@reventlessdev/reventless-spec 3.0.0-alpha.123 → 3.0.0-alpha.125

package/src/semantic/Messaging.res

@@ -0,0 +1,127 @@
+/**
+Sending a message to a person, and deciding whether to try again.
+
+The transport is provider-specific and lives with its provider. What is here is
+provider-neutral: who a message can be addressed to, what a send can answer, the
+retry rule — decided once, so no transport invents its own.
+
+## One value carries the channel and the address
+
+A `(channel, address)` pair can be built wrong: `Sms` beside an email address
+compiles and fails at the provider. `recipient` fuses them, so the wrong pair
+does not exist, and the channel is read back off the value that carries it.
+*/
+
+/** A delivery route. The selector a recipient chooses per notification kind, and
+    the granularity a platform provisions at. */
+type channel =
+  | Email
+  | Sms
+  | Push
+
+/** An addressed recipient: the channel and the address it needs, inseparable.
+    Each address is the branded scalar for its channel, so an unparseable one is
+    refused where it is built rather than by the provider. */
+type recipient =
+  | ToEmail(Email.t)
+  | ToSms(Phone.t)
+  | /** The token the device registered with the push service. Opaque and
+        provider-shaped — unlike an address, nobody else has a grammar for it. */
+  ToPush({deviceToken: string})
+
+/** The channel a recipient is addressed on. */
+let channelOf = (recipient: recipient): channel =>
+  switch recipient {
+  | ToEmail(_) => Email
+  | ToSms(_) => Sms
+  | ToPush(_) => Push
+  }
+
+/** The channel's name, for a message a human reads and for a preference key. */
+let channelToString = (channel: channel): string =>
+  switch channel {
+  | Email => "Email"
+  | Sms => "Sms"
+  | Push => "Push"
+  }
+
+/**
+What to say.
+
+`subject` is carried for the channels that have one — an email header, a push
+notification's title — and ignored by those that do not. Optional rather than an
+empty string, so "this message has no subject" and "its subject is blank" stay
+distinguishable.
+*/
+type message = {subject?: string, body: string}
+
+/** The provider accepted the message. `ref` is its own id for it — what a
+    support conversation about a missing message is conducted with, and the only
+    thing a caller can record that the provider will recognise. */
+type receipt = {ref: string}
+
+/**
+Why a send produced no receipt.
+
+Three constructors because the retry decision turns on the distinction, and
+getting it wrong is expensive in both directions: retrying a refused address
+burns the budget on an outcome that will not change, and abandoning a transient
+outage writes off a message that would have gone.
+*/
+type failure =
+  | /** The provider could not be reached, or refused the call. Retry. */
+  Unavailable(string)
+  | /** This deployment provisions nothing for this channel. Do not retry — no
+        number of attempts provisions one. */
+  UnsupportedChannel(channel)
+  | /** The provider answered and will not take this message: an address it
+        rejects, a recipient it suppresses. Do not retry. */
+  Refused(string)
+
+/** The retry rule, stated once. Everything that sweeps a failed send derives
+    from it rather than re-reading the constructors. */
+let retriable = (failure: failure): bool =>
+  switch failure {
+  | Unavailable(_) => true
+  | UnsupportedChannel(_)
+  | Refused(_) => false
+  }
+
+/** A reason for a human, for a caller that records the outcome rather than
+    acting on it. */
+let failureReason = (failure: failure): string =>
+  switch failure {
+  | Unavailable(reason) => reason
+  | UnsupportedChannel(channel) =>
+    `this deployment provisions no ${channel->channelToString} channel`
+  | Refused(reason) => reason
+  }
+
+/**
+The port a caller reaches a messaging provider through, so swapping the
+implementation is a change of supplier rather than of call site.
+*/
+type send = (~recipient: recipient, ~message: message) => promise<result<receipt, failure>>
+
+/**
+The capability as a slice receives it: what can be attempted, and how.
+
+`channels` is here because a recipient cannot be offered a choice the deployment
+cannot honour. A platform provisions email only, or email and SMS; a preference
+centre that listed all three would collect a subscription every send then answers
+`UnsupportedChannel` for. Published rather than inferred from a failed send,
+because discovering a channel by failing on it costs a real message.
+
+Empty means no channel at all — the shape `none` takes, and the one a deploy-time
+gate exists to catch before it ships.
+*/
+type provider = {
+  channels: array<channel>,
+  send: send,
+}
+
+/** Whether this provider can attempt a recipient's channel at all. The check a
+    caller makes before spending a send, and the same rule the provider applies
+    internally, so the two cannot disagree. */
+let supports = (provider: provider, ~recipient: recipient): bool =>
+  provider.channels->Array.includes(recipient->channelOf)

package/src/semantic/Messaging.res.mjs

@@ -0,0 +1,57 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function channelOf(recipient) {
+  switch (recipient.TAG) {
+    case "ToEmail" :
+      return "Email";
+    case "ToSms" :
+      return "Sms";
+    case "ToPush" :
+      return "Push";
+  }
+}
+
+function channelToString(channel) {
+  switch (channel) {
+    case "Email" :
+      return "Email";
+    case "Sms" :
+      return "Sms";
+    case "Push" :
+      return "Push";
+  }
+}
+
+function retriable(failure) {
+  switch (failure.TAG) {
+    case "Unavailable" :
+      return true;
+    case "UnsupportedChannel" :
+    case "Refused" :
+      return false;
+  }
+}
+
+function failureReason(failure) {
+  switch (failure.TAG) {
+    case "UnsupportedChannel" :
+      return `this deployment provisions no ` + channelToString(failure._0) + ` channel`;
+    case "Unavailable" :
+    case "Refused" :
+      return failure._0;
+  }
+}
+
+function supports(provider, recipient) {
+  return provider.channels.includes(channelOf(recipient));
+}
+
+export {
+  channelOf,
+  channelToString,
+  retriable,
+  failureReason,
+  supports,
+}
+/* No side effect */

package/src/semantic/Money.res

@@ -5,7 +5,7 @@ those units belong to.
 ## Why the currency travels with the number
 
 A minor unit is currency-dependent — ISO 4217 gives EUR two decimal places, **JPY
-zero** and **TND three** — so a bare `1000` is €10.00 or ¥1000 or 1.000 TND, and
+zero** and TND three — so a bare `1000` is €10.00 or ¥1000 or 1.000 TND, and
 there is no way to tell which. It cannot be rendered, compared, summed or
 sanity-checked without knowing. The currency is part of the number's meaning, not
 metadata beside it.
@@ -22,6 +22,20 @@ instead — see below.
 `0.1 +. 0.2` is not `0.3`, and money is summed. Minor units keep every amount an
 exact integer, so addition is exact and equality means what it says.
 
+This was tried the other way — an amount holding the decimal a person types —
+and reverted. What it bought was a readable log; what it cost was the guarantee.
+Every sum outside `add` became a float sum, including the ones a read side does
+over a page of rows, and the failure is a figure that is a cent out and looks
+entirely plausible. Binary floating point is not what money is counted in, and
+holding the exact value in a `float` only works while nothing does arithmetic on
+it — which is not a property a framework type can promise on behalf of everyone
+downstream.
+
+**The complaint that prompted the attempt was real and is answered elsewhere.** A
+form generated from this schema must not ask anyone for `1050`; it asks for
+`10.50` and converts at its own boundary, with `ofMajor`/`toMajor` below. That is
+a presentation concern, and this type had been letting it leak.
+
 ## Why `float` for a whole number
 
 Because ReScript's `int` is int32, and sury enforces that — an `int` amount caps
@@ -72,12 +86,15 @@ let validateAmount = (amount: float): result<float, string> =>
     Ok(amount)
   }
 
-/** The amount's own schema. The check sits on the field rather than on the pair
-    because wholeness is a property of the amount — and because sury 11-alpha
-    miscompiles a refinement wrapping a *record* schema (it hoists the result
-    object above the field reads, so both parse and serialize throw
-    `Cannot access 'v0' before initialization`). Refining the field is both the
-    honest placement and the one that works. */
+/** The amount's own schema.
+
+    The check sits on the field rather than on the pair because wholeness is a
+    property of the amount: it does not need the currency, and a rule placed
+    where it needs nothing else is a rule that cannot be read wrong. (A
+    record-level refinement is available — sury 11.0.0-rc.2 compiles one
+    correctly, where 11-alpha hoisted the result object above the field reads and
+    threw `Cannot access 'v0' before initialization` — it is simply not what this
+    check wants.) */
 let amountSchema: S.t<float> =
   S.float->S.refine(
     amount =>
@@ -109,34 +126,41 @@ let make = (~amount: float, ~currency: Currency.t): t => {amount, currency}
     euros" are different claims, and only the second one adds to a total. */
 let zero = (~currency: Currency.t): t => {amount: 0.0, currency}
 
+/** Ten to the power of the currency's decimal count — the factor between a major
+    amount and the minor units it is. Named because the two conversions below
+    both need it and neither should spell out `Math.pow` again. */
+let scale = (currency: Currency.t): float =>
+  Math.pow(10.0, ~exp=Int.toFloat(Currency.exponent(currency)))
+
 /**
 Convert a major-unit decimal (`10.5`) into minor units (`1050`), using the
 currency's own exponent.
 
 This is the one place a decimal is allowed to become money, and it is here rather
 than at each call site precisely so that `*. 100.0` is written once and is
-correct for JPY and TND — where it would be `*. 1.0` and `*. 1000.0`.
+correct for JPY and TND — where it would be `*. 1.0` and `*. 1000.0`. It is what
+a form, a supplier feed or any other boundary that speaks in decimals converts
+through.
 
-Rounds half away from zero (`10.005` EUR → `1001`), which is what a reader
-expects of a price. That is a *boundary conversion* and not an arithmetic
-policy: the half-even question that FX and tax rounding turn on is a separate
-decision, and nothing here forecloses it.
+Rounds half away from zero, in both directions: `Math.round` alone rounds half
+toward positive infinity, so `-2.5` would come back `-2` and a refund would round
+the other way from the charge it reverses. That is a *boundary conversion* and
+not an arithmetic policy: the half-even question that FX and tax rounding turn on
+is a separate decision, and nothing here forecloses it.
 */
 let ofMajor = (~amount: float, ~currency: Currency.t): t => {
-  let scale = Math.pow(10.0, ~exp=Int.toFloat(Currency.exponent(currency)))
-  {amount: Math.round(amount *. scale), currency}
+  let scaled = amount *. scale(currency)
+  {amount: scaled < 0.0 ? -.Math.round(-.scaled) : Math.round(scaled), currency}
 }
 
-/** The amount as a major-unit decimal — for charts, averages and anything that
-    has to be a number rather than money. Lossy by nature: the result is a float
-    again, so it is an output, not something to compute a balance in. */
-let toMajor = (m: t): float =>
-  m.amount /. Math.pow(10.0, ~exp=Int.toFloat(Currency.exponent(m.currency)))
+/** The amount as a major-unit decimal — what a form shows, and what a chart axis
+    or an average needs. Lossy by nature: the result is a float again, so it is an
+    output, not something to compute a balance in. */
+let toMajor = (m: t): float => m.amount /. scale(m.currency)
 
 /**
 The amount as text: the decimal point placed by the currency's exponent, digits
-grouped in threes, and the ISO code after it — `"1,234.50 EUR"`, `"1,000 JPY"`,
-`"1.000 TND"`.
+grouped in threes, and the ISO code after it — `"1,234.50 EUR"`, `"1,000 JPY"`.
 
 Deliberately locale-independent, matching the rest of the framework's
 formatters: the same value reads the same in every log line and every test. A
@@ -176,6 +200,9 @@ branded-scalar shape was that mixing currencies could not be written at all; the
 answer is to *check* it rather than to delete the information that makes checking
 possible. An aggregate that must hold one currency rejects a line item in
 another — a decider's concern, and one it can now actually express.
+
+The addition itself is integer addition, because both amounts are whole minor
+units. That is the whole reason they are.
 */
 let add = (a: t, b: t): result<t, string> =>
   a.currency == b.currency
@@ -185,6 +212,81 @@ let add = (a: t, b: t): result<t, string> =>
         `Converting between them needs a rate, which is not something an amount carries.`,
       )
 
+/** The largest whole number a `float` holds exactly, 2^53 - 1. Bound here
+    because `Float.Constants` does not carry it, and named because it is the
+    range every guarantee in this module is stated over. */
+@val @scope("Number") external maxSafeInteger: float = "MAX_SAFE_INTEGER"
+
+/**
+Multiply an amount by a count — a line item's unit price by its quantity.
+
+`~by` is an `int` because the operand is a *count* and not a rate: three of
+something, not 15% of something. Whole minor units times a whole count is
+whole-number arithmetic, so the result is an exact amount and no rounding
+question arises at all. That is the property this function exists to keep, and it
+is why a call site should not write `amount *. Int.toFloat(quantity)` itself.
+
+A rate is the other operation, and deliberately not this one. 15% of €10.50 is
+€8.925, which is not an amount of euros in the first place — so applying a rate
+is a rounding decision the domain has to state, through `toMajor`, the
+arithmetic, and `ofMajor` back, with the rounding visible where someone chose it.
+
+Refuses a product past the range where a `float` is an exact integer. Handing
+back an inexact amount is the failure the wholeness check exists to prevent, and
+it would not do to introduce it here.
+*/
+let times = (m: t, ~by: int): result<t, string> => {
+  let product = m.amount *. Int.toFloat(by)
+  Math.abs(product) <= maxSafeInteger
+    ? Ok({amount: product, currency: m.currency})
+    : Error(
+        `cannot multiply ${format(m)} by ${Int.toString(by)}: the result is past the ` ++
+        `largest amount that stays exact, ${Float.toString(maxSafeInteger)} minor units.`,
+      )
+}
+
+/**
+Split an amount into `into` parts that add back up to it.
+
+The last minor unit has to go somewhere. Dividing and rounding each part on its
+own loses or invents one — €10.00 into three is €3.33 three times, which is
+€9.99 — so the remainder is handed out instead: the first parts get one minor
+unit more than the rest. €10.00 into three is €3.34, €3.33, €3.33, and those add
+up to €10.00.
+
+*Which* parts get the extra unit is arbitrary, but it has to be decided rather
+than left to a rounding mode, and "the earliest" is the decision here. A caller
+that needs it somewhere else — the largest share, the payer's — reorders what it
+gets back. A caller that needs uneven shares wants a split by ratio, which is a
+different function and not this one.
+
+A negative amount splits away from zero the same way: -€10.00 into three is
+-€3.34, -€3.33, -€3.33. A refund divides like a charge.
+*/
+let allocate = (m: t, ~into: int): result<array<t>, string> =>
+  if into <= 0 {
+    Error(
+      `cannot split ${format(m)} into ${Int.toString(into)} parts: ` ++
+      `a split is into at least one part.`,
+    )
+  } else {
+    let parts = Int.toFloat(into)
+    // Truncated toward zero, so the remainder carries the sign of the amount and
+    // every part stays on the same side of zero as the whole it came from.
+    let share = Math.trunc(m.amount /. parts)
+    // Taken from the share actually used rather than from the ideal one, which
+    // is what makes the parts add back up by construction.
+    let remainder = m.amount -. share *. parts
+    let step = remainder < 0.0 ? -1.0 : 1.0
+    let extra = Math.abs(remainder)
+    Ok(
+      Array.fromInitializer(~length=into, i => {
+        amount: share +. (Int.toFloat(i) < extra ? step : 0.0),
+        currency: m.currency,
+      }),
+    )
+  }
+
 /** Add a run of amounts, refusing at the first currency that does not match the
     first amount's. `None` for an empty run — the sum of no amounts has no
     currency to be in. */

package/src/semantic/Money.res.mjs

@@ -54,10 +54,14 @@ function zero(currency) {
   };
 }
 
+function scale(currency) {
+  return Math.pow(10.0, Currency$Reventless.exponent(currency));
+}
+
 function ofMajor(amount, currency) {
-  let scale = Math.pow(10.0, Currency$Reventless.exponent(currency));
+  let scaled = amount * Math.pow(10.0, Currency$Reventless.exponent(currency));
   return {
-    amount: Math.round(amount * scale),
+    amount: scaled < 0.0 ? - Math.round(- scaled) : Math.round(scaled),
     currency: currency
   };
 }
@@ -108,6 +112,46 @@ function add(a, b) {
   }
 }
 
+function times(m, by) {
+  let product = m.amount * by;
+  if (Math.abs(product) <= Number.MAX_SAFE_INTEGER) {
+    return {
+      TAG: "Ok",
+      _0: {
+        amount: product,
+        currency: m.currency
+      }
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `cannot multiply ` + format(m) + ` by ` + by.toString() + `: the result is past the ` + (`largest amount that stays exact, ` + Number.MAX_SAFE_INTEGER.toString() + ` minor units.`)
+    };
+  }
+}
+
+function allocate(m, into) {
+  if (into <= 0) {
+    return {
+      TAG: "Error",
+      _0: `cannot split ` + format(m) + ` into ` + into.toString() + ` parts: a split is into at least one part.`
+    };
+  }
+  let share = Math.trunc(m.amount / into);
+  let remainder = m.amount - share * into;
+  let step = remainder < 0.0 ? -1.0 : 1.0;
+  let extra = Math.abs(remainder);
+  return {
+    TAG: "Ok",
+    _0: Stdlib_Array.fromInitializer(into, i => ({
+      amount: share + (
+        i < extra ? step : 0.0
+      ),
+      currency: m.currency
+    }))
+  };
+}
+
 function sum(amounts) {
   if (amounts.length !== 0) {
     return Stdlib_Array.reduce(amounts, {
@@ -126,10 +170,13 @@ export {
   schema$1 as schema,
   make,
   zero,
+  scale,
   ofMajor,
   toMajor,
   format,
   add,
+  times,
+  allocate,
   sum,
 }
 /* amountSchema Not a pure module */

package/src/types/Trait.res

@@ -0,0 +1,62 @@
+// What a domain trait says about itself, so that a graft leaves a trace.
+//
+// A graft becomes ordinary host source — that is the design, and it is why every
+// other signal a trait leaves is source-side: the package dependency, the variant
+// spread, the `module X = Trait_Rules` alias, the conformance binding under
+// `tests/`. None of them survives into a deployed plugin, so a running estate
+// cannot answer "which of my components came from a trait" at all.
+//
+// This is the one fact that does survive, because it travels the way
+// `capabilityNeeds` does: a value the trait exports and the host names, collected
+// into `pluginStructure` while it is assembled and re-emitted whole on every
+// registration.
+//
+// **Nothing here is typed by a human.** The trait exports its own identity, so a
+// renamed or removed trait is a build error rather than a stale row; the version
+// is read from the trait's own package rather than restated; and the component is
+// filled in by the structure, which is the only party that knows which component
+// declared it. That is the whole reason this is a value rather than an
+// annotation — an attribute's fields would all be strings the compiler never
+// checks, which is the failure this program exists to remove.
+//
+// **A declaration is a claim about origin, never about behaviour.** After a graft
+// the developer owns the files and may edit them freely. So this says "grafted
+// from trait X", and it does NOT say "still behaves like trait X" — the thing that
+// answers the second question is the trait's conformance suite, which runs in the
+// consumer's build and reports separately. A reader that paints a declared graft
+// as verified is drawing a conclusion this field cannot support.
+
+/** Whether the graft reports back into the host it is grafted onto.
+
+    `WritesBack` publishes commands to its host — the geocoding shape, where the
+    slice reports its answer back onto the aggregate. `Observes` reads host events
+    and writes nothing back. `SelfContained` brings its own components and grafts
+    only by reading — the notification shape, which is what broke the
+    write-back assumption the first two specimens shared. */
+type posture =
+  | WritesBack
+  | Observes
+  | SelfContained
+
+let postureToString = (p: posture): string =>
+  switch p {
+  | WritesBack => "WritesBack"
+  | Observes => "Observes"
+  | SelfContained => "SelfContained"
+  }
+
+/**
+One trait's own account of itself, exported by the trait package.
+
+`version` is read from the trait's package at load time rather than restated in
+source — see `PackageVersion.fromModuleUrl`, which the certification CLI already
+resolves trait versions with. A trait whose package.json cannot be found reports
+`"0.0.0"`, which is visibly wrong rather than quietly stale.
+*/
+type t = {
+  /** The package, as it is depended on: `"@reventlessdev/trait-attachments"`. */
+  trait: string,
+  /** Resolved from the trait's own package, never written by hand. */
+  version: string,
+  posture: posture,
+}

package/src/types/Trait.res.mjs

@@ -0,0 +1,18 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function postureToString(p) {
+  switch (p) {
+    case "WritesBack" :
+      return "WritesBack";
+    case "Observes" :
+      return "Observes";
+    case "SelfContained" :
+      return "SelfContained";
+  }
+}
+
+export {
+  postureToString,
+}
+/* No side effect */

package/src/types/Transition.res

@@ -0,0 +1,71 @@
+// The lifecycle edge a command owns, declared as a value rather than as an
+// attribute on the constructor.
+//
+// `@transition([Orders.Placed] => Orders.Shipped)` says the same thing and is
+// still the shorter spelling for a command a host declares itself. It cannot say
+// it for a command a host did NOT declare: a variant spread splices members,
+// while the annotation lowers to a dict on the parent union, so a spliced
+// command arrives carrying no edge at all. Nor can the annotation be checked —
+// the PPX extracts leaf identifiers as strings, and the states belong to another
+// component's enum, so a misspelling survives to the plugin structure.
+//
+// A `command => t<'state>` switch answers both. It is exhaustive, so a spliced
+// constructor is a compile error until the host says what it does; and `'state`
+// is the view's own lifecycle enum, so `Customers.Active` is a constructor the
+// compiler resolves rather than a string nobody reads.
+//
+// `'state` is one type across the whole switch, which is a third thing the
+// annotation cannot do: every arm of one component's edges must name the same
+// lifecycle, and a from-set drawn from one enum with a target from another does
+// not compile.
+//
+// The type stays parameterised all the way down rather than storing names,
+// because erasing a constructor to its own name means asserting its runtime
+// representation — and this is the module that exists so nothing has to be
+// asserted. The erasure happens once, at the framework's type-erasure boundary
+// (`Plugin_Structure`), which already reads every spec member that way.
+//
+// The reference costs nothing at run time. A lifecycle enum's arms are
+// payload-less, so `[Customers.Active]` compiles to `["Active"]` and the
+// generated module imports nothing from the view — which is also why it cannot
+// cycle: a view spec holds no reference back to the aggregate it projects.
+//
+// Read the same way `commandAuthorization` is: `Plugin_Structure.toCommandDef`
+// evaluates it against a synthetic value per constructor.
+//
+// No `@schema`: nothing serialises a transition. It is read once, while the
+// plugin structure is assembled, and what leaves is the pair of names the
+// structure already carried.
+type t<'state> =
+  /** No edge declared: legal in every state, moves the row nowhere. The honest
+      answer for a report a slice publishes, which must not be refused because
+      the row moved on while the report was in flight. */
+  | Unrestricted
+  /** Brings the row into existence, so there is no state it could come from.
+      Distinct from `Unrestricted`, which draws no edge at all. */
+  | Creates('state)
+  /** Legal in these states, and moves the row nowhere. A positive claim rather
+      than an omission. */
+  | Guards(array<'state>)
+  /** Legal in these states, and lands the row in that one. */
+  | Moves(array<'state>, 'state)
+
+/** The from-set, or `None` for a command that names no states to come from —
+    which `Creates` and `Unrestricted` both do, for different reasons the target
+    tells apart. */
+let allowedStates = (transition: t<'state>): option<array<'state>> =>
+  switch transition {
+  | Unrestricted
+  | Creates(_) => None
+  | Guards(states)
+  | Moves(states, _) => Some(states)
+  }
+
+/** The state the command's handler writes, or `None` for one that moves nothing. */
+let targetState = (transition: t<'state>): option<'state> =>
+  switch transition {
+  | Unrestricted
+  | Guards(_) => None
+  | Creates(state)
+  | Moves(_, state) => Some(state)
+  }

package/src/types/Transition.res.mjs

@@ -0,0 +1,36 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+
+function allowedStates(transition) {
+  if (typeof transition !== "object") {
+    return;
+  }
+  switch (transition.TAG) {
+    case "Creates" :
+      return;
+    case "Guards" :
+    case "Moves" :
+      return transition._0;
+  }
+}
+
+function targetState(transition) {
+  if (typeof transition !== "object") {
+    return;
+  }
+  switch (transition.TAG) {
+    case "Creates" :
+      return Primitive_option.some(transition._0);
+    case "Guards" :
+      return;
+    case "Moves" :
+      return Primitive_option.some(transition._1);
+  }
+}
+
+export {
+  allowedStates,
+  targetState,
+}
+/* No side effect */