aifsmjs 0.5.8 → 0.6.0

package/dist/pbt/index.d.ts

@@ -1,5 +1,5 @@
 import * as fc from 'fast-check';
-import { j as Runtime, f as MachineDef, I as Implementations } from '../types-DIM7QTtf.js';
+import { j as Runtime, f as MachineDef, I as Implementations } from '../types-CrDxFfBx.js';
 
 /**
  * Pure-model representation of an FSM run, used by `fc.commands`.
@@ -39,6 +39,22 @@ type AssertOpts = Readonly<{
     seed?: number;
     verbose?: boolean;
 }>;
+/**
+ * Structural deep-equality for two context values (C3). Backed by `node:util`
+ * `isDeepStrictEqual`, replacing the previous `JSON.stringify(a) === JSON.stringify(b)`
+ * oracle which was unsound:
+ *
+ *   - key-order-sensitive  → false-FAIL on `{a:1,b:2}` vs `{b:2,a:1}`;
+ *   - drops undefined keys  → false-PASS on `{v:undefined,w:1}` vs `{w:1}`;
+ *   - lossy for `Map`/`Set`/`Date` (all serialise to `{}` or an ISO string);
+ *   - throws on `BigInt`.
+ *
+ * `isDeepStrictEqual` distinguishes present-but-undefined from absent keys,
+ * compares `Map`/`Set`/`Date` by contents, and tolerates `BigInt` — exactly
+ * the verdicts a context-equality oracle for PBT requires. No new dependency
+ * (Node built-in; the package already targets Node >=18).
+ */
+declare function contextEquals(a: unknown, b: unknown): boolean;
 /**
  * #1 snapshotAlwaysFrozen — after any event sequence the live snapshot remains
  * frozen at the top level.
@@ -84,8 +100,8 @@ declare function guardsFalseNoTransition<Ctx, Evt extends {
 }, States extends string>(def: MachineDef<Ctx, Evt, States>, impl: Implementations<Ctx, Evt>, eventArbitraries: EventArbitraries<Evt>, opts?: AssertOpts): void;
 /**
  * #6 assignDoesNotMutate — running an `assign`-style action never mutates the
- * previous context object. Verified by deep-equality check on a snapshot taken
- * before each event.
+ * previous context object. Verified by re-checking the own state of every
+ * object reachable from the pre-step context.
  */
 declare function assignDoesNotMutate<Ctx, Evt extends {
     type: string;
@@ -100,18 +116,15 @@ declare function assertAll<Ctx, Evt extends {
     unknownEventType?: string;
 }): void;
 
-type propertiesModule_AssertOpts = AssertOpts;
-declare const propertiesModule_assertAll: typeof assertAll;
-declare const propertiesModule_assignDoesNotMutate: typeof assignDoesNotMutate;
-declare const propertiesModule_guardsFalseNoTransition: typeof guardsFalseNoTransition;
-declare const propertiesModule_reachableStatesSubsetDeclared: typeof reachableStatesSubsetDeclared;
-declare const propertiesModule_replayEqualsFold: typeof replayEqualsFold;
-declare const propertiesModule_snapshotAlwaysFrozen: typeof snapshotAlwaysFrozen;
-declare const propertiesModule_unknownEventNoOp: typeof unknownEventNoOp;
-declare namespace propertiesModule {
-  export { type propertiesModule_AssertOpts as AssertOpts, propertiesModule_assertAll as assertAll, propertiesModule_assignDoesNotMutate as assignDoesNotMutate, propertiesModule_guardsFalseNoTransition as guardsFalseNoTransition, propertiesModule_reachableStatesSubsetDeclared as reachableStatesSubsetDeclared, propertiesModule_replayEqualsFold as replayEqualsFold, propertiesModule_snapshotAlwaysFrozen as snapshotAlwaysFrozen, propertiesModule_unknownEventNoOp as unknownEventNoOp };
-}
-
-declare const properties: typeof propertiesModule;
+declare const properties: Readonly<{
+    assertAll: typeof assertAll;
+    assignDoesNotMutate: typeof assignDoesNotMutate;
+    contextEquals: typeof contextEquals;
+    guardsFalseNoTransition: typeof guardsFalseNoTransition;
+    reachableStatesSubsetDeclared: typeof reachableStatesSubsetDeclared;
+    replayEqualsFold: typeof replayEqualsFold;
+    snapshotAlwaysFrozen: typeof snapshotAlwaysFrozen;
+    unknownEventNoOp: typeof unknownEventNoOp;
+}>;
 
 export { type AssertOpts, type EventArbitraries, type FsmCommand, type FsmModel, assertAll, assignDoesNotMutate, commandsFromMachine, guardsFalseNoTransition, initialModel, properties, reachableStatesSubsetDeclared, replayEqualsFold, snapshotAlwaysFrozen, unknownEventNoOp };

package/dist/pbt/index.js

@@ -1,10 +1,10 @@
-import { createRuntime, initialSnapshot } from '../chunk-VZCSHTOI.js';
-import { replay } from '../chunk-NEJYZAKR.js';
-import { step, mergeContext, normalizeTransitions } from '../chunk-ZLQ7HZCE.js';
+import { createRuntime, initialSnapshot } from '../chunk-XA24A7VP.js';
+import { replay } from '../chunk-Q45LGXHO.js';
+import { step, normalizeTransitions } from '../chunk-D6H64FSI.js';
 import '../chunk-JKZAOPQC.js';
-import '../chunk-A7U7QQL5.js';
-import { __export } from '../chunk-PZ5AY32C.js';
+import { ownValue } from '../chunk-SSNKGEVB.js';
 import * as fc2 from 'fast-check';
+import { isDeepStrictEqual } from 'util';
 
 function initialModel(def) {
   return {
@@ -52,18 +52,6 @@ function commandsFromMachine(def, impl, eventArbitraries) {
   }
   return fc2.commands(arbs, { size: "+1" });
 }
-
-// src/pbt/properties.ts
-var properties_exports = {};
-__export(properties_exports, {
-  assertAll: () => assertAll,
-  assignDoesNotMutate: () => assignDoesNotMutate,
-  guardsFalseNoTransition: () => guardsFalseNoTransition,
-  reachableStatesSubsetDeclared: () => reachableStatesSubsetDeclared,
-  replayEqualsFold: () => replayEqualsFold,
-  snapshotAlwaysFrozen: () => snapshotAlwaysFrozen,
-  unknownEventNoOp: () => unknownEventNoOp
-});
 function buildAssertOpts(opts) {
   const out = {};
   if (opts?.numRuns !== void 0) out.numRuns = opts.numRuns;
@@ -71,13 +59,20 @@ function buildAssertOpts(opts) {
   if (opts?.verbose) out.verbose = true;
   return out;
 }
+function contextEquals(a, b) {
+  return isDeepStrictEqual(a, b);
+}
 function snapshotAlwaysFrozen(def, impl, eventArbitraries, opts) {
   fc2.assert(
     fc2.property(commandsFromMachine(def, impl, eventArbitraries), (cmds) => {
-      const real = createRuntime(def, impl);
-      const model = initialModel(def);
-      fc2.modelRun(() => ({ model, real }), cmds);
-      return Object.isFrozen(real.getSnapshot());
+      const real = createRuntime(def, impl, { dispatchEffects: false });
+      try {
+        const model = initialModel(def);
+        fc2.modelRun(() => ({ model, real }), cmds);
+        return Object.isFrozen(real.getSnapshot());
+      } finally {
+        real.dispose();
+      }
     }),
     buildAssertOpts(opts)
   );
@@ -96,13 +91,17 @@ function reachableStatesSubsetDeclared(def, impl, eventArbitraries, opts) {
   const declared = new Set(Object.keys(def.states));
   fc2.assert(
     fc2.property(commandsFromMachine(def, impl, eventArbitraries), (cmds) => {
-      const real = createRuntime(def, impl);
-      const model = initialModel(def);
-      fc2.modelRun(() => ({ model, real }), cmds);
-      for (const s of model.reached) {
-        if (!declared.has(s)) return false;
+      const real = createRuntime(def, impl, { dispatchEffects: false });
+      try {
+        const model = initialModel(def);
+        fc2.modelRun(() => ({ model, real }), cmds);
+        for (const s of model.reached) {
+          if (!declared.has(s)) return false;
+        }
+        return declared.has(real.getSnapshot().value);
+      } finally {
+        real.dispose();
       }
-      return declared.has(real.getSnapshot().value);
     }),
     buildAssertOpts(opts)
   );
@@ -112,10 +111,14 @@ function replayEqualsFold(def, impl, eventArbitraries, opts) {
   fc2.assert(
     fc2.property(fc2.array(eventArb, { maxLength: 32 }), (events) => {
       const real = createRuntime(def, impl, { dispatchEffects: false });
-      for (const e of events) real.send(e);
-      const live = real.getSnapshot();
-      const replayed = replay(initialSnapshot(def), events, def, impl).snapshot;
-      return live.value === replayed.value && JSON.stringify(live.context) === JSON.stringify(replayed.context);
+      try {
+        for (const e of events) real.send(e);
+        const live = real.getSnapshot();
+        const replayed = replay(initialSnapshot(def), events, def, impl).snapshot;
+        return live.value === replayed.value && contextEquals(live.context, replayed.context);
+      } finally {
+        real.dispose();
+      }
     }),
     buildAssertOpts(opts)
   );
@@ -124,7 +127,8 @@ function guardsFalseNoTransition(def, impl, eventArbitraries, opts) {
   const blockedGuards = new Proxy(
     {},
     {
-      get: () => () => false
+      get: () => () => false,
+      getOwnPropertyDescriptor: () => ({ configurable: true })
     }
   );
   const blockedImpl = {
@@ -132,7 +136,7 @@ function guardsFalseNoTransition(def, impl, eventArbitraries, opts) {
     guards: blockedGuards
   };
   const isFullyGuarded = (value, eventType) => {
-    const candidates = normalizeTransitions(def.states[value]?.on?.[eventType]);
+    const candidates = normalizeTransitions(ownValue(def.states[value]?.on, eventType));
     return candidates.length > 0 && candidates.every((t) => t.guard !== void 0);
   };
   fc2.assert(
@@ -152,20 +156,28 @@ function guardsFalseNoTransition(def, impl, eventArbitraries, opts) {
     buildAssertOpts(opts)
   );
 }
+var ownState = (v) => [
+  ...Reflect.ownKeys(v).flatMap((k) => [k, v[k]]),
+  ...v instanceof Map || v instanceof Set ? [...v.entries()].flat() : [],
+  v instanceof Date && v.getTime()
+];
 function assignDoesNotMutate(def, impl, eventArbitraries, opts) {
-  const dummy = { a: 1, b: 2 };
-  const merged = mergeContext(dummy, { b: 3 });
-  if (merged === dummy) throw new Error("aifsmjs/pbt: mergeContext returned the same reference");
   fc2.assert(
     fc2.property(
       fc2.array(fc2.oneof(...Object.values(eventArbitraries)), { maxLength: 16 }),
       (events) => {
         let snap = initialSnapshot(def);
         for (const e of events) {
-          const beforeCtxSerialised = JSON.stringify(snap.context);
-          step(def, snap, e, impl);
-          if (JSON.stringify(snap.context) !== beforeCtxSerialised) return false;
+          const before = /* @__PURE__ */ new Map();
+          const walk = (v) => {
+            if (!v || typeof v !== "object" || before.has(v)) return;
+            const own = ownState(v);
+            before.set(v, own);
+            own.forEach(walk);
+          };
+          walk(snap.context);
           snap = step(def, snap, e, impl).snapshot;
+          for (const [obj, own] of before) if (!contextEquals(ownState(obj), own)) return false;
         }
         return true;
       }
@@ -183,7 +195,16 @@ function assertAll(def, impl, eventArbitraries, opts) {
 }
 
 // src/pbt/index.ts
-var properties = properties_exports;
+var properties = Object.freeze({
+  assertAll,
+  assignDoesNotMutate,
+  contextEquals,
+  guardsFalseNoTransition,
+  reachableStatesSubsetDeclared,
+  replayEqualsFold,
+  snapshotAlwaysFrozen,
+  unknownEventNoOp
+});
 
 export { assertAll, assignDoesNotMutate, commandsFromMachine, guardsFalseNoTransition, initialModel, properties, reachableStatesSubsetDeclared, replayEqualsFold, snapshotAlwaysFrozen, unknownEventNoOp };
 //# sourceMappingURL=index.js.map

package/dist/pbt/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/pbt/commands.ts","../../src/pbt/properties.ts","../../src/pbt/index.ts"],"names":["fc"],"mappings":";;;;;;;;AAyBO,SAAS,aACd,GAAA,EACuB;AACvB,EAAA,OAAO;AAAA,IACL,OAAO,GAAA,CAAI,OAAA;AAAA,IACX,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,QAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,OAAO,CAAA,EAAG,QAAQ,OAAA,GAAU,QAAA;AAAA,IACnD,yBAAS,IAAI,GAAA,CAAI,CAAC,GAAA,CAAI,OAAO,CAAC;AAAA,GAChC;AACF;AAEA,IAAM,cAAN,MAEA;AAAA,EACE,WAAA,CACmB,KAAA,EACA,GAAA,EACA,IAAA,EACjB;AAHiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAChB;AAAA,EAHgB,KAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EAGnB,MAAM,EAAA,EAA8C;AAElD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,GAAA,CAAI,GAA0B,CAAA,EAAoC;AAChE,IAAA,MAAM,MAAA,GAAgC,EAAE,WAAA,EAAY;AACpD,IAAA,CAAA,CAAE,IAAA,CAAK,KAAK,KAAK,CAAA;AACjB,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAE5B,IAAA,MAAM,SAAA,GAAY,KAAK,IAAA,CAAK,GAAA,EAAK,QAAQ,IAAA,CAAK,KAAA,EAAO,KAAK,IAAI,CAAA;AAI9D,IAAA,IAAI,SAAA,CAAU,QAAA,CAAS,KAAA,KAAU,KAAA,CAAM,KAAA,EAAO;AAC5C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qDAAA,EAAmD,MAAA,CAAO,SAAA,CAAU,QAAA,CAAS,KAAK,CAAC,CAAA,wBAAA,EAA2B,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,QAAA,EAAW,IAAA,CAAK,UAAU,CAAA;AAAA,OAC7J;AAAA,IACF;AAGA,IAAA,CAAA,CAAE,QAAQ,KAAA,CAAM,KAAA;AAChB,IAAA,CAAA,CAAE,UAAU,KAAA,CAAM,OAAA;AAClB,IAAA,CAAA,CAAE,SAAS,KAAA,CAAM,MAAA;AACjB,IAAA,CAAA,CAAE,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAAA,EAC3B;AAAA,EAEA,QAAA,GAAmB;AACjB,IAAA,OAAO,CAAA,KAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,KAAK,CAAC,CAAA,CAAA,CAAA;AAAA,EAC3C;AACF,CAAA;AAWO,SAAS,mBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACsD;AACtD,EAAA,MAAM,OAAqD,EAAC;AAC5D,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAA,EAAG;AACjD,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,CAAC,KAAA,KAAU,IAAI,WAAA,CAAY,KAAA,EAAO,GAAA,EAAK,IAAI,CAAC,CAAC,CAAA;AAAA,EACjE;AACA,EAAA,OAAUA,GAAA,CAAA,QAAA,CAAS,IAAA,EAAM,EAAE,IAAA,EAAM,MAAM,CAAA;AACzC;;;AChGA,IAAA,kBAAA,GAAA,EAAA;AAAA,QAAA,CAAA,kBAAA,EAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,mBAAA,EAAA,MAAA,mBAAA;AAAA,EAAA,uBAAA,EAAA,MAAA,uBAAA;AAAA,EAAA,6BAAA,EAAA,MAAA,6BAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,oBAAA,EAAA,MAAA,oBAAA;AAAA,EAAA,gBAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAqBA,SAAS,gBAAgB,IAAA,EAAsD;AAC7E,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,IAAA,EAAM,OAAA,KAAY,MAAA,EAAW,GAAA,CAAI,UAAU,IAAA,CAAK,OAAA;AACpD,EAAA,IAAI,IAAA,EAAM,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,OAAO,IAAA,CAAK,IAAA;AAC9C,EAAA,IAAI,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,GAAU,IAAA;AACjC,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,oBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,aAAS,mBAAA,CAAoB,GAAA,EAAK,MAAM,gBAAgB,CAAA,EAAG,CAAC,IAAA,KAAS;AACtE,MAAA,MAAM,IAAA,GAAO,aAAA,CAAc,GAAA,EAAK,IAAI,CAAA;AACpC,MAAA,MAAM,KAAA,GAA+B,aAAa,GAAG,CAAA;AACrD,MAAG,aAAS,OAAO,EAAE,KAAA,EAAO,IAAA,KAAS,IAAI,CAAA;AACzC,MAAA,OAAO,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,WAAA,EAAa,CAAA;AAAA,IAC3C,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAMO,SAAS,gBAAA,CACd,GAAA,EACA,IAAA,EACA,WAAA,EACA,IAAA,EACM;AACN,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA,CAAY,GAAA,CAAA,QAAA,CAAS,WAAW,CAAA,EAAG,CAAC,CAAA,KAAM;AAC3C,MAAA,MAAM,OAAA,GAAU,gBAAgB,GAAG,CAAA;AACnC,MAAA,MAAM,MAAA,GAAS,KAAK,GAAA,EAAK,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA,IAAuB,IAAI,CAAA;AACrE,MAAA,OAAO,MAAA,CAAO,YAAY,KAAA,IAAS,MAAA,CAAO,aAAa,OAAA,IAAW,MAAA,CAAO,QAAQ,MAAA,KAAW,CAAA;AAAA,IAC9F,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAMO,SAAS,6BAAA,CAKd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAA,MAAM,WAAW,IAAI,GAAA,CAAY,OAAO,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC,CAAA;AACxD,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,aAAS,mBAAA,CAAoB,GAAA,EAAK,MAAM,gBAAgB,CAAA,EAAG,CAAC,IAAA,KAAS;AACtE,MAAA,MAAM,IAAA,GAAO,aAAA,CAAc,GAAA,EAAK,IAAI,CAAA;AACpC,MAAA,MAAM,KAAA,GAA+B,aAAa,GAAG,CAAA;AACrD,MAAG,aAAS,OAAO,EAAE,KAAA,EAAO,IAAA,KAAS,IAAI,CAAA;AACzC,MAAA,KAAA,MAAW,CAAA,IAAK,MAAM,OAAA,EAAwB;AAE5C,QAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,CAAC,GAAG,OAAO,KAAA;AAAA,MAC/B;AACA,MAAA,OAAO,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,WAAA,GAAc,KAAK,CAAA;AAAA,IAC9C,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAOO,SAAS,gBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAA,MAAM,WAAc,GAAA,CAAA,KAAA,CAAM,GAAG,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAC,CAAA;AAC5D,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA,CAAY,UAAM,QAAA,EAAU,EAAE,WAAW,EAAA,EAAI,CAAA,EAAG,CAAC,MAAA,KAAW;AAC7D,MAAA,MAAM,OAAO,aAAA,CAAc,GAAA,EAAK,MAAM,EAAE,eAAA,EAAiB,OAAO,CAAA;AAChE,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA;AACnC,MAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,MAAA,MAAM,QAAA,GAAW,OAAO,eAAA,CAAgB,GAAG,GAAG,MAAA,EAAQ,GAAA,EAAK,IAAI,CAAA,CAAE,QAAA;AACjE,MAAA,OACE,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IACxB,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,KAAM,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA;AAAA,IAEpE,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAaO,SAAS,uBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAA,MAAM,gBAAgB,IAAI,KAAA;AAAA,IACxB,EAAC;AAAA,IACD;AAAA,MACE,GAAA,EAAK,MAAM,MAAM;AAAA;AACnB,GACF;AACA,EAAA,MAAM,WAAA,GAAyC;AAAA,IAC7C,GAAG,IAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACV;AAIA,EAAA,MAAM,cAAA,GAAiB,CAAC,KAAA,EAAe,SAAA,KAA+B;AACpE,IAAA,MAAM,UAAA,GAAa,qBAAqB,GAAA,CAAI,MAAA,CAAO,KAAK,CAAA,EAAG,EAAA,GAAK,SAAS,CAAC,CAAA;AAC1E,IAAA,OAAO,UAAA,CAAW,SAAS,CAAA,IAAK,UAAA,CAAW,MAAM,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,KAAU,MAAS,CAAA;AAAA,EAC/E,CAAA;AACA,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA;AAAA,MACE,GAAA,CAAA,KAAA,CAAS,GAAA,CAAA,KAAA,CAAM,GAAG,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAC,CAAA,EAAG,EAAE,SAAA,EAAW,EAAA,EAAI,CAAA;AAAA,MACxE,CAAC,MAAA,KAAW;AACV,QAAA,IAAI,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAC9B,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,UAAA,MAAM,YAAA,GAAe,cAAA,CAAe,IAAA,CAAK,KAAA,EAAO,EAAE,IAAI,CAAA;AACtD,UAAA,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,GAAG,WAAW,CAAA;AAIxC,UAAA,IAAI,YAAA,IAAgB,CAAA,CAAE,OAAA,KAAY,KAAA,EAAO,OAAO,KAAA;AAChD,UAAA,IAAA,GAAO,CAAA,CAAE,QAAA;AAAA,QACX;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,KACF;AAAA,IACA,gBAAgB,IAAI;AAAA,GACtB;AACF;AAOO,SAAS,mBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AAEN,EAAA,MAAM,KAAA,GAAQ,EAAE,CAAA,EAAG,CAAA,EAAG,GAAG,CAAA,EAAE;AAC3B,EAAA,MAAM,SAAS,YAAA,CAAa,KAAA,EAAO,EAAE,CAAA,EAAG,GAAG,CAAA;AAE3C,EAAA,IAAI,MAAA,KAAW,KAAA,EAAO,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAE7F,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA;AAAA,MACE,GAAA,CAAA,KAAA,CAAS,GAAA,CAAA,KAAA,CAAM,GAAG,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAC,CAAA,EAAG,EAAE,SAAA,EAAW,EAAA,EAAI,CAAA;AAAA,MACxE,CAAC,MAAA,KAAW;AACV,QAAA,IAAI,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAC9B,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,UAAA,MAAM,mBAAA,GAAsB,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA;AACvD,UAAA,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA;AAEvB,UAAA,IAAI,KAAK,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,KAAM,qBAAqB,OAAO,KAAA;AAEjE,UAAA,IAAA,GAAO,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA;AAAA,QAClC;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,KACF;AAAA,IACA,gBAAgB,IAAI;AAAA,GACtB;AACF;AAMO,SAAS,SAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAA,oBAAA,CAAqB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AACtD,EAAA,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,IAAA,EAAM,gBAAA,IAAoB,uBAAuB,IAAI,CAAA;AACjF,EAAA,6BAAA,CAA8B,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AAC/D,EAAA,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AAClD,EAAA,uBAAA,CAAwB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AACzD,EAAA,mBAAA,CAAoB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AACvD;;;ACpNO,IAAM,UAAA,GAAa","file":"index.js","sourcesContent":["import * as fc from \"fast-check\";\nimport { step } from \"../fsm/lifecycle.js\";\nimport type { Implementations, MachineDef, Runtime, Snapshot } from \"../fsm/types.js\";\n\n/**\n * Pure-model representation of an FSM run, used by `fc.commands`.\n * `reached` tracks every state visited so generic properties can check\n * containment without re-running.\n */\nexport type FsmModel<Ctx, States extends string> = {\n  value: States;\n  context: Ctx;\n  status: \"active\" | \"final\";\n  reached: Set<States>;\n};\n\nexport type EventArbitraries<Evt extends { type: string }> = Readonly<\n  Record<string, fc.Arbitrary<Evt>>\n>;\n\nexport type FsmCommand<Ctx, Evt extends { type: string }, States extends string> = fc.Command<\n  FsmModel<Ctx, States>,\n  Runtime<Ctx, Evt, States>\n>;\n\nexport function initialModel<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n): FsmModel<Ctx, States> {\n  return {\n    value: def.initial,\n    context: def.context,\n    status: def.states[def.initial]?.final ? \"final\" : \"active\",\n    reached: new Set([def.initial]),\n  };\n}\n\nclass SendCommand<Ctx, Evt extends { type: string }, States extends string>\n  implements FsmCommand<Ctx, Evt, States>\n{\n  constructor(\n    private readonly event: Evt,\n    private readonly def: MachineDef<Ctx, Evt, States>,\n    private readonly impl: Implementations<Ctx, Evt>,\n  ) {}\n\n  check(_m: Readonly<FsmModel<Ctx, States>>): boolean {\n    // Every event is always applicable; invariants are asserted in run().\n    return true;\n  }\n\n  run(m: FsmModel<Ctx, States>, r: Runtime<Ctx, Evt, States>): void {\n    const before: Snapshot<Ctx, States> = r.getSnapshot();\n    r.send(this.event);\n    const after = r.getSnapshot();\n\n    const predicted = step(this.def, before, this.event, this.impl);\n\n    /* v8 ignore start — invariant guard: fires only when the live runtime\n       diverges from the pure step() prediction, i.e. an internal bug. */\n    if (predicted.snapshot.value !== after.value) {\n      throw new Error(\n        `aifsmjs/pbt: determinism violation — predicted \"${String(predicted.snapshot.value)}\" but runtime returned \"${String(after.value)}\" after ${this.toString()}`,\n      );\n    }\n    /* v8 ignore stop */\n\n    m.value = after.value;\n    m.context = after.context as Ctx;\n    m.status = after.status;\n    m.reached.add(after.value);\n  }\n\n  toString(): string {\n    return `send(${JSON.stringify(this.event)})`;\n  }\n}\n\n/**\n * Build an `fc.Arbitrary` of FSM command sequences. Each command pulls one\n * event from the user-supplied arbitrary map and, when run, asserts that the\n * pure `step()` prediction matches the runtime's observable outcome.\n *\n * Pair this arbitrary with `fc.property(...)` inside a `fc.assert(...)` call,\n * or use the helpers in `aifsmjs/pbt` properties to get the six generic\n * invariants for free.\n */\nexport function commandsFromMachine<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n): fc.Arbitrary<Iterable<FsmCommand<Ctx, Evt, States>>> {\n  const arbs: fc.Arbitrary<FsmCommand<Ctx, Evt, States>>[] = [];\n  for (const arb of Object.values(eventArbitraries)) {\n    arbs.push(arb.map((event) => new SendCommand(event, def, impl)));\n  }\n  return fc.commands(arbs, { size: \"+1\" });\n}\n","import * as fc from \"fast-check\";\nimport { initialSnapshot } from \"../fsm/definition.js\";\nimport { step } from \"../fsm/lifecycle.js\";\nimport { normalizeTransitions } from \"../fsm/resolver.js\";\nimport { createRuntime } from \"../fsm/runtime.js\";\nimport type { Guard, Implementations, MachineDef } from \"../fsm/types.js\";\nimport { mergeContext } from \"../fsm/updater.js\";\nimport { replay } from \"../replay/index.js\";\nimport {\n  type EventArbitraries,\n  type FsmModel,\n  commandsFromMachine,\n  initialModel,\n} from \"./commands.js\";\n\nexport type AssertOpts = Readonly<{\n  numRuns?: number;\n  seed?: number;\n  verbose?: boolean;\n}>;\n\nfunction buildAssertOpts(opts: AssertOpts | undefined): fc.Parameters<unknown> {\n  const out: fc.Parameters<unknown> = {};\n  if (opts?.numRuns !== undefined) out.numRuns = opts.numRuns;\n  if (opts?.seed !== undefined) out.seed = opts.seed;\n  if (opts?.verbose) out.verbose = true;\n  return out;\n}\n\n/**\n * #1 snapshotAlwaysFrozen — after any event sequence the live snapshot remains\n * frozen at the top level.\n */\nexport function snapshotAlwaysFrozen<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  fc.assert(\n    fc.property(commandsFromMachine(def, impl, eventArbitraries), (cmds) => {\n      const real = createRuntime(def, impl);\n      const model: FsmModel<Ctx, States> = initialModel(def);\n      fc.modelRun(() => ({ model, real }), cmds);\n      return Object.isFrozen(real.getSnapshot());\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #2 unknownEventNoOp — sending an event whose `type` is not declared in any\n * state's `on` map never changes the snapshot.\n */\nexport function unknownEventNoOp<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  unknownType: string,\n  opts?: AssertOpts,\n): void {\n  fc.assert(\n    fc.property(fc.constant(unknownType), (t) => {\n      const initial = initialSnapshot(def);\n      const result = step(def, initial, { type: t } as unknown as Evt, impl);\n      return result.changed === false && result.snapshot === initial && result.effects.length === 0;\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #3 reachableStatesSubsetDeclared — every state visited during a run belongs\n * to `def.states`.\n */\nexport function reachableStatesSubsetDeclared<\n  Ctx,\n  Evt extends { type: string },\n  States extends string,\n>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  const declared = new Set<string>(Object.keys(def.states));\n  fc.assert(\n    fc.property(commandsFromMachine(def, impl, eventArbitraries), (cmds) => {\n      const real = createRuntime(def, impl);\n      const model: FsmModel<Ctx, States> = initialModel(def);\n      fc.modelRun(() => ({ model, real }), cmds);\n      for (const s of model.reached as Set<string>) {\n        /* v8 ignore next — property failure branch; an unreachable state would indicate a bug. */\n        if (!declared.has(s)) return false;\n      }\n      return declared.has(real.getSnapshot().value);\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #4 replayEqualsFold — `replay(initial, log)` produces the same final state\n * as a live runtime fed the same events. Effects dispatched by the runtime are\n * ignored; the comparison is on `{ value, context }`.\n */\nexport function replayEqualsFold<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  const eventArb = fc.oneof(...Object.values(eventArbitraries));\n  fc.assert(\n    fc.property(fc.array(eventArb, { maxLength: 32 }), (events) => {\n      const real = createRuntime(def, impl, { dispatchEffects: false });\n      for (const e of events) real.send(e);\n      const live = real.getSnapshot();\n      const replayed = replay(initialSnapshot(def), events, def, impl).snapshot;\n      return (\n        live.value === replayed.value &&\n        JSON.stringify(live.context) === JSON.stringify(replayed.context)\n      );\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #5 guardsFalseNoTransition — when every candidate transition for the current\n * (state, event) pair carries a guard and every guard returns `false`, the\n * snapshot is unchanged (`changed === false`).\n *\n * Implementation: synthesise an impl that forces every guard to `false`, then\n * for each step whose candidate list is fully guarded, assert the step did not\n * change state. Steps with an unguarded fallback candidate (which fires even\n * when all guards are false) are skipped — the README claim is specifically\n * about the all-guards-false case.\n */\nexport function guardsFalseNoTransition<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  const blockedGuards = new Proxy(\n    {},\n    {\n      get: () => () => false,\n    },\n  ) as Readonly<Record<string, Guard<Ctx, Evt>>>;\n  const blockedImpl: Implementations<Ctx, Evt> = {\n    ...impl,\n    guards: blockedGuards,\n  };\n  // True when every candidate transition for (value, eventType) carries a\n  // guard — i.e. blocking all guards leaves no unconditional fallback, so a\n  // correct step() must report changed === false.\n  const isFullyGuarded = (value: States, eventType: string): boolean => {\n    const candidates = normalizeTransitions(def.states[value]?.on?.[eventType]);\n    return candidates.length > 0 && candidates.every((t) => t.guard !== undefined);\n  };\n  fc.assert(\n    fc.property(\n      fc.array(fc.oneof(...Object.values(eventArbitraries)), { maxLength: 16 }),\n      (events) => {\n        let snap = initialSnapshot(def);\n        for (const e of events) {\n          const fullyGuarded = isFullyGuarded(snap.value, e.type);\n          const r = step(def, snap, e, blockedImpl);\n          // The named invariant: all guards false + no unconditional fallback\n          // ⇒ no transition. Without this assertion the property was vacuous\n          // (it only failed if step() threw).\n          if (fullyGuarded && r.changed !== false) return false;\n          snap = r.snapshot;\n        }\n        return true;\n      },\n    ),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #6 assignDoesNotMutate — running an `assign`-style action never mutates the\n * previous context object. Verified by deep-equality check on a snapshot taken\n * before each event.\n */\nexport function assignDoesNotMutate<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  // Quick sanity guard: mergeContext is the only context mutator used by step.\n  const dummy = { a: 1, b: 2 };\n  const merged = mergeContext(dummy, { b: 3 });\n  /* v8 ignore next — invariant guard; mergeContext returning the same ref would mean unit tests have already broken. */\n  if (merged === dummy) throw new Error(\"aifsmjs/pbt: mergeContext returned the same reference\");\n\n  fc.assert(\n    fc.property(\n      fc.array(fc.oneof(...Object.values(eventArbitraries)), { maxLength: 16 }),\n      (events) => {\n        let snap = initialSnapshot(def);\n        for (const e of events) {\n          const beforeCtxSerialised = JSON.stringify(snap.context);\n          step(def, snap, e, impl);\n          /* v8 ignore next — property failure branch; step() mutating snap.context would indicate a bug. */\n          if (JSON.stringify(snap.context) !== beforeCtxSerialised) return false;\n          // Continue with the actual result for subsequent events\n          snap = step(def, snap, e, impl).snapshot;\n        }\n        return true;\n      },\n    ),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * Assert every generic property in one call. Use this when you don't need\n * fine-grained control over per-property options.\n */\nexport function assertAll<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts & { unknownEventType?: string },\n): void {\n  snapshotAlwaysFrozen(def, impl, eventArbitraries, opts);\n  unknownEventNoOp(def, impl, opts?.unknownEventType ?? \"__AIFSMJS_UNKNOWN__\", opts);\n  reachableStatesSubsetDeclared(def, impl, eventArbitraries, opts);\n  replayEqualsFold(def, impl, eventArbitraries, opts);\n  guardsFalseNoTransition(def, impl, eventArbitraries, opts);\n  assignDoesNotMutate(def, impl, eventArbitraries, opts);\n}\n","export {\n  commandsFromMachine,\n  initialModel,\n  type EventArbitraries,\n  type FsmCommand,\n  type FsmModel,\n} from \"./commands.js\";\n\nexport {\n  assertAll,\n  assignDoesNotMutate,\n  guardsFalseNoTransition,\n  reachableStatesSubsetDeclared,\n  replayEqualsFold,\n  snapshotAlwaysFrozen,\n  unknownEventNoOp,\n  type AssertOpts,\n} from \"./properties.js\";\n\n// Convenience namespace mirroring the README:\n//   import { properties } from \"aifsmjs/pbt\"\n//   properties.snapshotAlwaysFrozen(...)\nimport * as propertiesModule from \"./properties.js\";\nexport const properties = propertiesModule;\n"]}
+{"version":3,"sources":["../../src/pbt/commands.ts","../../src/pbt/properties.ts","../../src/pbt/index.ts"],"names":["fc"],"mappings":";;;;;;;;AAyBO,SAAS,aACd,GAAA,EACuB;AACvB,EAAA,OAAO;AAAA,IACL,OAAO,GAAA,CAAI,OAAA;AAAA,IACX,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,QAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,OAAO,CAAA,EAAG,QAAQ,OAAA,GAAU,QAAA;AAAA,IACnD,yBAAS,IAAI,GAAA,CAAI,CAAC,GAAA,CAAI,OAAO,CAAC;AAAA,GAChC;AACF;AAEA,IAAM,cAAN,MAEA;AAAA,EACE,WAAA,CACmB,KAAA,EACA,GAAA,EACA,IAAA,EACjB;AAHiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAChB;AAAA,EAHgB,KAAA;AAAA,EACA,GAAA;AAAA,EACA,IAAA;AAAA,EAGnB,MAAM,EAAA,EAA8C;AAElD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,GAAA,CAAI,GAA0B,CAAA,EAAoC;AAChE,IAAA,MAAM,MAAA,GAAgC,EAAE,WAAA,EAAY;AACpD,IAAA,CAAA,CAAE,IAAA,CAAK,KAAK,KAAK,CAAA;AACjB,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAE5B,IAAA,MAAM,SAAA,GAAY,KAAK,IAAA,CAAK,GAAA,EAAK,QAAQ,IAAA,CAAK,KAAA,EAAO,KAAK,IAAI,CAAA;AAI9D,IAAA,IAAI,SAAA,CAAU,QAAA,CAAS,KAAA,KAAU,KAAA,CAAM,KAAA,EAAO;AAC5C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qDAAA,EAAmD,MAAA,CAAO,SAAA,CAAU,QAAA,CAAS,KAAK,CAAC,CAAA,wBAAA,EAA2B,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,QAAA,EAAW,IAAA,CAAK,UAAU,CAAA;AAAA,OAC7J;AAAA,IACF;AAGA,IAAA,CAAA,CAAE,QAAQ,KAAA,CAAM,KAAA;AAChB,IAAA,CAAA,CAAE,UAAU,KAAA,CAAM,OAAA;AAClB,IAAA,CAAA,CAAE,SAAS,KAAA,CAAM,MAAA;AACjB,IAAA,CAAA,CAAE,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAAA,EAC3B;AAAA,EAEA,QAAA,GAAmB;AACjB,IAAA,OAAO,CAAA,KAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,KAAK,CAAC,CAAA,CAAA,CAAA;AAAA,EAC3C;AACF,CAAA;AAWO,SAAS,mBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACsD;AACtD,EAAA,MAAM,OAAqD,EAAC;AAC5D,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAA,EAAG;AACjD,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,CAAC,KAAA,KAAU,IAAI,WAAA,CAAY,KAAA,EAAO,GAAA,EAAK,IAAI,CAAC,CAAC,CAAA;AAAA,EACjE;AACA,EAAA,OAAUA,GAAA,CAAA,QAAA,CAAS,IAAA,EAAM,EAAE,IAAA,EAAM,MAAM,CAAA;AACzC;AC1EA,SAAS,gBAAgB,IAAA,EAAsD;AAC7E,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,IAAA,EAAM,OAAA,KAAY,MAAA,EAAW,GAAA,CAAI,UAAU,IAAA,CAAK,OAAA;AACpD,EAAA,IAAI,IAAA,EAAM,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,OAAO,IAAA,CAAK,IAAA;AAC9C,EAAA,IAAI,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,GAAU,IAAA;AACjC,EAAA,OAAO,GAAA;AACT;AAiBO,SAAS,aAAA,CAAc,GAAY,CAAA,EAAqB;AAC7D,EAAA,OAAO,iBAAA,CAAkB,GAAG,CAAC,CAAA;AAC/B;AAMO,SAAS,oBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,aAAS,mBAAA,CAAoB,GAAA,EAAK,MAAM,gBAAgB,CAAA,EAAG,CAAC,IAAA,KAAS;AACtE,MAAA,MAAM,OAAO,aAAA,CAAc,GAAA,EAAK,MAAM,EAAE,eAAA,EAAiB,OAAO,CAAA;AAGhE,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAA+B,aAAa,GAAG,CAAA;AACrD,QAAG,aAAS,OAAO,EAAE,KAAA,EAAO,IAAA,KAAS,IAAI,CAAA;AACzC,QAAA,OAAO,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,WAAA,EAAa,CAAA;AAAA,MAC3C,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,MACf;AAAA,IACF,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAMO,SAAS,gBAAA,CACd,GAAA,EACA,IAAA,EACA,WAAA,EACA,IAAA,EACM;AACN,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA,CAAY,GAAA,CAAA,QAAA,CAAS,WAAW,CAAA,EAAG,CAAC,CAAA,KAAM;AAC3C,MAAA,MAAM,OAAA,GAAU,gBAAgB,GAAG,CAAA;AACnC,MAAA,MAAM,MAAA,GAAS,KAAK,GAAA,EAAK,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA,IAAuB,IAAI,CAAA;AACrE,MAAA,OAAO,MAAA,CAAO,YAAY,KAAA,IAAS,MAAA,CAAO,aAAa,OAAA,IAAW,MAAA,CAAO,QAAQ,MAAA,KAAW,CAAA;AAAA,IAC9F,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAMO,SAAS,6BAAA,CAKd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAA,MAAM,WAAW,IAAI,GAAA,CAAY,OAAO,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC,CAAA;AACxD,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,aAAS,mBAAA,CAAoB,GAAA,EAAK,MAAM,gBAAgB,CAAA,EAAG,CAAC,IAAA,KAAS;AACtE,MAAA,MAAM,OAAO,aAAA,CAAc,GAAA,EAAK,MAAM,EAAE,eAAA,EAAiB,OAAO,CAAA;AAChE,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAA+B,aAAa,GAAG,CAAA;AACrD,QAAG,aAAS,OAAO,EAAE,KAAA,EAAO,IAAA,KAAS,IAAI,CAAA;AACzC,QAAA,KAAA,MAAW,CAAA,IAAK,MAAM,OAAA,EAAwB;AAE5C,UAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,CAAC,GAAG,OAAO,KAAA;AAAA,QAC/B;AACA,QAAA,OAAO,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,WAAA,GAAc,KAAK,CAAA;AAAA,MAC9C,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,MACf;AAAA,IACF,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAOO,SAAS,gBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAA,MAAM,WAAc,GAAA,CAAA,KAAA,CAAM,GAAG,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAC,CAAA;AAC5D,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA,CAAY,UAAM,QAAA,EAAU,EAAE,WAAW,EAAA,EAAI,CAAA,EAAG,CAAC,MAAA,KAAW;AAC7D,MAAA,MAAM,OAAO,aAAA,CAAc,GAAA,EAAK,MAAM,EAAE,eAAA,EAAiB,OAAO,CAAA;AAChE,MAAA,IAAI;AACF,QAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA;AACnC,QAAA,MAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AAC9B,QAAA,MAAM,QAAA,GAAW,OAAO,eAAA,CAAgB,GAAG,GAAG,MAAA,EAAQ,GAAA,EAAK,IAAI,CAAA,CAAE,QAAA;AACjE,QAAA,OAAO,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IAAS,cAAc,IAAA,CAAK,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,MACtF,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,MACf;AAAA,IACF,CAAC,CAAA;AAAA,IACD,gBAAgB,IAAI;AAAA,GACtB;AACF;AAaO,SAAS,uBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AAIN,EAAA,MAAM,gBAAgB,IAAI,KAAA;AAAA,IACxB,EAAC;AAAA,IACD;AAAA,MACE,GAAA,EAAK,MAAM,MAAM,KAAA;AAAA,MACjB,wBAAA,EAA0B,OAAO,EAAE,YAAA,EAAc,IAAA,EAAK;AAAA;AACxD,GACF;AACA,EAAA,MAAM,WAAA,GAAyC;AAAA,IAC7C,GAAG,IAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACV;AAIA,EAAA,MAAM,cAAA,GAAiB,CAAC,KAAA,EAAe,SAAA,KAA+B;AACpE,IAAA,MAAM,UAAA,GAAa,qBAAqB,QAAA,CAAS,GAAA,CAAI,OAAO,KAAK,CAAA,EAAG,EAAA,EAAI,SAAS,CAAC,CAAA;AAClF,IAAA,OAAO,UAAA,CAAW,SAAS,CAAA,IAAK,UAAA,CAAW,MAAM,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,KAAU,MAAS,CAAA;AAAA,EAC/E,CAAA;AACA,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA;AAAA,MACE,GAAA,CAAA,KAAA,CAAS,GAAA,CAAA,KAAA,CAAM,GAAG,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAC,CAAA,EAAG,EAAE,SAAA,EAAW,EAAA,EAAI,CAAA;AAAA,MACxE,CAAC,MAAA,KAAW;AACV,QAAA,IAAI,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAC9B,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,UAAA,MAAM,YAAA,GAAe,cAAA,CAAe,IAAA,CAAK,KAAA,EAAO,EAAE,IAAI,CAAA;AACtD,UAAA,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,GAAG,WAAW,CAAA;AAIxC,UAAA,IAAI,YAAA,IAAgB,CAAA,CAAE,OAAA,KAAY,KAAA,EAAO,OAAO,KAAA;AAChD,UAAA,IAAA,GAAO,CAAA,CAAE,QAAA;AAAA,QACX;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,KACF;AAAA,IACA,gBAAgB,IAAI;AAAA,GACtB;AACF;AAGA,IAAM,QAAA,GAAW,CAAC,CAAA,KAAyB;AAAA,EACzC,GAAG,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAC,CAAA,EAAI,CAAA,CAAmC,CAAC,CAAC,CAAC,CAAA;AAAA,EAChF,GAAI,CAAA,YAAa,GAAA,IAAO,CAAA,YAAa,GAAA,GAAM,CAAC,GAAG,CAAA,CAAE,OAAA,EAAS,CAAA,CAAE,IAAA,KAAS,EAAC;AAAA,EACtE,CAAA,YAAa,IAAA,IAAQ,CAAA,CAAE,OAAA;AACzB,CAAA;AAOO,SAAS,mBAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAG,GAAA,CAAA,MAAA;AAAA,IACE,GAAA,CAAA,QAAA;AAAA,MACE,GAAA,CAAA,KAAA,CAAS,GAAA,CAAA,KAAA,CAAM,GAAG,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAC,CAAA,EAAG,EAAE,SAAA,EAAW,EAAA,EAAI,CAAA;AAAA,MACxE,CAAC,MAAA,KAAW;AACV,QAAA,IAAI,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAC9B,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AAEtB,UAAA,MAAM,MAAA,uBAAa,GAAA,EAAuB;AAC1C,UAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAqB;AACjC,YAAA,IAAI,CAAC,KAAK,OAAO,CAAA,KAAM,YAAY,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,EAAG;AAClD,YAAA,MAAM,GAAA,GAAM,SAAS,CAAC,CAAA;AACtB,YAAA,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,CAAA;AACjB,YAAA,GAAA,CAAI,QAAQ,IAAI,CAAA;AAAA,UAClB,CAAA;AACA,UAAA,IAAA,CAAK,KAAK,OAAO,CAAA;AAEjB,UAAA,IAAA,GAAO,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA;AAChC,UAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,EAAQ,IAAI,CAAC,aAAA,CAAc,QAAA,CAAS,GAAG,CAAA,EAAG,GAAG,GAAG,OAAO,KAAA;AAAA,QAClF;AACA,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,KACF;AAAA,IACA,gBAAgB,IAAI;AAAA,GACtB;AACF;AAMO,SAAS,SAAA,CACd,GAAA,EACA,IAAA,EACA,gBAAA,EACA,IAAA,EACM;AACN,EAAA,oBAAA,CAAqB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AACtD,EAAA,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,IAAA,EAAM,gBAAA,IAAoB,uBAAuB,IAAI,CAAA;AACjF,EAAA,6BAAA,CAA8B,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AAC/D,EAAA,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AAClD,EAAA,uBAAA,CAAwB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AACzD,EAAA,mBAAA,CAAoB,GAAA,EAAK,IAAA,EAAM,gBAAA,EAAkB,IAAI,CAAA;AACvD;;;AClPO,IAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,EACtC,SAAA;AAAA,EACA,mBAAA;AAAA,EACA,aAAA;AAAA,EACA,uBAAA;AAAA,EACA,6BAAA;AAAA,EACA,gBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAC","file":"index.js","sourcesContent":["import * as fc from \"fast-check\";\nimport { step } from \"../fsm/lifecycle.js\";\nimport type { Implementations, MachineDef, Runtime, Snapshot } from \"../fsm/types.js\";\n\n/**\n * Pure-model representation of an FSM run, used by `fc.commands`.\n * `reached` tracks every state visited so generic properties can check\n * containment without re-running.\n */\nexport type FsmModel<Ctx, States extends string> = {\n  value: States;\n  context: Ctx;\n  status: \"active\" | \"final\";\n  reached: Set<States>;\n};\n\nexport type EventArbitraries<Evt extends { type: string }> = Readonly<\n  Record<string, fc.Arbitrary<Evt>>\n>;\n\nexport type FsmCommand<Ctx, Evt extends { type: string }, States extends string> = fc.Command<\n  FsmModel<Ctx, States>,\n  Runtime<Ctx, Evt, States>\n>;\n\nexport function initialModel<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n): FsmModel<Ctx, States> {\n  return {\n    value: def.initial,\n    context: def.context,\n    status: def.states[def.initial]?.final ? \"final\" : \"active\",\n    reached: new Set([def.initial]),\n  };\n}\n\nclass SendCommand<Ctx, Evt extends { type: string }, States extends string>\n  implements FsmCommand<Ctx, Evt, States>\n{\n  constructor(\n    private readonly event: Evt,\n    private readonly def: MachineDef<Ctx, Evt, States>,\n    private readonly impl: Implementations<Ctx, Evt>,\n  ) {}\n\n  check(_m: Readonly<FsmModel<Ctx, States>>): boolean {\n    // Every event is always applicable; invariants are asserted in run().\n    return true;\n  }\n\n  run(m: FsmModel<Ctx, States>, r: Runtime<Ctx, Evt, States>): void {\n    const before: Snapshot<Ctx, States> = r.getSnapshot();\n    r.send(this.event);\n    const after = r.getSnapshot();\n\n    const predicted = step(this.def, before, this.event, this.impl);\n\n    /* v8 ignore start — invariant guard: fires only when the live runtime\n       diverges from the pure step() prediction, i.e. an internal bug. */\n    if (predicted.snapshot.value !== after.value) {\n      throw new Error(\n        `aifsmjs/pbt: determinism violation — predicted \"${String(predicted.snapshot.value)}\" but runtime returned \"${String(after.value)}\" after ${this.toString()}`,\n      );\n    }\n    /* v8 ignore stop */\n\n    m.value = after.value;\n    m.context = after.context as Ctx;\n    m.status = after.status;\n    m.reached.add(after.value);\n  }\n\n  toString(): string {\n    return `send(${JSON.stringify(this.event)})`;\n  }\n}\n\n/**\n * Build an `fc.Arbitrary` of FSM command sequences. Each command pulls one\n * event from the user-supplied arbitrary map and, when run, asserts that the\n * pure `step()` prediction matches the runtime's observable outcome.\n *\n * Pair this arbitrary with `fc.property(...)` inside a `fc.assert(...)` call,\n * or use the helpers in `aifsmjs/pbt` properties to get the six generic\n * invariants for free.\n */\nexport function commandsFromMachine<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n): fc.Arbitrary<Iterable<FsmCommand<Ctx, Evt, States>>> {\n  const arbs: fc.Arbitrary<FsmCommand<Ctx, Evt, States>>[] = [];\n  for (const arb of Object.values(eventArbitraries)) {\n    arbs.push(arb.map((event) => new SendCommand(event, def, impl)));\n  }\n  return fc.commands(arbs, { size: \"+1\" });\n}\n","import { isDeepStrictEqual } from \"node:util\";\nimport * as fc from \"fast-check\";\nimport { initialSnapshot } from \"../fsm/definition.js\";\nimport { ownValue } from \"../fsm/evaluator.js\";\nimport { step } from \"../fsm/lifecycle.js\";\nimport { normalizeTransitions } from \"../fsm/resolver.js\";\nimport { createRuntime } from \"../fsm/runtime.js\";\nimport type { Guard, Implementations, MachineDef } from \"../fsm/types.js\";\nimport { replay } from \"../replay/index.js\";\nimport {\n  type EventArbitraries,\n  type FsmModel,\n  commandsFromMachine,\n  initialModel,\n} from \"./commands.js\";\n\nexport type AssertOpts = Readonly<{\n  numRuns?: number;\n  seed?: number;\n  verbose?: boolean;\n}>;\n\nfunction buildAssertOpts(opts: AssertOpts | undefined): fc.Parameters<unknown> {\n  const out: fc.Parameters<unknown> = {};\n  if (opts?.numRuns !== undefined) out.numRuns = opts.numRuns;\n  if (opts?.seed !== undefined) out.seed = opts.seed;\n  if (opts?.verbose) out.verbose = true;\n  return out;\n}\n\n/**\n * Structural deep-equality for two context values (C3). Backed by `node:util`\n * `isDeepStrictEqual`, replacing the previous `JSON.stringify(a) === JSON.stringify(b)`\n * oracle which was unsound:\n *\n *   - key-order-sensitive  → false-FAIL on `{a:1,b:2}` vs `{b:2,a:1}`;\n *   - drops undefined keys  → false-PASS on `{v:undefined,w:1}` vs `{w:1}`;\n *   - lossy for `Map`/`Set`/`Date` (all serialise to `{}` or an ISO string);\n *   - throws on `BigInt`.\n *\n * `isDeepStrictEqual` distinguishes present-but-undefined from absent keys,\n * compares `Map`/`Set`/`Date` by contents, and tolerates `BigInt` — exactly\n * the verdicts a context-equality oracle for PBT requires. No new dependency\n * (Node built-in; the package already targets Node >=18).\n */\nexport function contextEquals(a: unknown, b: unknown): boolean {\n  return isDeepStrictEqual(a, b);\n}\n\n/**\n * #1 snapshotAlwaysFrozen — after any event sequence the live snapshot remains\n * frozen at the top level.\n */\nexport function snapshotAlwaysFrozen<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  fc.assert(\n    fc.property(commandsFromMachine(def, impl, eventArbitraries), (cmds) => {\n      const real = createRuntime(def, impl, { dispatchEffects: false });\n      // Dispose every generated run's runtime (its signal aborts, its child\n      // runtimes are torn down); the asserted value is computed first.\n      try {\n        const model: FsmModel<Ctx, States> = initialModel(def);\n        fc.modelRun(() => ({ model, real }), cmds);\n        return Object.isFrozen(real.getSnapshot());\n      } finally {\n        real.dispose();\n      }\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #2 unknownEventNoOp — sending an event whose `type` is not declared in any\n * state's `on` map never changes the snapshot.\n */\nexport function unknownEventNoOp<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  unknownType: string,\n  opts?: AssertOpts,\n): void {\n  fc.assert(\n    fc.property(fc.constant(unknownType), (t) => {\n      const initial = initialSnapshot(def);\n      const result = step(def, initial, { type: t } as unknown as Evt, impl);\n      return result.changed === false && result.snapshot === initial && result.effects.length === 0;\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #3 reachableStatesSubsetDeclared — every state visited during a run belongs\n * to `def.states`.\n */\nexport function reachableStatesSubsetDeclared<\n  Ctx,\n  Evt extends { type: string },\n  States extends string,\n>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  const declared = new Set<string>(Object.keys(def.states));\n  fc.assert(\n    fc.property(commandsFromMachine(def, impl, eventArbitraries), (cmds) => {\n      const real = createRuntime(def, impl, { dispatchEffects: false });\n      try {\n        const model: FsmModel<Ctx, States> = initialModel(def);\n        fc.modelRun(() => ({ model, real }), cmds);\n        for (const s of model.reached as Set<string>) {\n          /* v8 ignore next — property failure branch; an unreachable state would indicate a bug. */\n          if (!declared.has(s)) return false;\n        }\n        return declared.has(real.getSnapshot().value);\n      } finally {\n        real.dispose();\n      }\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #4 replayEqualsFold — `replay(initial, log)` produces the same final state\n * as a live runtime fed the same events. Effects dispatched by the runtime are\n * ignored; the comparison is on `{ value, context }`.\n */\nexport function replayEqualsFold<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  const eventArb = fc.oneof(...Object.values(eventArbitraries));\n  fc.assert(\n    fc.property(fc.array(eventArb, { maxLength: 32 }), (events) => {\n      const real = createRuntime(def, impl, { dispatchEffects: false });\n      try {\n        for (const e of events) real.send(e);\n        const live = real.getSnapshot();\n        const replayed = replay(initialSnapshot(def), events, def, impl).snapshot;\n        return live.value === replayed.value && contextEquals(live.context, replayed.context);\n      } finally {\n        real.dispose();\n      }\n    }),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * #5 guardsFalseNoTransition — when every candidate transition for the current\n * (state, event) pair carries a guard and every guard returns `false`, the\n * snapshot is unchanged (`changed === false`).\n *\n * Implementation: synthesise an impl that forces every guard to `false`, then\n * for each step whose candidate list is fully guarded, assert the step did not\n * change state. Steps with an unguarded fallback candidate (which fires even\n * when all guards are false) are skipped — the README claim is specifically\n * about the all-guards-false case.\n */\nexport function guardsFalseNoTransition<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  // Every key reads as an own property: step() resolves guard refs with an\n  // own-key lookup (the value itself still comes from `get`), so a `get` trap\n  // alone would surface as UnknownGuardError.\n  const blockedGuards = new Proxy(\n    {},\n    {\n      get: () => () => false,\n      getOwnPropertyDescriptor: () => ({ configurable: true }),\n    },\n  ) as Readonly<Record<string, Guard<Ctx, Evt>>>;\n  const blockedImpl: Implementations<Ctx, Evt> = {\n    ...impl,\n    guards: blockedGuards,\n  };\n  // True when every candidate transition for (value, eventType) carries a\n  // guard — i.e. blocking all guards leaves no unconditional fallback, so a\n  // correct step() must report changed === false.\n  const isFullyGuarded = (value: States, eventType: string): boolean => {\n    const candidates = normalizeTransitions(ownValue(def.states[value]?.on, eventType));\n    return candidates.length > 0 && candidates.every((t) => t.guard !== undefined);\n  };\n  fc.assert(\n    fc.property(\n      fc.array(fc.oneof(...Object.values(eventArbitraries)), { maxLength: 16 }),\n      (events) => {\n        let snap = initialSnapshot(def);\n        for (const e of events) {\n          const fullyGuarded = isFullyGuarded(snap.value, e.type);\n          const r = step(def, snap, e, blockedImpl);\n          // The named invariant: all guards false + no unconditional fallback\n          // ⇒ no transition. Without this assertion the property was vacuous\n          // (it only failed if step() threw).\n          if (fullyGuarded && r.changed !== false) return false;\n          snap = r.snapshot;\n        }\n        return true;\n      },\n    ),\n    buildAssertOpts(opts),\n  );\n}\n\n// Own keys/values of one object, plus Map/Set entries and Date time.\nconst ownState = (v: object): unknown[] => [\n  ...Reflect.ownKeys(v).flatMap((k) => [k, (v as Record<PropertyKey, unknown>)[k]]),\n  ...(v instanceof Map || v instanceof Set ? [...v.entries()].flat() : []),\n  v instanceof Date && v.getTime(),\n];\n\n/**\n * #6 assignDoesNotMutate — running an `assign`-style action never mutates the\n * previous context object. Verified by re-checking the own state of every\n * object reachable from the pre-step context.\n */\nexport function assignDoesNotMutate<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts,\n): void {\n  fc.assert(\n    fc.property(\n      fc.array(fc.oneof(...Object.values(eventArbitraries)), { maxLength: 16 }),\n      (events) => {\n        let snap = initialSnapshot(def);\n        for (const e of events) {\n          // Record, not clone (clones drop prototypes, throw on functions).\n          const before = new Map<object, unknown[]>();\n          const walk = (v: unknown): void => {\n            if (!v || typeof v !== \"object\" || before.has(v)) return;\n            const own = ownState(v);\n            before.set(v, own);\n            own.forEach(walk);\n          };\n          walk(snap.context);\n          // `before` keeps the pre-step objects, so advancing `snap` first is safe.\n          snap = step(def, snap, e, impl).snapshot;\n          for (const [obj, own] of before) if (!contextEquals(ownState(obj), own)) return false;\n        }\n        return true;\n      },\n    ),\n    buildAssertOpts(opts),\n  );\n}\n\n/**\n * Assert every generic property in one call. Use this when you don't need\n * fine-grained control over per-property options.\n */\nexport function assertAll<Ctx, Evt extends { type: string }, States extends string>(\n  def: MachineDef<Ctx, Evt, States>,\n  impl: Implementations<Ctx, Evt>,\n  eventArbitraries: EventArbitraries<Evt>,\n  opts?: AssertOpts & { unknownEventType?: string },\n): void {\n  snapshotAlwaysFrozen(def, impl, eventArbitraries, opts);\n  unknownEventNoOp(def, impl, opts?.unknownEventType ?? \"__AIFSMJS_UNKNOWN__\", opts);\n  reachableStatesSubsetDeclared(def, impl, eventArbitraries, opts);\n  replayEqualsFold(def, impl, eventArbitraries, opts);\n  guardsFalseNoTransition(def, impl, eventArbitraries, opts);\n  assignDoesNotMutate(def, impl, eventArbitraries, opts);\n}\n","export {\n  commandsFromMachine,\n  initialModel,\n  type EventArbitraries,\n  type FsmCommand,\n  type FsmModel,\n} from \"./commands.js\";\n\nexport {\n  assertAll,\n  assignDoesNotMutate,\n  guardsFalseNoTransition,\n  reachableStatesSubsetDeclared,\n  replayEqualsFold,\n  snapshotAlwaysFrozen,\n  unknownEventNoOp,\n  type AssertOpts,\n} from \"./properties.js\";\n\n// Convenience namespace mirroring the README:\n//   import { properties } from \"aifsmjs/pbt\"\n//   properties.snapshotAlwaysFrozen(...)\n// A frozen object literal rather than `import * as`: a namespace re-export\n// makes tsup emit a shared `__export` helper chunk that every subpath entry\n// (root, guards, timer, ...) then imports and pays for.\nimport {\n  assertAll,\n  assignDoesNotMutate,\n  contextEquals,\n  guardsFalseNoTransition,\n  reachableStatesSubsetDeclared,\n  replayEqualsFold,\n  snapshotAlwaysFrozen,\n  unknownEventNoOp,\n} from \"./properties.js\";\nexport const properties = Object.freeze({\n  assertAll,\n  assignDoesNotMutate,\n  contextEquals,\n  guardsFalseNoTransition,\n  reachableStatesSubsetDeclared,\n  replayEqualsFold,\n  snapshotAlwaysFrozen,\n  unknownEventNoOp,\n});\n"]}

package/dist/replay/index.cjs

@@ -1,16 +1,15 @@
 'use strict';
 
-var chunkFHTQ7LSQ_cjs = require('../chunk-FHTQ7LSQ.cjs');
-require('../chunk-I354FONA.cjs');
+var chunkVV5TKFQO_cjs = require('../chunk-VV5TKFQO.cjs');
+require('../chunk-VGLF5NQH.cjs');
 require('../chunk-3B2USJ3H.cjs');
-require('../chunk-CDK25FTD.cjs');
-require('../chunk-Q7SFCCGT.cjs');
+require('../chunk-QCTA2X4J.cjs');
 
 
 
 Object.defineProperty(exports, "replay", {
   enumerable: true,
-  get: function () { return chunkFHTQ7LSQ_cjs.replay; }
+  get: function () { return chunkVV5TKFQO_cjs.replay; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/replay/index.d.cts

@@ -1,4 +1,4 @@
-import { S as Snapshot, E as Effect, f as MachineDef, I as Implementations } from '../types-DIM7QTtf.cjs';
+import { S as Snapshot, E as Effect, f as MachineDef, I as Implementations } from '../types-CrDxFfBx.cjs';
 
 type ReplayResult<Ctx, States extends string> = Readonly<{
     snapshot: Snapshot<Ctx, States>;

package/dist/replay/index.d.ts

@@ -1,4 +1,4 @@
-import { S as Snapshot, E as Effect, f as MachineDef, I as Implementations } from '../types-DIM7QTtf.js';
+import { S as Snapshot, E as Effect, f as MachineDef, I as Implementations } from '../types-CrDxFfBx.js';
 
 type ReplayResult<Ctx, States extends string> = Readonly<{
     snapshot: Snapshot<Ctx, States>;

package/dist/replay/index.js

@@ -1,7 +1,6 @@
-export { replay } from '../chunk-NEJYZAKR.js';
-import '../chunk-ZLQ7HZCE.js';
+export { replay } from '../chunk-Q45LGXHO.js';
+import '../chunk-D6H64FSI.js';
 import '../chunk-JKZAOPQC.js';
-import '../chunk-A7U7QQL5.js';
-import '../chunk-PZ5AY32C.js';
+import '../chunk-SSNKGEVB.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/timer/index.cjs

@@ -1,10 +1,16 @@
 'use strict';
 
-require('../chunk-Q7SFCCGT.cjs');
-
 // src/timer/scheduler.ts
 var NOOP = Object.freeze({ cancel: () => {
 } });
+var MAX_DELAY = 2147483647;
+var clampDelay = (ms) => Math.min(ms, MAX_DELAY);
+function checkArgs(ms, fn) {
+  if (!Number.isFinite(ms) || ms < 0) {
+    throw new RangeError("aifsmjs: after() ms must be a finite number >= 0");
+  }
+  if (typeof fn !== "function") throw new TypeError("aifsmjs: after() fn must be a function");
+}
 function resolveTimers(opts) {
   return {
     st: opts?.setTimeout ?? ((fn, ms) => globalThis.setTimeout(fn, ms)),
@@ -12,6 +18,7 @@ function resolveTimers(opts) {
   };
 }
 function after(ms, fn, opts) {
+  checkArgs(ms, fn);
   if (opts?.signal?.aborted) return NOOP;
   const { st, ct } = resolveTimers(opts);
   let fired = false;
@@ -28,7 +35,7 @@ function after(ms, fn, opts) {
     if (cancelled) return;
     if (opts?.signal) opts.signal.removeEventListener("abort", cancel);
     fn();
-  }, ms);
+  }, clampDelay(ms));
   if (opts?.signal && !fired) {
     opts.signal.addEventListener("abort", cancel, { once: true });
   }
@@ -38,8 +45,14 @@ function createScheduler(defaults) {
   const pending = /* @__PURE__ */ new Set();
   const sched = {
     after(ms, fn, opts) {
-      const merged = { ...defaults, ...opts };
-      const { signal, ...innerOpts } = merged;
+      checkArgs(ms, fn);
+      const signal = opts?.signal ?? defaults?.signal;
+      const setTimeoutFn = opts?.setTimeout ?? defaults?.setTimeout;
+      const clearTimeoutFn = opts?.clearTimeout ?? defaults?.clearTimeout;
+      const innerOpts = {
+        ...setTimeoutFn !== void 0 && { setTimeout: setTimeoutFn },
+        ...clearTimeoutFn !== void 0 && { clearTimeout: clearTimeoutFn }
+      };
       if (signal?.aborted) return NOOP;
       const slot = {};
       let fired = false;

package/dist/timer/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/timer/scheduler.ts"],"names":[],"mappings":";;;;;AAuBA,IAAM,IAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,EAAE,QAAQ,MAAM;AAAC,CAAA,EAAG,CAAA;AAE5D,SAAS,cAAc,IAAA,EAGrB;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,UAAA,KAAe,CAAC,IAAI,EAAA,KAAO,UAAA,CAAW,UAAA,CAAW,EAAA,EAAI,EAAE,CAAA,CAAA;AAAA,IACjE,IAAI,IAAA,EAAM,YAAA,KAAiB,CAAC,CAAA,KAAM,UAAA,CAAW,aAAa,CAAW,CAAA;AAAA,GACvE;AACF;AAeO,SAAS,KAAA,CAAM,EAAA,EAAY,EAAA,EAAgB,IAAA,EAAkC;AAClF,EAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAO,IAAA;AAElC,EAAA,MAAM,EAAE,EAAA,EAAI,EAAA,EAAG,GAAI,cAAc,IAAI,CAAA;AACrC,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI,SAAA,GAAY,KAAA;AAOhB,EAAA,MAAM,QAA4C,EAAC;AAEnD,EAAA,MAAM,SAAS,MAAM;AACnB,IAAA,IAAI,SAAS,SAAA,EAAW;AACxB,IAAA,SAAA,GAAY,IAAA;AACZ,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,EAAW,EAAA,CAAG,MAAM,MAAM,CAAA;AAG/C,IAAA,IAAI,MAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,CAAO,mBAAA,CAAoB,SAAS,MAAM,CAAA;AAAA,EACnE,CAAA;AAEA,EAAA,KAAA,CAAM,MAAA,GAAS,GAAG,MAAM;AACtB,IAAA,KAAA,GAAQ,IAAA;AAER,IAAA,IAAI,SAAA,EAAW;AAGf,IAAA,IAAI,MAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,CAAO,mBAAA,CAAoB,SAAS,MAAM,CAAA;AACjE,IAAA,EAAA,EAAG;AAAA,EACL,GAAG,EAAE,CAAA;AAKL,EAAA,IAAI,IAAA,EAAM,MAAA,IAAU,CAAC,KAAA,EAAO;AAC1B,IAAA,IAAA,CAAK,OAAO,gBAAA,CAAiB,OAAA,EAAS,QAAQ,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC9D;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,MAAA,EAAQ,CAAA;AACjC;AAgBO,SAAS,gBAAgB,QAAA,EAAoC;AAClE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAiB;AAErC,EAAA,MAAM,KAAA,GAAmB;AAAA,IACvB,KAAA,CAAM,EAAA,EAAI,EAAA,EAAI,IAAA,EAAM;AAClB,MAAA,MAAM,MAAA,GAAuB,EAAE,GAAG,QAAA,EAAU,GAAG,IAAA,EAAK;AAOpD,MAAA,MAAM,EAAE,MAAA,EAAQ,GAAG,SAAA,EAAU,GAAI,MAAA;AAKjC,MAAA,IAAI,MAAA,EAAQ,SAAS,OAAO,IAAA;AAI5B,MAAA,MAAM,OAA8B,EAAC;AACrC,MAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,MAAA,IAAI,OAAA,GAAU,KAAA;AAEd,MAAA,MAAM,cAAc,MAAM;AACxB,QAAA,IAAI,MAAA,EAAQ,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,MACzD,CAAA;AAGA,MAAA,MAAM,SAAS,MAAM;AACnB,QAAA,IAAI,OAAA,EAAS;AACb,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,KAAK,GAAG,CAAA;AACrC,QAAA,WAAA,EAAY;AAAA,MACd,CAAA;AAEA,MAAA,MAAM,UAAU,MAAM;AACpB,QAAA,KAAA,GAAQ,IAAA;AACR,QAAA,MAAA,EAAO;AACP,QAAA,EAAA,EAAG;AAAA,MACL,CAAA;AAIA,MAAA,MAAM,SAAS,MAAM;AACnB,QAAA,KAAA,CAAM,MAAA,EAAO;AACb,QAAA,MAAA,EAAO;AAAA,MACT,CAAA;AACA,MAAA,SAAS,OAAA,GAAU;AACjB,QAAA,MAAA,EAAO;AAAA,MACT;AAEA,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,EAAA,EAAI,OAAA,EAAS,SAAS,CAAA;AAE1C,MAAA,MAAM,MAAA,GAAsB,MAAA,CAAO,MAAA,CAAO,EAAE,QAAQ,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,GAAM,MAAA;AAMX,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAA,CAAQ,IAAI,MAAM,CAAA;AAKlB,QAAA,IAAI,MAAA,SAAe,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,MACtE;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,SAAA,GAAY;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO;AAClC,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB,CAAA;AAAA,IACA,IAAI,IAAA,GAAO;AACT,MAAA,OAAO,OAAA,CAAQ,IAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,OAAO,KAAA;AACT","file":"index.cjs","sourcesContent":["export type AfterHandle = Readonly<{\n  cancel(): void;\n}>;\n\nexport type SetTimeoutFn = (fn: () => void, ms: number) => unknown;\nexport type ClearTimeoutFn = (handle: unknown) => void;\n\nexport type AfterOptions = Readonly<{\n  /**\n   * If supplied and aborted, the callback never runs and any pending timer is\n   * cleared. Aborting after fire is a no-op.\n   */\n  signal?: AbortSignal;\n  /**\n   * Override `setTimeout` (testing, SSR, custom loops). Defaults to globalThis.\n   */\n  setTimeout?: SetTimeoutFn;\n  /**\n   * Override `clearTimeout`. Must match the `setTimeout` you injected.\n   */\n  clearTimeout?: ClearTimeoutFn;\n}>;\n\nconst NOOP: AfterHandle = Object.freeze({ cancel: () => {} });\n\nfunction resolveTimers(opts: AfterOptions | undefined): {\n  st: SetTimeoutFn;\n  ct: ClearTimeoutFn;\n} {\n  return {\n    st: opts?.setTimeout ?? ((fn, ms) => globalThis.setTimeout(fn, ms)),\n    ct: opts?.clearTimeout ?? ((h) => globalThis.clearTimeout(h as number)),\n  };\n}\n\n/**\n * Schedule `fn` to run after `ms` milliseconds. Returns a handle whose\n * `cancel()` clears the pending timer. Optional `signal` aborts the timer when\n * triggered. Aborting after the callback fires is a no-op.\n *\n * The abort listener is registered with `{ once: true }` as a baseline, but\n * `{ once: true }` alone does NOT prevent listener accumulation when the same\n * signal is reused across many timers: it only removes the listener when the\n * signal aborts, not when the timer fires normally or `cancel()` is called.\n * We therefore explicitly call `signal.removeEventListener(\"abort\", cancel)`\n * inside the fire callback and at the end of `cancel()` so that a shared,\n * long-lived signal never accumulates dead listeners across timer reuse.\n */\nexport function after(ms: number, fn: () => void, opts?: AfterOptions): AfterHandle {\n  if (opts?.signal?.aborted) return NOOP;\n\n  const { st, ct } = resolveTimers(opts);\n  let fired = false;\n  let cancelled = false;\n  // `cancel` and the timer handle reference each other. A const cell holds the\n  // handle so `cancel` can be defined BEFORE `st(...)` runs (letting a custom\n  // `st` that fires its callback synchronously reference `cancel` without\n  // hitting the temporal-dead-zone) while still being able to clear the handle\n  // assigned afterwards. A synchronous fire sets `fired=true`, so cancel() never\n  // reads the still-unset handle in that path.\n  const timer: { handle?: ReturnType<typeof st> } = {};\n\n  const cancel = () => {\n    if (fired || cancelled) return;\n    cancelled = true;\n    if (timer.handle !== undefined) ct(timer.handle);\n    // Detach the abort listener so a reused signal does not accumulate dead\n    // closures after this timer is cancelled.\n    if (opts?.signal) opts.signal.removeEventListener(\"abort\", cancel);\n  };\n\n  timer.handle = st(() => {\n    fired = true;\n    /* v8 ignore next — defensive race guard: cancel() sets cancelled=true and clears the timer, but if a custom setTimeout fires after clear, this short-circuits fn(). */\n    if (cancelled) return;\n    // Detach the abort listener now that the timer has fired — the listener\n    // will never be invoked and must not accumulate on a reused signal.\n    if (opts?.signal) opts.signal.removeEventListener(\"abort\", cancel);\n    fn();\n  }, ms);\n\n  // Attach only if the timer has not already fired synchronously (a custom `st`\n  // may fire inline); otherwise the listener would be registered AFTER the fire\n  // path's removal ran and would then leak until the signal aborts.\n  if (opts?.signal && !fired) {\n    opts.signal.addEventListener(\"abort\", cancel, { once: true });\n  }\n\n  return Object.freeze({ cancel });\n}\n\nexport type Scheduler = Readonly<{\n  after(ms: number, fn: () => void, opts?: AfterOptions): AfterHandle;\n  cancelAll(): void;\n  readonly size: number;\n}>;\n\n/**\n * Build a scheduler that tracks every pending `after()` so they can be\n * cancelled together (e.g. on machine destroy). Each `after` returns a handle\n * whose `cancel()` also removes it from the tracking set.\n *\n * `defaults` are merged into every call — typically you inject `setTimeout` /\n * `clearTimeout` once at construction.\n */\nexport function createScheduler(defaults?: AfterOptions): Scheduler {\n  const pending = new Set<AfterHandle>();\n\n  const sched: Scheduler = {\n    after(ms, fn, opts) {\n      const merged: AfterOptions = { ...defaults, ...opts };\n      // Signal handling is lifted to the scheduler layer: we own one abort\n      // listener per timer and route it through the scheduler-level cancel so\n      // the abort path also removes the handle from `pending`. The inner\n      // after() therefore must NOT see the signal — otherwise it would clear\n      // its timer on abort without ever touching `pending`, leaking the entry\n      // (FSM-R-01, path a).\n      const { signal, ...innerOpts } = merged;\n\n      // Path b: scheduling on an already-aborted signal must not grow the Set.\n      // after() returns NOOP in that case; tracking it would be a permanent\n      // dead entry. Return the same NOOP without adding.\n      if (signal?.aborted) return NOOP;\n\n      // Forward-reference slot so `wrapped`/`cancel` can find the tracked\n      // handle before it is constructed below.\n      const slot: { ref?: AfterHandle } = {};\n      let fired = false;\n      let settled = false; // true once removed from pending (fire or cancel)\n\n      const detachAbort = () => {\n        if (signal) signal.removeEventListener(\"abort\", onAbort);\n      };\n\n      // Single removal path shared by fire, explicit cancel, and abort.\n      const settle = () => {\n        if (settled) return;\n        settled = true;\n        if (slot.ref) pending.delete(slot.ref);\n        detachAbort();\n      };\n\n      const wrapped = () => {\n        fired = true;\n        settle();\n        fn();\n      };\n\n      // Scheduler-level cancel: cancel the inner timer AND drop from pending\n      // AND detach the abort listener. Registered on the abort path too.\n      const cancel = () => {\n        inner.cancel();\n        settle();\n      };\n      function onAbort() {\n        cancel();\n      }\n\n      const inner = after(ms, wrapped, innerOpts);\n\n      const handle: AfterHandle = Object.freeze({ cancel });\n      slot.ref = handle;\n\n      // Path c (sync-fire): a custom setTimeout may fire `wrapped` inline,\n      // during the after() call above — before we reach here. In that case the\n      // timer is already done; adding it now would leave a permanent dead\n      // entry. Only track timers that are still live.\n      if (!fired) {\n        pending.add(handle);\n        // Attach the abort listener only for a live timer on a real signal.\n        // { once: true } removes it on abort; settle()/detachAbort() remove it\n        // on fire/cancel so a long-lived shared signal never accumulates dead\n        // listeners.\n        if (signal) signal.addEventListener(\"abort\", onAbort, { once: true });\n      }\n\n      return handle;\n    },\n    cancelAll() {\n      for (const h of pending) h.cancel();\n      pending.clear();\n    },\n    get size() {\n      return pending.size;\n    },\n  };\n  return sched;\n}\n"]}
+{"version":3,"sources":["../../src/timer/scheduler.ts"],"names":[],"mappings":";;;AAuBA,IAAM,IAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,EAAE,QAAQ,MAAM;AAAC,CAAA,EAAG,CAAA;AAK5D,IAAM,SAAA,GAAY,UAAA;AAClB,IAAM,aAAa,CAAC,EAAA,KAAuB,IAAA,CAAK,GAAA,CAAI,IAAI,SAAS,CAAA;AAKjE,SAAS,SAAA,CAAU,IAAa,EAAA,EAAmB;AACjD,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAM,KAAgB,CAAA,EAAG;AAC9C,IAAA,MAAM,IAAI,WAAW,kDAAkD,CAAA;AAAA,EACzE;AACA,EAAA,IAAI,OAAO,EAAA,KAAO,UAAA,EAAY,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAC5F;AAEA,SAAS,cAAc,IAAA,EAGrB;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,MAAM,UAAA,KAAe,CAAC,IAAI,EAAA,KAAO,UAAA,CAAW,UAAA,CAAW,EAAA,EAAI,EAAE,CAAA,CAAA;AAAA,IACjE,IAAI,IAAA,EAAM,YAAA,KAAiB,CAAC,CAAA,KAAM,UAAA,CAAW,aAAa,CAAW,CAAA;AAAA,GACvE;AACF;AAqBO,SAAS,KAAA,CAAM,EAAA,EAAY,EAAA,EAAgB,IAAA,EAAkC;AAClF,EAAA,SAAA,CAAU,IAAI,EAAE,CAAA;AAChB,EAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAO,IAAA;AAElC,EAAA,MAAM,EAAE,EAAA,EAAI,EAAA,EAAG,GAAI,cAAc,IAAI,CAAA;AACrC,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI,SAAA,GAAY,KAAA;AAOhB,EAAA,MAAM,QAA4C,EAAC;AAEnD,EAAA,MAAM,SAAS,MAAM;AACnB,IAAA,IAAI,SAAS,SAAA,EAAW;AACxB,IAAA,SAAA,GAAY,IAAA;AACZ,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,EAAW,EAAA,CAAG,MAAM,MAAM,CAAA;AAG/C,IAAA,IAAI,MAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,CAAO,mBAAA,CAAoB,SAAS,MAAM,CAAA;AAAA,EACnE,CAAA;AAEA,EAAA,KAAA,CAAM,MAAA,GAAS,GAAG,MAAM;AACtB,IAAA,KAAA,GAAQ,IAAA;AAER,IAAA,IAAI,SAAA,EAAW;AAGf,IAAA,IAAI,MAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,CAAO,mBAAA,CAAoB,SAAS,MAAM,CAAA;AACjE,IAAA,EAAA,EAAG;AAAA,EACL,CAAA,EAAG,UAAA,CAAW,EAAE,CAAC,CAAA;AAKjB,EAAA,IAAI,IAAA,EAAM,MAAA,IAAU,CAAC,KAAA,EAAO;AAC1B,IAAA,IAAA,CAAK,OAAO,gBAAA,CAAiB,OAAA,EAAS,QAAQ,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC9D;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,MAAA,EAAQ,CAAA;AACjC;AAgBO,SAAS,gBAAgB,QAAA,EAAoC;AAClE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAiB;AAErC,EAAA,MAAM,KAAA,GAAmB;AAAA,IACvB,KAAA,CAAM,EAAA,EAAI,EAAA,EAAI,IAAA,EAAM;AAGlB,MAAA,SAAA,CAAU,IAAI,EAAE,CAAA;AAQhB,MAAA,MAAM,MAAA,GAAS,IAAA,EAAM,MAAA,IAAU,QAAA,EAAU,MAAA;AACzC,MAAA,MAAM,YAAA,GAAe,IAAA,EAAM,UAAA,IAAc,QAAA,EAAU,UAAA;AACnD,MAAA,MAAM,cAAA,GAAiB,IAAA,EAAM,YAAA,IAAgB,QAAA,EAAU,YAAA;AAOvD,MAAA,MAAM,SAAA,GAA0B;AAAA,QAC9B,GAAI,YAAA,KAAiB,MAAA,IAAa,EAAE,YAAY,YAAA,EAAa;AAAA,QAC7D,GAAI,cAAA,KAAmB,MAAA,IAAa,EAAE,cAAc,cAAA;AAAe,OACrE;AAKA,MAAA,IAAI,MAAA,EAAQ,SAAS,OAAO,IAAA;AAI5B,MAAA,MAAM,OAA8B,EAAC;AACrC,MAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,MAAA,IAAI,OAAA,GAAU,KAAA;AAEd,MAAA,MAAM,cAAc,MAAM;AACxB,QAAA,IAAI,MAAA,EAAQ,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,MACzD,CAAA;AAGA,MAAA,MAAM,SAAS,MAAM;AACnB,QAAA,IAAI,OAAA,EAAS;AACb,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,KAAK,GAAG,CAAA;AACrC,QAAA,WAAA,EAAY;AAAA,MACd,CAAA;AAEA,MAAA,MAAM,UAAU,MAAM;AACpB,QAAA,KAAA,GAAQ,IAAA;AACR,QAAA,MAAA,EAAO;AACP,QAAA,EAAA,EAAG;AAAA,MACL,CAAA;AAIA,MAAA,MAAM,SAAS,MAAM;AACnB,QAAA,KAAA,CAAM,MAAA,EAAO;AACb,QAAA,MAAA,EAAO;AAAA,MACT,CAAA;AACA,MAAA,SAAS,OAAA,GAAU;AACjB,QAAA,MAAA,EAAO;AAAA,MACT;AAEA,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,EAAA,EAAI,OAAA,EAAS,SAAS,CAAA;AAE1C,MAAA,MAAM,MAAA,GAAsB,MAAA,CAAO,MAAA,CAAO,EAAE,QAAQ,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,GAAM,MAAA;AAMX,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAA,CAAQ,IAAI,MAAM,CAAA;AAKlB,QAAA,IAAI,MAAA,SAAe,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,MACtE;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,SAAA,GAAY;AACV,MAAA,KAAA,MAAW,CAAA,IAAK,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO;AAClC,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB,CAAA;AAAA,IACA,IAAI,IAAA,GAAO;AACT,MAAA,OAAO,OAAA,CAAQ,IAAA;AAAA,IACjB;AAAA,GACF;AACA,EAAA,OAAO,KAAA;AACT","file":"index.cjs","sourcesContent":["export type AfterHandle = Readonly<{\n  cancel(): void;\n}>;\n\nexport type SetTimeoutFn = (fn: () => void, ms: number) => unknown;\nexport type ClearTimeoutFn = (handle: unknown) => void;\n\nexport type AfterOptions = Readonly<{\n  /**\n   * If supplied and aborted, the callback never runs and any pending timer is\n   * cleared. Aborting after fire is a no-op.\n   */\n  signal?: AbortSignal;\n  /**\n   * Override `setTimeout` (testing, SSR, custom loops). Defaults to globalThis.\n   */\n  setTimeout?: SetTimeoutFn;\n  /**\n   * Override `clearTimeout`. Must match the `setTimeout` you injected.\n   */\n  clearTimeout?: ClearTimeoutFn;\n}>;\n\nconst NOOP: AfterHandle = Object.freeze({ cancel: () => {} });\n\n// Largest delay setTimeout honours (2^31-1 ms, about 24.8 days); hosts treat\n// anything larger as ~1 ms. Every delay handed to setTimeout goes through\n// clampDelay (ai*js timer rule; no timer chaining).\nconst MAX_DELAY = 2_147_483_647;\nconst clampDelay = (ms: number): number => Math.min(ms, MAX_DELAY);\n\n// Argument validation shared by after() and createScheduler().after(), run\n// before any side effect. aifsmjs/timer exports no error class, so misuse is\n// a prefixed built-in RangeError / TypeError.\nfunction checkArgs(ms: unknown, fn: unknown): void {\n  if (!Number.isFinite(ms) || (ms as number) < 0) {\n    throw new RangeError(\"aifsmjs: after() ms must be a finite number >= 0\");\n  }\n  if (typeof fn !== \"function\") throw new TypeError(\"aifsmjs: after() fn must be a function\");\n}\n\nfunction resolveTimers(opts: AfterOptions | undefined): {\n  st: SetTimeoutFn;\n  ct: ClearTimeoutFn;\n} {\n  return {\n    st: opts?.setTimeout ?? ((fn, ms) => globalThis.setTimeout(fn, ms)),\n    ct: opts?.clearTimeout ?? ((h) => globalThis.clearTimeout(h as number)),\n  };\n}\n\n/**\n * Schedule `fn` to run after `ms` milliseconds. Returns a handle whose\n * `cancel()` clears the pending timer. Optional `signal` aborts the timer when\n * triggered. Aborting after the callback fires is a no-op.\n *\n * `ms` must be a finite number >= 0 (`NaN`, `Infinity`, negatives and\n * non-numbers throw `RangeError`) and `fn` a function (`TypeError`); both are\n * checked before anything else, including an already-aborted `signal`. A\n * finite `ms` above 2^31-1 (about 24.8 days) is clamped to 2^31-1 when handed\n * to `setTimeout`. To mean \"never\", do not schedule.\n *\n * The abort listener is registered with `{ once: true }` as a baseline, but\n * `{ once: true }` alone does NOT prevent listener accumulation when the same\n * signal is reused across many timers: it only removes the listener when the\n * signal aborts, not when the timer fires normally or `cancel()` is called.\n * We therefore explicitly call `signal.removeEventListener(\"abort\", cancel)`\n * inside the fire callback and at the end of `cancel()` so that a shared,\n * long-lived signal never accumulates dead listeners across timer reuse.\n */\nexport function after(ms: number, fn: () => void, opts?: AfterOptions): AfterHandle {\n  checkArgs(ms, fn);\n  if (opts?.signal?.aborted) return NOOP;\n\n  const { st, ct } = resolveTimers(opts);\n  let fired = false;\n  let cancelled = false;\n  // `cancel` and the timer handle reference each other. A const cell holds the\n  // handle so `cancel` can be defined BEFORE `st(...)` runs (letting a custom\n  // `st` that fires its callback synchronously reference `cancel` without\n  // hitting the temporal-dead-zone) while still being able to clear the handle\n  // assigned afterwards. A synchronous fire sets `fired=true`, so cancel() never\n  // reads the still-unset handle in that path.\n  const timer: { handle?: ReturnType<typeof st> } = {};\n\n  const cancel = () => {\n    if (fired || cancelled) return;\n    cancelled = true;\n    if (timer.handle !== undefined) ct(timer.handle);\n    // Detach the abort listener so a reused signal does not accumulate dead\n    // closures after this timer is cancelled.\n    if (opts?.signal) opts.signal.removeEventListener(\"abort\", cancel);\n  };\n\n  timer.handle = st(() => {\n    fired = true;\n    /* v8 ignore next — defensive race guard: cancel() sets cancelled=true and clears the timer, but if a custom setTimeout fires after clear, this short-circuits fn(). */\n    if (cancelled) return;\n    // Detach the abort listener now that the timer has fired — the listener\n    // will never be invoked and must not accumulate on a reused signal.\n    if (opts?.signal) opts.signal.removeEventListener(\"abort\", cancel);\n    fn();\n  }, clampDelay(ms));\n\n  // Attach only if the timer has not already fired synchronously (a custom `st`\n  // may fire inline); otherwise the listener would be registered AFTER the fire\n  // path's removal ran and would then leak until the signal aborts.\n  if (opts?.signal && !fired) {\n    opts.signal.addEventListener(\"abort\", cancel, { once: true });\n  }\n\n  return Object.freeze({ cancel });\n}\n\nexport type Scheduler = Readonly<{\n  after(ms: number, fn: () => void, opts?: AfterOptions): AfterHandle;\n  cancelAll(): void;\n  readonly size: number;\n}>;\n\n/**\n * Build a scheduler that tracks every pending `after()` so they can be\n * cancelled together (e.g. on machine destroy). Each `after` returns a handle\n * whose `cancel()` also removes it from the tracking set.\n *\n * `defaults` are merged into every call — typically you inject `setTimeout` /\n * `clearTimeout` once at construction.\n */\nexport function createScheduler(defaults?: AfterOptions): Scheduler {\n  const pending = new Set<AfterHandle>();\n\n  const sched: Scheduler = {\n    after(ms, fn, opts) {\n      // Same validation as after(), before the aborted-signal shortcut and\n      // before `pending` is touched.\n      checkArgs(ms, fn);\n      // Field-by-field merge with `??`: an explicitly-undefined per-call field\n      // (common when forwarding optional options in JS, or in TS without\n      // exactOptionalPropertyTypes) must fall back to the scheduler's default,\n      // not silently win over it the way `{ ...defaults, ...opts }` would.\n      // Built with `exactOptionalPropertyTypes` in mind: an option that ends\n      // up undefined after the merge is left OUT of the object rather than\n      // set to `undefined`, so the AfterOptions type is honoured exactly.\n      const signal = opts?.signal ?? defaults?.signal;\n      const setTimeoutFn = opts?.setTimeout ?? defaults?.setTimeout;\n      const clearTimeoutFn = opts?.clearTimeout ?? defaults?.clearTimeout;\n      // Signal handling is lifted to the scheduler layer: we own one abort\n      // listener per timer and route it through the scheduler-level cancel so\n      // the abort path also removes the handle from `pending`. The inner\n      // after() therefore must NOT see the signal — otherwise it would clear\n      // its timer on abort without ever touching `pending`, leaking the entry\n      // (FSM-R-01, path a).\n      const innerOpts: AfterOptions = {\n        ...(setTimeoutFn !== undefined && { setTimeout: setTimeoutFn }),\n        ...(clearTimeoutFn !== undefined && { clearTimeout: clearTimeoutFn }),\n      };\n\n      // Path b: scheduling on an already-aborted signal must not grow the Set.\n      // after() returns NOOP in that case; tracking it would be a permanent\n      // dead entry. Return the same NOOP without adding.\n      if (signal?.aborted) return NOOP;\n\n      // Forward-reference slot so `wrapped`/`cancel` can find the tracked\n      // handle before it is constructed below.\n      const slot: { ref?: AfterHandle } = {};\n      let fired = false;\n      let settled = false; // true once removed from pending (fire or cancel)\n\n      const detachAbort = () => {\n        if (signal) signal.removeEventListener(\"abort\", onAbort);\n      };\n\n      // Single removal path shared by fire, explicit cancel, and abort.\n      const settle = () => {\n        if (settled) return;\n        settled = true;\n        if (slot.ref) pending.delete(slot.ref);\n        detachAbort();\n      };\n\n      const wrapped = () => {\n        fired = true;\n        settle();\n        fn();\n      };\n\n      // Scheduler-level cancel: cancel the inner timer AND drop from pending\n      // AND detach the abort listener. Registered on the abort path too.\n      const cancel = () => {\n        inner.cancel();\n        settle();\n      };\n      function onAbort() {\n        cancel();\n      }\n\n      const inner = after(ms, wrapped, innerOpts);\n\n      const handle: AfterHandle = Object.freeze({ cancel });\n      slot.ref = handle;\n\n      // Path c (sync-fire): a custom setTimeout may fire `wrapped` inline,\n      // during the after() call above — before we reach here. In that case the\n      // timer is already done; adding it now would leave a permanent dead\n      // entry. Only track timers that are still live.\n      if (!fired) {\n        pending.add(handle);\n        // Attach the abort listener only for a live timer on a real signal.\n        // { once: true } removes it on abort; settle()/detachAbort() remove it\n        // on fire/cancel so a long-lived shared signal never accumulates dead\n        // listeners.\n        if (signal) signal.addEventListener(\"abort\", onAbort, { once: true });\n      }\n\n      return handle;\n    },\n    cancelAll() {\n      for (const h of pending) h.cancel();\n      pending.clear();\n    },\n    get size() {\n      return pending.size;\n    },\n  };\n  return sched;\n}\n"]}

package/dist/timer/index.d.cts

@@ -23,6 +23,12 @@ type AfterOptions = Readonly<{
  * `cancel()` clears the pending timer. Optional `signal` aborts the timer when
  * triggered. Aborting after the callback fires is a no-op.
  *
+ * `ms` must be a finite number >= 0 (`NaN`, `Infinity`, negatives and
+ * non-numbers throw `RangeError`) and `fn` a function (`TypeError`); both are
+ * checked before anything else, including an already-aborted `signal`. A
+ * finite `ms` above 2^31-1 (about 24.8 days) is clamped to 2^31-1 when handed
+ * to `setTimeout`. To mean "never", do not schedule.
+ *
  * The abort listener is registered with `{ once: true }` as a baseline, but
  * `{ once: true }` alone does NOT prevent listener accumulation when the same
  * signal is reused across many timers: it only removes the listener when the

package/dist/timer/index.d.ts

@@ -23,6 +23,12 @@ type AfterOptions = Readonly<{
  * `cancel()` clears the pending timer. Optional `signal` aborts the timer when
  * triggered. Aborting after the callback fires is a no-op.
  *
+ * `ms` must be a finite number >= 0 (`NaN`, `Infinity`, negatives and
+ * non-numbers throw `RangeError`) and `fn` a function (`TypeError`); both are
+ * checked before anything else, including an already-aborted `signal`. A
+ * finite `ms` above 2^31-1 (about 24.8 days) is clamped to 2^31-1 when handed
+ * to `setTimeout`. To mean "never", do not schedule.
+ *
  * The abort listener is registered with `{ once: true }` as a baseline, but
  * `{ once: true }` alone does NOT prevent listener accumulation when the same
  * signal is reused across many timers: it only removes the listener when the

package/dist/timer/index.js

@@ -1,8 +1,14 @@
-import '../chunk-PZ5AY32C.js';
-
 // src/timer/scheduler.ts
 var NOOP = Object.freeze({ cancel: () => {
 } });
+var MAX_DELAY = 2147483647;
+var clampDelay = (ms) => Math.min(ms, MAX_DELAY);
+function checkArgs(ms, fn) {
+  if (!Number.isFinite(ms) || ms < 0) {
+    throw new RangeError("aifsmjs: after() ms must be a finite number >= 0");
+  }
+  if (typeof fn !== "function") throw new TypeError("aifsmjs: after() fn must be a function");
+}
 function resolveTimers(opts) {
   return {
     st: opts?.setTimeout ?? ((fn, ms) => globalThis.setTimeout(fn, ms)),
@@ -10,6 +16,7 @@ function resolveTimers(opts) {
   };
 }
 function after(ms, fn, opts) {
+  checkArgs(ms, fn);
   if (opts?.signal?.aborted) return NOOP;
   const { st, ct } = resolveTimers(opts);
   let fired = false;
@@ -26,7 +33,7 @@ function after(ms, fn, opts) {
     if (cancelled) return;
     if (opts?.signal) opts.signal.removeEventListener("abort", cancel);
     fn();
-  }, ms);
+  }, clampDelay(ms));
   if (opts?.signal && !fired) {
     opts.signal.addEventListener("abort", cancel, { once: true });
   }
@@ -36,8 +43,14 @@ function createScheduler(defaults) {
   const pending = /* @__PURE__ */ new Set();
   const sched = {
     after(ms, fn, opts) {
-      const merged = { ...defaults, ...opts };
-      const { signal, ...innerOpts } = merged;
+      checkArgs(ms, fn);
+      const signal = opts?.signal ?? defaults?.signal;
+      const setTimeoutFn = opts?.setTimeout ?? defaults?.setTimeout;
+      const clearTimeoutFn = opts?.clearTimeout ?? defaults?.clearTimeout;
+      const innerOpts = {
+        ...setTimeoutFn !== void 0 && { setTimeout: setTimeoutFn },
+        ...clearTimeoutFn !== void 0 && { clearTimeout: clearTimeoutFn }
+      };
       if (signal?.aborted) return NOOP;
       const slot = {};
       let fired = false;