starts at 2026-01-01T00:00:00Z and advances 1 ms per effect and to each timer's due time",
+	"timers fire only while the invocation is idle (no effect in flight), in due order; an invocation waiting on something outside Eutaxy makes the run UNSUPPORTED",
+	"while an effect performs real I/O the real timer functions are in place for that I/O, so user code that schedules a timer concurrently with an effect gets a real one",
+	"module-level state cannot be reset between runs; before BOUNDED the first runs are replayed in reverse order and any difference makes the run UNSUPPORTED (module_state_leak)",
+	"outbound fetch never reaches the network: requests are answered from the scenario's declared externals, an external's dedupeBy guarantee is honoured by replaying the first response per key, and an undeclared host makes the run UNSUPPORTED"
+];
+/** Run the scenario once under the given run's fault decisions and return its log. */
+async function runOnce(spec, platform, run) {
+	await platform.reset(spec);
+	run.install(spec.externals);
+	try {
+		try {
+			const pending = [...platform.initialEvents(spec)];
+			while (pending.length > 0) {
+				const event = pending.shift();
+				const result = await platform.deliver(event, run, spec);
+				pending.push(...result.followUps);
+			}
+		} finally {
+			run.uninstall();
+		}
+		await platform.finish?.(spec, run);
+	} finally {
+		await platform.cleanup?.(spec);
+	}
+	return run.log;
+}
+/** Re-run a recorded schedule exactly and return the whole run (log and support status). */
+async function replayRun(spec, platform, schedule) {
+	const run = new Run({
+		mode: "replay",
+		schedule,
+		bounds: spec.bounds,
+		faultProbability: 0
+	});
+	await runOnce(spec, platform, run);
+	return run;
+}
+/** Re-run a recorded schedule exactly. */
+async function replay(spec, platform, schedule) {
+	return (await replayRun(spec, platform, schedule)).log;
+}
+async function explore(spec, platform, options) {
+	const now = options.now ?? (() => Date.now());
+	const maxRuns = options.maxRuns ?? 100;
+	const faultProbability = options.faultProbability ?? .5;
+	const assumptions = [...engineAssumptions, ...platform.assumptions];
+	const start = now();
+	const reached = {
+		runs: 0,
+		effectPoints: 0,
+		faultsInjected: 0
+	};
+	const done = () => ({
+		...reached,
+		elapsedMs: now() - start
+	});
+	const base = {
+		scenario: spec.name,
+		seed: options.seed,
+		assumptions
+	};
+	if (spec.bounds.maxConcurrentInvocations !== 1) return {
+		...base,
+		kind: "UNSUPPORTED",
+		cause: "unsupported_bounds",
+		reason: "maxConcurrentInvocations above 1 is not supported yet",
+		reached: done()
+	};
+	const leakCheckRuns = options.leakCheckRuns ?? 2;
+	/** The first runs' schedules and digests, replayed in reverse order before BOUNDED. */
+	const witnesses = [];
+	let master = seedPrng(options.seed);
+	while (reached.runs < maxRuns && now() - start < spec.bounds.budgetMs) {
+		const [runSeed, next] = nextU32(master);
+		master = next;
+		const run = new Run({
+			mode: "explore",
+			schedule: {
+				seed: runSeed,
+				faults: []
+			},
+			bounds: spec.bounds,
+			faultProbability
+		});
+		const log = await runOnce(spec, platform, run);
+		reached.runs++;
+		reached.effectPoints += run.effectPoints;
+		reached.faultsInjected += run.faultsInjected;
+		if (witnesses.length < leakCheckRuns) witnesses.push({
+			schedule: run.schedule,
+			digest: digestLog(log)
+		});
+		if (run.unsupportedReasons.length > 0) return {
+			...base,
+			kind: "UNSUPPORTED",
+			cause: "unsupported_api",
+			reason: run.unsupportedReasons.join("; "),
+			reached: done()
+		};
+		const violation = checkInvariants(log, spec.invariants)[0];
+		if (violation) {
+			const schedule = run.schedule;
+			const replayedRun = await replayRun(spec, platform, schedule);
+			const replayed = replayedRun.log;
+			reached.runs++;
+			if (replayedRun.unsupportedReasons.length > 0 || digestLog(replayed) !== digestLog(log)) return {
+				...base,
+				kind: "UNSUPPORTED",
+				cause: "not_replayable",
+				reason: `the violating run of seed ${schedule.seed} did not reproduce on replay`,
+				reached: done()
+			};
+			const shrunk = await shrink(spec, platform, schedule, violation, replayed, {
+				maxRuns: options.maxShrinkRuns ?? 200,
+				deadline: now() + spec.bounds.budgetMs,
+				now
+			});
+			reached.runs += shrunk.runs;
+			return {
+				...base,
+				kind: "VIOLATED",
+				violation: shrunk.violation,
+				trace: shrunk.trace,
+				schedule: shrunk.schedule,
+				keptEvents: shrunk.keptEvents,
+				shrunk: {
+					faultsRemoved: shrunk.faultsRemoved,
+					eventsRemoved: shrunk.eventsRemoved,
+					runs: shrunk.runs
+				},
+				reached: done()
+			};
+		}
+	}
+	for (const witness of [...witnesses].reverse()) {
+		const again = await replayRun(spec, platform, witness.schedule);
+		reached.runs++;
+		if (again.unsupportedReasons.length > 0 || digestLog(again.log) !== witness.digest) return {
+			...base,
+			kind: "UNSUPPORTED",
+			cause: "module_state_leak",
+			reason: `run seed ${witness.schedule.seed} produced a different log when replayed after other runs: state is leaking between runs (module-level variables, or a binding Eutaxy does not reset)`,
+			reached: done()
+		};
+	}
+	return {
+		...base,
+		kind: "BOUNDED",
+		bounds: spec.bounds,
+		reached: done()
+	};
+}
+export { Run as a, realTick as c, validateScenario as d, checkInvariant as f, CrashSignal as i, settleOn as l, getPath as m, replay as n, installScriptedFetch as o, checkInvariants as p, restrictSpec as r, patchGlobals as s, explore as t, defaultBounds as u };
+
+//# sourceMappingURL=src-BrCsF5RZ.mjs.map