statechart

어떤 스킬인가요?

Draw how any system moves between states, such as a product flow, a protocol, or a service, as a Mermaid statechart from a TLA+ model. Each bug is a numbered path with blue borders to a state that breaks a rule. Use for /statechart, to show a bug as a path through states, or to turn an agreed chart into a TLA+ skeleton.

설치 방법

프로젝트 폴더에서 아래 명령어를 실행하고, 설치할 에이전트를 선택하세요.

설치 명령을 직접 실행해야 적용됩니다. 지원 에이전트와 필요한 권한·라이선스는 제작자의 안내를 확인하세요.

스킬 원문 파일

import fs from "node:fs";
import { BROKEN_MARK, parseValue, stateKey } from "./lib.mjs";
import { SEP } from "./chart-parts.mjs";

export function firstBad(raw) {
  const badStates = new Map();
  for (const t of raw) {
    if (!badStates.has(t.invariant)) badStates.set(t.invariant, new Set());
    badStates.get(t.invariant).add(stateKey(t.steps[t.steps.length - 1].vars));
  }
  const cuts = [];
  const seen = new Set();
  for (const t of raw) {
    const first = t.steps.findIndex((s) => badStates.get(t.invariant).has(stateKey(s.vars)));
    const cut = { invariant: t.invariant, steps: t.steps.slice(0, first + 1) };
    const id = `${t.invariant}${SEP}${stateKey(cut.steps[cut.steps.length - 1].vars)}`;
    if (seen.has(id)) continue;
    seen.add(id);
    cuts.push(cut);
  }
  return cuts;
}

export const byOrder = (a, b) =>
  a.steps - b.steps ||
  a.trace.steps.length - b.trace.steps.length ||
  (a.id < b.id ? -1 : a.id > b.id ? 1 : 0);

const lastKey = (t) => stateKey(t.steps[t.steps.length - 1].vars);
export const badOf = (raw, rule) => new Set(raw.filter((t) => t.invariant === rule).map(lastKey));
export function reachableAvoiding({ graph: g, stateKeys }, bad) {
  const ok = (id) => !bad.has(stateKeys.get(id));
  const next = new Map();
  for (const e of g.edges) {
    if (!next.has(e.from)) next.set(e.from, []);
    next.get(e.from).push(e.to);
  }
  const clean = new Set([...g.nodes.values()].filter((n) => n.init && ok(n.id)).map((n) => n.id));
  for (const id of clean) for (const to of next.get(id) ?? []) if (ok(to)) clean.add(to);
  return clean;
}

export const diverges = (c) => c.second?.key !== undefined;
export function readBroken(file) {
  if (!file) return [];
  const lines = fs.readFileSync(file, "utf8").split("\n");
  const marked = new RegExp(`^<<\\s*"${BROKEN_MARK}",`);
  const out = [];
  for (let i = 0; i < lines.length; i++) {
    if (!marked.test(lines[i])) continue;
    let text = lines[i];
    while (typeof parseValue(text) === "string" && i + 1 < lines.length) text += `\n${lines[++i]}`;
    const [, vars, broken] = parseValue(text);
    out.push({ key: stateKey(vars), rules: broken });
  }
  return out;
}
export const badStates = (raw, broken, counts = () => true) =>
  new Set([
    ...raw.filter((t) => counts(t.invariant)).map(lastKey),
    ...broken.filter((b) => b.rules.some(counts)).map((b) => b.key),
  ]);
export function labelStatus(m, keys, bad) {
  const good = reachableAvoiding(m, bad);
  const kinds = new Map();
  for (const n of m.graph.nodes.values()) {
    const k = keys.get(n.id);
    if (!kinds.has(k)) kinds.set(k, new Set());
    kinds.get(k).add(bad.has(m.stateKeys.get(n.id)) ? "bad" : good.has(n.id) ? "good" : "after");
  }
  return (k) => {
    const has = kinds.get(k);
    if (!has) return undefined;
    if (has.has("bad")) return has.has("good") ? "mixed" : "wrong";
    return has.has("good") ? "works" : "after";
  };
}

export const RANK = ["works", "fixed", "after", "mixed", "wrong", "worse"];
export const worst = (...all) =>
  all.filter(Boolean).reduce((a, b) => (RANK.indexOf(b) > RANK.indexOf(a) ? b : a), "works");

import { edgeId } from "./chart-parts.mjs";
import { diverges } from "./bug-states.mjs";

export const edgesAlong = (c) =>
  c.path.slice(1).map((p, i) => ({
    id: edgeId(c.path[i].key, p.key),
    from: c.path[i].key,
    to: p.key,
    label: p.label,
    guard: p.guard,
  }));

export function chartEdges({ args, now, secondQ, modelEdges, classes, chosen, coverOff }) {
  const edges = new Map(modelEdges);
  for (const { second: s } of classes.filter(diverges)) {
    if (modelEdges.has(s.edge)) continue;
    if (!edges.has(s.edge))
      edges.set(s.edge, {
        from: s.from,
        to: s.key,
        labels: new Set(),
        secondOnly: true,
        apart: s.apart,
      });
    edges.get(s.edge).labels.add(s.overview);
  }
  const pathNumbers = new Map();
  (chosen ? edgesAlong(chosen) : []).forEach((step, i) => {
    if (!pathNumbers.has(step.id)) pathNumbers.set(step.id, []);
    const shown = step.guard ? `${step.label} [${step.guard}]` : step.label;
    pathNumbers.get(step.id).push({ n: i + 1, label: step.label, shown });
    if (!edges.has(step.id))
      edges.set(step.id, { from: step.from, to: step.to, labels: new Set([step.label]) });
  });
  const bugSteps = classes.flatMap(edgesAlong);
  const pathEdges = new Map();
  for (const step of bugSteps) {
    if (edges.has(step.id)) continue;
    if (!pathEdges.has(step.id))
      pathEdges.set(step.id, { from: step.from, to: step.to, labels: new Set() });
    pathEdges.get(step.id).labels.add(step.label);
  }
  for (const [id, e] of pathEdges) edges.set(id, e);
  if (!args.cover || coverOff) return { edges, pathNumbers, coverEdges: null };

  const coverEdges = new Set(bugSteps.map((step) => step.id));
  const bfs = (q, targets) => {
    const parent = new Map([...q.initial].map((k) => [k, null]));
    const outEdges = new Map();
    for (const [id, e] of q.edges) {
      if (!outEdges.has(e.from)) outEdges.set(e.from, []);
      outEdges.get(e.from).push([id, e]);
    }
    for (const k of parent.keys())
      for (const [id, e] of outEdges.get(k) ?? []) if (!parent.has(e.to)) parent.set(e.to, id);
    for (const t of targets) {
      for (let id = parent.get(t); id; id = parent.get(q.edges.get(id).from)) coverEdges.add(id);
    }
  };
  bfs(now, now.settled);
  if (secondQ)
    bfs(
      secondQ,
      [...secondQ.settled].filter((k) => !now.nodes.has(k)),
    );
  for (const c of classes.filter(diverges)) coverEdges.add(c.second.edge);
  return { edges, pathNumbers, coverEdges };
}

export const SEP = "\u0000";
export const edgeId = (from, to) => `${from}${SEP}${SEP}${to}`;

export function guarded(guards, label) {
  const words = guards?.get(label);
  return words && !words.has("") ? `${label} [${[...words].sort().join(" or ")}]` : label;
}
export const addGuard = (guards, label, words) => {
  if (!guards.has(label)) guards.set(label, new Set());
  guards.get(label).add(words);
};

export const frontMatter = (title) => [
  "---",
  ...(title ? [`title: ${JSON.stringify(title)}`] : []),
  "config:",
  "  markdownAutoWrap: false",
  "  state:",
  "    useMaxWidth: false",
  "---",
];

#!/usr/bin/env node
import fs from "node:fs";
import path from "node:path";
import process from "node:process";
import { parseMermaid } from "./lib.mjs";

const USAGE = "Usage: node chart-to-tla.mjs CHART.mmd --module NAME [--dir OUT]";

const args = {};
for (let i = 2; i < process.argv.length; i++) {
  const a = process.argv[i];
  if (a === "--module") args.module = process.argv[++i];
  else if (a === "--dir") args.dir = process.argv[++i];
  else if (!a.startsWith("-") && !args.chart) args.chart = a;
  else {
    console.error(`unknown argument ${a}.`);
    process.exit(2);
  }
}
if (!args.chart || !/^[A-Za-z][A-Za-z0-9_]*$/.test(args.module ?? "")) {
  console.error(USAGE);
  process.exit(2);
}
const dir = args.dir ?? path.dirname(args.chart);
const { regions, nevers } = parseMermaid(fs.readFileSync(args.chart, "utf8"));

const RESERVED = new Set(["vars", "Init", "Next", "Spec", "TypeOK", "Settled"]);
const taken = new Set(RESERVED);
function ident(words, lower) {
  const parts = words
    .normalize("NFKD")
    .replace(/[^A-Za-z0-9]+/g, " ")
    .trim()
    .split(" ")
    .filter(Boolean);
  let id =
    parts
      .map((p, i) => (lower && i === 0 ? p[0].toLowerCase() : p[0].toUpperCase()) + p.slice(1))
      .join("") || "Step";
  if (/^[0-9]/.test(id)) id = `${lower ? "r" : "S"}${id}`;
  let unique = id;
  for (let n = 2; taken.has(unique); n++) unique = `${id}${n}`;
  taken.add(unique);
  return unique;
}
const str = (s) => `"${s.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
const set = (xs) => `{${[...xs].map(str).join(", ")}}`;

const vars = Object.entries(regions).map(([name, r]) => {
  if (r.states.size === 0) throw new Error(`region ${name} has no states`);
  if (r.initial.size === 0) throw new Error(`region ${name} has no [*] --> start`);
  return { name, v: ident(name, true), ...r };
});

function guardOf(g) {
  if (!g) return null;
  const parts = Object.entries(g.states).map(([name, states]) => {
    const { v } = vars.find((x) => x.name === name);
    return states.length === 1 ? `${v} = ${str(states[0])}` : `${v} \\in ${set(states)}`;
  });
  return g.not ? `~(${parts.join(" \\/ ")})` : parts.join(" /\\ ");
}

const actions = [];
const byLabel = new Map();
for (const [ri, r] of vars.entries()) {
  for (const t of r.transitions) {
    let a = t.label ? byLabel.get(t.label) : null;
    if (!a) {
      a = { label: t.label, moves: new Map() };
      actions.push(a);
      if (t.label) byLabel.set(t.label, a);
    }
    if (!a.moves.has(ri)) a.moves.set(ri, []);
    const moves = a.moves.get(ri);
    const when = guardOf(t.guard);
    if (!moves.some((m) => m.from === t.from && m.to === t.to && m.when === when))
      moves.push({ from: t.from, to: t.to, when });
  }
}
for (const a of actions) {
  const only = a.label ? null : [...a.moves.values()][0][0];
  a.name = ident(a.label || `${only.from} to ${only.to}`, false);
}

const out = [];
const conjuncts = (lines) => lines.map((l) => `    /\\ ${l}`);
out.push(`---- MODULE ${args.module} ----`);
out.push(`\\* Generated by chart-to-tla.mjs from ${path.basename(args.chart)}.`);
out.push("\\* Each region is one variable and each transition label is one action.");
out.push("\\* Once you add guards and variables from the real code, this file is the source.");
out.push(
  `\\* statechart.mjs from-chart ${path.basename(args.chart)} keeps it, checks it, and compares it with the chart.`,
);
out.push("");
out.push(`VARIABLES ${vars.map((x) => x.v).join(", ")}`);
out.push(`vars == <<${vars.map((x) => x.v).join(", ")}>>`);
out.push("");
for (const x of vars)
  out.push(`\\* Region ${x.name}`, `${x.v}States == ${set([...x.states].sort())}`);
out.push("");
out.push("TypeOK ==", ...conjuncts(vars.map((x) => `${x.v} \\in ${x.v}States`)));
out.push("");
out.push(
  "Init ==",
  ...conjuncts(
    vars.map((x) =>
      x.initial.size === 1 ? `${x.v} = ${str([...x.initial][0])}` : `${x.v} \\in ${set(x.initial)}`,
    ),
  ),
);
const enabled = (v, m) => `${v} = ${str(m.from)}${m.when ? ` /\\ ${m.when}` : ""}`;
function whetherTakes(a, ri) {
  const { v } = vars[ri];
  const moves = a.moves.get(ri);
  if (moves.every((m) => !m.when)) {
    const from = set(new Set(moves.map((m) => m.from)));
    return { can: `${v} \\in ${from}`, cannot: `${v} \\notin ${from}` };
  }
  const any = moves.map((m) => `(${enabled(v, m)})`).join(" \\/ ");
  return { can: any, cannot: `~(${any})` };
}
for (const a of actions) {
  out.push("");
  if (a.label) out.push(`\\* ${a.label}`);
  out.push(`${a.name} ==`);
  const moving = [...a.moves.keys()];
  const shared = moving.length > 1;
  if (shared) out.push(`    /\\ (${moving.map((ri) => whetherTakes(a, ri).can).join(" \\/ ")})`);
  for (const ri of moving) {
    const { v } = vars[ri];
    const ds = a.moves.get(ri).map((m) => `(${enabled(v, m)} /\\ ${v}' = ${str(m.to)})`);
    if (shared) ds.push(`(${whetherTakes(a, ri).cannot} /\\ UNCHANGED ${v})`);
    out.push(`    /\\ \\/ ${ds[0]}`);
    for (const d of ds.slice(1)) out.push(`       \\/ ${d}`);
  }
  const still = vars.filter((_, ri) => !a.moves.has(ri)).map((x) => x.v);
  if (still.length) out.push(`    /\\ UNCHANGED <<${still.join(", ")}>>`);
}
out.push("");
out.push(actions.length ? `Next == ${actions.map((a) => a.name).join(" \\/ ")}` : "Next == FALSE");
out.push("");
out.push("Spec == Init /\\ [][Next]_vars");

function resolve(item) {
  const hits = [];
  for (const [ri, x] of vars.entries()) {
    const inside = x.states.has(item)
      ? [item]
      : [...x.states].filter((s) => s.startsWith(`${item}.`));
    if (inside.length) hits.push({ ri, inside });
  }
  if (hits.length === 0)
    throw new Error(`never line names "${item}", which is not a state in the chart`);
  if (hits.length > 1)
    throw new Error(
      `never line names "${item}", which is a state in regions ${hits.map((h) => vars[h.ri].name).join(" and ")}; rename one`,
    );
  return hits[0];
}
const invariants = [];
for (const n of nevers) {
  if (taken.has(n.name)) throw new Error(`never name ${n.name} is already used in the spec`);
  taken.add(n.name);
  const parts = n.states.map(resolve);
  const regionsUsed = new Set(parts.map((p) => p.ri));
  if (regionsUsed.size !== parts.length)
    throw new Error(
      `never ${n.name} names two states of one region; one region is in one state at a time`,
    );
  const cond = parts.map((p) =>
    p.inside.length === 1
      ? `${vars[p.ri].v} = ${str(p.inside[0])}`
      : `${vars[p.ri].v} \\in ${set(p.inside)}`,
  );
  out.push("");
  if (n.sentence) out.push(`\\* ${n.sentence}`);
  out.push(`${n.name} == ~(${cond.join(" /\\ ")})`);
  invariants.push(n.name);
}
out.push("", "====", "");

const rules = ["TypeOK", ...invariants];
const cfg = ["SPECIFICATION Spec", ...rules.map((r) => `INVARIANT ${r}`), ""];

const labels = Object.fromEntries(actions.map((a) => [a.name, a.label]));
const map = [
  `// Generated by chart-to-tla.mjs from ${path.basename(args.chart)}. Reader states are the chart's own states.`,
  `export const regions = ${JSON.stringify(vars.map((x) => x.v))};`,
  `const LABELS = ${JSON.stringify(labels, null, "\t")};`,
  "",
  "// The actions the reader takes. facts.settled needs them. Add cause() and detail() as the spec grows.",
  "export const readerActions = [];",
  'export const state = (v) => regions.map((r) => v[r]).join(" | ");',
  "export const step = (action) => LABELS[action] ?? action;",
  "",
];

fs.mkdirSync(dir, { recursive: true });
fs.writeFileSync(path.join(dir, `${args.module}.tla`), out.join("\n"));
fs.writeFileSync(path.join(dir, `${args.module}.cfg`), cfg.join("\n"));
fs.writeFileSync(path.join(dir, `${args.module}.map.mjs`), map.join("\n"));
console.error(
  `${args.module}: ${vars.length} region variable(s), ${actions.length} action(s), rules ${rules.join(" ")} -> ${path.join(dir, args.module)}.{tla,cfg,map.mjs}`,
);

#!/usr/bin/env node
import fs from "node:fs";
import process from "node:process";
import { FULL_LABELS, LEGEND_ID, NO_LOOPS, compareCharts, parseMermaid } from "./lib.mjs";

const USAGE = "Usage: node compare-charts.mjs EXPECTED.mmd ACTUAL.mmd";

const files = [];
for (const a of process.argv.slice(2)) {
  if (a.startsWith("-") || files.length === 2) {
    console.error(`unknown argument ${a}.`);
    process.exit(2);
  } else files.push(a);
}
if (files.length < 2) {
  console.error(USAGE);
  process.exit(2);
}
const [expectedFile, actualFile] = files;

const orExit = (file, f) => {
  try {
    return f();
  } catch (e) {
    console.error(`${file}: ${e.message}`);
    process.exit(2);
  }
};
const [expectedText, actualText] = files.map((f) => orExit(f, () => fs.readFileSync(f, "utf8")));
const has = (re) => re.test(actualText);
const textRefusals = [
  [
    has(/^\s*%% second model/m),
    "it has a second model; draw ACTUAL without --fixed-dot or --against-dot",
  ],
  [
    has(new RegExp(`^\\s*state\\s+"[^"]*"\\s+as\\s+(?!${LEGEND_ID}\\b)\\w+\\s*\\{`, "m")),
    "it has boxes; draw ACTUAL with --flat",
  ],
  [
    has(new RegExp(`^\\s*state\\s+"[^"]*"\\s+as\\s+${LEGEND_ID}\\s*\\{`, "m")) &&
      !actualText.includes(FULL_LABELS),
    "edge labels write shared words once; draw ACTUAL with --full-labels",
  ],
];
for (const [bad, why] of textRefusals) {
  if (bad) {
    console.error(`${actualFile}: ${why}`);
    process.exit(2);
  }
}
const expectedRegions = orExit(expectedFile, () => parseMermaid(expectedText).regions);
const actualRegions = orExit(actualFile, () => parseMermaid(actualText).regions);
const numbered = Object.values(actualRegions)
  .flatMap((r) => r.transitions)
  .some((t) => /^\d+(, \d+)*\. /.test(t.label));
if (numbered) {
  console.error(
    `${actualFile}: an edge label is a numbered path step; draw ACTUAL with --highlight 0`,
  );
  process.exit(2);
}

const rows = compareCharts(expectedRegions, actualRegions, {
  loops: !actualText.includes(NO_LOOPS),
});
let differences = 0;
for (const [title, xs] of rows) {
  console.log(`${title}:`);
  for (const x of xs) console.log(`  ${x}`);
  differences += xs.length;
}
console.log(differences === 0 ? "same" : `${differences} difference(s)`);
process.exit(differences === 0 ? 0 : 1);

import fs from "node:fs";
import path from "node:path";

const tuples = new WeakSet();
export const isTuple = (v) => tuples.has(v);

export function parseValue(text) {
  const src = text.trim();
  let i = 0;
  const ws = () => {
    while (i < src.length && /\s/.test(src[i])) i++;
  };
  const peek = (s) => src.startsWith(s, i);
  const eat = (s) => {
    ws();
    if (!peek(s)) throw new Error(`expected ${s} at ${i} in ${src}`);
    i += s.length;
  };
  const list = (close, item) => {
    const out = [];
    ws();
    if (peek(close)) {
      i += close.length;
      return out;
    }
    for (;;) {
      out.push(item());
      ws();
      if (peek(",")) {
        i++;
        continue;
      }
      eat(close);
      return out;
    }
  };
  const value = () => {
    ws();
    if (peek("<<")) {
      i += 2;
      const items = list(">>", value);
      tuples.add(items);
      return items;
    }
    if (peek("{")) {
      i++;
      return list("}", value);
    }
    if (peek("[")) {
      i++;
      const pairs = list("]", () => {
        ws();
        const m = /^[A-Za-z_][A-Za-z0-9_]*/.exec(src.slice(i));
        if (!m) throw new Error(`bad record field at ${i}`);
        i += m[0].length;
        eat("|->");
        return [m[0], value()];
      });
      return Object.fromEntries(pairs);
    }
    if (peek("(")) {
      i++;
      const fn = {};
      for (;;) {
        const k = value();
        eat(":>");
        fn[typeof k === "string" ? k : JSON.stringify(k)] = value();
        ws();
        if (peek("@@")) {
          i += 2;
          continue;
        }
        eat(")");
        return fn;
      }
    }
    if (peek('"')) {
      i++;
      let s = "";
      while (i < src.length && src[i] !== '"') {
        if (src[i] === "\\") i++;
        s += src[i++];
      }
      i++;
      return s;
    }
    const m = /^-?\d+|^[A-Za-z_][A-Za-z0-9_]*/.exec(src.slice(i));
    if (!m) throw new Error(`bad value at ${i} in ${src}`);
    i += m[0].length;
    if (m[0] === "TRUE") return true;
    if (m[0] === "FALSE") return false;
    return /^-?\d+$/.test(m[0]) ? Number(m[0]) : m[0];
  };
  try {
    const v = value();
    ws();
    return i === src.length ? v : src;
  } catch {
    return src;
  }
}

// One state as TLC prints it: "/\ x = 1" lines, or "x = 1" for one variable.
export function parseState(text) {
  const lines = text.split("\n").filter((l) => l.trim() !== "");
  const conjuncts = [];
  for (const line of lines) {
    if (/^\s*\/\\ /.test(line) || conjuncts.length === 0)
      conjuncts.push(line.replace(/^\s*\/\\ /, ""));
    else conjuncts[conjuncts.length - 1] += ` ${line.trim()}`;
  }
  const vars = {};
  for (const c of conjuncts) {
    const eq = c.indexOf(" = ");
    if (eq < 0) continue;
    vars[c.slice(0, eq).trim()] = parseValue(c.slice(eq + 3));
  }
  return vars;
}

export const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
const canon = (v) =>
  Array.isArray(v)
    ? v.map(canon)
    : isRecord(v)
      ? Object.fromEntries(
          Object.keys(v)
            .sort()
            .map((k) => [k, canon(v[k])]),
        )
      : v;
export const stateKey = (vars) => JSON.stringify(canon(vars));

export function ruleSentences(tla) {
  const out = new Map();
  const lines = tla.split("\n");
  lines.forEach((line, i) => {
    const name = /^([A-Za-z_]\w*)\s*==/.exec(line)?.[1];
    if (!name) return;
    const said = [];
    for (let j = i - 1; j >= 0 && /^\s*\\\*/.test(lines[j]); j--)
      said.unshift(lines[j].replace(/^\s*\\\*\s?/, "").trim());
    const sentence = said.filter(Boolean).join(" ");
    if (sentence) out.set(name, sentence);
  });
  return out;
}

export const tlaVariables = (code) =>
  [...code.matchAll(/\bVARIABLES?\s+(\w+(?:\s*,\s*\w+)*)/g)].flatMap((m) => m[1].split(/\s*,\s*/));

export function splitCommentsKeepingOffsets(text) {
  let code = "";
  let notes = "";
  let block = 0;
  let line = false;
  let string = false;
  const put = (c, n) => {
    code += c;
    notes += n;
  };
  for (let i = 0; i < text.length; i++) {
    const c = text[i];
    const two = text.slice(i, i + 2);
    if (c === "\n") {
      line = string = false;
      put(c, c);
    } else if (block) {
      if (two === "(*" || two === "*)") {
        block += two === "(*" ? 1 : -1;
        put("  ", two);
        i++;
      } else put(" ", c);
    } else if (line) put(" ", c);
    else if (string) {
      if (c === "\\" && text[i + 1] && text[i + 1] !== "\n") {
        put(two, "  ");
        i++;
      } else {
        string = c !== '"';
        put(c, " ");
      }
    } else if (two === "\\*" || two === "(*") {
      if (two === "\\*") line = true;
      else block = 1;
      put("  ", two);
      i++;
    } else {
      string = c === '"';
      put(c, " ");
    }
  }
  return { code, notes };
}

const IDENTIFIER = /(?<![\\.\w])[A-Za-z_]\w*(?!\w)(?!\s*\|->)/g;
const QUALIFIED = /(?<![\\.\w!])[A-Za-z_]\w*(?:![A-Za-z_]\w*)+/g;
const PRIMED = /(?<![\\.\w])([A-Za-z_]\w*)'/g;
const UNCHANGED_CLAUSE = /\bUNCHANGED\s*(?:<<[\s\S]*?>>|[A-Za-z_]\w*)/g;
const CITATION = /[\w./-]+\.[A-Za-z]\w*:\d+|#L\d+/;

const DEPTH = { "(": 1, "[": 1, "{": 1, ")": -1, "]": -1, "}": -1 };
const LOOSER_THAN_AND = /^(\\\/|=>|<=>|~>|-\+->|\\equiv\b)/;
const RUNS_TO_END = /^(\\[EA]|IF|LET|CASE|CHOOSE)\b/;
export const PRIMES_OR_UNCHANGED = /[\w)\]>}]'|\bUNCHANGED\b/;

function conjuncts(bare, from, to, lineStart) {
  const first = from + bare.slice(from, to).search(/\S/);
  if (first < from) return null;
  if (/^\\E\b/.test(bare.slice(first, to))) {
    for (let i = first, depth = 0; i < to; i++) {
      depth += DEPTH[bare[i]] ?? 0;
      if (depth === 0 && bare[i] === ":") return conjuncts(bare, i + 1, to, lineStart);
    }
    return null;
  }
  if (bare.startsWith("/\\", first)) {
    const column = first - lineStart(first);
    const bullets = [first];
    for (const m of bare.slice(first, to).matchAll(/\n([ \t]*)(?=\S)/g)) {
      if (m[1].length < column) return null;
      const at = first + m.index + m[0].length;
      if (m[1].length === column && bare.startsWith("/\\", at)) bullets.push(at);
    }
    return bullets.flatMap((b, i) => {
      const end = bullets[i + 1] ?? to;
      return conjuncts(bare, b + 2, end, lineStart) ?? [[b + 2, end]];
    });
  }
  const cuts = [];
  let depth = 0;
  for (let i = first; i < to; i++) {
    const two = bare.slice(i, i + 2);
    const ahead = bare.slice(i, i + 7);
    if (two === "<<" || two === ">>") {
      depth += two === "<<" ? 1 : -1;
      i++;
    } else if (DEPTH[bare[i]]) depth += DEPTH[bare[i]];
    else if (depth > 0) continue;
    else if (LOOSER_THAN_AND.test(ahead)) return null;
    else if (!/\w/.test(bare[i - 1] ?? "") && RUNS_TO_END.test(ahead)) break;
    else if (two === "/\\") cuts.push(i++);
  }
  return [first, ...cuts.map((c) => c + 2)].map((a, i) => [a, cuts[i] ?? to]);
}

export const blankStrings = (code) =>
  code.replace(/"(?:[^"\\\n]|\\.)*"/g, (s) => " ".repeat(s.length));

export function definitions(text, instancedReads = new Map(), parameters = []) {
  const { code, notes } = splitCommentsKeepingOffsets(text);
  const bare = blankStrings(code);
  const variables = new Set([...parameters, ...tlaVariables(bare)]);
  const defs = new Map();
  const nextItem = /^(?![ \t\n]|\/\\|\\\/)/gm;
  for (const m of bare.matchAll(
    /^(?:LOCAL[ \t]+)?([A-Za-z_]\w*)[ \t]*(?:\([^)]*\)|\[[^\]]*\])?[ \t]*==/gm,
  )) {
    const from = m.index + m[0].length;
    nextItem.lastIndex = from;
    defs.set(m[1], { at: m.index, from, to: nextItem.exec(bare)?.index ?? bare.length });
  }
  const known = (id) => defs.has(id) || instancedReads.has(id);
  const direct = (body) => {
    const plain = body.replace(UNCHANGED_CLAUSE, " ").replace(PRIMED, " ");
    const qualified = (plain.match(QUALIFIED) ?? []).filter(known);
    const ids = plain.replace(QUALIFIED, (q) => (known(q) ? " " : q)).match(IDENTIFIER) ?? [];
    return {
      reads: ids.filter((id) => variables.has(id)),
      writes: [...body.matchAll(PRIMED)].map((m) => m[1]).filter((id) => variables.has(id)),
      acts: PRIMES_OR_UNCHANGED.test(body),
      calls: [...new Set([...ids.filter(known), ...qualified])],
    };
  };
  const own = new Map([
    ...[...instancedReads].map(([name, reads]) => [name, direct(reads.join(" "))]),
    ...[...defs].map(([name, d]) => [name, direct(bare.slice(d.from, d.to))]),
  ]);
  const through = (start) => {
    const out = { reads: new Set(start.reads), writes: new Set(start.writes), acts: start.acts };
    const seen = new Set(start.calls);
    const todo = [...seen];
    while (todo.length) {
      const d = own.get(todo.pop());
      d.reads.forEach((v) => out.reads.add(v));
      d.writes.forEach((v) => out.writes.add(v));
      out.acts ||= d.acts;
      for (const c of d.calls.filter((c) => !seen.has(c))) {
        seen.add(c);
        todo.push(c);
      }
    }
    return out;
  };
  return { code, notes, bare, defs, direct, own, through };
}

export function uncitedConditions(text) {
  const { code, notes, bare, defs, direct, own, through } = definitions(text);
  const starts = [0, ...[...bare.matchAll(/\n/g)].map((m) => m.index + 1)];
  const lineOf = (at) => {
    let lo = 0;
    let hi = starts.length - 1;
    while (lo < hi) {
      const mid = (lo + hi + 1) >> 1;
      if (starts[mid] <= at) lo = mid;
      else hi = mid - 1;
    }
    return lo;
  };
  const lineStart = (at) => starts[lineOf(at)];
  const lines = { bare: bare.split("\n"), notes: notes.split("\n") };
  const cited = (from, to, { above }) => {
    for (let l = from; l <= to; l++) if (CITATION.test(lines.notes[l])) return true;
    for (let l = from - 1; above && !lines.bare[l].trim() && lines.notes[l].trim(); l--)
      if (CITATION.test(lines.notes[l])) return true;
    return false;
  };

  const found = [];
  for (const [action, d] of defs) {
    if (!own.get(action).acts) continue;
    const changes = through(own.get(action)).writes;
    for (const [a, b] of conjuncts(bare, d.from, d.to, lineStart) ?? []) {
      const part = through(direct(bare.slice(a, b)));
      if (part.acts || [...part.reads].every((v) => changes.has(v))) continue;
      const first = lineOf(a + bare.slice(a, b).search(/\S/));
      const last = lineOf(a + bare.slice(a, b).trimEnd().length - 1);
      if (cited(first, last, { above: first > lineOf(d.at) })) continue;
      found.push({
        line: first + 1,
        action,
        condition: code.slice(a, b).replace(/\s+/g, " ").trim(),
      });
    }
  }
  return found;
}

const TEMPORAL = /\[\]|(?<!<)<>(?!>)|~>|-\+->|\\(?:AA|EE)\b|\b[WS]F_/;

export function checkedOnlyInInitialStates(spec, property) {
  const bodies = new Map();
  const modules = new Set();
  const read = (module) => {
    const file = path.join(path.dirname(spec), `${module}.tla`);
    if (modules.has(module) || !fs.existsSync(file)) return;
    modules.add(module);
    const { bare, defs } = definitions(fs.readFileSync(file, "utf8"));
    for (const [name, d] of defs)
      bodies.set(name, [...(bodies.get(name) ?? []), bare.slice(d.from, d.to)]);
    for (const [, names] of bare.matchAll(/\b(?:EXTENDS|INSTANCE)\s+(\w+(?:\s*,\s*\w+)*)/g))
      names.split(/\s*,\s*/).forEach(read);
  };
  read(path.basename(spec, ".tla"));
  const seen = new Set();
  const temporal = (name) => {
    if (seen.has(name)) return false;
    seen.add(name);
    return (bodies.get(name) ?? []).some(
      (body) => TEMPORAL.test(body) || (body.match(IDENTIFIER) ?? []).some(temporal),
    );
  };
  return bodies.has(property) && !temporal(property);
}

function unescapeDot(s) {
  let out = "";
  for (let i = 0; i < s.length; i++) {
    if (s[i] === "\\" && i + 1 < s.length) {
      const n = s[++i];
      out += n === "n" ? "\n" : n;
    } else out += s[i];
  }
  return out;
}

export function parseDot(text) {
  const nodes = new Map();
  const edges = [];
  const loops = [];
  const seen = new Set();
  const LABEL = '"((?:[^"\\\\]|\\\\.)*)"';
  const nodeRe = new RegExp(`^(-?\\d+) \\[label=${LABEL}(.*)\\];?\\s*$`);
  const edgeRe = new RegExp(`^(-?\\d+) -> (-?\\d+)(?: \\[label=${LABEL})?`);
  for (const line of text.split("\n")) {
    let m = edgeRe.exec(line);
    if (m) {
      const e = { from: m[1], to: m[2], action: m[3] ? unescapeDot(m[3]).split("(")[0] : "" };
      const id = `${e.from} ${e.to} ${e.action}`;
      if (seen.has(id)) continue;
      seen.add(id);
      (e.from === e.to ? loops : edges).push(e);
      continue;
    }
    m = nodeRe.exec(line);
    if (m)
      nodes.set(m[1], {
        id: m[1],
        vars: parseState(unescapeDot(m[2])),
        init: /style\s*=\s*filled/.test(m[3]),
      });
  }
  if (nodes.size === 0)
    throw new Error("no states found; dump the graph with TLC -dump dot,actionlabels <file>");
  const missing = [...edges, ...loops].find((e) => !nodes.has(e.from) || !nodes.has(e.to));
  if (missing)
    throw new Error(
      `transition ${missing.from} -> ${missing.to} names a state the file does not define`,
    );
  if (edges.length > 0 && [...edges, ...loops].every((e) => !e.action))
    throw new Error(
      "the graph has no action names; dump it with TLC -dump dot,actionlabels <file>",
    );
  return { nodes, edges, loops };
}

export function parseTraces(text) {
  const traces = [];
  let invariant = null;
  let current = null;
  const lines = text.split("\n");
  const stateAt = (i) => {
    const body = [];
    while (i + 1 < lines.length && lines[i + 1].trim() !== "") body.push(lines[++i]);
    return [parseState(body.join("\n")), i];
  };
  for (let i = 0; i < lines.length; i++) {
    const line = lines[i];
    const inv = /^Error: Invariant (\S+) is violated( by the initial state:)?/.exec(line);
    if (inv) {
      invariant = inv[1];
      if (inv[2]) {
        const [vars, end] = stateAt(i);
        traces.push({ invariant, steps: [{ action: null, vars }] });
        i = end;
      }
      continue;
    }
    if (line.startsWith("Error: ") && !line.startsWith("Error: The behavior up to this point is"))
      invariant = null;
    const head = /^State (\d+): <([^\s>(]+)/.exec(line);
    if (!head) continue;
    const [vars, end] = stateAt(i);
    i = end;
    if (head[1] === "1") {
      current = invariant && { invariant, steps: [] };
      if (current) traces.push(current);
    }
    current?.steps.push({ action: head[2] === "Initial" ? null : head[2], vars });
  }
  return traces;
}

// TLC words a broken PROPERTY by its form: [](state predicate) as an invariant, [][A]_v as an
// action property, a bare state predicate, which TLC checks only in the initial states, as a
// property of the initial state, and any other formula as a temporal property.
export const BROKEN_PROPERTY =
  /^Error: (Invariant .+? is violated|Action property .+? is violated\.|Property .+? is violated by the initial state:|Temporal properties were violated\.)/m;

// With -continue, TLC prints "Model checking completed" even after broken invariants, and not
// when it stopped early.
export function tlcOutputWarning(text, file) {
  const lines = text.split("\n");
  const broken = [
    ...new Set(
      lines.map((l) => /^Error: Invariant (\S+) is violated/.exec(l)?.[1]).filter(Boolean),
    ),
  ];
  const reported =
    /^Error: (Invariant .+? is violated|Action property .+? is violated\.|Property .+? is violated by the initial state:|The behavior up to this point is|Temporal properties were violated\.|The following behavior constitutes a counter-example:)/;
  const other = lines.find((l) => l.startsWith("Error: ") && !reported.test(l));
  if (other && broken.length) {
    const thrown = /^The exception was a (\S+)\n: (?:([\w$]+(?:\.[\w$]+)+):)?(.*)$/m.exec(text);
    const error = thrown
      ? `${thrown[2] ?? thrown[1]}: ${thrown[3].trim()}`
      : other.slice(7).replace(/\.$/, "");
    const rules = joinAnd(broken);
    return `TLC found that ${rules} ${broken.length === 1 ? "is" : "are"} broken, and then stopped on an error: ${error}. The paths that TLC printed before it stopped are complete, but TLC did not check every state, so the charts can miss states that break ${rules}. A smaller constant can let TLC finish.`;
  }
  if (other)
    throw new Error(
      `${file}: TLC stopped on an error that is not a broken rule: ${other.slice(7)}`,
    );
  // TLC stops at the first broken temporal property, and at an initial state that breaks a
  // PROPERTY, and then does not print that it completed.
  if (
    !/^(Model checking completed\.|Error: (Temporal properties were violated\.|Property .+? is violated by the initial state:))/m.test(
      text,
    )
  )
    throw new Error(
      `${file}: TLC did not finish, so its counterexamples are not all there; read the file`,
    );
  return null;
}

export function wrap(text, width = 26) {
  const words = String(text).split(/\s+/);
  const rows = [];
  let row = "";
  for (const w of words) {
    if (row && (row + " " + w).length > width) {
      rows.push(row);
      row = w;
    } else row = row ? `${row} ${w}` : w;
  }
  if (row) rows.push(row);
  return rows.join("<br/>");
}

export const joinAnd = (items) =>
  items.length < 3 ? items.join(" and ") : `${items.slice(0, -1).join(", ")}, and ${items.at(-1)}`;

const OPENS_A_PHRASE = new Set(
  "a an the your my our their its this that to of in on at for with from by and or".split(" "),
);
export function joinLabels(labels) {
  if (labels.length < 2) return labels.join(" or ");
  const words = labels.map((l) => String(l).split(" "));
  let n = 0;
  while (words.every((w) => n < w.length - 1 && w[n] === words[0][n])) n++;
  while (n > 0 && OPENS_A_PHRASE.has(words[0][n - 1])) n--;
  if (n < 2) return labels.join(" or ");
  const rest = words.map((w) => w.slice(n).join(" "));
  const list =
    rest.length === 2 ? rest.join(" or ") : `${rest.slice(0, -1).join(", ")}, or ${rest.at(-1)}`;
  return `${words[0].slice(0, n).join(" ")} ${list}`;
}

const unwrap = (s) =>
  s
    .replace(/<br\s*\/?>|#160;/g, " ")
    .replace(/#(quot|34);/g, '"')
    .replace(/\s+/g, " ")
    .trim();

export const escapeMermaidQuotes = (s) => String(s).replaceAll('"', "#quot;");

export const LEGEND_ID = "legend";
export const FULL_LABELS = "%% labels in full";
export const NO_LOOPS = "%% self-loops left out";
export const BROKEN_MARK = "statechart broken";

export function parseMermaid(text) {
  const names = new Map();
  const nevers = [];
  let last = null;
  const newPart = () => ({ children: [], transitions: [] });
  const root = { name: "", parts: [newPart()] };
  const stack = [root];
  const part = () => stack[stack.length - 1].parts.at(-1);
  const display = (id) => names.get(id) ?? id;
  const implicit = new Map();
  const declare = (id) => {
    const prev = implicit.get(id);
    if (prev)
      prev.children.splice(
        prev.children.findIndex((c) => c.name === id),
        1,
      );
    implicit.set(id, null);
  };
  const mention = (id) => {
    if (id === "[*]" || implicit.has(id)) return;
    part().children.push({ name: id, leaf: true });
    implicit.set(id, part());
  };
  const body = text.replace(/^\s*---[ \t]*\r?\n[^]*?\r?\n---[ \t]*(\r?\n|$)/, "");
  for (const raw of body.split("\n")) {
    const line = raw.trim().replace(/(\[\*\]|[A-Za-z_]\w*):::[\w-]+/g, "$1");
    const when = /^%%\s*when\s+(not\s+)?(.+)$/.exec(line);
    if (when) {
      if (!last) throw new Error(`a %% when line must come right after a transition: ${line}`);
      if (!last.words)
        throw new Error(
          `the guarded step "${last.label}" must end its label with the guard's words in [ ]`,
        );
      last.when = { not: Boolean(when[1]), ids: when[2].split(",").map((s) => s.trim()) };
      last = null;
      continue;
    }
    last = null;
    const never = /^%%\s*never\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.+?)(?:\s+--\s+(.*))?$/.exec(line);
    if (never) {
      nevers.push({
        name: never[1],
        states: never[2].split("&").map((s) => s.trim()),
        sentence: never[3] ?? "",
      });
      continue;
    }
    if (
      !line ||
      line.startsWith("%%") ||
      /^(stateDiagram|direction|classDef|class |note)/.test(line)
    )
      continue;
    let m = /^state\s+"([^"]*)"\s+as\s+([A-Za-z_]\w*)\s*(\{)?\s*$/.exec(line);
    if (!m) {
      const plain = /^state\s+([A-Za-z_]\w*)\s*(\{)?\s*$/.exec(line);
      if (plain) m = [line, null, plain[1], plain[2]];
    }
    if (m) {
      if (m[1] !== null && !names.has(m[2])) names.set(m[2], unwrap(m[1]));
      declare(m[2]);
      if (m[3]) {
        const node = { name: m[2], parts: [newPart()] };
        part().children.push(node);
        stack.push(node);
      } else part().children.push({ name: m[2], leaf: true });
      continue;
    }
    if (line === "}") {
      if (stack.length === 1) throw new Error("unmatched } in the chart");
      stack.pop();
      continue;
    }
    if (line === "--") {
      stack[stack.length - 1].parts.push(newPart());
      continue;
    }
    m = /^(\[\*\]|[A-Za-z_]\w*)\s*-->\s*(\[\*\]|[A-Za-z_]\w*)(?:\s*:\s*(.*))?$/.exec(line);
    if (m) {
      if (m[2] === "[*]" && m[1] !== "[*]")
        throw new Error(
          `cannot read final state in "${line}"; draw the step to the state the reader sees next`,
        );
      mention(m[1]);
      mention(m[2]);
      const said = m[3] ? unwrap(m[3]) : "";
      const label = said.replace(/\s*\[[^\]]*\]/g, "");
      last = { from: m[1], to: m[2], label, words: label !== said };
      part().transitions.push(last);
      continue;
    }
    m = /^([A-Za-z_]\w*)\s*:\s*(.*)$/.exec(line);
    if (m) {
      if (!names.has(m[1])) names.set(m[1], unwrap(m[2]));
      if (implicit.get(m[1]) === null) continue;
      declare(m[1]);
      part().children.push({ name: m[1], leaf: true });
      continue;
    }
    throw new Error(`cannot read chart line: ${line}`);
  }
  if (stack.length !== 1) throw new Error("the chart has an unclosed {");
  if (root.parts.length > 1)
    throw new Error(
      "the chart has -- outside a composite; to make parallel regions, split one top-level composite with --",
    );

  function region(p) {
    const out = { states: new Set(), initial: new Set(), transitions: [] };
    const info = new Map();
    const declaredInRegion = new Set();
    (function collect(q) {
      for (const c of q.children) {
        if (c.name === LEGEND_ID) continue;
        declaredInRegion.add(c.name);
        if (!c.leaf) for (const sub of c.parts) collect(sub);
      }
    })(p);
    const transitions = [];
    const lookup = (id) => {
      const found = info.get(id);
      if (!found) throw new Error(`transition names ${id}, which is not in this region`);
      return found;
    };
    function states(q, prefix, depth) {
      const local = q.children.filter((c) => c.name !== LEGEND_ID);
      for (const t of q.transitions) {
        for (const end of [t.from, t.to]) {
          if (end === "[*]" || declaredInRegion.has(end)) continue;
          declaredInRegion.add(end);
          local.push({ name: end, leaf: true });
        }
      }
      const all = [];
      for (const c of local) {
        if (info.has(c.name)) {
          if (local.indexOf(c) !== local.findIndex((x) => x.name === c.name)) continue;
          throw new Error(`state id ${c.name} is declared in two places`);
        }
        const full = `${prefix}${display(c.name)}`;
        if (c.leaf) {
          if (out.states.has(full))
            throw new Error(`two states have the caption "${full}"; give each its own caption`);
          out.states.add(full);
          info.set(c.name, { all: [full], initial: [full], depth });
          all.push(full);
          continue;
        }
        if (c.parts.length > 1)
          throw new Error(
            `${display(c.name)} splits into regions below the top level; make each region a top-level region`,
          );
        const inner = states(c.parts[0], `${full}.`, depth + 1);
        const initial = c.parts[0].transitions
          .filter((t) => t.from === "[*]")
          .flatMap((t) => lookup(t.to).initial);
        if (initial.length === 0)
          throw new Error(
            `${display(c.name)} has no [*] --> start, so a transition into it has nowhere to land`,
          );
        info.set(c.name, { all: inner, initial, depth });
        all.push(...inner);
      }
      for (const t of q.transitions) if (t.from !== "[*]" && t.to !== "[*]") transitions.push(t);
      return all;
    }
    states(p, "", 0);
    for (const t of p.transitions)
      if (t.from === "[*]") for (const s of lookup(t.to).initial) out.initial.add(s);
    transitions.sort((a, b) => lookup(b.from).depth - lookup(a.from).depth);
    const handled = new Set();
    let pending = [];
    let depth = null;
    for (const t of transitions) {
      const from = lookup(t.from);
      if (from.depth !== depth) {
        for (const h of pending) handled.add(h);
        pending = [];
        depth = from.depth;
      }
      for (const f of from.all) {
        const key = `${f}\u0000${t.label}`;
        if (t.label && handled.has(key)) continue;
        for (const to of lookup(t.to).initial)
          out.transitions.push({
            from: f,
            to,
            label: t.label,
            ...(t.when ? { when: t.when } : {}),
          });
        if (t.label) pending.push(key);
      }
    }
    return [out, info];
  }

  const owners = new Map();
  const regions = {};
  const top = root.parts[0];
  const machine = top.children.filter((c) => c.name !== LEGEND_ID);
  const parallel =
    machine.length === 1 &&
    !machine[0].leaf &&
    machine[0].parts.length > 1 &&
    top.transitions.every((t) => t.from === "[*]");
  if (parallel) {
    for (const p of machine[0].parts) {
      const [only] = p.children;
      const holder =
        p.children.length === 1 &&
        !only.leaf &&
        p.transitions.every((t) => t.from === "[*]" && t.to === only.name)
          ? only
          : null;
      if (holder && holder.parts.length > 1)
        throw new Error(`${display(holder.name)} splits into regions below the top level`);
      const name = holder ? display(holder.name) : `Region${Object.keys(regions).length + 1}`;
      const [r, ids] = region(holder ? holder.parts[0] : p);
      regions[name] = r;
      for (const [id, { all }] of ids) owners.set(id, { name, all });
    }
  } else {
    const [r, ids] = region(top);
    regions.Main = r;
    for (const [id, { all }] of ids) owners.set(id, { name: "Main", all });
  }
  for (const [name, r] of Object.entries(regions))
    for (const t of r.transitions) {
      if (!t.when) continue;
      if (!parallel)
        throw new Error("a %% when line guards a step on other regions, and the chart has none");
      const states = {};
      for (const id of t.when.ids) {
        const at = owners.get(id);
        if (!at)
          throw new Error(`a %% when line names ${id}, which is not a state id in the chart`);
        if (at.name === name)
          throw new Error(
            `a %% when line names ${display(id)}, which is in the step's own region; a guard reads other regions`,
          );
        states[at.name] = [...new Set([...(states[at.name] ?? []), ...at.all])].sort();
      }
      t.guard = { not: t.when.not, states };
      delete t.when;
    }
  return { regions, nevers };
}

function guardHolds(guard, at) {
  if (!guard) return true;
  const hits = Object.entries(guard.states).map(([r, states]) => states.includes(at[r]));
  return guard.not ? !hits.some(Boolean) : hits.every(Boolean);
}

export function productOf(regions, { loops = true } = {}) {
  const names = Object.keys(regions);
  const rs = Object.values(regions);
  const join = (parts) => parts.join(" | ");
  const byLabel = new Map();
  const unlabeled = [];
  rs.forEach((r, ri) => {
    for (const t of r.transitions) {
      if (!t.label) {
        unlabeled.push({ ri, from: t.from, to: t.to, guard: t.guard });
        continue;
      }
      if (!byLabel.has(t.label))
        byLabel.set(
          t.label,
          rs.map(() => new Map()),
        );
      const moves = byLabel.get(t.label)[ri];
      if (!moves.has(t.from)) moves.set(t.from, []);
      moves.get(t.from).push({ to: t.to, guard: t.guard });
    }
  });
  let starts = [[]];
  for (const r of rs) starts = starts.flatMap((p) => [...r.initial].map((s) => [...p, s]));
  const out = { states: new Set(), initial: new Set(starts.map(join)), transitions: [] };
  const seen = new Set(starts.map(join));
  const queue = [...starts];
  const step = (from, to, label) => {
    const [a, b] = [join(from), join(to)];
    if (a === b && !loops) return;
    out.transitions.push({ from: a, to: b, label });
    if (!seen.has(b)) {
      seen.add(b);
      queue.push(to);
    }
  };
  while (queue.length) {
    const cur = queue.shift();
    out.states.add(join(cur));
    const at = Object.fromEntries(names.map((n, ri) => [n, cur[ri]]));
    for (const u of unlabeled) {
      if (cur[u.ri] !== u.from || !guardHolds(u.guard, at)) continue;
      const next = [...cur];
      next[u.ri] = u.to;
      step(cur, next, "");
    }
    for (const [label, perRegion] of byLabel) {
      const open = perRegion.map((moves, ri) =>
        (moves.get(cur[ri]) ?? []).filter((m) => guardHolds(m.guard, at)).map((m) => m.to),
      );
      if (open.every((tos) => tos.length === 0)) continue;
      let nexts = [[]];
      open.forEach((tos, ri) => {
        const options = tos.length ? [...new Set(tos)] : [cur[ri]];
        nexts = nexts.flatMap((p) => options.map((s) => [...p, s]));
      });
      for (const next of nexts) step(cur, next, label);
    }
  }
  return out;
}

export function compareCharts(expectedRegions, actualRegions, { loops = true } = {}) {
  const expected = productOf(expectedRegions, { loops });
  const actual = productOf(actualRegions, { loops });
  const edgeSet = (m) => {
    const labeled = new Set();
    const out = new Set();
    for (const t of m.transitions) {
      if (!t.label) continue;
      labeled.add(`${t.from} --> ${t.to}`);
      for (const l of t.label.split(" or ")) out.add(`${t.from} --> ${t.to} : ${l}`);
    }
    for (const t of m.transitions)
      if (!t.label && !labeled.has(`${t.from} --> ${t.to}`)) out.add(`${t.from} --> ${t.to}`);
    return out;
  };
  const minus = (a, b) => [...a].filter((x) => !b.has(x)).sort();
  const unreached = [];
  const regionEntries = Object.entries(expectedRegions);
  if (regionEntries.length === 1) {
    for (const s of regionEntries[0][1].states) if (!expected.states.has(s)) unreached.push(s);
  } else {
    regionEntries.forEach(([name, r], ri) => {
      const seen = new Set([...expected.states].map((s) => s.split(" | ")[ri]));
      for (const s of r.states) if (!seen.has(s)) unreached.push(`${name}: ${s}`);
    });
  }
  return [
    ["states the agreed chart's own steps never reach", unreached.sort()],
    [
      "states only in EXPECTED (no path from the start reaches them in the spec, or the spec renamed them)",
      minus(expected.states, actual.states),
    ],
    ["states only in ACTUAL", minus(actual.states, expected.states)],
    ["start states only in EXPECTED", minus(expected.initial, actual.initial)],
    ["start states only in ACTUAL", minus(actual.initial, expected.initial)],
    [
      "transitions only in EXPECTED (a guard in the spec blocks them, or the spec renamed the step)",
      minus(edgeSet(expected), edgeSet(actual)),
    ],
    ["transitions only in ACTUAL", minus(edgeSet(actual), edgeSet(expected))],
  ].filter(([, xs]) => xs.length > 0);
}

export const STATUS_CLASSES = [
  "classDef works fill:#f4f6f7,stroke:#566573,color:#1b2631",
  "classDef wrong fill:#fdedec,stroke:#c0392b,color:#7b241c",
  "classDef fixed fill:#e9f7ef,stroke:#1e8449,color:#145a32",
  "classDef mixed fill:#fdebd0,stroke:#d35400,color:#7e5109",
  "classDef after fill:#ffffff,stroke:#808b96,color:#566573",
  "classDef worse fill:#f4ecf7,stroke:#7d3c98,color:#4a235a",
  "classDef worksPath fill:#f4f6f7,stroke:#1f3a93,stroke-width:4px,color:#1b2631",
  "classDef wrongPath fill:#fdedec,stroke:#1f3a93,stroke-width:4px,color:#7b241c",
  "classDef fixedPath fill:#e9f7ef,stroke:#1f3a93,stroke-width:4px,color:#145a32",
  "classDef mixedPath fill:#fdebd0,stroke:#1f3a93,stroke-width:4px,color:#7e5109",
  "classDef afterPath fill:#ffffff,stroke:#1f3a93,stroke-width:4px,color:#566573",
  "classDef worsePath fill:#f4ecf7,stroke:#1f3a93,stroke-width:4px,color:#4a235a",
];

export const GROUP_PALETTE = [
  "#d6eaf8",
  "#fdebd0",
  "#e8daef",
  "#fcf3cf",
  "#d1f2eb",
  "#ede0d4",
  "#f6e0ef",
];
export const PLAIN_FILL = "#f4f6f7";

const rgb = (hex) => {
  const h = hex.length === 4 ? [...hex.slice(1)].map((c) => c + c).join("") : hex.slice(1);
  return [0, 2, 4].map((i) => parseInt(h.slice(i, i + 2), 16));
};
function wcagRelativeLuminance(hex) {
  const [r, g, b] = rgb(hex).map((c) => {
    const s = c / 255;
    return s <= 0.03928 ? s / 12.92 : ((s + 0.055) / 1.055) ** 2.4;
  });
  return 0.2126 * r + 0.7152 * g + 0.0722 * b;
}
export function groupColorProblem(color) {
  if (typeof color !== "string" || !/^#([0-9a-f]{3}|[0-9a-f]{6})$/i.test(color))
    return 'is not "#rgb" or "#rrggbb"';
  if (wcagRelativeLuminance(color) < 0.5) return "is too dark for the status borders to show on it";
  return null;
}

const BORDERS = {
  Wrong: ["stroke:#c0392b,stroke-width:4px", "#7b241c"],
  Fixed: ["stroke:#1e8449,stroke-width:4px", "#145a32"],
  Mixed: ["stroke:#d35400,stroke-width:4px", "#7e5109"],
  After: ["stroke:#808b96,stroke-width:4px", "#566573"],
  Worse: ["stroke:#7d3c98,stroke-width:4px", "#4a235a"],
  Path: ["stroke:#1f3a93,stroke-width:4px", "#1b2631"],
};
export function groupClassDef(base, fill, border) {
  const darker = `#${rgb(fill)
    .map((c) =>
      Math.round(c / 2)
        .toString(16)
        .padStart(2, "0"),
    )
    .join("")}`;
  const [stroke, color] = BORDERS[border] ?? [
    `stroke:${fill === PLAIN_FILL ? "#566573" : darker}`,
    "#1b2631",
  ];
  return `classDef ${base}${border} fill:${fill},${stroke},color:${color}`;
}

import { isRecord, isTuple } from "./lib.mjs";

export function mapView(value, at = "v") {
  if (isRecord(value))
    return Object.fromEntries(Object.entries(value).map(([k, x]) => [k, mapView(x, `${at}.${k}`)]));
  if (!Array.isArray(value)) return value;
  if (isTuple(value))
    return tupleView(
      value.map((x, i) => mapView(x, `${at}[${i + 1}]`)),
      at,
    );
  return arrayView(value.map((x, i) => mapView(x, `${at}[${i}]`)));
}
const arrayView = (items) =>
  Object.defineProperties(items, {
    flat: { value: (depth = 1) => flatten(items, depth) },
    flatMap: { value: (f, self) => flatten(items.map(f, self), 1) },
  });
const views = new WeakMap();
const itemAt = (k) => (typeof k === "string" && /^[1-9]\d*$/.test(k) ? k - 1 : -1);
const flatten = (xs, depth) =>
  Array.prototype.flatMap.call(xs, (x) =>
    depth >= 1 && Array.isArray(x) ? flatten(views.get(x)?.items ?? x, depth - 1) : [x],
  );
function tupleView(items, at) {
  const view = new Proxy(items, {
    get(_, k) {
      if (k === "0")
        throw new Error(
          `the mapping reads ${at}[0], but a tuple reads from 1, as in TLA+. Read ${at}[1] for its first item.`,
        );
      const i = itemAt(k);
      if (i >= 0) return items[i];
      if (k === "toJSON") return () => items;
      if (k === "flat") return (depth = 1) => flatten(items, depth);
      if (k === "flatMap") return (f, self) => flatten(items.map(f, self), 1);
      const x = Reflect.get(items, k);
      if (typeof x !== "function") return x;
      return x.bind(x === Object.prototype[k] ? view : items);
    },
    set(_, k, x) {
      if (k === "0")
        throw new Error(
          `the mapping writes ${at}[0], but a tuple reads from 1, as in TLA+. Write ${at}[1] for its first item.`,
        );
      const i = itemAt(k);
      if (i < 0) return Reflect.set(items, k, x);
      items[i] = x;
      return true;
    },
    has(_, k) {
      if (k === "0")
        throw new Error(
          `the mapping looks for index 0 in ${at}, with "in" or with an array method such as concat or flat, but a tuple reads from 1, as in TLA+. Use [...${at}] for an array that reads from 0.`,
        );
      const i = itemAt(k);
      return i < 0 ? Reflect.has(items, k) : i in items;
    },
    ownKeys: () =>
      Reflect.ownKeys(items).map((k) =>
        typeof k === "string" && /^(0|[1-9]\d*)$/.test(k) ? String(+k + 1) : k,
      ),
    getOwnPropertyDescriptor(_, k) {
      if (k === "0") return undefined;
      const i = itemAt(k);
      return Reflect.getOwnPropertyDescriptor(items, i < 0 ? k : i);
    },
  });
  views.set(view, { items, at });
  return view;
}
const nativeClone = globalThis.structuredClone;
function cloneView(x, seen) {
  if (x === null || typeof x !== "object") return nativeClone(x);
  if (seen.has(x)) return seen.get(x);
  const view = views.get(x);
  if (!view && !Array.isArray(x) && Object.getPrototypeOf(x) !== Object.prototype)
    return nativeClone(x);
  const out = view || Array.isArray(x) ? [] : {};
  const copy = view ? tupleView(out, view.at) : Array.isArray(x) ? arrayView(out) : out;
  seen.set(x, copy);
  for (const [k, item] of Object.entries(view?.items ?? x)) out[k] = cloneView(item, seen);
  return copy;
}
globalThis.structuredClone = (value, options) => {
  try {
    return nativeClone(value, options);
  } catch (e) {
    if (e?.name !== "DataCloneError") throw e;
    return cloneView(value, new Map());
  }
};

import fs from "node:fs";
import { joinAnd, parseDot, parseState, stateKey } from "./lib.mjs";
import { mapView } from "./map-view.mjs";

const TEMPORAL_BREAK = "Error: Temporal properties were violated.";

function lasso(tlcOutput) {
  const start = tlcOutput.lastIndexOf(TEMPORAL_BREAK);
  if (start < 0) return null;
  const lines = tlcOutput.slice(start).split("\n");
  const states = [];
  for (let i = 0; i < lines.length; i++) {
    const back = /^Back to state (\d+): /.exec(lines[i]);
    if (back) return { loop: states.slice(Number(back[1]) - 1), stutters: false };
    const head = /^State \d+: (<|Stuttering)/.exec(lines[i]);
    if (!head) continue;
    if (head[1] === "Stuttering") return { loop: states.slice(-1), stutters: true };
    const body = [];
    while (i + 1 < lines.length && lines[i + 1].trim() !== "") body.push(lines[++i]);
    states.push(parseState(body.join("\n")));
  }
  return null;
}

const collapseRepeatsAroundLoop = (names) => {
  const runs = names.filter((name, i) => name !== names[i - 1]);
  return runs.length > 1 && runs.at(-1) === runs[0] ? runs.slice(0, -1) : runs;
};

export function repeatsIn(tlcOutput, nameOf) {
  const found = lasso(tlcOutput);
  return (
    found && { states: collapseRepeatsAroundLoop(found.loop.map(nameOf)), stutters: found.stutters }
  );
}

function enabledByState({ nodes, edges, loops }) {
  const byId = new Map([...nodes.keys()].map((id) => [id, new Set()]));
  for (const e of [...edges, ...loops]) byId.get(e.from).add(e.action);
  return new Map([...nodes.values()].map((n) => [stateKey(n.vars), byId.get(n.id)]));
}

export function readerStateNamer(mapping, dotFile) {
  const readerActions = new Set(mapping.readerActions ?? []);
  let enabledAt;
  return (vars) => {
    enabledAt ??= enabledByState(parseDot(fs.readFileSync(dotFile, "utf8")));
    const enabled = enabledAt.get(stateKey(vars)) ?? new Set();
    const settled = [...enabled].every((a) => readerActions.has(a));
    return String(mapping.state(mapView(vars), { enabled, settled }));
  };
}

export function loopSentence(repeats) {
  if (!repeats) return null;
  const quoted = repeats.states.map((name) => `"${name}"`);
  if (repeats.stutters) return `The run stops in ${quoted[0]} forever.`;
  if (quoted.length === 1) return `The run stays in ${quoted[0]} forever.`;
  return `The run loops through ${joinAnd(quoted)} forever.`;
}

import { isRecord } from "./lib.mjs";
import { SEP } from "./chart-parts.mjs";

const kindOf = (v) => (isRecord(v) ? "record" : Array.isArray(v) ? "list" : typeof v);
function shapeOf(graph, traces) {
  const shape = new Map();
  const walk = (o, path) => {
    for (const [k, v] of Object.entries(o)) {
      const p = [...path, k];
      const id = p.join(SEP);
      if (!shape.has(id)) shape.set(id, { path: p, kinds: new Set() });
      shape.get(id).kinds.add(kindOf(v));
      if (isRecord(v)) walk(v, p);
    }
  };
  for (const n of graph.nodes.values()) walk(n.vars, []);
  for (const t of traces) for (const s of t.steps) walk(s.vars, []);
  return shape;
}
const disjoint = (a, b) => ![...b.kinds].some((k) => a.kinds.has(k));
const foreign = (a, b) => [...b.kinds].some((k) => !a.kinds.has(k));
function lacking(a, b) {
  const out = [];
  for (const [id, x] of a) {
    const within = out.some((p) => id.startsWith(`${p.join(SEP)}${SEP}`));
    if (!within && (!b.has(id) || disjoint(x, b.get(id)))) out.push(x.path);
  }
  return out;
}
const unreadOf = (a, b) =>
  [...a].flatMap(([id, x]) =>
    !b.has(id) || foreign(x, b.get(id)) ? [{ ...x, somewhere: b.has(id) }] : [],
  );
function guard(vars, unread, label, at = "v") {
  if (!unread.length || !isRecord(vars)) return vars;
  const here = new Map();
  const deeper = new Map();
  for (const { path, ...x } of unread) {
    const [k, ...rest] = path;
    if (!rest.length) here.set(k, x);
    else deeper.set(k, [...(deeper.get(k) ?? []), { ...x, path: rest }]);
  }
  const check = (target, k, listing) => {
    const x = here.get(k);
    const absent = !Object.hasOwn(target, k);
    if (!x || (absent ? x.somewhere : x.kinds.has(kindOf(target[k])))) return;
    const name = `${at}.${k}`.slice(2);
    const has = absent ? `no ${name}` : `${name} as a value of another type`;
    const does = listing ? `lists the fields of ${at}` : `reads ${at}.${k}`;
    const hint = listing
      ? ", and read the fields it needs by name"
      : absent
        ? `, or test "${k}" in ${at} first`
        : "";
    throw new Error(
      `${label} has ${has}, and the mapping ${does} on its states. Label states and steps only from what both models have${hint}.`,
    );
  };
  return new Proxy(vars, {
    get(target, k) {
      check(target, k, false);
      return deeper.has(k) ? guard(target[k], deeper.get(k), label, `${at}.${k}`) : target[k];
    },
    ownKeys(target) {
      for (const k of here.keys()) check(target, k, true);
      return Reflect.ownKeys(target);
    },
  });
}

export function readCheck({ graph, rawTraces, secondGraph, rawSecondTraces, L }) {
  const [a, b] = [shapeOf(graph, rawTraces), shapeOf(secondGraph, rawSecondTraces)];
  const unread = unreadOf(a, b);
  return {
    lacks: lacking(a, b),
    extra: lacking(b, a),
    guard: (vars) => guard(vars, unread, L),
  };
}

import fs from "node:fs";
import {
  NO_LOOPS,
  compareCharts,
  escapeMermaidQuotes,
  parseMermaid,
  productOf,
  wrap,
} from "./lib.mjs";
import { SEP, addGuard, frontMatter, guarded } from "./chart-parts.mjs";
import { RANK, diverges, worst } from "./bug-states.mjs";
import { edgesAlong } from "./chart-edges.mjs";

export function regionsChart({
  states,
  starts,
  edges,
  loops,
  classes,
  proofPath,
  allPath,
  mapping,
  status,
  LEGEND,
  groupOf,
  drawnState,
  groupCounts,
  head,
}) {
  const norm = (s) => s.replaceAll(";", ",").replace(/\s+/g, " ").trim();
  const split = (k) => {
    const at = k.indexOf(": ");
    return at > 0 && at + 2 < k.length ? [norm(k.slice(0, at)), norm(k.slice(at + 2))] : null;
  };
  const nodes = [...states].sort();
  if (!nodes.every(split)) return null;
  const steps = [];
  for (const e of edges.values()) {
    if (e.labels.size === 0) return { why: "a step has no label" };
    for (const l of e.labels)
      steps.push({
        from: split(e.from),
        to: split(e.to),
        label: norm(l),
        words: e.guards?.get(l) ?? new Set([""]),
      });
  }
  const bar = (p) => p.join(" | ");
  const flat = {
    Main: {
      states: new Set(nodes.map((k) => bar(split(k)))),
      initial: new Set(starts.map((k) => bar(split(k)))),
      transitions: steps.map((s) => ({ from: bar(s.from), to: bar(s.to), label: s.label })),
    },
  };
  const ids = new Map([...flat.Main.states].map((s, i) => [s, `p${i}`]));
  const proof = [
    ...frontMatter(),
    "stateDiagram-v2",
    ...(loops ? [] : [`  ${NO_LOOPS}`]),
    ...[...ids].map(([s, id]) => `  state "${escapeMermaidQuotes(s)}" as ${id}`),
    ...[...flat.Main.initial].map((s) => `  [*] --> ${ids.get(s)}`),
    ...steps.map((s) => `  ${ids.get(bar(s.from))} --> ${ids.get(bar(s.to))} : ${s.label}`),
  ];
  if (proofPath) fs.writeFileSync(proofPath, proof.join("\n") + "\n");

  const beside = [new Map(), new Map()];
  for (const k of nodes) {
    const p = split(k);
    for (const i of [0, 1]) {
      if (!beside[i].has(p[i])) beside[i].set(p[i], new Set());
      beside[i].get(p[i]).add(p[1 - i]);
    }
  }
  const size = beside[0].size + beside[1].size;
  if (size >= nodes.length)
    return { why: `${size} region states are not fewer than the ${nodes.length} flat states` };

  const regionStatus = [new Map(), new Map()];
  for (const k of nodes) {
    const p = split(k);
    for (const i of [0, 1]) {
      const prev = regionStatus[i].get(p[i]);
      if (!prev || RANK.indexOf(status(k)) < RANK.indexOf(prev))
        regionStatus[i].set(p[i], status(k));
    }
  }
  for (const k of nodes) {
    const p = split(k);
    const shown = worst(...[0, 1].map((i) => regionStatus[i].get(p[i])));
    if (shown !== status(k))
      return {
        why: `"${k}" is "${LEGEND[status(k)][1]}", and its two region states would show "${LEGEND[shown][1]}"`,
      };
  }

  const moves = [new Map(), new Map()];
  for (const s of steps)
    for (const i of [0, 1]) {
      const id = [s.from[i], s.label, s.to[i]].join(SEP);
      if (!moves[i].has(id))
        moves[i].set(id, {
          from: s.from[i],
          label: s.label,
          to: s.to[i],
          beside: new Set(),
          guards: new Map(),
        });
      moves[i].get(id).beside.add(s.from[1 - i]);
      for (const w of s.words) addGuard(moves[i].get(id).guards, s.label, norm(w));
    }
  for (const m of moves)
    for (const [id, x] of m)
      if (
        x.from === x.to &&
        ![...m.values()].some((y) => y.from === x.from && y.label === x.label && y.to !== x.from)
      )
        m.delete(id);
  const rid = beside.map((m, i) => new Map([...m.keys()].sort().map((s, j) => [s, `r${i}s${j}`])));
  const regionGroup = [new Map(), new Map()];
  for (const k of nodes) {
    const p = split(k);
    for (const i of [0, 1]) {
      const prev = regionGroup[i].get(p[i]);
      regionGroup[i].set(p[i], prev === undefined || prev === groupOf(k) ? groupOf(k) : "");
    }
  }
  const drawn = rid.map((m, i) =>
    [...m.keys()].map((s) => drawnState(regionGroup[i].get(s), regionStatus[i].get(s))),
  );
  const draw = (only) => {
    const out = head(drawn.flat());
    out.push(`  state "At the same time" as regions {`);
    let count = 0;
    for (const i of [0, 1]) {
      if (i) out.push("    --");
      const name = mapping.regionNames?.[i];
      const pad = name ? "      " : "    ";
      if (name) out.push(`    state "${escapeMermaidQuotes(wrap(name))}" as region${i} {`);
      for (const s of new Set(starts.map((k) => split(k)[i])))
        out.push(`${pad}[*] --> ${rid[i].get(s)}`);
      for (const [s, id] of rid[i])
        out.push(`${pad}state "${escapeMermaidQuotes(wrap(s))}" as ${id}`);
      const shownMoves = [...moves[i]]
        .filter(([id]) => !only || only[i].has(id))
        .map(([, m]) => m)
        .sort((a, b) => a.from.localeCompare(b.from) || a.label.localeCompare(b.label));
      for (const m of shownMoves) {
        const all = beside[i].get(m.from);
        const not = [...all].filter((s) => !m.beside.has(s)).sort();
        const yes = [...m.beside].sort();
        const unless = not.length > 0 && not.length < yes.length;
        const guard = not.length === 0 ? null : unless ? not : yes;
        const worded = guarded(m.guards, m.label);
        const text =
          worded !== m.label || !guard
            ? worded
            : `${m.label} [${unless ? "unless" : "when"} ${guard.join(" or ")}]`;
        out.push(`${pad}${rid[i].get(m.from)} --> ${rid[i].get(m.to)} : ${wrap(text, 30)}`);
        if (guard)
          out.push(
            `${pad}%% when ${unless ? "not " : ""}${guard.map((s) => rid[1 - i].get(s)).join(", ")}`,
          );
        count++;
      }
      if (name) out.push("    }");
    }
    out.push("  }");
    for (const i of [0, 1])
      [...rid[i].values()].forEach((id, j) => out.push(`  class ${id} ${drawn[i][j].cls}`));
    return { mermaid: out.join("\n") + "\n", count };
  };

  const all = draw(null);
  const differences = compareCharts(parseMermaid(all.mermaid).regions, flat, { loops });
  if (differences.length) {
    const n = differences.reduce((sum, [, xs]) => sum + xs.length, 0);
    return {
      why: `the regions do not combine into the flat chart, with ${n} difference(s), such as ${differences[0][0]}: ${differences[0][1][0]}`,
    };
  }
  if (allPath) fs.writeFileSync(allPath, all.mermaid);

  const parts = new Map(nodes.map((k) => [bar(split(k)), split(k)]));
  const key = (from, label, to) => `${from} --> ${to} : ${label}`;
  const real = new Set(steps.map((s) => key(bar(s.from), s.label, bar(s.to))));
  const next = new Map();
  for (const s of steps) {
    if (!next.has(bar(s.from))) next.set(bar(s.from), []);
    next.get(bar(s.from)).push(s);
  }
  const keep = [new Set(), new Set()];
  const movesOf = (s) =>
    [0, 1]
      .filter((i) => s.from[i] !== s.to[i])
      .map((i) => [i, [s.from[i], s.label, s.to[i]].join(SEP)]);
  const price = (s) => movesOf(s).filter(([i, id]) => !keep[i].has(id)).length * nodes.length + 1;
  const wanted = [];
  const want = (s) => {
    wanted.push(s);
    for (const [i, id] of movesOf(s)) keep[i].add(id);
  };
  const stepsOf = (e, said) => {
    const labels = [...e.labels].map(norm);
    return (labels.includes(said) ? [said] : labels).map((label) => ({
      from: split(e.from),
      to: split(e.to),
      label,
    }));
  };
  for (const c of classes) {
    for (const step of edgesAlong(c)) {
      const e = edges.get(step.id);
      if (e) stepsOf(e, norm(step.label)).forEach(want);
    }
    if (diverges(c)) stepsOf(edges.get(c.second.edge), "").forEach(want);
  }
  const cheapest = () => {
    const cost = new Map(starts.map((k) => [bar(split(k)), 0]));
    const parent = new Map();
    const open = new Set(cost.keys());
    while (open.size) {
      const k = [...open].reduce((a, b) => (cost.get(b) < cost.get(a) ? b : a));
      open.delete(k);
      for (const s of next.get(k) ?? []) {
        const c = cost.get(k) + price(s);
        if (c < (cost.get(bar(s.to)) ?? Infinity)) {
          cost.set(bar(s.to), c);
          parent.set(bar(s.to), s);
          open.add(bar(s.to));
        }
      }
    }
    return { cost, parent };
  };
  const targets = [
    ...[0, 1].flatMap((i) =>
      [...beside[i].keys()].sort().map((r) => ({ at: (k) => parts.get(k)[i] === r })),
    ),
    ...[...new Set(steps.map((s) => s.label))]
      .filter((l) => !wanted.some((s) => s.label === l))
      .sort()
      .map((l) => ({ ends: (s) => s.label === l })),
  ];
  while (targets.length) {
    const { cost, parent } = cheapest();
    let best = null;
    targets.forEach((t, n) => {
      const ways = t.at
        ? [...cost.keys()].filter(t.at).map((k) => ({ k, c: cost.get(k), last: null }))
        : steps
            .filter(t.ends)
            .filter((s) => cost.has(bar(s.from)))
            .map((s) => ({ k: bar(s.from), c: cost.get(bar(s.from)) + price(s), last: s }));
      for (const w of ways) if (!best || w.c < best.c) best = { ...w, n };
    });
    if (!best) break;
    targets.splice(best.n, 1);
    const path = best.last ? [best.last] : [];
    for (let s = parent.get(best.k); s; s = parent.get(bar(s.from))) path.push(s);
    path.forEach(want);
  }
  const takes = (x, label) =>
    [0, 1].flatMap((i) =>
      [...moves[i]]
        .filter(([, m]) => m.from === x[i] && m.label === label && m.beside.has(x[1 - i]))
        .map(([id]) => [i, id]),
    );
  let scoped;
  let made;
  for (;;) {
    scoped = draw(keep);
    made = productOf(parseMermaid(scoped.mermaid).regions, { loops });
    const madeKeys = new Set(made.transitions.map((t) => key(t.from, t.label, t.to)));
    const redo = [
      ...made.transitions
        .filter((t) => parts.has(t.from) && !real.has(key(t.from, t.label, t.to)))
        .map((t) => [parts.get(t.from), t.label]),
      ...wanted
        .filter((s) => made.states.has(bar(s.from)))
        .filter((s) => !madeKeys.has(key(bar(s.from), s.label, bar(s.to))))
        .map((s) => [s.from, s.label]),
    ];
    const before = keep[0].size + keep[1].size;
    for (const [x, label] of redo) for (const [i, id] of takes(x, label)) keep[i].add(id);
    if (keep[0].size + keep[1].size === before) break;
  }
  const sound =
    [...made.states].every((s) => parts.has(s)) &&
    made.transitions.every((t) => real.has(key(t.from, t.label, t.to)));
  if (!sound) scoped = all;

  return {
    mermaid: scoped.mermaid,
    states: [beside[0].size, beside[1].size],
    transitions: scoped.count,
    all: all.count,
    flat: { states: nodes.length, transitions: steps.length },
    status: Object.fromEntries(
      RANK.filter((s) => LEGEND[s]).map((s) => [
        s,
        regionStatus.reduce((n, m) => n + [...m.values()].filter((x) => x === s).length, 0),
      ]),
    ),
    groups: groupCounts(drawn.flat()),
  };
}

import { execFileSync, spawnSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import process from "node:process";
import { pathToFileURL } from "node:url";
import { GROUP_PALETTE, PLAIN_FILL } from "./lib.mjs";

export const PACKAGES = ["pele@1.8.0", "@resvg/resvg-js@2.6.2"];
export const CACHE_NAME = PACKAGES.map((p) => p.replace(/^@[^/]+\//, "").replace("@", "-")).join(
  "-",
);
const ENTRY = 'export { render } from "pele";\nexport { Resvg } from "@resvg/resvg-js";\n';

export const cacheDir = () =>
  path.join(
    process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache"),
    "statechart",
    CACHE_NAME,
  );

function install(dir) {
  fs.mkdirSync(path.dirname(dir), { recursive: true });
  const tmp = fs.mkdtempSync(`${dir}-`);
  try {
    fs.writeFileSync(path.join(tmp, "package.json"), '{ "private": true }\n');
    console.error(`Installing ${PACKAGES.join(" and ")} with npm in ${dir}. This happens once.`);
    const r = spawnSync(
      "npm",
      ["install", "--no-audit", "--no-fund", "--ignore-scripts", "--save-exact", ...PACKAGES],
      {
        cwd: tmp,
        encoding: "utf8",
        env: {
          ...process.env,
          PATH: `${path.dirname(process.execPath)}${path.delimiter}${process.env.PATH ?? ""}`,
        },
        shell: process.platform === "win32",
      },
    );
    if (r.status !== 0) {
      const said =
        r.error?.message ??
        (`${r.stderr ?? ""}${r.stdout ?? ""}`.trim().split("\n").slice(-20).join("\n") ||
          `npm install exited ${r.status}, with no output`);
      throw new Error(
        `cannot install ${PACKAGES.join(" and ")} with npm:\n${said.replace(/^/gm, "  ")}`,
      );
    }
    fs.writeFileSync(path.join(tmp, "entry.mjs"), ENTRY);
    try {
      fs.renameSync(tmp, dir);
    } catch (e) {
      if (!fs.existsSync(path.join(dir, "entry.mjs"))) throw e;
    }
  } finally {
    fs.rmSync(tmp, { recursive: true, force: true });
  }
}

export async function loadRenderer() {
  const dir = cacheDir();
  const entry = path.join(dir, "entry.mjs");
  if (!fs.existsSync(entry)) install(dir);
  try {
    return await import(pathToFileURL(entry).href);
  } catch (e) {
    throw new Error(
      `cannot load Pele and resvg from ${dir}: ${e.message}\nDelete that folder to install them again.`,
    );
  }
}

const STYLE = { line: 1.5, text: 0.4, arrow: 1.25, zoom: 2 };
const MAX_PIXELS = 100_000_000;
const MARK = "2.5px";
const FONT = "system-ui, -apple-system, 'Segoe UI', Roboto, sans-serif";

export const THEMES = {
  light: {
    background: "#ffffff",
    stateFill: "#fcfcfc",
    stateBorder: "#c9c9c9",
    stateText: "#1c1c1c",
    edge: "#808080",
    edgeLabel: "#656565",
    region: { fill: "#f1f1f1", border: "#c9c9c9", text: "#1c1c1c" },
    groups: ["#c3e0ff", "#f0d3bf", "#e3d5ff", "#f0dcbf", "#bfe3df", "#e5d9ce", "#ffcbe6"],
    groupBorder: "#c9c9c9",
    wrong: { fill: "#ffecee", border: "#e72e3b", text: "#cd2834" },
    fixed: { fill: "#eaf9f2", border: "#10ab61" },
    mixed: { fill: "#fff3e6", border: "#e8730c", text: "#b85a06" },
    after: { fill: "#ffffff", border: "#9a9a9a", text: "#656565" },
    worse: { fill: "#f7edfd", border: "#9b35d6", text: "#8424b8" },
    path: "#1680f3",
  },
  dark: {
    background: "#1f1f1f",
    stateFill: "#121212",
    stateBorder: "#4e4e4e",
    stateText: "#f5f5f5",
    edge: "#939393",
    edgeLabel: "#acacac",
    region: { fill: "#2c2c2c", border: "#4e4e4e", text: "#f5f5f5" },
    groups: ["#1b3857", "#573117", "#3c2e57", "#573d17", "#174641", "#3d3127", "#57233e"],
    groupBorder: "#4e4e4e",
    wrong: { fill: "#2e2021", border: "#cf2b35", text: "#ff6463" },
    fixed: { fill: "#1e2a25", border: "#0e9f5a" },
    mixed: { fill: "#2e2619", border: "#d0700f", text: "#ffa257" },
    after: { fill: "#1f1f1f", border: "#6e6e6e", text: "#acacac" },
    worse: { fill: "#29202e", border: "#9a3fcf", text: "#d38cff" },
    path: "#116dd2",
  },
  classic: {
    background: "#ffffff",
    stateFill: PLAIN_FILL,
    stateBorder: "#566573",
    stateText: "#1b2631",
    edge: "#1f1f1f",
    edgeLabel: "#1f1f1f",
    region: { fill: "#e6e6e6", border: "#8a8a8a", text: "#1f1f1f" },
    groups: null,
    groupBorder: null,
    wrong: { fill: "#fadbd8", border: "#922b21", text: "#7b241c" },
    fixed: { fill: "#d5f5e3", border: "#196f3d" },
    mixed: { fill: "#fdebd0", border: "#d35400", text: "#7e5109" },
    after: { fill: "#ffffff", border: "#808b96", text: "#566573" },
    worse: { fill: "#ebdef0", border: "#6c3483", text: "#4a235a" },
    path: "#1f3a93",
  },
};

const hex6 = (c) => {
  const m = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(c?.trim() ?? "");
  if (!m) return null;
  const h = m[1].toLowerCase();
  return `#${h.length === 3 ? [...h].map((x) => x + x).join("") : h}`;
};
const rgb = (hex) => [1, 3, 5].map((i) => parseInt(hex.slice(i, i + 2), 16));
const lab = (hex) => {
  const [r, g, b] = rgb(hex).map((c) =>
    (c /= 255) <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4,
  );
  const f = (t) => (t > 0.008856 ? Math.cbrt(t) : 7.787 * t + 16 / 116);
  const [x, y, z] = [
    (0.4124 * r + 0.3576 * g + 0.1805 * b) / 0.95047,
    0.2126 * r + 0.7152 * g + 0.0722 * b,
    (0.0193 * r + 0.1192 * g + 0.9505 * b) / 1.08883,
  ].map(f);
  return [116 * y - 16, 500 * (x - y), 200 * (y - z)];
};
const deltaE = (a, b) => Math.hypot(...lab(a).map((v, i) => v - lab(b)[i]));

const STATE_CLASS =
  /^(plain|group\d+|works|wrong|fixed|mixed|after|worse)(Wrong|Fixed|Mixed|After|Worse|Path)?$/;
const CLASS_DEF = /^(\s*classDef\s+)(\w+)\s+(\S+?)\s*$/gm;
const rawFill = (body) => /(?:^|,)fill:([^,]+)/.exec(body)?.[1];
const STATUSES = ["wrong", "fixed", "mixed", "after", "worse"];

function markOf(name) {
  const m = STATE_CLASS.exec(name);
  if (!m) return null;
  const [, base, mark = ""] = m;
  const own = mark.toLowerCase();
  if (STATUSES.includes(own)) return own;
  return STATUSES.includes(base) ? base : own;
}

function paletteSlots(fills) {
  const slot = new Map();
  const taken = new Set();
  for (const f of fills) {
    const k = GROUP_PALETTE.indexOf(f);
    if (k >= 0) {
      slot.set(f, k);
      taken.add(k);
    }
  }
  const all = GROUP_PALETTE.map((_, k) => k);
  for (const f of fills) {
    if (f === PLAIN_FILL || slot.has(f)) continue;
    const free = all.filter((k) => !taken.has(k));
    const [k] = (free.length ? free : all).sort(
      (a, b) => deltaE(f, GROUP_PALETTE[a]) - deltaE(f, GROUP_PALETTE[b]),
    );
    slot.set(f, k);
    taken.add(k);
  }
  return slot;
}

const marked = ({ fill, border, text }) =>
  `fill:${fill},stroke:${border},stroke-width:${MARK},color:${text}`;
const STYLES = {
  wrong: ({ wrong }) => marked(wrong),
  mixed: ({ mixed }) => marked(mixed),
  after: ({ after }) => marked(after),
  worse: ({ worse }) => marked(worse),
  fixed: ({ fixed: f, stateText }) =>
    `fill:${f.fill},stroke:${f.border},stroke-width:${MARK},color:${stateText}`,
  path: ({ path, stateText }, fill) =>
    `${fill ? `fill:${fill},` : ""}stroke:${path},stroke-width:${MARK},color:${stateText}`,
  "": ({ groups, stateFill, stateBorder, groupBorder, stateText }, fill) =>
    groups &&
    `${fill ? `fill:${fill},` : ""}stroke:${fill === stateFill ? stateBorder : groupBorder},color:${stateText}`,
};

function themed(src, theme) {
  const own = new Set();
  for (const [, , name, body] of src.matchAll(CLASS_DEF)) {
    const fill = hex6(rawFill(body));
    if (fill && (markOf(name) === "" || markOf(name) === "path")) own.add(fill);
  }
  const slot = paletteSlots([...own]);
  const fillFor = (body) => {
    const raw = rawFill(body);
    const fill = hex6(raw);
    if (!theme.groups || !fill) return raw;
    if (fill === PLAIN_FILL) return theme.stateFill;
    return slot.has(fill) ? theme.groups[slot.get(fill)] : raw;
  };
  return src.replace(CLASS_DEF, (line, head, name, body) => {
    const mark = markOf(name);
    const style = mark === null ? null : STYLES[mark](theme, fillFor(body));
    return style ? `${head}${name} ${style}` : line;
  });
}

function withRootDirection(src) {
  const lines = src.split("\n");
  let at = -1;
  let depth = 0;
  let regions = false;
  let direction = false;
  for (const [i, line] of lines.entries()) {
    const code = line
      .replace(/"[^"]*"/g, '""')
      .replace(/:.*$/, "")
      .trim();
    if (at < 0) {
      if (/^stateDiagram/.test(code)) at = i;
      continue;
    }
    if (code.startsWith("%%")) continue;
    if (code === "--") regions = true;
    if (depth === 0 && /^direction\s/.test(code)) direction = true;
    depth += (code.match(/\{/g) ?? []).length - (code.match(/\}/g) ?? []).length;
  }
  if (at < 0 || !regions || direction) return src;
  lines.splice(at + 1, 0, "  direction LR");
  return lines.join("\n");
}

const SYSTEM_KEYWORD = /^(system-ui|-apple-system|BlinkMacSystemFont|ui-sans-serif)$/i;

export function fcMatch(pattern) {
  try {
    const [file, name] = execFileSync("fc-match", ["-f", "%{file}\n%{family[0]}", pattern], {
      encoding: "utf8",
      stdio: ["ignore", "pipe", "ignore"],
    }).split("\n");
    return file ? { file, name } : null;
  } catch {
    return null;
  }
}

let systemFont;
export function systemFamily() {
  if (systemFont === undefined) systemFont = fcMatch("system-ui")?.name ?? null;
  return systemFont;
}

function pngStack(sys) {
  if (!sys) return FONT;
  const names = FONT.split(",")
    .map((f) => f.trim().replace(/^'|'$/g, ""))
    .map((f) => (SYSTEM_KEYWORD.test(f) ? sys : f));
  return [...new Set(names)].map((f) => (/^[\w-]+$/.test(f) ? f : `'${f}'`)).join(", ");
}

const xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");

const measurers = new Map();
export function fontMeasurer(Resvg, family) {
  if (measurers.has(family)) return measurers.get(family);
  const ink = (face, text, size, style) => {
    const svg =
      `<svg xmlns="http://www.w3.org/2000/svg" width="4000" height="200"><text x="10" y="100" font-size="${size}"` +
      ` font-family="'${face.name}'"${style & 1 ? ' font-weight="bold"' : ""}${style & 2 ? ' font-style="italic"' : ""}` +
      ` xml:space="preserve">${xml(text)}</text></svg>`;
    const font = face.file
      ? { loadSystemFonts: false, fontFiles: [face.file] }
      : { loadSystemFonts: true };
    return new Resvg(svg, { font }).getBBox()?.width;
  };
  const draws = (face, style) => ink(face, "x", 16, style) > 0;
  const matchFace = (style) => {
    const name = style & 4 ? "monospace" : family;
    return fcMatch(`${name}${style & 1 ? ":bold" : ""}${style & 2 ? ":italic" : ""}`) ?? { name };
  };
  const regular = matchFace(0);
  if (!draws(regular, 0)) {
    measurers.set(family, null);
    return null;
  }
  const faces = new Map([[0, regular]]);
  const faceFor = (style) => {
    if (!faces.has(style)) {
      const face = matchFace(style);
      faces.set(style, draws(face, style) ? face : regular);
    }
    return faces.get(style);
  };
  const widths = new Map();
  const bars = new Map();
  const measurer = {
    width(text, size, style = 0) {
      const key = `${size}|${style}|${text}`;
      if (!widths.has(key)) {
        const face = faceFor(style);
        const bar = `${size}|${style}`;
        if (!bars.has(bar)) bars.set(bar, ink(face, "||", size, style));
        widths.set(key, text ? ink(face, `|${text}|`, size, style) - bars.get(bar) : 0);
      }
      return widths.get(key);
    },
  };
  measurers.set(family, measurer);
  return measurer;
}

const STATE_PAD = 16;
const DEFAULT_WRAP = 200;
const labelLines = (src) =>
  [...src.matchAll(/^\s*state "([^"]+)" as|^[^%\n]*-->[^:\n]*:\s*([^\n]+)$/gm)]
    .flatMap((m) => (m[1] ?? m[2]).split(/<br\s*\/?>/))
    .map((l) => l.trim())
    .filter((l) => l && !/["\\]/.test(l));

function widthRatio(render, src, measurer) {
  const lines = [...new Set(labelLines(src))];
  if (!lines.length) return 1;
  const probe = `---\nconfig:\n  state:\n    wrappingWidth: 2000\n---\nstateDiagram-v2\n${lines.map((l, i) => `  state "${l}" as p${i}`).join("\n")}\n`;
  const builtin = new Map(
    [...render(probe).svg.matchAll(/data-id="p(\d+)"[^>]*><rect\b[^>]*\swidth="([\d.]+)"/g)].map(
      ([, i, w]) => [lines[+i], +w - 2 * STATE_PAD],
    ),
  );
  const sum = (f) => lines.reduce((s, l) => s + f(l), 0);
  return (
    sum((l) => measurer.width(l, 16, 0)) / sum((l) => builtin.get(l) ?? measurer.width(l, 16, 0))
  );
}

function setWrap(src, width) {
  const fm = /^---\n([\s\S]*?\n)---\n/.exec(src);
  if (!fm) return `---\nconfig:\n  state:\n    wrappingWidth: ${width}\n---\n${src}`;
  let body = fm[1];
  if (/^ {4}wrappingWidth:.*$/m.test(body))
    body = body.replace(/^ {4}wrappingWidth:.*$/m, `    wrappingWidth: ${width}`);
  else if (/^ {2}state:\n/m.test(body))
    body = body.replace(/^( {2}state:\n)/m, `$1    wrappingWidth: ${width}\n`);
  else if (/^config:\n/m.test(body))
    body = body.replace(/^(config:\n)/m, `$1  state:\n    wrappingWidth: ${width}\n`);
  else body += `config:\n  state:\n    wrappingWidth: ${width}\n`;
  return `---\n${body}---\n${src.slice(fm[0].length)}`;
}
const wrapOf = (src) =>
  +(/^---\n[\s\S]*?^ {4}wrappingWidth:\s*(\d+)[\s\S]*?^---$/m.exec(src)?.[1] ?? DEFAULT_WRAP);

const toHex = (c) => `#${c.map((v) => Math.round(v).toString(16).padStart(2, "0")).join("")}`;

function splitTop(s) {
  const out = [];
  let depth = 0;
  let cur = "";
  for (const ch of s) {
    if (ch === "(") depth++;
    if (ch === ")") depth--;
    if (ch === "," && depth === 0) {
      out.push(cur);
      cur = "";
    } else cur += ch;
  }
  out.push(cur);
  return out.map((x) => x.trim());
}

function resolveCss(svg) {
  const defs = new Map();
  for (const m of svg.matchAll(/(--[\w-]+)\s*:\s*([^;"}]+)/g))
    if (!defs.has(m[1])) defs.set(m[1], m[2].trim());
  const resolve = (value) => {
    let changed = true;
    while (changed) {
      changed = false;
      value = value.replace(
        /var\((--[\w-]+)\s*(?:,\s*((?:[^()]|\([^()]*\))*))?\)/g,
        (_, name, fallback) => {
          changed = true;
          const d = defs.get(name);
          if (d !== undefined && d !== `var(${name})`) return resolve(d);
          return fallback !== undefined ? fallback : "currentColor";
        },
      );
      value = value.replace(/color-mix\(\s*in srgb\s*,((?:[^()]|\([^()]*\))*)\)/g, (_, args) => {
        changed = true;
        const [a, b] = splitTop(args);
        const pa = /(.*?)\s+([\d.]+)%$/.exec(a);
        const ca = hex6(pa ? pa[1] : a);
        const cb = hex6(b.replace(/\s+[\d.]+%$/, ""));
        const p = pa ? Number(pa[2]) / 100 : 0.5;
        if (!ca || !cb) return pa ? pa[1] : a;
        const [x, y] = [rgb(ca), rgb(cb)];
        return toHex(x.map((v, i) => v * p + y[i] * (1 - p)));
      });
    }
    return value;
  };
  for (const [k, v] of defs) defs.set(k, resolve(v));
  return resolve(svg.replace(/@import[^;]+;/g, ""));
}

function themeSvg(svg, theme) {
  const vars =
    `--pele-bg:${theme.background};--pele-fg:${theme.region.text};--pele-muted:${theme.edgeLabel};--pele-line:${theme.edge};` +
    `--pele-surface:${theme.stateFill};--pele-surface-alt:${theme.region.fill};--pele-border:${theme.region.border};`;
  return svg
    .replace(/(<svg\b[^>]*?\sstyle=")/, `$1${vars}`)
    .replace(
      /(<g class="pele-edge-label"[^>]*><rect[^>]*\/><text\b)/g,
      `$1 fill="${theme.edgeLabel}"`,
    );
}

const LINES =
  `<style>.pele-edges,.pele-dividers{stroke-width:${STYLE.line}px}` +
  `.pele-node rect,.pele-node path,.pele-node circle,.pele-cluster rect,.pele-cluster path,.pele-note rect,.pele-note path{stroke-width:${STYLE.line}px}</style>`;
const round = (v) => +v.toFixed(2);

function heavier(svg) {
  svg = resolveCss(svg)
    .replace(/style="([^"]*)"/g, (_, css) => `style="${css.replace(/--[\w-]+:[^;]*;?/g, "")}"`)
    .replace(/font:\s*([\d.]+px)\s+([^;"]+);/, "font-size:$1;font-family:$2;");
  const rootFill = /<svg[^>]*\sfill="([^"]+)"/.exec(svg)?.[1] ?? "#1f1f1f";
  return svg
    .replace(/(<svg[^>]*>)/, `$1${LINES}`)
    .replace(/<text\b([^>]*)>/g, (_, attrs) => {
      const fill =
        /style="[^"]*fill:\s*([^;"]+)/.exec(attrs)?.[1] ??
        /\sfill="([^"]+)"/.exec(attrs)?.[1] ??
        rootFill;
      return `<text${attrs} stroke="${fill.trim()}" stroke-width="${STYLE.text}" stroke-linejoin="round">`;
    })
    .replace(
      /(class="pele-marker" d=")M([\d.-]+),([\d.-]+)((?:L[\d.-]+,[\d.-]+)+)Z/g,
      (_, head, tx, ty, rest) => {
        const [x0, y0] = [+tx, +ty];
        const points = [...rest.matchAll(/L([\d.-]+),([\d.-]+)/g)].map(
          ([, x, y]) =>
            `L${round(x0 + (x - x0) * STYLE.arrow)},${round(y0 + (y - y0) * STYLE.arrow)}`,
        );
        return `${head}M${tx},${ty}${points.join("")}Z`;
      },
    );
}

function maskBands(svg) {
  const pad = STYLE.line / 2;
  // The holes set their own fill because mask content inherits the root <svg> fill, which is not black.
  const holes = [
    ...svg.matchAll(
      /<g class="pele-cluster\b[^"]*"[^>]*><rect x="([\d.-]+)" y="([\d.-]+)" width="([\d.]+)"[^>]*\/><path d="M[\d.-]+,([\d.-]+)H/g,
    ),
  ]
    .map(
      ([, x, y, w, divider]) =>
        `<rect x="${round(x - pad)}" y="${round(y - pad)}" width="${round(+w + 2 * pad)}" height="${round(divider - y + 2 * pad)}" fill="#000"/>`,
    )
    .join("");
  if (!holes) return svg;
  return svg.replace(
    /<g class="pele-edges"/,
    `<mask id="pele-bands" maskUnits="userSpaceOnUse"><rect width="100%" height="100%" fill="#fff"/>${holes}</mask>$& mask="url(#pele-bands)"`,
  );
}

export function renderChart(lib, src, { theme = THEMES.light, systemFont = systemFamily() } = {}) {
  let text = withRootDirection(themed(src, theme));
  const measurer = systemFont ? fontMeasurer(lib.Resvg, systemFont) : undefined;
  let wrap = wrapOf(text);
  if (measurer) {
    wrap = Math.ceil(wrap * Math.max(1, widthRatio(lib.render, text, measurer)));
    text = setWrap(text, wrap);
  }
  const r = lib.render(text, { fontFamily: FONT, measurer });
  return {
    svg: heavier(maskBands(themeSvg(r.svg, theme))),
    width: r.width,
    height: r.height,
    wrap,
  };
}

export function toPng(
  lib,
  { svg, width, height },
  { theme = THEMES.light, systemFont = systemFamily() } = {},
) {
  return new lib.Resvg(svg.split(FONT).join(pngStack(systemFont)), {
    background: theme.background,
    fitTo: { mode: "zoom", value: Math.min(STYLE.zoom, Math.sqrt(MAX_PIXELS / (width * height))) },
    font: systemFont
      ? { loadSystemFonts: true, defaultFontFamily: systemFont, sansSerifFamily: systemFont }
      : { loadSystemFonts: true },
  })
    .render()
    .asPng();
}

export function renderPng(lib, src, options = {}) {
  try {
    return toPng(lib, renderChart(lib, src, options), options);
  } catch (e) {
    if (e.code !== "limit") throw e;
    throw new Error(
      `${e.message} The chart is too big for one PNG, and the .mmd file still has all of it. A chart with fewer states fits. Run node statechart.mjs from-spec SPEC.tla --cover --png to draw a smaller overview of the spec.`,
    );
  }
}

import fs from "node:fs";
import path from "node:path";
import {
  blankStrings,
  definitions,
  ruleSentences,
  splitCommentsKeepingOffsets,
  tlaVariables,
} from "./lib.mjs";

const EXTENDS_STATEMENT = /\bEXTENDS\s+(\w+(?:\s*,\s*\w+)*)/g;
const CONSTANT_STATEMENT = /\bCONSTANTS?\s+(\w+(?:\([^)]*\))?(?:\s*,\s*\w+(?:\([^)]*\))?)*)/g;
const DECLARED_NAME = /(\w+)(?:\([^)]*\))?/g;
const LOCAL_DEFINITION = /^LOCAL\s/;
const INSTANCE_STATEMENT =
  /^(LOCAL[ \t]+)?(?:([A-Za-z_]\w*)[ \t]*==\s*)?INSTANCE\s+(\w+)((?:[^\n]|\n(?=\s))*)/gm;
const SUBSTITUTION = /(\w+)\s*<-([\s\S]*?)(?=\w+\s*<-|$)/g;
const ALIAS = /^\s*([A-Za-z_]\w*(?:![A-Za-z_]\w*)*)\s*$/;

export function ruleBook(spec) {
  const modules = new Map();
  const moduleOf = (file) => {
    if (modules.has(file)) return modules.get(file);
    const module = { rules: new Map(), parameters: [] };
    modules.set(file, module);
    const text = fs.readFileSync(file, "utf8");
    const code = blankStrings(splitCommentsKeepingOffsets(text).code);
    const fileOf = (name) => path.join(path.dirname(file), `${name}.tla`);
    const inherited = new Map();
    const instancedReads = new Map();
    const localImports = new Set();
    const take = (imported, { name, local, substitutions = new Map() }) => {
      for (const [rule, entry] of moduleOf(imported).rules) {
        if (entry.local) continue;
        const key = name ? `${name}!${rule}` : rule;
        if (local) localImports.add(key);
        if (entry.sentence) inherited.set(key, entry.sentence);
        instancedReads.set(
          key,
          [...entry.reads].map((v) => substitutions.get(v) ?? v),
        );
      }
    };
    const parameters = [];
    for (const [, names] of code.matchAll(EXTENDS_STATEMENT))
      for (const extended of names
        .split(/\s*,\s*/)
        .map(fileOf)
        .filter(fs.existsSync)) {
        parameters.push(...moduleOf(extended).parameters);
        take(extended, {});
      }
    for (const [, names] of code.matchAll(CONSTANT_STATEMENT))
      parameters.push(...[...names.matchAll(DECLARED_NAME)].map(([, constant]) => constant));
    for (const [, local, name, instanced, clause] of code.matchAll(INSTANCE_STATEMENT))
      if (fs.existsSync(fileOf(instanced)))
        take(fileOf(instanced), {
          name,
          local,
          substitutions: new Map([...clause.matchAll(SUBSTITUTION)].map(([, v, e]) => [v, e])),
        });
    const written = ruleSentences(text);
    const { bare, defs, own, through } = definitions(text, instancedReads, parameters);
    module.parameters.push(...parameters, ...tlaVariables(bare));
    const sentenceOf = (rule, seen = new Set()) => {
      if (written.has(rule)) return written.get(rule);
      if (seen.has(rule)) return undefined;
      const d = defs.get(rule);
      if (!d) return inherited.get(rule);
      const alias = ALIAS.exec(bare.slice(d.from, d.to))?.[1];
      return alias ? sentenceOf(alias, seen.add(rule)) : undefined;
    };
    for (const [rule, entry] of own) {
      const d = defs.get(rule);
      module.rules.set(rule, {
        sentence: sentenceOf(rule),
        reads: through(entry).reads,
        local: d ? LOCAL_DEFINITION.test(bare.slice(d.at, d.from)) : localImports.has(rule),
      });
    }
    return module;
  };
  return moduleOf(path.resolve(spec)).rules;
}

import { isRecord, stateKey } from "./lib.mjs";
import { SEP, edgeId } from "./chart-parts.mjs";
import { badOf } from "./bug-states.mjs";

const holder = (o, p) => p.slice(0, -1).reduce((x, k) => (isRecord(x?.[k]) ? x[k] : null), o);
function omit(vars, paths) {
  if (!paths.length) return vars;
  const out = structuredClone(vars);
  for (const p of paths) {
    const o = holder(out, p);
    if (o) delete o[p.at(-1)];
  }
  return out;
}

export function replaySecond(
  trace,
  { main, lacks, extra, second, hiddenStep, readerPath, mainActions, secondRules, rawSecondTraces },
) {
  if (!second) return null;
  const shared = (vars) => stateKey(omit(vars, lacks));
  const sharedOf = (n) => stateKey(omit(n.vars, extra));
  const out = new Map();
  for (const e of [...second.graph.edges, ...second.graph.loops]) {
    if (!out.has(e.from)) out.set(e.from, []);
    out.get(e.from).push(e);
  }
  const actions = new Set([...second.graph.edges, ...second.graph.loops].map((e) => e.action));
  const nodeOf = (id) => second.graph.nodes.get(id);
  const screen = new Map(
    [...second.graph.nodes.values()].map((n) => [n.id, second.customer(n.vars)]),
  );
  const words = (e) =>
    second.step(e.action, nodeOf(e.from).vars, nodeOf(e.to).vars, "customer") || e.action;
  const settle = (ids) => {
    const all = new Set(ids);
    for (const id of all)
      for (const e of out.get(id) ?? []) {
        const sameLabel = screen.get(e.to) === screen.get(id);
        if (
          !mainActions.has(e.action) &&
          hiddenStep(trace.invariant, sameLabel, e.action, nodeOf(id).vars, nodeOf(e.to).vars)
        )
          all.add(e.to);
      }
    return all;
  };
  const seen = readerPath(trace, main, main.customer, "customer");
  const shownAt = new Map(seen.map((p, j) => [p.modelStep, j]));
  let here = settle(
    [...second.graph.nodes.values()]
      .filter((n) => n.init && screen.get(n.id) === seen[0].key)
      .map((n) => n.id),
  );
  if (here.size === 0) return { reason: "starts in another state" };
  const passed = new Set(here);
  let j = 0;
  for (let i = 1; i < trace.steps.length; i++) {
    const { action } = trace.steps[i];
    const hidden = !shownAt.has(i);
    if (!hidden) j = shownAt.get(i);
    const want = seen[j];
    const [before, after] = [trace.steps[i - 1].vars, trace.steps[i].vars];
    const known = actions.has(action);
    if (!known && hidden) continue;
    const moved = shared(before) !== shared(after);
    const steps = (keep) => [...here].flatMap((id) => (out.get(id) ?? []).filter(keep));
    const tries = steps((e) =>
      known ? e.action === action : moved && sharedOf(nodeOf(e.to)) === shared(after),
    );
    if (hidden && tries.length === 0) continue;
    const looksSame = (e) => screen.get(e.to) === want.key && (hidden || words(e) === want.label);
    const matched = known ? tries.filter(looksSame) : tries;
    const same = matched.length || hidden ? matched : steps(looksSame);
    if (same.length) {
      here = settle(same.map((e) => e.to));
      for (const id of here) passed.add(id);
      continue;
    }
    const outcomes = new Map();
    for (const e of tries) {
      const id = `${screen.get(e.to)}${SEP}${words(e)}`;
      outcomes.set(id, [...(outcomes.get(id) ?? []), e]);
    }
    const taken = [...outcomes.values()].sort((a, b) => b.length - a.length)[0]?.[0];
    const from = main.key(before);
    const said = hidden ? main.step(action, before, after, "customer") || action : want.label;
    const at = { modelStep: i, said, from, hidden };
    if (!taken)
      return {
        ...at,
        key: from,
        label: main.step(action, before, after) || action,
        disabled: true,
      };
    const [b, a] = [nodeOf(taken.from).vars, nodeOf(taken.to).vars];
    return {
      ...at,
      key: second.key(a),
      label: second.step(taken.action, b, a) || taken.action,
      own: words(taken),
    };
  }
  const bad = badOf(rawSecondTraces, trace.invariant);
  const checked = secondRules.has(trace.invariant);
  const ruleHolds = checked && ![...passed].some((id) => bad.has(stateKey(nodeOf(id).vars)));
  return { sameEnd: true, checked, ruleHolds };
}

export function divergence(s, path, n, { inSecond, modelEdges }) {
  if (s?.key === undefined) return s;
  const step = path.findLastIndex((p) => p.modelStep < s.modelStep) + (s.hidden ? 0 : 1);
  const plain = edgeId(s.from, s.key);
  if (s.disabled) {
    const text = inSecond(`${s.label} cannot happen at step ${step}`);
    const edge = `${plain}${SEP}cannot${SEP}second`;
    return { ...s, step, text, overview: `${text} of bug ${n}`, edge, apart: true };
  }
  const text = inSecond(s.label);
  const drawn = [s.label, text].some((l) => modelEdges.get(plain)?.labels.has(l));
  return { ...s, step, text, overview: text, edge: drawn ? plain : `${plain}${SEP}second` };
}

import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import process from "node:process";

const imports = (text, dir) =>
  [...text.matchAll(/\b(?:from|import)\s*\(?\s*["'](\.{1,2}\/[^"']+)["']/g)].map((m) =>
    path.resolve(dir, m[1]),
  );

const DEPENDENCIES = {
  ".tla": (text, dir) =>
    [
      ...text
        .replace(/\(\*[^]*?\*\)/g, " ")
        .replace(/\\\*.*/g, " ")
        .matchAll(/\b(?:EXTENDS|INSTANCE)\s+(\w+(?:\s*,\s*\w+)*)/g),
    ].flatMap((m) => m[1].split(/\s*,\s*/).map((name) => path.join(dir, `${name}.tla`))),
  ".mjs": imports,
  ".js": imports,
};

export const copyPath = (root, file, paths = path) => {
  const absolute = paths.resolve(file);
  const pathRoot = paths.parse(absolute).root;
  return paths.join(root, pathRoot.replace(/\W+/g, ""), paths.relative(pathRoot, absolute));
};

const contentOf = (file) => {
  try {
    return fs.readFileSync(file, "base64");
  } catch {
    return null;
  }
};

export class Inputs {
  #root = fs.mkdtempSync(path.join(os.tmpdir(), "statechart-inputs-"));
  #files = new Set();

  constructor() {
    process.on("exit", () => fs.rmSync(this.#root, { recursive: true, force: true }));
  }

  add(files) {
    for (const file of files) if (file) this.#take(path.resolve(file), true);
    return this;
  }

  copyOf(file) {
    return copyPath(this.#root, file);
  }

  changed() {
    return [...this.#files].find((file) => contentOf(file) !== contentOf(this.copyOf(file)));
  }

  #take(file, listed) {
    if (this.#files.has(file)) return;
    let content;
    try {
      content = fs.readFileSync(file);
    } catch {
      if (listed) this.#files.add(file);
      return;
    }
    this.#files.add(file);
    const copy = this.copyOf(file);
    fs.mkdirSync(path.dirname(copy), { recursive: true });
    fs.writeFileSync(copy, content);
    const found = DEPENDENCIES[path.extname(file)]?.(content.toString("utf8"), path.dirname(file));
    for (const dependency of found ?? []) this.#take(dependency, false);
  }
}

import fs from "node:fs";
import path from "node:path";
import { BROKEN_MARK, PRIMES_OR_UNCHANGED, tlaVariables } from "./lib.mjs";

export const withoutComments = (spec) =>
  fs
    .readFileSync(spec, "utf8")
    .replace(/\(\*[^]*?\*\)/g, " ")
    .replace(/\\\*.*/g, " ");

function specVariables(spec, seen) {
  const text = withoutComments(spec);
  const extended = /\bEXTENDS\s+(\w+(?:\s*,\s*\w+)*)/.exec(text)?.[1].split(/\s*,\s*/) ?? [];
  return [
    ...extended.flatMap((m) => {
      const file = path.join(path.dirname(spec), `${m}.tla`);
      if (seen.has(m) || !fs.existsSync(file)) return [];
      seen.add(m);
      return specVariables(file, seen);
    }),
    ...tlaVariables(text),
  ];
}

export const RULES_INVARIANT = "StatechartRules";

export function writeRulesModule(spec, rules, dir) {
  const name = path.basename(spec, ".tla");
  const file = path.join(dir, `${name}_rules.tla`);
  const fields = specVariables(spec, new Set([name])).map((v) => `${v} |-> ${v}`);
  const broken = rules.map((r) => `(IF ${r} THEN {} ELSE {"${r}"})`).join(" \\cup ");
  fs.writeFileSync(
    file,
    `---- MODULE ${name}_rules ----
EXTENDS ${name}
StatechartTLC == INSTANCE TLC
StatechartBroken == ${broken}
${RULES_INVARIANT} == StatechartBroken = {} \\/ StatechartTLC!PrintT(<<"${BROKEN_MARK}", [${fields.join(", ")}], StatechartBroken>>)
====
`,
  );
  return file;
}

export const SCAFFOLD = (name, spec) => {
  const text = withoutComments(spec);
  const vars = tlaVariables(text);
  const primedDefinitions = [
    ...new Set(
      text
        .split(/\n(?=\S)/)
        .map((d) => /^(\w+)\s*(?:\([^)]*\))?\s*==([^]*)/.exec(d))
        .filter((d) => d && PRIMES_OR_UNCHANGED.test(d[2]))
        .map((d) => d[1]),
    ),
  ].sort();
  return `// Chart labels for ${name}, for statechart.mjs. Write labels in the words of the person who reads
// the chart, not in variable or action names.
// v, before, and after map each variable to its value. Strings, numbers, and booleans keep their kind.
// Sequences and tuples, including functions over 1..n, read from 1 as in TLA+, so v.seat[1] is the
// first item. Reading index 0 stops the run. length, array methods, and spread still work. A
// method's index, such as indexOf or the i in map((x, i) => ...), still counts from 0.
// Sets become arrays. Records and other functions become objects.
// Variables: ${vars.join(", ")}.

// The actions that the reader takes, by action name, when the chart separates what the reader does
// from what happens around the reader. facts.settled is true when only these are enabled. With
// --cover, the overview keeps only the shortest path to each settled state, plus every bug path.
// Leave it empty when every action counts the same.
export const readerActions = [];

// The label for one model state. facts.enabled is the set of actions the state enables,
// including steps that change no variable. A label "context: progress", such as
// "Primary down: write queued", puts the states of one context in one box, and can draw the
// overview as two parallel regions. Use that form only when the context and the progress change
// independently. A label without ": " draws each state on its own.
// Do not claim a result that a pending step can still change, such as "write lost" while a
// retry is still queued.
export function state(v, facts) {
	return JSON.stringify(v);
}

// The names of the two parallel regions, when the overview draws them: contexts, then progress.
// export const regionNames = ["Primary", "Write"];

// The group of one model state, in the reader's words, such as "Order shipped". The chart fills
// the states of one group with one color, and the legend names the groups. TLC still decides
// which states break a rule, and draws them with a thick red border on top of the group color.
// groupColors gives a group a light color. Groups without one take a palette color.
// export function group(v, facts) {}
// export const groupColors = { "Order shipped": "#d1f2eb" };

// The label for one step. A step that leaves the reader in the same state is not drawn,
// unless the reader takes it on a bug path. "" draws no label, and a numbered bug step shows the action.
// action is the action's name without its parameters, so compare before and after to tell which
// process or item the step changed.
// STEPS lists every definition that changes a variable. TLC names no step after one that another
// action uses in its /\\ list, such as Log in Save == Log /\\ saved' = TRUE, so delete its entry.
const STEPS = {
${primedDefinitions.map((a) => `\t${a}: ${JSON.stringify(a)},`).join("\n")}
};
export function step(action, before, after) {
	return STEPS[action] ?? action;
}

// When the step can happen, in plain words, such as "after the lease expires". The chart shows
// "step [words]". "" adds nothing.
// export function guard(action, before, after) {}

// For a timer step, how many seconds the code waits, from the constant in the code. The chart
// shows "after N s, step". Return nothing for other steps.
// export function timer(action, before, after) {}

// Why a bad state is bad, in the reader's words, such as "a worker crashed after it took the job,
// and no other worker can take it". No variable, function, or event names.
// Counterexamples that break one rule with one cause are one bug, so two bugs that end in the
// same state stay apart only if their causes differ. Return null to group by the end state.
// export function cause(v, facts, invariant) {}

// The developer's words for one model state. With it, each bug is also drawn through these states.
// export function detail(v, facts) {}

// The legend's words for each status, in place of the defaults. Group entries keep their names.
// export const legend = { works: "Works on main", wrong: "Wrong on main", fixed: "Fixed in the open PR" };
`;
};

import { CACHE_NAME, PACKAGES } from "./render.mjs";

export const USAGE = {
  "from-spec":
    "node statechart.mjs from-spec SPEC.tla [--config FILE] [--fixed FIXED.tla [--fixed-config FILE] | --against AGREED.tla [--against-config FILE]] [--label TEXT] [--map FILE] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--cover] [--png [--theme NAME]]",
  "from-chart":
    "node statechart.mjs from-chart CHART.mmd [--module NAME] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--png [--theme NAME]]",
  render: "node statechart.mjs render CHART.mmd [--theme NAME] [--out FILE]",
};
export const usage = (lines) => `Usage: ${lines.join("\n       ")}`;

const FROM_SPEC = `from-spec SPEC.tla
  Checks each INVARIANT in SPEC.cfg in a separate TLC run. TLC stops at the first rule that a state
  breaks, and the separate runs find the rest. Each run also has the rule as a CONSTRAINT, so TLC
  stops each path at its first state that breaks the rule, and a rule that stays broken reports
  only the step that broke it. SPEC.cfg has SPECIFICATION and one INVARIANT line per rule. Each
  PROPERTY, a rule about whole behaviors, gets one TLC run too, and the charts do not draw it. TLC
  checks a PROPERTY with no [], <>, or ~> only in the initial states, and the command says so. A
  rule listed as both INVARIANT and PROPERTY is checked once, as an INVARIANT. After those runs
  print their results, one more run dumps the state graph and checks every INVARIANT on every
  state in it, and then the command draws the charts. TLC goes down from the next-state action
  through each \\/, \\E, LET, and definition, and names each step after the last definition on that
  path. It stops at any other expression, such as /\\, IF, or CASE, so a definition inside one names
  no step. Give each kind of step its own definition, and join them with \\/ in the next-state
  action. The command warns when steps carry the name of the whole next-state action. The command
  prints the config that it checks each model with, and stops when a config does not exist, with
  the configs beside the spec.

  --config FILE      The config for SPEC.tla. Default: SPEC.cfg next to the spec.
  --fixed FIXED.tla  The model of the open fix. It is a copy of the spec in a different file, such
                     as SpecFixed.tla or fix/Spec.tla. The command checks it the same way, with
                     FIXED.cfg, or with the config of SPEC.tla when there is no FIXED.cfg. The
                     charts then mark each bad state fixed or still wrong. A rule that the
                     config of FIXED.tla does not check stays as wrong as it is today. When the
                     fix shows the same states and steps as a bug of such a rule, the story says
                     "does not check this rule".
  --fixed-config FILE
                     The config for FIXED.tla.
  --against AGREED.tla
                     The spec that SPEC.tla must follow, when SPEC.tla models the code. It is a
                     different file from SPEC.tla. The command checks it with AGREED.cfg, and
                     never with the config of SPEC.tla. SPEC.tla may add variables, record fields,
                     and actions that AGREED.tla does not have. The comparison leaves them out.
                     Do not use it with --fixed.
  --against-config FILE
                     The config for AGREED.tla, when it is not AGREED.cfg. Give the config that the
                     spec's authors say the unchanged spec passes. When the spec shows the same
                     states and steps as a bug of a rule that this config does not check, the
                     story says "does not check this rule".
  --label TEXT       The name of the --fixed or --against model in the charts and the stories.
                     Default: "the fix", or "the spec".
  --map FILE         The labels for each model state and step. Default: SPEC.map.mjs next to the
                     spec. When the file does not exist, the command writes one from the spec's
                     VARIABLES and actions to fill in, and exits 2 before it runs TLC. Its
                     comments say what each function gets. The map reads a sequence or tuple
                     from 1, as in TLA+, so v.seat[1] is its first item. A map that reads from
                     0, such as v.pc[r - 1], gets the item before the one it wants, and stops
                     the run when it reads index 0.
  --cover            Draw only the shortest path from the start to each settled state, plus
                     every bug path, in the overview. A state is settled when only the
                     mapping's readerActions are enabled. The command prints the states and
                     arrows that the overview leaves out. The counts of states that work or
                     break a rule still include the states it leaves out. When no step in
                     TLC's graph is a reader action, the overview draws every state.

  With --fixed or --against, SPEC.tla (and FIXED.tla) models the code, and the command finds each
  condition of an action that no comment ties to code with a file and line, as in \\* pay.ts:120.
  A condition is a conjunct of the action that changes nothing and reads a variable that the
  action does not change. A rule can hold only because the model waits for a condition that the
  code does not check, so the command prints these conditions when a rule holds.
  With --against, each story says whether a config beside AGREED.tla expects TLC to break the
  bug's rule. A config's "\\* expect: RULE" line says what TLC finds, and "\\* module: NAME" names
  the module it checks when the folder has more than one .tla file. The command warns when no
  config beside AGREED.tla has an expect line for that module.`;

const FROM_CHART = `from-chart CHART.mmd
  Writes NAME.tla, NAME.cfg, and NAME.map.mjs next to the chart. When NAME.tla already exists, it
  writes none of them. Otherwise it replaces a NAME.cfg or NAME.map.mjs that is there. Then it
  checks the spec as from-spec does, and compares the chart that the spec draws with CHART.mmd.

  --module NAME      The TLA+ module name. Default: the chart's file name in CamelCase, such as
                     NotesApp for notes-app.mmd.

  The chart is a Mermaid stateDiagram-v2. Each transition label is one action. For parallel
  regions, split one top-level composite with --, and put each part in a named composite, such as
  state Connection { ... }. Each region is one variable. A step moves every region whose current
  state has a transition with the step's label, and the other regions stay where they are. Each
  rule is one comment line:
    %% never NAME: A & B -- the rule in one sentence
  Each name after the colon is a state caption or a composite, and each comes from a different
  region. A composite stands for every state in it. A "%% when ID, ID" or "%% when not ID, ID" line
  right after a transition is its guard, and the transition's label must end with the guard's
  words in [ ]. The region takes the transition only while each other region that the line names
  is in one of the states that it names, or with not, while none is. A transition with no label is
  its own action. NAME.cfg has SPECIFICATION Spec, INVARIANT TypeOK, and one INVARIANT per never
  line. The command refuses final, choice, fork, and history states, and regions below the top
  level.

  The comparison looks at reachable states, start states, and labeled steps. A chart with regions
  compares as its combined machine, with each state named by its region states joined by " | ", so
  a guard that blocks a step in only some combinations of regions shows as a difference. The
  guard's words in [ ] are not part of the label. A loop compares like any other step. An edge
  label "a or b" counts as two labels. An edge with no label counts only when no labeled edge joins
  the same two states.`;

const RENDER = `render CHART.mmd
  Draws one chart as a PNG. It does not run TLC, so the chart can come from from-spec, from
  from-chart, or from a person.

  --theme NAME       The colors of the PNG: light, dark, or classic. Default: light.
  --out FILE         The PNG to write. Default: the chart's path with .png in place of .mmd. The
                     command makes the folder when it does not exist.

  Exit codes
    0  The command wrote the PNG.
    2  The command cannot finish: a bad argument, a chart that it cannot read, a renderer that it
       cannot install or load, or a PNG that it cannot render or write. It writes no PNG then.`;

const PNG = `PNG
  Pele lays out each chart, and resvg draws it at twice its size. A chart that is more than 100
  million pixels at that size draws smaller, at about 100 million pixels. The first PNG installs
  ${PACKAGES.join(" and ")} with npm into a cache folder. The folder is
  $XDG_CACHE_HOME/statechart/${CACHE_NAME}, or
  ~/.cache/statechart/${CACHE_NAME} when XDG_CACHE_HOME is not set. Delete that folder to
  install them again. When npm or the packages fail, the command prints why, exits 2, and writes
  no file.
  The PNG uses the font that fc-match finds for system-ui. The command measures each label in that
  font, so no label goes past its box. When that font is wider than the widths that Pele has built
  in, the command makes the wrap width wider by the same amount, so the lines break where the chart
  breaks them. Without fc-match, or when resvg cannot read that font, the PNG uses Pele's widths.
  Pele puts parallel regions side by side. When a chart with regions has no top-level direction,
  the PNG puts the legend above the regions, so the PNG is narrower.
  --theme picks light, dark, or classic. light is the default. classic keeps the group fills from
  the chart's own classDef lines.`;

const COMMON = `Both commands
  --expect-broken RULE
                     An INVARIANT or PROPERTY that is known to break. Repeat it, or list rules
                     with commas, as in A,B. The command then exits 0 when exactly these rules
                     break, and the --fixed or --against model breaks no other rule.
  --title TEXT       The chart title. Each bug chart adds ", bug N".
  --out DIR          The output folder. Default: NAME-statechart next to the input. A run writes its
                     files in a temporary folder, and then replaces the whole output folder with
                     it. When runs overlap, the output folder has the files of the run that
                     finished last. The command does not use an output folder that has files that
                     it did not write. On a filesystem that cannot rename, the command copies the
                     files into place, and overlapping runs can mix their files.
  --png              Also draw each chart as a PNG. The PNG section tells how.
  --theme NAME       The colors of each PNG: light, dark, or classic. Default: light. It needs
                     --png.
  -h, --help         Print this help, and exit 0.

Output
  The command prints whether each rule holds, the chart's counts, and one story per bug.
  from-chart also prints the comparison. The command writes these files in the output folder:
  chart.mmd          The overview.
  bug-N.mmd          Only the steps of bug N, numbered. Bugs are numbered by fewest reader steps,
                     then fewest model steps, then rule name, then cause. Bugs that only the
                     --fixed or --against model has come last.
  bug-N-developer.mmd, bug-N-layered.mmd
                     The path of bug N through the developer's states, when the mapping exports
                     detail(). The layered chart puts each detail state in a box named by its
                     state label. A state with a blank detail stays a plain state.
  stories.md         One entry per bug: the rule, why it breaks, the steps that lead into it, the
                     shortest path in reader steps, and what the --fixed or --against model does
                     instead. The rule's sentence is the \\* comment lines above the rule in the
                     spec, or in a module in its folder that the spec EXTENDS, directly or
                     through another module. With --fixed or --against, the other spec and its
                     modules count too, after SPEC.tla and its modules. The entry numbers each
                     step that changes the state label, each reader action, each step that
                     changes a variable that the rule reads, and the step into the bug. Between
                     them, it counts the hidden steps and names each different step once. Above
                     the steps, a line names up to five different steps that lead into the bug,
                     most common first, and counts the rest. When more than one step or start
                     state leads into the bug, the entry says that the path is the shortest that
                     TLC found. A step leads into the bug when it goes there from a state that
                     keeps the bug's own rule. That state can already break other rules. "(the
                     state stays the same)" marks a step on that line that keeps the state's
                     label and is not on the bug's path. from-spec does not draw such a step.
                     When TLC names the steps only after the whole next-state action, the entry
                     cannot count them. Then one line per broken PROPERTY with its sentence,
                     which comes only from its own spec file, the reader states that repeat
                     forever, if any, and the TLC output that has its counterexample.
  summary.json       The counts behind the chart. Each bug has counterexamples, how many model
                     states end it, each with its own TLC trace; lastSteps, the steps that lead
                     into it, most common first; and startsHere, whether a start state is in it.
                     brokenProperties has each broken PROPERTY, its rule sentence, the reader
                     states that repeat forever as repeats, and its TLC output. mixedStatus
                     lists the states that break a rule in some cases. chartGroups counts the
                     drawn states of each group, and mixedGroups lists the states in more than
                     one group. With --cover, cover lists the states and arrows that the
                     overview leaves out. With --fixed or --against, uncited has the conditions
                     with no file and line for each code model. With --against, second.listed
                     has what each config beside AGREED.tla expects, and each bug has the
                     configs that list it.
  tlc/               The config and the TLC output of each run. When the overview has regions,
                     from-spec also writes tlc/regions-all.mmd, the regions with every arrow, and
                     tlc/regions-proof.mmd, every state and step of TLC's graph in one region.
                     compare-charts.mjs tlc/regions-all.mmd tlc/regions-proof.mmd repeats the
                     proof. It prints "same" and exits 0, or prints each difference and exits 1.
  *.png              Each chart as a PNG, with --png. A run without --png deletes them.

Reading a chart
  from-spec draws the overview as two parallel regions when every state reads "context: progress":
  the contexts on one side, the progress on the other, both at the same time. It does so only when
  that has fewer states, when the regions combine back into exactly every state and step of TLC's
  graph, and when each state's color is the worse color of its two region states. Otherwise it puts
  the states of one context in a box named context, and prints why. Each state in a box shows only
  its progress, and a context with one state stays a plain state.
  Regions draw only the arrows of the shortest way to each state, of each bug path, and of the
  nearest step with each label. The script checks that these arrows make no step that TLC's graph
  does not have. At a step that they make wrongly, it puts back every arrow that the full regions
  take there.
  An arrow from a box's border leaves from every state in the box. The chart draws it only when
  every state in the box takes the step with the same labels to the same state, and no state
  outside the box has the box's name.
  In regions, a step leaves every region that has it. "[when A or B]" or "[unless A or B]",
  whichever is shorter, says which states of the other region the step needs, and a "%% when" or
  "%% when not" line under it lists their ids. A loop says the region may also stay.
  Other words in [ ] come from the mapping's guard(), and "after N s" from its timer(). An edge
  shows guard() words only when every model step behind it has them. In regions, they replace
  "when A or B" and "unless A or B". TLC does not check them, and has no clock, so a reviewer
  checks them against the code.
  Gray states work. Red states break a rule. An orange state breaks a rule in some cases: a model
  state under its label breaks a rule, and a path without a bug reaches another one. A white state
  is reached only after a bug: every path from the start to its model states passes a state that
  breaks a rule, and none of them breaks one. With --fixed, red, orange, and white describe the
  fix, and green states are fixed by it or exist only with it. A purple state breaks a rule only
  with the fix: today it works, is reached only after a bug, or does not exist. With --against, a
  state takes the worse of its two models' colors, red, then orange, then white, and green states
  exist only in the spec.
  When the mapping exports group(), the fill is the state's group, which the legend names. A chart
  state is in a group when all its model states are in it, and a region state when every state
  that it is part of is in it. A state in no group, or in more than one, is gray. The legend lists
  the groups that the chart draws: first the groups in groupColors, in that order, then the others
  from A to Z, and then each status border that the chart uses. groupColors gives a group a light
  "#rgb" or "#rrggbb" color. A group with no color takes the next free palette color: light blue,
  orange, purple, yellow, teal, tan, then pink. A group cannot have the name of a status, such as
  "Breaks a rule". Without group(), the legend shows only the statuses that the chart uses. In the
  .mmd file, the status is a thick border of its color, gray for a white state, on top of the group
  fill. In a PNG, a red, orange, purple, or white state is a box of that color with a border and
  text of its color in place of its group fill, and a fixed state is a green box, so each box shows
  one signal.
  A thick blue border and numbered labels mark the bug. With group(), and in a PNG, the blue border
  marks only the states on the bug's path that work, and the numbered labels show the rest.
  Mermaid state diagrams cannot color an edge.
  Each bug replays on the other model by its state labels and step words, which are what the
  reader sees. The replay takes the bug's own steps. Between them, it also takes the other model's
  steps of actions that SPEC.tla's state graph does not have, when they keep the state label, are
  not reader actions, and change no variable that the broken rule reads. A bug step that the story
  hides must keep the state label on the other model too, unless that model cannot take it. A step
  that the reader sees takes a step with the same words between the same two state labels, and
  prefers a step of the same action. A hidden step of an action that the other model does not have
  is skipped. A step that the reader sees of such an action takes any step to the same shared state
  when it changes a shared variable, or else a step with the same words between the same two state
  labels.
  A label "with the fix, STEP" or "in the spec, STEP" is a step that only the other model takes. On
  a bug's path it leaves the state before the first step that the other model shows the reader
  differently, and ends where that model goes instead. The story quotes the other model's words
  when they differ. "with the fix, STEP cannot happen at step N" or "in the spec, STEP cannot
  happen at step N" loops on the state where that model stops the step, on an arrow of its own. On
  the overview, the label ends with "of bug M". Outside regions, two states otherwise have at most
  one arrow between them. Its lines are the numbered steps, then SPEC.tla's steps, then the other
  model's steps, with a blank line between each group.
  The other model may have other variables, record fields, and actions. The comparison leaves out a
  variable or field that no state of one model has, in its state graph or its traces, and one whose
  values never have the same type in the two models. One mapping draws both models, so it may read
  only what both have. The command stops when the mapping reads, on a state of the other model, a
  variable or field that no state of that model has, or one whose value has a type that SPEC.tla
  never has there. It also stops when the mapping lists the fields of such a state, as a spread,
  Object.keys, or JSON.stringify does. Test "name" in v before the mapping reads a field that the
  other model lacks. The command also stops when a label, guard, group, or cause that the mapping
  makes for the other model has the word "undefined" in it.
  A chart with another model has the line "%% second model (fix|against): LABEL" right after
  stateDiagram-v2. Each chart starts with front matter that keeps Mermaid from shrinking it to the
  page or wrapping its labels again.
  An edge lists every step that takes it, most common first. Words that the steps share at the
  start are written once, as in "you tap Pay or Back".

Regenerate
  List every rule that is known to break with --expect-broken, the goals and the known bugs. Each
  run then exits 0 until a rule changes, so one script rebuilds every chart and stops on any change:
    set -e
    node statechart.mjs from-spec Code.tla --against Agreed.tla --expect-broken NoLostUpload --png
  A run that leaves a broken rule out of --expect-broken exits 1, and set -e stops the script there.

TLC
  TLA2TOOLS is the path to tla2tools.jar, and JAVA is the path to the java binary. With only
  TLA2TOOLS set, the command runs java from PATH. Otherwise it uses TLC 1.7.4 and Java temurin-25
  from mise, or JAVA when it is set, and installs what is missing with mise. The first install
  downloads about 305 MB and needs the network. It checks the checksum of tla2tools.jar. mise runs
  in an empty temporary folder, so the mise files around the spec, in a repo, or above TMPDIR do
  not apply, do not change, and need no trust. When mise cannot start or fails, the command prints
  why, the install command, and how to set TLA2TOOLS and JAVA instead.
  When the command starts, it copies its input files, which Exit codes lists. TLC checks the
  copies, so an edit during the run does not change what TLC checks.
  TLC checks each rule with one worker per CPU. When a rule is broken, TLC checks it again with one
  worker, which finds the shortest bug paths, the same on every run. The command then prints how
  many times TLC ran and how long that took.
  TLC can find that a rule is broken and then stop on an error, such as a Java exception. The
  command then keeps the paths that TLC printed, marks the rule broken, and warns that the charts
  can miss states that break it. A smaller constant can let TLC finish.

Exit codes
  0  Every rule holds, or exactly the --expect-broken rules break. from-chart also draws CHART.mmd
     back unchanged.
  1  Another rule is broken, an expected rule holds, or the chart that the spec draws is not
     CHART.mmd. The output says which.
  2  The command cannot finish: a bad argument, a missing file, a chart or TLC output that it
     cannot read, no TLC, a helper script that cannot start, an output folder with files that the
     command did not write, an input file whose content changed during the run, a new mapping to
     fill in, a mapping that it cannot use, a renderer that --png cannot install or load, or a
     chart that --png cannot render.
     When a chart does not render, the command keeps the files it wrote and exits 2, whatever the
     rules give. Otherwise, exit 2 does not change the output folder, unless the command moved it
     aside and cannot put it back. Then the message names the folder's new path. When the command
     stops after TLC has run, it keeps the files that it wrote, TLC's output among them, in a
     temporary folder, and the message names it. When TLC's state graph is too large to draw, the
     command prints whether each rule holds and exits 2, whatever the rules give. It stops TLC as
     soon as the graph passes that size. The input files are the spec and config, the --fixed or
     --against spec and config, the chart, and the map. Each .tla file in the same folder that an
     input .tla file EXTENDS or INSTANCEs is an input file too, and so is each file that an input
     .mjs or .js file imports by a relative path. Before --png renders, and again before it writes
     the output folder, the command compares the content of each input file with its content at
     the start. A save that does not change the content does not stop the run.`;

export const HELP = {
  "": `${usage([...Object.values(USAGE), "node statechart.mjs [from-spec|from-chart|render] --help"])}

Draws a Mermaid statechart from TLC's state graph of a TLA+ spec. The spec can model any system,
such as a product flow, a protocol, a service, a job queue, or an algorithm. A mapping labels each
state and step in the words of the person who reads the chart, and the help calls that person the
reader. The reader can be a user, an operator, an engineer, or a reviewer.

${FROM_SPEC}

${FROM_CHART}

${COMMON}

${RENDER}

${PNG}`,
  "from-spec": `${usage([USAGE["from-spec"]])}\n\n${FROM_SPEC}\n\n${COMMON}\n\n${PNG}`,
  "from-chart": `${usage([USAGE["from-chart"]])}\n\n${FROM_CHART}\n\n${COMMON}\n\n${PNG}`,
  render: `${usage([USAGE.render])}\n\n${RENDER}\n\n${PNG}`,
};

export const more = (cmd) =>
  `Run node statechart.mjs ${cmd ? `${cmd} ` : ""}--help for the flags, the output, and the exit codes.`;

#!/usr/bin/env node
import { constants } from "node:buffer";
import { spawn, spawnSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import process from "node:process";
import { fileURLToPath, pathToFileURL } from "node:url";
import { HELP, more, USAGE, usage } from "./statechart-help.mjs";
import {
  BROKEN_PROPERTY,
  checkedOnlyInInitialStates,
  joinAnd,
  parseDot,
  tlcOutputWarning,
  uncitedConditions,
} from "./lib.mjs";
import { loopSentence, readerStateNamer, repeatsIn } from "./property-loop.mjs";
import { loadRenderer, renderPng, THEMES } from "./render.mjs";
import { ruleBook } from "./rule-book.mjs";
import { Inputs } from "./snapshot.mjs";
import { RULES_INVARIANT, SCAFFOLD, withoutComments, writeRulesModule } from "./spec-text.mjs";
import { cannotRunTlc, findTlc } from "./tlc-tools.mjs";

const here = path.dirname(fileURLToPath(import.meta.url));
const { MAX_STRING_LENGTH } = constants;

class CannotFinish extends Error {}
class TlcStopped extends CannotFinish {}
class NotPublished extends CannotFinish {}

const COMMANDS = {
  "from-spec": {
    values: [
      "--map",
      "--config",
      "--fixed",
      "--fixed-config",
      "--against",
      "--against-config",
      "--label",
      "--expect-broken",
      "--title",
      "--out",
      "--theme",
    ],
    switches: ["--cover", "--png"],
    renders: (flags) => flags.png,
    run: fromSpec,
  },
  "from-chart": {
    values: ["--module", "--expect-broken", "--title", "--out", "--theme"],
    switches: ["--png"],
    renders: (flags) => flags.png,
    run: fromChart,
  },
  render: { values: ["--theme", "--out"], switches: [], renders: () => true, run: renderFile },
};

function parseArgs([command, ...rest]) {
  if (command === "-h" || command === "--help") return { help: HELP[""] };
  if (!Object.hasOwn(COMMANDS, command))
    throw new CannotFinish(`${usage(Object.values(USAGE))}\n${more()}`);
  const { values, switches, renders } = COMMANDS[command];
  const flags = { "expect-broken": new Set() };
  let input;
  for (let i = 0; i < rest.length; i++) {
    const a = rest[i];
    if (a === "-h" || a === "--help") return { help: HELP[command] };
    if (switches.includes(a)) flags[a.slice(2)] = true;
    else if (values.includes(a)) {
      if (i + 1 === rest.length) throw new CannotFinish(`${a} needs a value. ${more(command)}`);
      const name = a.slice(2);
      if (flags[name] instanceof Set) for (const v of rest[++i].split(",")) flags[name].add(v);
      else flags[name] = rest[++i];
    } else if (!a.startsWith("-") && input === undefined) input = a;
    else throw new CannotFinish(`unknown argument ${a}. ${more(command)}`);
  }
  if (input === undefined) throw new CannotFinish(`${usage([USAGE[command]])}\n${more(command)}`);
  const themes = Object.keys(THEMES);
  if (flags.theme !== undefined && !themes.includes(flags.theme))
    throw new CannotFinish(
      `--theme takes ${themes.slice(0, -1).join(", ")}, or ${themes.at(-1)}. ${more(command)}`,
    );
  if (flags.theme !== undefined && !renders(flags))
    throw new CannotFinish(`--theme needs --png. ${more(command)}`);
  return { command, input, flags };
}

async function rendererFor(command, flags) {
  if (!COMMANDS[command].renders(flags)) return null;
  try {
    return { lib: await loadRenderer(), theme: THEMES[flags.theme ?? "light"] };
  } catch (e) {
    throw new CannotFinish(e.message);
  }
}

const rel = (file) => {
  const r = path.relative(process.cwd(), file) || ".";
  return r === ".." || r.startsWith(`..${path.sep}`) ? path.resolve(file) : r;
};
const cfgOf = (spec) => spec.replace(/\.tla$/, ".cfg");

function findTools() {
  try {
    return findTlc();
  } catch (e) {
    throw new CannotFinish(e.message);
  }
}

function script(name, scriptArgs, about, { okExits = [0] } = {}) {
  const r = spawnSync(process.execPath, [path.join(here, name), ...scriptArgs], {
    encoding: "utf8",
  });
  if (r.error) throw new CannotFinish(`cannot run ${name}: ${r.error.message}`);
  if (okExits.includes(r.status)) return r;
  const thrown = r.stderr.match(/^Error: (.*)$/m)?.[1];
  throw new CannotFinish(thrown ? `${rel(about)}: ${thrown}` : r.stderr.trim());
}

const KEYWORD =
  /^(SPECIFICATION|INIT|NEXT|CONSTANTS?|INVARIANTS?|PROPERTY|PROPERTIES|SYMMETRY|VIEW|CONSTRAINTS?|ACTION_CONSTRAINTS?|CHECK_DEADLOCK|POSTCONDITION|ALIAS)$/;

function splitRules(cfg) {
  const words = cfg
    .replace(/\(\*[^]*?\*\)/g, " ")
    .replace(/\\\*.*/g, " ")
    .split(/\s+/)
    .filter(Boolean);
  const kept = [];
  const rules = [];
  const properties = [];
  let section = "";
  for (const w of words) {
    if (KEYWORD.test(w)) section = w;
    const list = /^INVARIANTS?$/.test(section)
      ? rules
      : /^PROPERT(Y|IES)$/.test(section)
        ? properties
        : null;
    if (!list) kept.push(KEYWORD.test(w) && kept.length ? `\n${w}` : w);
    else if (w !== section && !list.includes(w)) list.push(w);
  }
  // TLC takes only a state predicate as an INVARIANT, and checks a state predicate given as a
  // PROPERTY only in the initial states, which the INVARIANT run checks too.
  return {
    cfgWithoutRules: `${kept.join(" ")}\n`,
    rules,
    properties: properties.filter((p) => !rules.includes(p)),
  };
}

function runJava(file, args, options, dot) {
  return new Promise((resolve) => {
    const r = { stdout: "", stderr: "", stopped: false, overflowed: false };
    const child = spawn(file, args, options);
    for (const stream of ["stdout", "stderr"])
      child[stream].setEncoding("utf8").on("data", (text) => {
        if (r.overflowed) return;
        if (r[stream].length + text.length <= MAX_STRING_LENGTH) r[stream] += text;
        else {
          r.overflowed = true;
          child.kill("SIGKILL");
        }
      });
    child.on("error", (e) => (r.error = e));
    const watch =
      dot &&
      setInterval(() => {
        if ((fs.statSync(dot, { throwIfNoEntry: false })?.size ?? 0) <= MAX_STRING_LENGTH) return;
        r.stopped = true;
        child.kill("SIGKILL");
      }, 500);
    child.on("close", (status, signal) => {
      clearInterval(watch);
      resolve({ ...r, status, signal });
    });
  });
}

async function tlc(tools, spec, cfg, base, { dump, module, workers = "1" } = {}) {
  fs.writeFileSync(`${base}.cfg`, cfg);
  const metadir = fs.mkdtempSync(path.join(os.tmpdir(), "tlc-"));
  // TLC writes the standard modules, such as Naturals.tla, to java.io.tmpdir under fixed names,
  // so runs that share that folder can read a module while another run rewrites it.
  const javaTmp = path.join(metadir, "tmp");
  fs.mkdirSync(javaTmp);
  // -deadlock: a system at rest has nothing left to do, which TLC would report as a deadlock.
  const r = await runJava(
    tools.java,
    [
      "-XX:+UseParallelGC",
      `-Djava.io.tmpdir=${javaTmp}`,
      ...(module ? [`-DTLA-Library=${path.dirname(path.resolve(spec))}`] : []),
      "-cp",
      tools.jar,
      "tlc2.TLC",
      "-workers",
      workers,
      "-metadir",
      metadir,
      "-deadlock",
      "-continue",
      ...(dump ? ["-dump", "dot,actionlabels", path.resolve(dump)] : []),
      "-config",
      path.resolve(`${base}.cfg`),
      module ? path.resolve(module) : path.basename(spec),
    ],
    { cwd: path.dirname(path.resolve(spec)) },
    dump,
  );
  fs.rmSync(metadir, { recursive: true, force: true });
  if (r.overflowed) {
    fs.writeFileSync(`${base}.out`, r.stdout);
    throw new TlcStopped(
      `${base}.out: TLC printed more than ${MAX_STRING_LENGTH.toLocaleString("en-US")} characters, the most that the command can read, so the command stopped TLC. Smaller constants make TLC print less.`,
    );
  }
  if (r.stopped) {
    fs.writeFileSync(`${base}.out`, r.stdout);
    return { stdout: r.stdout, stopped: true };
  }
  if (r.error || !/^TLC2 Version/m.test(r.stdout)) throw new CannotFinish(cannotRunTlc(tools, r));
  fs.writeFileSync(`${base}.out`, r.stdout);
  try {
    return { stdout: r.stdout, warning: tlcOutputWarning(r.stdout, `${base}.out`) };
  } catch (e) {
    throw new TlcStopped(e.message);
  }
}

function warnUnnamedSteps({ spec, copy }, cfg, dot) {
  const text = withoutComments(copy);
  const specName = /^SPECIFICATION\s+(\w+)/m.exec(cfg)?.[1];
  const specBody = specName && new RegExp(`^${specName}\\s*==(.*(\\n[ \\t]+.*)*)`, "m").exec(text);
  const next =
    /^NEXT\s+(\w+)/m.exec(cfg)?.[1] ?? /\[\]\s*\[\s*(\w+)\s*\]_/.exec(specBody?.[1] ?? text)?.[1];
  const graph = parseDot(fs.readFileSync(dot, "utf8"));
  const unnamed = [...graph.edges, ...graph.loops].filter((e) => e.action === next).length;
  if (unnamed > 0)
    console.error(
      `${rel(spec)}: ${unnamed} ${unnamed === 1 ? "step has" : "steps have"} the name ${next}, the whole next-state action. TLC goes down from ${next} through each \\/, \\E, LET, and definition, and names each step after the last definition on that path. It stops at any other expression, such as /\\, IF, or CASE. If the reader must tell these steps apart, join a definition for each kind of step with \\/ in ${next}, as in ${next} == Pay \\/ Charge, and move each conjunct of ${next} into those definitions.`,
    );
  return next;
}

function readModel(spec, cfgFile, flag, inputs) {
  const [copy, cfgCopy] = [spec, cfgFile].map((f) => inputs.copyOf(f));
  if (!fs.existsSync(copy)) throw new CannotFinish(`${rel(spec)} does not exist`);
  if (!fs.existsSync(cfgCopy)) {
    const beside = fs
      .readdirSync(path.dirname(spec))
      .filter((f) => f.endsWith(".cfg"))
      .sort();
    throw new CannotFinish(
      `${rel(cfgFile)} does not exist. Pass ${flag} with the config to check ${path.basename(spec)} with. ${
        beside.length
          ? `The configs beside it: ${beside.join(", ")}.`
          : "A config has SPECIFICATION and one INVARIANT line per rule."
      }`,
    );
  }
  return { spec, copy, cfgFile, ...splitRules(fs.readFileSync(cfgCopy, "utf8")) };
}

function readInput(spec, cfgFile, expected, inputs) {
  const model = readModel(spec, cfgFile, "--config", inputs);
  const names = [...model.rules, ...model.properties];
  const unknown = [...expected].filter((r) => !names.includes(r));
  if (unknown.length)
    throw new CannotFinish(
      `--expect-broken ${unknown.join(", ")}: not a rule in ${rel(model.cfgFile)}, whose rules are ${names.join(", ") || "none"}.`,
    );
  return model;
}

async function check(tools, model, { work, out, role }, expected) {
  const { spec, copy, cfgFile, cfgWithoutRules, rules, properties } = model;
  const started = Date.now();
  let runs = 0;
  const run = (cfg, file, options) => {
    runs++;
    return tlc(tools, copy, cfg, file, options);
  };
  const name = path.basename(spec, ".tla");
  const tlcDir = path.join(work, "tlc", ...(role ? [role] : []));
  fs.mkdirSync(tlcDir, { recursive: true });
  console.log(`TLC on ${rel(spec)} with ${rel(cfgFile)}:`);
  if (rules.length === 0)
    console.log(
      `  ${path.basename(cfgFile)} has no INVARIANT, so ${properties.length ? "the chart marks no state broken" : "no rule is checked"}.`,
    );
  const said = (rule, broken) =>
    `  ${rule} ${broken ? (expected.has(rule) ? "is broken (expected)" : "is broken") : "holds"}.`;
  const shown = published(work, out);
  const traces = [];
  for (const rule of rules) {
    const file = path.join(tlcDir, `${name}-${rule}`);
    const cfg = `${cfgWithoutRules}INVARIANT ${rule}\nCONSTRAINT ${rule}\n`;
    let result = await run(cfg, file, { workers: "auto" });
    // Several workers can reach a bad state by a longer path first. One worker searches breadth
    // first in a fixed order, so the chart's bug paths are the shortest, and the same every run.
    if (/^Error: Invariant /m.test(result.stdout)) result = await run(cfg, file);
    const broken = /^Error: Invariant /m.test(result.stdout);
    console.log(said(rule, broken));
    if (result.warning) console.error(`${shown(`${file}.out`)}: ${result.warning}`);
    traces.push({ file: `${file}.out`, rule, broken });
  }
  const temporal = [];
  for (const property of properties) {
    const file = path.join(tlcDir, `${name}-${property}`);
    const { stdout } = await run(`${cfgWithoutRules}PROPERTY ${property}\n`, file, {
      workers: "auto",
    });
    const broken = BROKEN_PROPERTY.test(stdout);
    const notes = [
      broken &&
        `The chart draws only INVARIANT rules, so read TLC's counterexample in ${shown(`${file}.out`)}.`,
      checkedOnlyInInitialStates(spec, property) &&
        `TLC checked ${property} only in the initial states, because it has no [], <>, or ~>. List it as an INVARIANT to check every state.`,
    ];
    console.log([said(property, broken), ...notes.filter(Boolean)].join(" "));
    temporal.push({ file: `${file}.out`, rule: property, broken });
  }
  const dot = path.join(tlcDir, `${name}.dot`);
  const module = rules.length ? writeRulesModule(copy, rules, tlcDir) : undefined;
  const dumpCfg = module ? `${cfgWithoutRules}INVARIANT ${RULES_INVARIANT}\n` : cfgWithoutRules;
  const { stopped } = await run(dumpCfg, path.join(tlcDir, name), {
    dump: dot,
    module,
    workers: "1",
  });
  const dotBytes = fs.statSync(dot).size;
  const next = dotBytes <= MAX_STRING_LENGTH && warnUnnamedSteps(model, cfgWithoutRules, dot);
  const seconds = ((Date.now() - started) / 1000).toFixed(1);
  console.log(`  TLC ran ${runs} ${runs === 1 ? "time" : "times"} in ${seconds} s.`);
  const broken = [...traces, ...temporal].some((t) => t.broken);
  return {
    spec,
    copy,
    dot,
    dotBytes,
    stopped,
    next,
    dumpOut: path.join(tlcDir, `${name}.out`),
    traces,
    properties: temporal,
    broken,
  };
}

function rulesAsExpected(now, other, expected) {
  const brokenIn = (m) =>
    [...(m?.traces ?? []), ...(m?.properties ?? [])].filter((t) => t.broken).map((t) => t.rule);
  if (expected.size === 0) return !now.broken && !other?.broken;
  const unexpected = [...new Set([...brokenIn(now), ...brokenIn(other)])].filter(
    (r) => !expected.has(r),
  );
  const holds = [...expected].filter((r) => !brokenIn(now).includes(r));
  if (unexpected.length) console.log(`\nBroken but not expected: ${unexpected.join(", ")}.`);
  if (holds.length) console.log(`\nExpected to break but holds: ${holds.join(", ")}.`);
  if (!unexpected.length && !holds.length)
    console.log(`\nBroken as expected: ${[...expected].join(", ")}.`);
  return !unexpected.length && !holds.length;
}

async function draw({ now, other, uncited, map, work, out, title, comparing, cover }) {
  const huge = [now, other].find((m) => m?.dotBytes > MAX_STRING_LENGTH);
  const limit = MAX_STRING_LENGTH.toLocaleString("en-US");
  if (huge)
    throw new NotPublished(
      `${rel(huge.spec)}: TLC's state graph ${huge.stopped ? `passed ${limit} bytes, the most that the command can read, so the command stopped TLC and draws no chart` : `has ${huge.dotBytes.toLocaleString("en-US")} bytes, more than the ${limit} that the command can read, so it draws no chart`}. The rule results above stand. Smaller constants make a smaller graph.`,
    );
  const shown = published(work, out);
  const mapping = await import(pathToFileURL(path.resolve(map)).href);
  const from = ["--dot", now.dot, "--broken", now.dumpOut, "--map", map, "--spec", now.copy];
  for (const m of [now, other]) if (m?.next) from.push("--next", m.next);
  from.push(...now.traces.flatMap((t) => ["--traces", t.file]));
  if (other) {
    from.push(`--${other.role}-dot`, other.dot, `--${other.role}-broken`, other.dumpOut);
    from.push("--spec", other.copy);
    from.push(...other.traces.flatMap((t) => [`--${other.role}-traces`, t.file]));
    if (other.traces.length)
      from.push(`--${other.role}-rules`, other.traces.map((t) => t.rule).join(","));
    if (other.label !== undefined) from.push("--label", other.label);
    if (other.listed) from.push("--listed", JSON.stringify(other.listed));
  }
  if (comparing) from.push("--full-labels", "--flat", "--loops");
  const titled = (suffix) => (title ? ["--title", `${title}${suffix}`] : []);

  const files = {
    overview: path.join(work, "chart.mmd"),
    stories: path.join(work, "stories.md"),
    summary: path.join(work, "summary.json"),
  };
  const proof = path.join(work, "tlc", "regions-proof.mmd");
  const everyArrow = path.join(work, "tlc", "regions-all.mmd");
  script(
    "tlc-to-chart.mjs",
    [
      ...from,
      ...(comparing ? [] : ["--regions", "--proof", proof, "--regions-all", everyArrow]),
      ...(cover ? ["--cover"] : []),
      ...titled(""),
      "--highlight",
      "0",
      "--out",
      files.overview,
      "--story",
      files.stories,
      "--summary",
      files.summary,
    ],
    map,
  );
  const summary = JSON.parse(fs.readFileSync(files.summary, "utf8"));
  const L = summary.second?.label;
  const broken = [now, other].filter(Boolean).flatMap((m) => {
    const book = ruleBook(m.copy);
    const where = m === now ? "" : ` ${other.role === "fixed" ? "with" : "in"} ${L}`;
    const nameOf = readerStateNamer(mapping, m.dot);
    return m.properties
      .filter((p) => p.broken)
      .map((p) => ({
        where,
        property: {
          spec: rel(m.spec),
          property: p.rule,
          rule: book.get(p.rule)?.sentence ?? null,
          repeats: repeatsIn(fs.readFileSync(p.file, "utf8"), nameOf),
          counterexample: path.relative(work, p.file),
        },
      }));
  });
  const brokenProperties = broken.map((b) => b.property);
  fs.writeFileSync(
    files.summary,
    `${JSON.stringify({ ...summary, ...(uncited && { uncited }), brokenProperties }, null, 2)}\n`,
  );
  if (brokenProperties.length) {
    const lines = broken.map(
      ({ where, property: b }) =>
        `Rule broken${where}: ${[
          (b.rule ?? `\`${b.property}\``).replace(/\.?$/, "."),
          loopSentence(b.repeats),
          `TLC's counterexample is in ${b.counterexample}.`,
        ]
          .filter(Boolean)
          .join(" ")}`,
    );
    const bugs = fs.readFileSync(files.stories, "utf8");
    fs.writeFileSync(
      files.stories,
      `${bugs}${bugs && "\n"}## Broken rules that the chart does not draw\n\n${lines.join("\n")}\n`,
    );
  }
  const charts = [files.overview];
  for (const c of summary.classes) {
    const views = typeof mapping.detail === "function" ? ["", "-developer", "-layered"] : [""];
    for (const view of views) {
      const file = path.join(work, `bug-${c.n}${view}.mmd`);
      const shape = [...(view ? ["--view", view.slice(1)] : []), "--path-only"];
      script(
        "tlc-to-chart.mjs",
        [...from, ...shape, ...titled(`, bug ${c.n}`), "--highlight", String(c.n), "--out", file],
        map,
      );
      charts.push(file);
    }
  }

  const { works, wrong, fixed: fixedCount, mixed, after, worse } = summary.chartStatus;
  console.log(
    `\nChart: ${summary.chartStates} states and ${summary.chartTransitions} transitions from ${summary.modelStates} model states.`,
  );
  const r = summary.regions;
  if (r?.drawn)
    console.log(
      `It has 2 parallel regions, of ${r.states[0]} and ${r.states[1]} states. Proof: their ${r.all} arrows together make exactly the ${r.flat.states} states and ${r.flat.transitions} labeled steps of ${shown(proof)}, and the ${r.transitions} drawn arrows make only steps among them. ${shown(everyArrow)} has all ${r.all} arrows.`,
    );
  else if (r) console.log(`It has no parallel regions, because ${r.why}.`);
  const c = summary.cover;
  if (c?.drawn === false) console.log(`--cover draws every state, because ${c.why}.`);
  else if (c) {
    const list = (head, xs) => [
      ...(xs.length ? [head] : []),
      ...xs.slice(0, 10).map((x) => `  ${x}`),
      ...(xs.length > 10 ? [`  and ${xs.length - 10} more in summary.json`] : []),
    ];
    const left = [
      ...list("States left out:", c.leftOutStates),
      ...list("Transitions left out:", c.leftOutTransitions),
    ];
    console.log(
      left.length
        ? `--cover leaves out ${c.leftOutStates.length} of ${c.states} states and ${c.leftOutTransitions.length} of ${c.transitions} transitions. The counts of states that work or break a rule include the states it leaves out.\n${left.join("\n")}`
        : "--cover leaves out no state and no transition.",
    );
  }
  const verb = (n) => (n === 1 ? "breaks" : "break");
  const breaks = `${wrong} ${verb(wrong)} a rule`;
  const withFix = other?.role === "fixed" ? ` with ${L}` : "";
  const partly =
    (mixed ? `, ${mixed} ${verb(mixed)} a rule in some cases${withFix}` : "") +
    (after ? `, ${after} reached only after a bug${withFix}` : "") +
    (worse ? `, ${worse} ${verb(worse)} a rule only${withFix}` : "");
  console.log(
    other?.role === "fixed"
      ? `${works} work today, ${wrong} still wrong with ${L}, ${fixedCount} fixed or new with ${L}${partly}.\n`
      : other?.role === "against"
        ? `${works} work, ${breaks}, ${fixedCount} only in ${L}${partly}.\n`
        : `${works} work, ${breaks}${partly}.\n`,
  );
  if (summary.mixedStatus.length)
    console.log(
      `${summary.mixedStatus.length === 1 ? "This state breaks" : "These states break"} a rule in some cases and not in others:\n${summary.mixedStatus.map((t) => `  ${t}`).join("\n")}\n`,
    );
  if (summary.codeLike.length)
    console.log(
      `These labels or causes read like code. Write them in the reader's words in ${rel(map)}:\n${summary.codeLike.map((t) => `  ${t}`).join("\n")}\n`,
    );
  const stories = fs.readFileSync(files.stories, "utf8").trimEnd();
  console.log(
    summary.classes.length
      ? stories
      : ["No state breaks an INVARIANT rule.", stories].filter(Boolean).join("\n\n"),
  );
  return { files, charts };
}

const pngOf = (chart) => chart.replace(/(\.mmd)?$/, ".png");

function render(charts, { lib, theme }, shown) {
  const pngs = [];
  for (const chart of charts) {
    try {
      fs.writeFileSync(pngOf(chart), renderPng(lib, fs.readFileSync(chart, "utf8"), { theme }));
      pngs.push(pngOf(chart));
    } catch (e) {
      console.error(`could not render ${shown(chart)}: ${e.message}`);
    }
  }
  return pngs;
}

function finish({ work, out, inputs }, { files, charts }, ok, renderer) {
  unchanged(inputs, out);
  const pngs = renderer ? render(charts, renderer, published(work, out)) : [];
  publish(work, out, inputs);
  const written = [...charts, ...pngs, files.stories, files.summary]
    .map((f) => path.basename(f))
    .join(", ");
  console.log(`\nWrote ${written} in ${rel(out)}.`);
  if (renderer && pngs.length < charts.length) return 2;
  return ok ? 0 : 1;
}

function renderFile(input, flags, { lib, theme }) {
  const out = flags.out ?? pngOf(input);
  const step = (failed, f) => {
    try {
      return f();
    } catch (e) {
      throw new CannotFinish(`${failed}: ${e.message}`);
    }
  };
  const src = step(`cannot read ${rel(input)}`, () => fs.readFileSync(input, "utf8"));
  const png = step(`could not render ${rel(input)}`, () => renderPng(lib, src, { theme }));
  step(`cannot write ${rel(out)}`, () => {
    fs.mkdirSync(path.dirname(path.resolve(out)), { recursive: true });
    fs.writeFileSync(out, png);
  });
  console.log(`Wrote ${rel(out)}.`);
  return 0;
}

const published = (work, out) => (file) => rel(path.join(out, path.relative(work, file)));

const OWN =
  /^((chart|bug-\d+(-developer|-layered)?)\.(mmd|png)|stories\.md|summary\.json|tlc|\.DS_Store)$/;

function foreign(dir) {
  try {
    return fs
      .readdirSync(dir)
      .filter((f) => !OWN.test(f))
      .sort();
  } catch (e) {
    if (e.code === "ENOENT") return [];
    throw new CannotFinish(`cannot use ${rel(dir)} as the output folder: ${e.message}`);
  }
}

function refuseForeign(out, files = foreign(out)) {
  const [first, ...others] = files;
  if (first)
    throw new CannotFinish(
      `${rel(out)} has ${others.length ? `${others.length + 1} files that this command did not write, such as ${first}` : `a file that this command did not write: ${first}`}. A run puts its files in place of the whole output folder, so pass --out with a new folder.`,
    );
}

function outDir(flagged, input, name) {
  const out = flagged ?? path.join(path.dirname(input), `${name}-statechart`);
  refuseForeign(out);
  return out;
}

async function inWorkFolder(body) {
  const work = fs.mkdtempSync(path.join(os.tmpdir(), "statechart-"));
  fs.mkdirSync(path.join(work, "tlc"));
  let keep = false;
  try {
    return await body(work);
  } catch (e) {
    keep = fs.readdirSync(path.join(work, "tlc")).some((f) => f.endsWith(".out"));
    if (keep && !(e instanceof TlcStopped))
      e.message += ` The files that this run wrote are in ${rel(work)}.`;
    throw e;
  } finally {
    if (!keep) fs.rmSync(work, { recursive: true, force: true });
  }
}

const moved = (from, to, ...missed) => {
  try {
    fs.renameSync(from, to);
    return true;
  } catch (e) {
    if (missed.includes(e.code)) return false;
    if (!["ENOSYS", "EXDEV", "EISDIR"].includes(e.code)) throw e;
  }
  // Some filesystems, such as FUSE mounts, cannot rename a folder that has files. They fail with
  // ENOSYS, or with EISDIR when the target exists. They can rename an empty folder.
  if (!fs.existsSync(from) && missed.includes("ENOENT")) return false;
  const claimed = claimedFolder(to, missed);
  if (claimed === null) return false;
  try {
    copyExclusive(from, to);
    if (!sameFolder(to, claimed))
      throw new Error("another run replaced the folder during the copy");
  } catch (e) {
    if (sameFolder(to, claimed)) fs.rmSync(to, { recursive: true, force: true });
    throw e;
  } finally {
    fs.closeSync(claimed);
  }
  fs.rmSync(from, { recursive: true, force: true });
  return true;
};

function claimedFolder(to, missed) {
  // Making a folder and opening it take two calls. Another run can replace the folder at `to`
  // between them. So the run opens its folder before it moves the folder to `to`.
  // A filesystem can reuse a removed folder's inode number. Holding this folder open keeps its
  // number, so a folder that another run makes in its place cannot match it.
  const mine = fs.mkdtempSync(path.join(path.dirname(to), `.${path.basename(to)}-`));
  const claimed = fs.openSync(mine, "r");
  try {
    fs.renameSync(mine, to);
    return claimed;
  } catch (e) {
    fs.closeSync(claimed);
    fs.rmdirSync(mine);
    if (missed.includes(e.code)) return null;
    throw e;
  }
}

function sameFolder(at, claimed) {
  const now = fs.statSync(at, { throwIfNoEntry: false });
  const made = fs.fstatSync(claimed);
  return now?.dev === made.dev && now?.ino === made.ino;
}

function copyExclusive(from, to) {
  for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
    const source = path.join(from, entry.name);
    const target = path.join(to, entry.name);
    if (entry.isDirectory()) {
      fs.mkdirSync(target);
      copyExclusive(source, target);
    } else fs.copyFileSync(source, target, fs.constants.COPYFILE_EXCL);
  }
}

function unchanged(inputs, out) {
  const changed = inputs.changed();
  if (changed)
    throw new NotPublished(
      `${rel(changed)} changed while this run read it, so the run left ${rel(out)} as it was. Run the command again.`,
    );
}

function publish(work, out, inputs) {
  const parent = path.dirname(path.resolve(out));
  fs.mkdirSync(parent, { recursive: true });
  const next = fs.mkdtempSync(path.join(parent, `.${path.basename(out)}-`));
  const old = `${next}-old`;
  let aside = false;
  try {
    fs.cpSync(work, next, { recursive: true });
    unchanged(inputs, out);
    refuseForeign(out);
    while (!moved(next, out, "ENOTEMPTY", "EEXIST")) {
      if (aside) {
        refuseForeign(out);
        fs.rmSync(old, { recursive: true, force: true });
        aside = false;
      }
      aside = moved(out, old, "ENOENT");
      if (aside) refuseForeign(out, foreign(old));
    }
  } catch (e) {
    const back = !aside || putBack(old, out);
    fs.rmSync(next, { recursive: true, force: true });
    const why = e instanceof CannotFinish ? e.message : `cannot replace ${rel(out)}: ${e.message}.`;
    if (!back)
      throw new NotPublished(
        `${why} This run moved the previous ${rel(out)} to ${rel(old)} and could not put it back.`,
      );
    throw new NotPublished(
      e instanceof CannotFinish ? why : `${why} The run left ${rel(out)} as it was.`,
    );
  }
  if (aside) fs.rmSync(old, { recursive: true, force: true });
}

function putBack(old, out) {
  try {
    return moved(old, out, "ENOTEMPTY", "EEXIST");
  } catch {
    return false;
  }
}

function secondCfg(cfg, flags) {
  if (flags["fixed-config"] && !flags.fixed)
    throw new CannotFinish(`--fixed-config needs --fixed. ${more("from-spec")}`);
  if (flags["against-config"] && !flags.against)
    throw new CannotFinish(`--against-config needs --against. ${more("from-spec")}`);
  if (flags.fixed)
    return flags["fixed-config"] ?? (fs.existsSync(cfgOf(flags.fixed)) ? cfgOf(flags.fixed) : cfg);
  return flags.against && (flags["against-config"] ?? cfgOf(flags.against));
}

function secondModel(input, cfg, { fixed, against, label }, inputs) {
  if (fixed && against)
    throw new CannotFinish(`use --fixed or --against, not both. ${more("from-spec")}`);
  if (!fixed && !against) {
    if (label === undefined) return null;
    throw new CannotFinish(
      `--label names the --fixed or --against model; it needs one of them. ${more("from-spec")}`,
    );
  }
  const [role, spec] = fixed ? ["fixed", fixed] : ["against", against];
  if (path.resolve(spec) === path.resolve(input))
    throw new CannotFinish(`--${role} needs a file other than the spec, ${rel(input)}.`);
  return { role, label, model: readModel(spec, cfg, `--${role}-config`, inputs) };
}

function warnUnchecked(now, other) {
  const unchecked = now.rules.filter((r) => !other.rules.includes(r));
  if (unchecked.length)
    console.error(
      `${rel(other.cfgFile)} does not check ${unchecked.join(", ")}, so the stories cannot say whether ${rel(other.spec)} keeps ${unchecked.length === 1 ? "it" : "them"}.`,
    );
}

function listedBreaks(spec) {
  const dir = path.dirname(spec);
  const files = fs.readdirSync(dir).sort();
  const modules = files.filter((f) => f.endsWith(".tla") && !f.includes("_TTrace_"));
  const only = modules.length === 1 ? path.basename(modules[0], ".tla") : undefined;
  const breaks = {};
  let headed = false;
  for (const f of files.filter((f) => f.endsWith(".cfg"))) {
    const cfg = fs.readFileSync(path.join(dir, f), "utf8");
    const module = /^\\\* module:[ \t]*(\w+)[ \t]*$/m.exec(cfg)?.[1] ?? only;
    const expect = /^\\\* expect:[ \t]*(\w+)[ \t]*$/m.exec(cfg)?.[1];
    if (module !== path.basename(spec, ".tla") || !expect) continue;
    headed = true;
    if (!/^(pass|deadlock)$|^error/.test(expect)) breaks[f] = expect;
  }
  return headed ? { spec: path.basename(spec), breaks } : null;
}

function warnUnlisted(now, other) {
  if (other.listed || !now.traces.some((t) => t.broken)) return;
  const module = path.basename(other.spec, ".tla");
  console.error(
    `No config beside ${rel(other.spec)} has an "\\* expect:" line for ${module}, so the stories cannot say whether ${module} already lists each bug. When ${path.basename(other.spec)} is a copy, pass the spec in its own folder.`,
  );
}

function warnUncited(models) {
  return Object.fromEntries(
    models.map(({ spec, copy, traces, properties }) => {
      const found = uncitedConditions(fs.readFileSync(copy, "utf8"));
      const held = [...traces, ...properties].filter((t) => !t.broken).map((t) => t.rule);
      const short = (s) => (s.length > 90 ? `${s.slice(0, 87)}...` : s);
      if (found.length && held.length)
        console.error(
          `${rel(spec)}: ${joinAnd(held)} ${held.length === 1 ? "holds" : "hold"}, but a rule can also hold because the model waits for a condition that the code does not check. No comment gives the file and line of the code that checks ${found.length === 1 ? "this condition" : "these conditions"}:\n${found.map((c) => `  ${rel(spec)}:${c.line} ${c.action}: ${short(c.condition)}`).join("\n")}\nPut that file and line in a comment on each condition, as in \\* pay.ts:120, or remove the condition when no code checks it.`,
        );
      return [rel(spec), found];
    }),
  );
}

async function fromSpec(input, { "expect-broken": expected, title, cover, ...flags }, renderer) {
  const name = path.basename(input, ".tla");
  const map = flags.map ?? path.join(path.dirname(input), `${name}.map.mjs`);
  const cfg = flags.config ?? cfgOf(input);
  const otherCfg = secondCfg(cfg, flags);
  const inputs = new Inputs().add([input, cfg, map, flags.fixed ?? flags.against, otherCfg]);
  const second = secondModel(input, otherCfg, flags, inputs);
  const listed = second?.role === "against" ? listedBreaks(second.model.spec) : undefined;
  const model = readInput(input, cfg, expected, inputs);
  const out = outDir(flags.out, input, name);
  if (!fs.existsSync(map)) {
    fs.writeFileSync(map, SCAFFOLD(name, input));
    throw new CannotFinish(`Wrote ${rel(map)}. Fill in its labels, then run this command again.`);
  }
  const tools = findTools();
  return inWorkFolder(async (work) => {
    const now = await check(tools, model, { work, out }, expected);
    const other = second && {
      role: second.role,
      label: second.label,
      listed,
      ...(await check(tools, second.model, { work, out, role: second.role }, expected)),
    };
    let uncited;
    if (second) {
      warnUnchecked(model, second.model);
      if (second.role === "against") warnUnlisted(now, other);
      uncited = warnUncited(second.role === "fixed" ? [now, other] : [now]);
    }
    const drawn = await draw({ now, other, uncited, map, work, out, title, cover });
    return finish({ work, out, inputs }, drawn, rulesAsExpected(now, other, expected), renderer);
  });
}

async function fromChart(input, { "expect-broken": expected, ...flags }, renderer) {
  const name =
    flags.module ??
    path
      .basename(input, path.extname(input))
      .replace(/(^|[^A-Za-z0-9]+)([A-Za-z0-9])/g, (_, __, c) => c.toUpperCase());
  if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
    throw new CannotFinish(`cannot make a TLA+ module name from ${input}; add --module NAME`);
  const spec = path.join(path.dirname(input), `${name}.tla`);
  const map = spec.replace(/\.tla$/, ".map.mjs");
  const inputs = new Inputs().add([input]);
  if (fs.existsSync(spec)) {
    console.log(`Kept ${rel(spec)}. Delete it to write the spec again from ${rel(input)}.`);
  } else {
    script("chart-to-tla.mjs", [input, "--module", name], input);
    console.log(`Wrote ${name}.tla, ${name}.cfg, and ${name}.map.mjs from ${rel(input)}.`);
  }
  inputs.add([spec, cfgOf(spec), map]);
  const tools = findTools();
  const model = readInput(spec, cfgOf(spec), expected, inputs);
  const out = outDir(flags.out, input, name);
  return inWorkFolder(async (work) => {
    const now = await check(tools, model, { work, out }, expected);
    const drawn = await draw({ now, map, work, out, title: flags.title, comparing: true });
    const compared = script(
      "compare-charts.mjs",
      [inputs.copyOf(input), drawn.files.overview],
      input,
      {
        okExits: [0, 1],
      },
    );
    if (compared.status === 0) console.log(`\nThe spec draws ${rel(input)} back unchanged.`);
    else
      console.log(
        `\nThe spec does not draw ${rel(input)}:\n${compared.stdout.trimEnd().replace(/^/gm, "  ")}`,
      );
    return finish(
      { work, out, inputs },
      drawn,
      rulesAsExpected(now, null, expected) && compared.status === 0,
      renderer,
    );
  });
}

try {
  const { help, command, input, flags } = parseArgs(process.argv.slice(2));
  if (help) {
    console.log(help);
    process.exit(0);
  }
  process.exit(await COMMANDS[command].run(input, flags, await rendererFor(command, flags)));
} catch (e) {
  if (!(e instanceof CannotFinish)) throw e;
  console.error(e.message);
  process.exit(2);
}

---
title: "An edge into a group from above"
---
stateDiagram-v2
  state "Outside" as a
  state "A group" as G {
    state "Inside one" as i1
    state "Inside two" as i2
    i1 --> i2 : go
  }
  state "After" as b
  [*] --> a
  a --> G : into the group
  G --> b : out of the group
  a --> i2 : straight to a child

---
title: "Parcel and payment"
config:
  markdownAutoWrap: false
  state:
    useMaxWidth: false
---
stateDiagram-v2
  classDef plain fill:#f4f6f7,stroke:#566573,color:#1b2631
  classDef plainWrong fill:#f4f6f7,stroke:#c0392b,stroke-width:4px,color:#7b241c
  classDef group0 fill:#d6eaf8,stroke:#6b757c,color:#1b2631
  classDef group0Wrong fill:#d6eaf8,stroke:#c0392b,stroke-width:4px,color:#7b241c
  classDef group1 fill:#fdebd0,stroke:#7f7668,color:#1b2631
  state "Legend" as legend {
    state "Card on file" as legendGroup0
    state "No card yet" as legendGroup1
    state "Breaks a rule" as legendWrong
  }
  class legendGroup0 group0
  class legendGroup1 group1
  class legendWrong plainWrong
  state "At the same time" as regions {
    state "The parcel" as region0 {
      [*] --> r0s0
      state "Label printed" as r0s0
      state "In transit" as r0s1
      state "Out for delivery" as r0s2
      state "Left at the front door<br/>without a signature" as r0s3
      state "Held at the depot after<br/>a missed delivery" as r0s4
      state "Sent back to the shop" as r0s5
      r0s0 --> r0s1 : the courier scans the label<br/>at the depot
      r0s1 --> r0s2 : the van leaves the depot with<br/>the parcel on board
      r0s2 --> r0s3 : the courier leaves the parcel<br/>at the door [when charged<br/>once]
      r0s2 --> r0s4 : nobody answers the door<br/>before the van moves on
      r0s4 --> r0s2 : the depot books a second<br/>delivery for the next day
      r0s4 --> r0s5 : the parcel waits at the depot<br/>for more than fourteen days
    }
    --
    state "Payment" as region1 {
      [*] --> r1s0
      state "No card on file" as r1s0
      state "Card saved, waiting<br/>for the charge" as r1s1
      state "Charged once" as r1s2
      state "Charged twice for<br/>one parcel" as r1s3
      state "Refund sent while the<br/>parcel was on the doorstep" as r1s4
      r1s0 --> r1s1 : you save a card on the<br/>checkout page
      r1s1 --> r1s2 : the bank approves the charge<br/>for the parcel
      r1s2 --> r1s3 : the payment service retries<br/>a charge that went through
      r1s2 --> r1s4 : the shop sends a refund before<br/>the parcel comes back [when<br/>left at the front door]
    }
  }
  class r0s0 group1
  class r0s1 plain
  class r0s2 plain
  class r0s3 plainWrong
  class r0s4 plain
  class r0s5 plain
  class r1s0 group1
  class r1s1 group0
  class r1s2 group0
  class r1s3 group0Wrong
  class r1s4 group0Wrong

import assert from "node:assert/strict";
import { constants } from "node:buffer";
import { spawn, spawnSync } from "node:child_process";
import {
  cpSync,
  existsSync,
  mkdirSync,
  mkdtempSync,
  readdirSync,
  readFileSync,
  renameSync,
  rmSync,
  statSync,
  symlinkSync,
  utimesSync,
  writeFileSync,
} from "node:fs";
import { tmpdir } from "node:os";
import { basename, delimiter, dirname, join, posix, win32 } from "node:path";
import { test } from "node:test";
import { setTimeout as sleep } from "node:timers/promises";
import { fileURLToPath, pathToFileURL } from "node:url";
import { crc32, inflateSync } from "node:zlib";
import {
  checkedOnlyInInitialStates,
  groupClassDef,
  parseDot,
  parseMermaid,
  parseTraces,
  parseValue,
  ruleSentences,
  stateKey,
  STATUS_CLASSES,
  tlcOutputWarning,
  uncitedConditions,
} from "../lib.mjs";
import {
  CACHE_NAME,
  cacheDir,
  fcMatch,
  fontMeasurer,
  loadRenderer,
  renderChart,
  THEMES,
} from "../render.mjs";
import { ruleBook } from "../rule-book.mjs";
import { copyPath } from "../snapshot.mjs";
import { findTlc, JAVA_TOOL, TLC_TOOL } from "../tlc-tools.mjs";

const here = dirname(fileURLToPath(import.meta.url));
const scripts = dirname(here);
const fixture = (name) => readFileSync(join(here, name), "utf8");
const edges = (r) => r.transitions.map((t) => `${t.from} -> ${t.to} : ${t.label}`).sort();
const node = (script, args, cwd, env = {}, at = scripts) => {
  const r = spawnSync(process.execPath, [join(at, script), ...args], {
    cwd,
    encoding: "utf8",
    env: { ...process.env, ...env },
    timeout: 120_000,
  });
  r.stdout = r.stdout?.replace(/^( {2}TLC ran \d+ times? in )\d+\.\d s\.$/gm, "$1N s.");
  return r;
};
const statusOf = (chart) => {
  const names = new Map(
    [...chart.matchAll(/^ {2}state "([^"]+)" as (s\d+)$/gm)].map((m) => [
      m[2],
      m[1].replace(/<br\/>/g, " "),
    ]),
  );
  return Object.fromEntries(
    [...chart.matchAll(/^ {2}class (s\d+) (\w+)$/gm)].map((m) => [names.get(m[1]), m[2]]),
  );
};

test("a transition on a composite leaves from every state inside it", () => {
  const { regions } = parseMermaid(fixture("upload.mmd"));
  const main = regions.Main;
  assert.deepEqual([...main.states].sort(), [
    "Nothing chosen",
    "Upload failed",
    "Uploaded",
    "Uploading.Checking the file",
    "Uploading.Sending the file",
  ]);
  assert.deepEqual([...main.initial], ["Nothing chosen"]);
  assert.deepEqual(edges(main), [
    "Nothing chosen -> Uploading.Sending the file : you choose a file",
    "Upload failed -> Uploading.Sending the file : you retry",
    "Uploading.Checking the file -> Nothing chosen : you cancel",
    "Uploading.Checking the file -> Upload failed : the network drops",
    "Uploading.Checking the file -> Uploaded : the check passes",
    "Uploading.Sending the file -> Nothing chosen : you cancel",
    "Uploading.Sending the file -> Upload failed : the network drops",
    "Uploading.Sending the file -> Uploading.Checking the file : the last byte arrives",
  ]);
});

test("the deepest source wins when a composite and a state inside it share a label", () => {
  const { regions } = parseMermaid(`stateDiagram-v2
  state Form {
    [*] --> Typing
    Typing --> Confirm : you press Escape
    state Confirm
  }
  [*] --> Form
  Form --> Closed : you press Escape
  Confirm --> Closed : you press Escape`);
  assert.deepEqual(edges(regions.Main), [
    "Form.Confirm -> Closed : you press Escape",
    "Form.Typing -> Form.Confirm : you press Escape",
  ]);
});

test("a top-level composite split by -- makes one region per part", () => {
  const { regions, nevers } = parseMermaid(fixture("sync.mmd"));
  assert.deepEqual(Object.keys(regions), ["Connection", "Sync badge"]);
  assert.deepEqual(edges(regions["Sync badge"]), [
    "Synced -> Waiting to sync : the network drops",
    "Synced -> Waiting to sync : you edit a note",
    "Waiting to sync -> Synced : the server confirms",
  ]);
  assert.deepEqual(nevers, [
    {
      name: "NeverSyncedWhileOffline",
      states: ["Offline", "Synced"],
      sentence: 'You never see "Synced" while you are offline.',
    },
  ]);
});

test("a rule's sentence is the comment lines right above it, and a state key ignores field order", () => {
  const sentences = ruleSentences(`---- MODULE M ----
\\* Not about a rule.

\\* You never see "Saved"
\\* while the note is a draft.
NoFalseSaved == TRUE
Bare == TRUE
====`);
  assert.deepEqual(
    [...sentences],
    [["NoFalseSaved", 'You never see "Saved" while the note is a draft.']],
  );
  assert.equal(stateKey({ b: 1, a: { d: 2, c: [3] } }), stateKey({ a: { c: [3], d: 2 }, b: 1 }));
});

test("a rule defined in a module that the spec extends, directly or through another module, keeps its sentence and the step that breaks it", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "LampVars.tla"),
    `---- MODULE LampVars ----
VARIABLES light, wire
====
`,
  );
  writeFileSync(
    join(dir, "LampRules.tla"),
    `---- MODULE LampRules ----
EXTENDS LampVars
\\* The light never comes on over a shorted wire.
SafeLight == wire = "Short" => light # "On"
====
`,
  );
  writeFileSync(
    join(dir, "LampSteps.tla"),
    `---- MODULE LampSteps ----
EXTENDS LampRules
Short == wire = "Ok" /\\ wire' = "Short" /\\ UNCHANGED light
SwitchOn == light = "Off" /\\ light' = "On" /\\ UNCHANGED wire
====
`,
  );
  writeFileSync(
    join(dir, "Lamp.tla"),
    `---- MODULE Lamp ----
EXTENDS Naturals,
        LampSteps
Init == light = "Off" /\\ wire = "Ok"
Spec == Init /\\ [][Short \\/ SwitchOn]_<<light, wire>>
====
`,
  );
  const dotNode = (id, light, wire, init) =>
    `${id} [label="/\\\\ light = \\"${light}\\"\\n/\\\\ wire = \\"${wire}\\""${init ? ",style = filled" : ""}]`;
  writeFileSync(
    join(dir, "Lamp.dot"),
    `strict digraph DiskGraph {
${dotNode(1, "Off", "Ok", true)}
${dotNode(2, "Off", "Short")}
${dotNode(3, "On", "Short")}
${dotNode(4, "On", "Ok")}
1 -> 2 [label="Short"];
2 -> 3 [label="SwitchOn"];
1 -> 4 [label="SwitchOn"];
4 -> 3 [label="Short"];
}`,
  );
  writeFileSync(
    join(dir, "Lamp.out"),
    `Error: Invariant SafeLight is violated.
Error: The behavior up to this point is:
State 1: <Initial predicate>
/\\ light = "Off"
/\\ wire = "Ok"

State 2: <Short line 3, col 10 to line 3, col 58 of module LampSteps>
/\\ light = "Off"
/\\ wire = "Short"

State 3: <SwitchOn line 4, col 13 to line 4, col 58 of module LampSteps>
/\\ light = "On"
/\\ wire = "Short"

${done}`,
  );
  writeFileSync(
    join(dir, "lamp.map.mjs"),
    'export const state = (v) => v.light;\nexport const step = (a) => ({ Short: "the wire shorts", SwitchOn: "you switch it on" })[a];\n',
  );
  const r = node(
    "tlc-to-chart.mjs",
    [
      ...["--dot", "Lamp.dot", "--map", "lamp.map.mjs", "--traces", "Lamp.out"],
      ...["--spec", "Lamp.tla", "--story", "story.md", "--out", "chart.mmd"],
    ],
    dir,
  );
  assert.equal(r.status, 0, r.stderr);
  const story = readFileSync(join(dir, "story.md"), "utf8");
  assert.match(story, /^Rule broken: The light never comes on over a shorted wire\.$/m);
  assert.match(story, /^1\. The wire shorts\. Now: Off\n2\. You switch it on\. Now: On$/m);
});

const lampRules = `---- MODULE LampRules ----
VARIABLES light, wire
\\* The light never comes on over a shorted wire.
SafeLight == wire = "Short" => light # "On"
\\* The wire never shorts.
NeverShorts == [](wire # "Short")
====
`;
const lampSteps = `Init == lamp = "Off" /\\ cable = "Ok"
Short == cable = "Ok" /\\ cable' = "Short" /\\ UNCHANGED lamp
SwitchOn == lamp = "Off" /\\ lamp' = "On" /\\ UNCHANGED cable
Spec == Init /\\ [][Short \\/ SwitchOn]_<<lamp, cable>>
====
`;
const lampMap =
  'export const state = (v) => v.lamp;\nexport const step = (a) => ({ Short: "the wire shorts", SwitchOn: "you switch it on" })[a];\n';

test("a rule that the spec pulls in through an unnamed INSTANCE with substitutions keeps its sentence and the step that breaks it", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "LampRules.tla"), lampRules);
  writeFileSync(
    join(dir, "Lamp.tla"),
    `---- MODULE Lamp ----
VARIABLES lamp, cable
INSTANCE LampRules
  WITH light <- lamp,
       wire <- cable
${lampSteps}`,
  );
  const dotNode = (id, lamp, cable, init) =>
    `${id} [label="/\\\\ cable = \\"${cable}\\"\\n/\\\\ lamp = \\"${lamp}\\""${init ? ",style = filled" : ""}]`;
  writeFileSync(
    join(dir, "Lamp.dot"),
    `strict digraph DiskGraph {
${dotNode(1, "Off", "Ok", true)}
${dotNode(2, "Off", "Short")}
${dotNode(3, "On", "Short")}
${dotNode(4, "On", "Ok")}
1 -> 2 [label="Short"];
2 -> 3 [label="SwitchOn"];
1 -> 4 [label="SwitchOn"];
4 -> 3 [label="Short"];
}`,
  );
  writeFileSync(
    join(dir, "Lamp.out"),
    `Error: Invariant SafeLight is violated.
Error: The behavior up to this point is:
State 1: <Initial predicate>
/\\ cable = "Ok"
/\\ lamp = "Off"

State 2: <Short line 7, col 10 to line 7, col 59 of module Lamp>
/\\ cable = "Short"
/\\ lamp = "Off"

State 3: <SwitchOn line 8, col 13 to line 8, col 59 of module Lamp>
/\\ cable = "Short"
/\\ lamp = "On"

${done}`,
  );
  writeFileSync(join(dir, "lamp.map.mjs"), lampMap);
  const r = node(
    "tlc-to-chart.mjs",
    [
      ...["--dot", "Lamp.dot", "--map", "lamp.map.mjs", "--traces", "Lamp.out"],
      ...["--spec", "Lamp.tla", "--story", "story.md", "--out", "chart.mmd"],
    ],
    dir,
  );
  assert.equal(r.status, 0, r.stderr);
  const story = readFileSync(join(dir, "story.md"), "utf8");
  assert.match(story, /^Rule broken: The light never comes on over a shorted wire\.$/m);
  assert.match(story, /^1\. The wire shorts\. Now: Off\n2\. You switch it on\. Now: On$/m);
});

test("rules reached through nested EXTENDS and INSTANCE keep their sentences and read the spec's variables behind each substitution", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const module = (name, body) =>
    writeFileSync(join(dir, `${name}.tla`), `---- MODULE ${name} ----\n${body}\n====\n`);
  module("Wire", `VARIABLE wire\n\\* The wire is never cut.\nIntact == wire # "Cut"`);
  module("Socket", `VARIABLE power\n\\* The socket always has power.\nLive == power = "On"`);
  module("Count", `VARIABLE v\n\\* The count never goes negative.\nOk == v >= 0`);
  module(
    "LampRules",
    `EXTENDS Naturals, Wire\nVARIABLE light\nPlug == INSTANCE Socket WITH power <- light\nLOCAL INSTANCE Count WITH v <- light\n\\* The light never comes on over a shorted wire.\nSafeLight == wire = "Short" => light # "On"`,
  );
  module(
    "Lamp",
    `EXTENDS TLC
VARIABLES lamp, wire
shown == lamp
INSTANCE LampRules WITH light <- shown
Rules == INSTANCE
    LampRules WITH light <- lamp, wire <- lamp
Quoted == INSTANCE Wire WITH wire <- IF lamp = "Cut<-" THEN wire ELSE "Cut"
Plain == Intact
Chain == Plain
Safe == Rules!SafeLight
Ok == wire # "Short"
\\* Its own words.
Worded == Rules!SafeLight`,
  );
  const book = ruleBook(join(dir, "Lamp.tla"));
  const reads = (rule) => [...book.get(rule).reads].sort();
  assert.deepEqual(reads("SafeLight"), ["lamp", "wire"]);
  assert.deepEqual(reads("Intact"), ["wire"]);
  assert.deepEqual(reads("Plug!Live"), ["lamp"]);
  assert.deepEqual(reads("Rules!SafeLight"), ["lamp"]);
  assert.deepEqual(reads("Worded"), ["lamp"]);
  assert.deepEqual(reads("Quoted!Intact"), ["lamp", "wire"]);
  assert.deepEqual(reads("Ok"), ["wire"]);
  const rules = [
    "SafeLight",
    "Rules!SafeLight",
    "Plug!Live",
    "Plain",
    "Chain",
    "Safe",
    "Ok",
    "Worded",
  ];
  assert.deepEqual(
    rules.map((rule) => book.get(rule).sentence),
    [
      "The light never comes on over a shorted wire.",
      "The light never comes on over a shorted wire.",
      "The socket always has power.",
      "The wire is never cut.",
      "The wire is never cut.",
      "The light never comes on over a shorted wire.",
      undefined,
      "Its own words.",
    ],
  );
});

test("a LOCAL INSTANCE or LOCAL definition stays inside the module that declares it, and a public name that starts with LOCAL does not", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const module = (name, body) =>
    writeFileSync(join(dir, `${name}.tla`), `---- MODULE ${name} ----\n${body}\n====\n`);
  module("Glow", `VARIABLE g\n\\* The glow is bright.\nOk == g = "Bright"`);
  module("Dim", `VARIABLE d\n\\* The glow is dim.\nOk == d = "Dim"`);
  module(
    "Base",
    `VARIABLE b\nLOCAL INSTANCE Dim WITH d <- b\nLOCAL Lit == b = "On"\n\\* The base is lit or dim.\nShown == Lit \\/ Ok\n\\* The base is never off.\nLOCALOn == b # "Off"`,
  );
  module("Room", `EXTENDS Base\nVARIABLE r\nINSTANCE Glow WITH g <- r\nHall == INSTANCE Base`);
  const book = ruleBook(join(dir, "Room.tla"));
  assert.deepEqual(book.get("Ok").sentence, "The glow is bright.");
  assert.deepEqual([...book.get("Ok").reads], ["r"]);
  assert.deepEqual(book.get("Shown").sentence, "The base is lit or dim.");
  assert.deepEqual([...book.get("Shown").reads], ["b"]);
  assert.deepEqual([...book.get("Hall!Shown").reads], ["b"]);
  assert.deepEqual(book.get("LOCALOn")?.sentence, "The base is never off.");
  assert.deepEqual(book.get("Hall!LOCALOn")?.sentence, "The base is never off.");
  assert.deepEqual(
    ["Lit", "Hall!Lit", "Hall!Ok"].filter((rule) => book.has(rule)),
    [],
  );
});

test("a rule that reads a CONSTANT reads the spec's variables that WITH puts in its place", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const module = (name, body) =>
    writeFileSync(join(dir, `${name}.tla`), `---- MODULE ${name} ----\n${body}\n====\n`);
  module(
    "Limit",
    `EXTENDS Naturals\nCONSTANTS Max, Fits(_, _)\nVARIABLE level\n\\* The level stays under the cap.\nUnder == Fits(level, Max)`,
  );
  module("Capped", `EXTENDS Limit\nVARIABLE spare\nRoom == spare + level <= Max`);
  module(
    "Tank",
    `EXTENDS Naturals
VARIABLES tank, cap, gap
Gauge == INSTANCE Limit WITH level <- tank, Max <- cap, Fits <- LAMBDA a, b : a <= b
Fixed == INSTANCE Limit WITH level <- tank, Max <- 3, Fits <- LAMBDA a, b : a <= b
Shell == INSTANCE Capped WITH level <- tank, spare <- gap, Max <- cap + 1, Fits <- LAMBDA a, b : a <= b`,
  );
  const book = ruleBook(join(dir, "Tank.tla"));
  const reads = (rule) => [...book.get(rule).reads].sort();
  assert.deepEqual(reads("Gauge!Under"), ["cap", "tank"]);
  assert.deepEqual(reads("Fixed!Under"), ["tank"]);
  assert.deepEqual(reads("Shell!Under"), ["cap", "tank"]);
  assert.deepEqual(reads("Shell!Room"), ["cap", "gap", "tank"]);
  assert.deepEqual(book.get("Gauge!Under").sentence, "The level stays under the cap.");
});

test("an action's condition on a variable that the action does not change needs a file and line", () => {
  const found = uncitedConditions(`---- MODULE Pay ----
CONSTANT MaxAge
VARIABLES screen, sent,
          paid, clock
Ready == sent > 0
Tick == clock' = clock + 1 /\\ UNCHANGED <<screen, sent, paid>>
Pay ==
  /\\ screen = "Cart \\* not a comment"
  /\\ MaxAge > 0
  /\\ clock < MaxAge (* pay.ts:120 *)
  /\\ Ready
  \\* checkout.ts:88
  /\\ sent < 3
  /\\ screen' = IF clock > 0 /\\ sent > 0 THEN "Paid" ELSE screen /\\ paid' = TRUE
  /\\ UNCHANGED <<sent, clock>>
\\* fill.ts:10
Fill == \\E o \\in 1..3 : /\\ paid = TRUE
                        /\\ clock > 0 /\\ sent' = o + 1
                        /\\ sent = o
                        /\\ paid => clock > 0 /\\ screen = "Cart"
                        /\\ UNCHANGED <<screen, paid, clock>>
Next == Tick \\/ Pay \\/ Fill
====`);
  assert.deepEqual(found, [
    { line: 11, action: "Pay", condition: "Ready" },
    { line: 17, action: "Fill", condition: "paid = TRUE" },
    { line: 18, action: "Fill", condition: "clock > 0" },
    { line: 20, action: "Fill", condition: 'paid => clock > 0 /\\ screen = "Cart"' },
  ]);
});

test("a rule reads the variables its helpers read, and not the ones its actions only change or leave unchanged", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "Door.tla"),
    `---- MODULE Door ----
VARIABLES door, lock, bell
rest == <<lock, bell>>
Locked == lock = "on"
NeverOpenWhileLocked == ~(door = "open" /\\ Locked)
Open == door = "shut" /\\ door' = "open" /\\ bell' = TRUE /\\ UNCHANGED lock
Close == door = "open" /\\ door' = "shut" /\\ UNCHANGED rest
System == Open \\/ Close
Settled == ~ENABLED System
====`,
  );
  const book = ruleBook(join(dir, "Door.tla"));
  assert.deepEqual([...book.get("NeverOpenWhileLocked").reads].sort(), ["door", "lock"]);
  assert.deepEqual([...book.get("Settled").reads], ["door"]);
});

test("a property is checked only in the initial states when no definition it reaches has a temporal operator", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "LampBase.tla"),
    `---- MODULE LampBase ----
VARIABLE on
Safe == [](on \\in BOOLEAN)
====
`,
  );
  writeFileSync(
    join(dir, "Lamp.tla"),
    `---- MODULE Lamp ----
VARIABLE on
vars == <<on>>
Base == INSTANCE LampBase
StaysOff == on = FALSE
NotEmpty == vars /= <<>>
Always == [](on \\in BOOLEAN)
Eventually == <>on
LeadsTo == on ~> ~on
WhilePlus == StaysOff -+-> StaysOff
Weak == WF_vars(on' = ~on)
Strong == SF_vars(on' = ~on)
Some == \\EE x : StaysOff
Every == \\AA x : StaysOff
ByHelper == Always
FromBase == Base!Safe
====
`,
  );
  const names = [
    "StaysOff",
    "NotEmpty",
    "Always",
    "Eventually",
    "LeadsTo",
    "WhilePlus",
    "Weak",
    "Strong",
    "Some",
    "Every",
    "ByHelper",
    "FromBase",
    "Missing",
  ];
  assert.deepEqual(
    names.filter((name) => checkedOnlyInInitialStates(join(dir, "Lamp.tla"), name)),
    ["StaysOff", "NotEmpty"],
  );
});

test("the legend is not part of the machine", () => {
  const { regions } = parseMermaid(`stateDiagram-v2
  state "Legend" as legend {
    state "Works today" as legendWorks
  }
  [*] --> A
  A --> B : go`);
  assert.deepEqual([...regions.Main.states].sort(), ["A", "B"]);
});

test("the parser refuses charts it cannot read", () => {
  assert.throws(() => parseMermaid("stateDiagram-v2\n  state A {\n  [*] --> B"), /unclosed/);
  assert.throws(() => parseMermaid("stateDiagram-v2\n  A ==> B"), /cannot read chart line/);
  assert.throws(
    () => parseMermaid("stateDiagram-v2\n  state A {\n    B --> C : go\n  }\n  [*] --> A"),
    /no \[\*\] --> start/,
  );
  assert.throws(
    () =>
      parseMermaid(
        "stateDiagram-v2\n  state A {\n    state B {\n      [*] --> C\n      --\n      [*] --> D\n    }\n    [*] --> B\n  }\n  [*] --> A",
      ),
    /below the top level/,
  );
  assert.throws(
    () => parseMermaid("stateDiagram-v2\n  [*] --> A\n  A --> [*] : you close the app"),
    /final state/,
  );
  assert.throws(
    () =>
      parseMermaid(
        'stateDiagram-v2\n  state "Something went wrong" as UploadError\n  state "Something went wrong" as SyncError\n  [*] --> UploadError\n  UploadError --> SyncError : go',
      ),
    /two states have the caption "Something went wrong"/,
  );
});

test("the parser reads class shorthand, repeated descriptions, and states first named inside a composite", () => {
  const { regions } = parseMermaid(`stateDiagram-v2
  classDef wrong fill:#fdd
  N : Nothing chosen
  N : press Upload to start
  [*] --> N
  N:::wrong --> Done : you finish
  Done --> Moving:::wrong
  state A {
    [*] --> X
    X --> Y : go
  }
  Moving --> A : start
  Y --> Z : next
  A --> N : cancel`);
  assert.deepEqual([...regions.Main.states].sort(), [
    "A.X",
    "A.Y",
    "Done",
    "Moving",
    "Nothing chosen",
    "Z",
  ]);
  assert.deepEqual(edges(regions.Main), [
    "A.X -> A.Y : go",
    "A.X -> Nothing chosen : cancel",
    "A.Y -> Nothing chosen : cancel",
    "A.Y -> Z : next",
    "Done -> Moving : ",
    "Moving -> A.X : start",
    "Nothing chosen -> Done : you finish",
  ]);
});

test("TLC values, states, graphs, and traces parse", () => {
  assert.deepEqual(parseValue('[a |-> <<1, "x">>, b |-> {TRUE}]'), { a: [1, "x"], b: [true] });
  assert.deepEqual(parseValue('("p" :> 1 @@ "q" :> 2)'), { p: 1, q: 2 });
  const graph = parseDot(`strict digraph DiskGraph {
1 [label="/\\\\ x = 0",style = filled]
2 [label="/\\\\ x = 1"]
1 -> 2 [label="Inc",color="black",fontcolor="black"];
1 -> 2 [label="Inc",color="black",fontcolor="black"];
2 -> 2 [label="Stay"];
}`);
  assert.equal(graph.nodes.get("1").init, true);
  assert.deepEqual(graph.nodes.get("2").vars, { x: 1 });
  assert.deepEqual(graph.edges, [{ from: "1", to: "2", action: "Inc" }]);
  assert.deepEqual(graph.loops, [{ from: "2", to: "2", action: "Stay" }]);
  assert.throws(
    () =>
      parseDot(
        'strict digraph DiskGraph {\n1 [label="/\\\\ x = 0",style = filled]\n2 [label="/\\\\ x = 1"]\n1 -> 2;\n}',
      ),
    /no action names/,
  );
  const [trace] = parseTraces(`Error: Invariant Small is violated.
Error: The behavior up to this point is:
State 1: <Initial predicate>
x = 0

State 2: <Inc line 9, col 8 to line 9, col 20 of module M>
x = 1
`);
  assert.equal(trace.invariant, "Small");
  assert.deepEqual(trace.steps, [
    { action: null, vars: { x: 0 } },
    { action: "Inc", vars: { x: 1 } },
  ]);
});

const done = "Model checking completed. No error has been found.\n";
const evaluationError = `Error: Invariant NoLost is violated.
Error: The behavior up to this point is:
State 1: <Initial predicate>
s = "Idle"

State 2: <Lose line 4, col 9 to line 4, col 33 of module F>
s = "Lost"

Error: TLC threw an unexpected exception.
This was probably caused by an error in the spec or model.

Error: The behavior up to this point is:
State 1: <Initial predicate>
s = "Idle"

State 2: <Save line 5, col 9 to line 5, col 35 of module F>
s = "Saving"

3 states generated, 3 distinct states found, 0 states left on queue.
`;

test("a rule broken by a start state is a counterexample of one state", () => {
  const text = `Error: Invariant NeverSyncedWhileOffline is violated by the initial state:
/\\ badge = "Synced"
/\\ conn = "Offline"

${done}`;
  assert.doesNotThrow(() => tlcOutputWarning(text, "tlc.out"));
  assert.deepEqual(parseTraces(text), [
    {
      invariant: "NeverSyncedWhileOffline",
      steps: [{ action: null, vars: { badge: "Synced", conn: "Offline" } }],
    },
  ]);
});

test("TLC output from a run that failed or stopped early is refused", () => {
  assert.doesNotThrow(() =>
    tlcOutputWarning(
      `Error: Invariant Small is violated.\nError: The behavior up to this point is:\nState 1: <Initial predicate>\nx = 0\n\n${done}`,
      "ok.out",
    ),
  );
  assert.throws(
    () =>
      tlcOutputWarning(
        "Error: The invariant Nope specified in the configuration file\nis not defined in the specification.\n",
        "cfg.out",
      ),
    /cfg\.out: TLC stopped on an error that is not a broken rule/,
  );
  assert.throws(
    () => tlcOutputWarning("Error: Parsing or semantic analysis failed.\n", "parse.out"),
    /not a broken rule/,
  );
  assert.throws(
    () =>
      tlcOutputWarning(
        "Error: Invariant Small is violated.\nError: The behavior up to this point is:\nState 1: <Initial predicate>\nx = 0\n",
        "stopped.out",
      ),
    /did not finish/,
  );
});

const tlcThrew = (cls, message) => `Error: Evaluating invariant Small failed.
Index 123 out of bounds for length 4
Error: TLC threw an unexpected exception.
This was probably caused by an error in the spec or model.
See the User Output or TLC Console for clues to what happened.
The exception was a ${cls}
: ${message}
Error: The error occurred when TLC was evaluating the nested
expressions at the following positions:
    The error call stack is empty.
`;
const smallBroken =
  "Error: Invariant Small is violated.\nError: The behavior up to this point is:\nState 1: <Initial predicate>\nx = 0\n\n";
const stoppedEarly = "9 states generated, 9 distinct states found, 4 states left on queue.\n";

test("a rule that TLC finds broken keeps its paths after any error that TLC then stops on, with a warning", () => {
  const warned = (rule, error) =>
    `TLC found that ${rule} is broken, and then stopped on an error: ${error}. The paths that TLC printed before it stopped are complete, but TLC did not check every state, so the charts can miss states that break ${rule}. A smaller constant can let TLC finish.`;
  const aioobe = "java.lang.ArrayIndexOutOfBoundsException: Index 123 out of bounds for length 4";
  const oneWorker = `${smallBroken}Error: Invariant Small is violated.\n${tlcThrew(
    "java.lang.ArrayIndexOutOfBoundsException",
    "Index 123 out of bounds for length 4",
  )}\n${stoppedEarly}`;
  assert.equal(tlcOutputWarning(oneWorker, "tlc.out"), warned("Small", aioobe));
  const workersInterleaved = `${tlcThrew("java.lang.RuntimeException", aioobe)}${smallBroken}${stoppedEarly}`;
  assert.equal(tlcOutputWarning(workersInterleaved, "tlc.out"), warned("Small", aioobe));
  assert.deepEqual(
    parseTraces(workersInterleaved).map((t) => t.invariant),
    ["Small"],
  );
  const arraycopy = (message) =>
    `${smallBroken}${tlcThrew("java.lang.ArrayIndexOutOfBoundsException", message)}${stoppedEarly}`;
  const negative = "java.lang.ArrayIndexOutOfBoundsException: arraycopy: length -3 is negative";
  assert.equal(
    tlcOutputWarning(arraycopy("arraycopy: length -3 is negative"), "tlc.out"),
    warned("Small", negative),
  );
  assert.equal(tlcOutputWarning(arraycopy(negative), "tlc.out"), warned("Small", negative));
  assert.equal(
    tlcOutputWarning(
      `${smallBroken}${tlcThrew("java.lang.RuntimeException", "util.Assert$TLCRuntimeException: Attempted to apply tuple")}${stoppedEarly}`,
      "formula.out",
    ),
    warned("Small", "util.Assert$TLCRuntimeException: Attempted to apply tuple"),
  );
  assert.equal(
    tlcOutputWarning(
      `${smallBroken}Error: Invariant Small is violated.\nError: Failed to recover the initial state from its fingerprint.\nThis is probably a TLC bug(4).\n${stoppedEarly}`,
      "fingerprint.out",
    ),
    warned("Small", "Failed to recover the initial state from its fingerprint"),
  );
  assert.equal(
    tlcOutputWarning(evaluationError, "eval.out"),
    warned("NoLost", "TLC threw an unexpected exception"),
  );
  assert.deepEqual(
    parseTraces(evaluationError).map((t) => t.invariant),
    ["NoLost"],
  );
  assert.throws(
    () =>
      tlcOutputWarning(
        `${tlcThrew("java.lang.ArrayIndexOutOfBoundsException", "Index 123 out of bounds for length 4")}${stoppedEarly}`,
        "never-broken.out",
      ),
    /not a broken rule: Evaluating invariant Small failed\./,
  );
});

test("a step that changes nothing keeps a state unsettled, and a quote in a reader label survives the chart", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "save.dot"),
    `strict digraph DiskGraph {
1 [label="/\\\\ s = \\"Idle\\"",style = filled]
2 [label="/\\\\ s = \\"Saving\\""]
1 -> 2 [label="Tap"];
2 -> 2 [label="Retry"];
}`,
  );
  writeFileSync(
    join(dir, "save.map.mjs"),
    `export const readerActions = ["Tap"];
export const state = (v, facts) => (v.s === "Idle" ? 'Badge says "Synced"' : facts.settled ? "Saved" : "Saving");
export const step = (action) => ({ Tap: "you tap Save" })[action] ?? "";
`,
  );
  const r = node(
    "tlc-to-chart.mjs",
    ["--dot", "save.dot", "--map", "save.map.mjs", "--highlight", "0", "--out", "chart.mmd"],
    dir,
  );
  assert.equal(r.status, 0, r.stderr);
  assert.deepEqual(edges(parseMermaid(readFileSync(join(dir, "chart.mmd"), "utf8")).regions.Main), [
    'Badge says "Synced" -> Saving : you tap Save',
  ]);
});

test("a map keys on the bare action name when TLC 1.8.0 writes each step with its parameters", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "seats.dot"),
    `strict digraph DiskGraph {
node [shape=box,style=rounded]
nodesep=0.35;
subgraph cluster_graph {
color="white";
1 [label="seat = <<\\"free\\", \\"free\\">>",style = filled]
1 -> 2 [label="Take(1)",color="black",fontcolor="black"];
2 [label="seat = <<\\"taken\\", \\"free\\">>",tooltip="seat = <<\\"taken\\", \\"free\\">>"];
1 -> 3 [label="Take(2)",color="black",fontcolor="black"];
3 [label="seat = <<\\"free\\", \\"taken\\">>",tooltip="seat = <<\\"free\\", \\"taken\\">>"];
2 -> 1 [label="Leave(1)",color="black",fontcolor="black"];
2 -> 4 [label="Take(2)",color="black",fontcolor="black"];
4 [label="seat = <<\\"taken\\", \\"taken\\">>",tooltip="seat = <<\\"taken\\", \\"taken\\">>"];
3 -> 4 [label="Take(1)",color="black",fontcolor="black"];
3 -> 1 [label="Leave(2)",color="black",fontcolor="black"];
4 -> 3 [label="Leave(1)",color="black",fontcolor="black"];
4 -> 2 [label="Leave(2)",color="black",fontcolor="black"];
{rank = same; 1;}
{rank = same; 3;2;}
{rank = same; 4;}
}
}`,
  );
  writeFileSync(
    join(dir, "seats.map.mjs"),
    `export const readerActions = ["Take", "Leave"];
const taken = (v) => v.seat.filter((s) => s === "taken").length;
export const state = (v) => ["Both free", "One taken", "Both taken"][taken(v)];
export const step = (action) => ({ Take: "you sit down", Leave: "you get up" })[action] ?? action;
`,
  );
  const draw = (...extra) => {
    const r = node(
      "tlc-to-chart.mjs",
      ["--dot", "seats.dot", "--map", "seats.map.mjs", "--out", "chart.mmd", ...extra],
      dir,
    );
    assert.equal(r.status, 0, r.stderr);
    return parseMermaid(readFileSync(join(dir, "chart.mmd"), "utf8")).regions.Main;
  };
  assert.deepEqual(edges(draw()), [
    "Both free -> One taken : you sit down",
    "Both taken -> One taken : you get up",
    "One taken -> Both free : you get up",
    "One taken -> Both taken : you sit down",
  ]);
  assert.deepEqual([...draw("--cover").states].sort(), ["Both free", "Both taken", "One taken"]);
});

function layeredHouse({
  extra = [],
  edges = "",
  state = '(v.x === "attic" ? "Upstairs" : "Downstairs")',
  detail = '(v.x === "porch" || v.x === "hall" ? v.x : "")',
} = {}) {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "house.dot"),
    `strict digraph DiskGraph {
1 [label="x = \\"start\\"",style = filled]
1 -> 2 [label="Side"];
2 [label="x = \\"porch\\""];
1 -> 3 [label="Front"];
3 [label="x = \\"hall\\""];
2 -> 4 [label="Arrive"];
4 [label="x = \\"attic\\""];
4 -> 1 [label="Leave"];
${edges}
}`,
  );
  writeFileSync(
    join(dir, "house.map.mjs"),
    `export const readerActions = ["Side", "Front", "Arrive"];
export const state = (v) => ${state};
export const detail = (v) => ${detail};
export const step = (a) => ({ Side: "you take the side door", Front: "you take the front door", Arrive: "you climb the stairs", Leave: "the lights go out" })[a];
`,
  );
  const r = node(
    "tlc-to-chart.mjs",
    [
      ...["--dot", "house.dot", "--map", "house.map.mjs", "--view", "layered"],
      ...["--out", "chart.mmd", ...extra],
    ],
    dir,
  );
  assert.equal(r.status, 0, r.stderr);
  return dir;
}

test("--cover names a layered state with an empty detail by its outer label alone", () => {
  const dir = layeredHouse({ extra: ["--cover", "--summary", "summary.json"] });
  const { cover } = JSON.parse(readFileSync(join(dir, "summary.json"), "utf8"));
  assert.deepEqual(cover.leftOutStates, ["Upstairs"]);
  assert.deepEqual(cover.leftOutTransitions, [
    "Downstairs: porch --> Upstairs: you climb the stairs [Arrive]",
    "Upstairs --> Downstairs: the lights go out [Leave]",
  ]);
});

test("a layered chart draws a state with an empty detail by its outer label alone, outside any box", () => {
  const chart = readFileSync(join(layeredHouse(), "chart.mmd"), "utf8");
  assert.doesNotMatch(chart, /state ""/);
  assert.match(
    chart,
    /^ {2}state "Downstairs" as g\d+ \{\n {4}state "hall" as s\d+\n {4}state "porch" as s\d+\n {2}\}$/m,
  );
  const plain = /^ {2}state "Downstairs" as (s\d+)$/m.exec(chart)?.[1];
  assert.ok(plain, chart);
  assert.match(chart, new RegExp(`^ {2}\\[\\*\\] --> ${plain}$`, "m"));
  assert.match(chart, /^ {2}state "Upstairs" as s\d+$/m);
});

test("a box's shared step stays on each state when a plain state outside the box has the box's name", () => {
  const chart = readFileSync(
    join(layeredHouse({ edges: '3 -> 4 [label="Arrive"];' }), "chart.mmd"),
    "utf8",
  );
  assert.doesNotMatch(chart, /^ {2}g\d+ --> /m);
  assert.deepEqual(
    flatEdges(chart).map((e) => e.replaceAll("<br/>", " ")),
    [
      "Downstairs --> Downstairs: hall : you take the front door [Front]",
      "Downstairs --> Downstairs: porch : you take the side door [Side]",
      "Downstairs: hall --> Upstairs : you climb the stairs [Arrive]",
      "Downstairs: porch --> Upstairs : you climb the stairs [Arrive]",
      "Upstairs --> Downstairs : the lights go out [Leave]",
    ],
  );
});

test("--flat draws a layered chart with no boxes, naming each state by its label and detail", () => {
  const chart = readFileSync(join(layeredHouse({ extra: ["--flat"] }), "chart.mmd"), "utf8");
  assert.doesNotMatch(chart, / as g\d+ \{$/m);
  assert.deepEqual([...chart.matchAll(/^ {2}state "([^"]+)" as s\d+$/gm)].map((m) => m[1]).sort(), [
    "Downstairs",
    "Downstairs: hall",
    "Downstairs: porch",
    "Upstairs",
  ]);
});

test("a layered chart and its --cover lists treat a blank state label or detail as absent", () => {
  const dir = layeredHouse({
    extra: ["--cover", "--summary", "summary.json"],
    state: '({ attic: "Upstairs", hall: " " })[v.x] ?? "Downstairs"',
    detail: '(v.x === "porch" || v.x === "hall" ? v.x : "  ")',
  });
  const chart = readFileSync(join(dir, "chart.mmd"), "utf8");
  assert.doesNotMatch(chart, /state ""/);
  assert.match(chart, /^ {2}state "Downstairs" as g\d+ \{\n {4}state "porch" as s\d+\n {2}\}$/m);
  assert.deepEqual([...chart.matchAll(/^ {2}state "([^"]+)" as s\d+$/gm)].map((m) => m[1]).sort(), [
    "Downstairs",
    "hall",
  ]);
  const { cover } = JSON.parse(readFileSync(join(dir, "summary.json"), "utf8"));
  assert.deepEqual(cover.leftOutStates, ["Upstairs"]);
  assert.deepEqual(cover.leftOutTransitions, [
    "Downstairs: porch --> Upstairs: you climb the stairs [Arrive]",
    "Upstairs --> Downstairs: the lights go out [Leave]",
  ]);
});

test("a large graph with a thousand bugs draws its overview and a bug chart in seconds", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const [states, bugs, bound] = [20_000, 1000, 10_000];
  const label = (n, broken) => `/\\\\ n = ${n}\\n/\\\\ broken = ${broken ? "TRUE" : "FALSE"}`;
  const dot = [];
  for (let i = 1; i <= states; i++) {
    dot.push(`${i} [label="${label(i, false)}"${i === 1 ? ",style = filled" : ""}];`);
    if (i < states) dot.push(`${i} -> ${i + 1} [label="Tick"];`);
    dot.push(`${i} -> ${((i * 7) % states) + 1} [label="Jump"];`);
  }
  const traces = [];
  for (let k = 1; k <= bugs; k++) {
    dot.push(`${states + k} [label="${label(k, true)}"];`, `1 -> ${states + k} [label="Break"];`);
    traces.push(
      `Error: Invariant ${k % 2 ? "Safe" : "Calm"} is violated.\nError: The behavior up to this point is:\nState 1: <Initial predicate>\n/\\ n = 1\n/\\ broken = FALSE\n\nState 2: <Break line 1, col 1 to line 1, col 2 of module M>\n/\\ n = ${k}\n/\\ broken = TRUE\n`,
    );
  }
  writeFileSync(join(dir, "big.dot"), `strict digraph DiskGraph {\n${dot.join("\n")}\n}\n`);
  writeFileSync(join(dir, "big.out"), `${traces.join("\n")}\n${done}`);
  writeFileSync(
    join(dir, "big.map.mjs"),
    `export const state = (v) => (v.broken ? "Broken" : "Counting");
export const step = (a) => ({ Tick: "a second passes", Jump: "it jumps", Break: "it breaks" })[a];
export const cause = (v) => (v.broken ? \`counter \${v.n} broke\` : null);
`,
  );
  for (const view of [
    "--highlight 0 --out chart.mmd --story stories.md --summary summary.json",
    "--highlight 1 --path-only --out bug-1.mmd",
  ]) {
    const input = `--dot big.dot --map big.map.mjs --traces big.out ${view}`.split(" ");
    const r = spawnSync(process.execPath, [join(scripts, "tlc-to-chart.mjs"), ...input], {
      cwd: dir,
      encoding: "utf8",
      timeout: bound,
    });
    assert.equal(r.signal, null, `${view} ran past ${bound / 1000} s`);
    assert.equal(r.status, 0, r.stderr);
  }
  const { classes } = JSON.parse(readFileSync(join(dir, "summary.json"), "utf8"));
  assert.equal(classes.length, bugs);
  assert.deepEqual(
    new Set(classes.map((c) => JSON.stringify([c.lastSteps, c.startsHere]))),
    new Set([JSON.stringify([["it breaks"], false])]),
  );
});

test("chart-to-tla writes one action per label and one invariant per never line", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd"));
  const r = node("chart-to-tla.mjs", ["sync.mmd", "--module", "Sync"], dir);
  assert.equal(r.status, 0, r.stderr);
  const spec = readFileSync(join(dir, "Sync.tla"), "utf8");
  assert.match(spec, /^VARIABLES connection, syncBadge$/m);
  assert.match(
    spec,
    /^TheNetworkDrops ==\n {4}\/\\ \(connection \\in \{"Online"\} \\\/ syncBadge \\in \{"Synced"\}\)$/m,
  );
  assert.match(
    spec,
    /^NeverSyncedWhileOffline == ~\(connection = "Offline" \/\\ syncBadge = "Synced"\)$/m,
  );
  assert.equal(
    readFileSync(join(dir, "Sync.cfg"), "utf8"),
    "SPECIFICATION Spec\nINVARIANT TypeOK\nINVARIANT NeverSyncedWhileOffline\n",
  );
  assert.match(r.stderr, /rules TypeOK NeverSyncedWhileOffline/);
});

test("chart-to-tla refuses a never line that names no state", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "c.mmd"),
    "stateDiagram-v2\n  [*] --> A\n  A --> B : go\n  %% never Bad: C -- never C\n",
  );
  const r = node("chart-to-tla.mjs", ["c.mmd", "--module", "C"], dir);
  assert.notEqual(r.status, 0);
  assert.match(r.stderr, /names "C", which is not a state/);
});

test("a never line names a state exactly, or every state inside a composite", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "c.mmd"),
    `stateDiagram-v2
  state "Saving" as S
  state "Saving..." as S2
  state Busy {
    [*] --> Checking
    Checking --> Sending : the check passes
  }
  [*] --> S
  S --> S2 : you wait
  S2 --> Busy : you send
  Busy --> S : you cancel
  %% never NoSaving: Saving -- You never see Saving.
  %% never NoBusy: Busy -- You are never busy.
`,
  );
  const r = node("chart-to-tla.mjs", ["c.mmd", "--module", "C"], dir);
  assert.equal(r.status, 0, r.stderr);
  const spec = readFileSync(join(dir, "C.tla"), "utf8");
  assert.match(spec, /^NoSaving == ~\(main = "Saving"\)$/m);
  assert.match(spec, /^NoBusy == ~\(main \\in \{"Busy\.Checking", "Busy\.Sending"\}\)$/m);
  assert.match(
    readFileSync(join(dir, "C.map.mjs"), "utf8"),
    /^export const readerActions = \[\];$/m,
  );
});

const door = `stateDiagram-v2
  state Door {
    [*] --> Locked
    Locked --> Unlocked : tap unlock
    Unlocked --> Locked : tap lock
    --
    [*] --> Closed
    Closed --> Open : open the door
    Open --> Closed : close the door
  }
  [*] --> Door`;
const flatDoor = (extra = []) =>
  [
    "stateDiagram-v2",
    '  state "Locked | Closed" as L_C',
    '  state "Locked | Open" as L_O',
    '  state "Unlocked | Closed" as U_C',
    '  state "Unlocked | Open" as U_O',
    "  [*] --> L_C",
    "  L_C --> U_C : tap unlock",
    "  U_C --> L_C : tap lock",
    "  L_O --> U_O : tap unlock",
    "  L_C --> L_O : open the door",
    "  L_O --> L_C : close the door",
    "  U_C --> U_O : open the door",
    "  U_O --> U_C : close the door",
    ...extra,
  ].join("\n");

test("compare reads parallel regions as one machine, so a guard across regions shows", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "agreed.mmd"), door);
  writeFileSync(join(dir, "guarded.mmd"), flatDoor());
  writeFileSync(join(dir, "free.mmd"), flatDoor(["  U_O --> L_O : tap lock"]));
  const differ = node("compare-charts.mjs", ["agreed.mmd", "guarded.mmd"], dir);
  assert.equal(differ.status, 1);
  assert.match(
    differ.stdout,
    /transitions only in EXPECTED[^\n]*:\n {2}Unlocked \| Open --> Locked \| Open : tap lock\n1 difference\(s\)/,
  );
  const same = node("compare-charts.mjs", ["agreed.mmd", "free.mmd"], dir);
  assert.equal(same.stdout.trim(), "same", same.stdout);
});

const lamp = `stateDiagram-v2
  state "Lamp" as lamp {
    state "Power" as power {
      [*] --> Off
      Off --> On : flip the switch
      On --> Off : flip the switch
    }
    --
    state "Bulb" as bulb {
      [*] --> Dark
      Dark --> Lit : warm up [when the<br/>power is on]
      %% when On
      Lit --> Dark : cool down [when the power is off]
      %% when not On
    }
  }
  %% never LitWhileOff: Off & Lit -- The bulb is never lit while the power is off.
`;

test("a %% when line guards a step on the other region's states, and [words] are only its text", () => {
  const { regions } = parseMermaid(lamp);
  assert.deepEqual(regions.Bulb.transitions, [
    { from: "Dark", to: "Lit", label: "warm up", guard: { not: false, states: { Power: ["On"] } } },
    {
      from: "Lit",
      to: "Dark",
      label: "cool down",
      guard: { not: true, states: { Power: ["On"] } },
    },
  ]);
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "lamp.mmd"), lamp);
  writeFileSync(
    join(dir, "flat.mmd"),
    [
      "stateDiagram-v2",
      "  [*] --> OD",
      '  state "Off | Dark" as OD',
      '  state "On | Dark" as ND',
      '  state "On | Lit" as NL',
      '  state "Off | Lit" as OL',
      "  OD --> ND : flip the switch",
      "  ND --> OD : flip the switch",
      "  ND --> NL : warm up",
      "  NL --> OL : flip the switch",
      "  OL --> NL : flip the switch",
      "  OL --> OD : cool down",
    ].join("\n"),
  );
  const same = node("compare-charts.mjs", ["lamp.mmd", "flat.mmd"], dir);
  assert.equal(same.stdout, "same\n", same.stderr);
  const tla = node("chart-to-tla.mjs", ["lamp.mmd", "--module", "Lamp"], dir);
  assert.equal(tla.status, 0, tla.stderr);
  const spec = readFileSync(join(dir, "Lamp.tla"), "utf8");
  assert.match(spec, /\(bulb = "Dark" \/\\ power = "On" \/\\ bulb' = "Lit"\)/);
  assert.match(spec, /\(bulb = "Lit" \/\\ ~\(power = "On"\) \/\\ bulb' = "Dark"\)/);

  for (const [from, to, why] of [
    [
      "      %% when On\n",
      "      state Glow\n      %% when On\n",
      /must come right after a transition/,
    ],
    [
      "warm up [when the<br/>power is on]",
      "warm up",
      /must end its label with the guard's words in \[ \]/,
    ],
    ["      %% when On\n", "      %% when Nope\n", /names Nope, which is not a state id/],
    ["      %% when On\n", "      %% when Lit\n", /names Lit, which is in the step's own region/],
  ])
    assert.throws(() => parseMermaid(lamp.replace(from, to)), why);
  assert.throws(
    () =>
      parseMermaid(
        "stateDiagram-v2\n  [*] --> A\n  A --> B : go [when C]\n  %% when C\n  B --> C : on\n",
      ),
    /the chart has none/,
  );
  assert.deepEqual(
    edges(parseMermaid("stateDiagram-v2\n  [*] --> A\n  A --> B : go [user away]\n").regions.Main),
    ["A -> B : go"],
  );
});

const switchLamp = `stateDiagram-v2
  state "Lamp" as lamp {
    state "Power" as power {
      [*] --> Off
      Off --> On : flip the switch
      On --> Off : flip the switch
    }
    --
    state "Bulb" as bulb {
      [*] --> Dark
      Dark --> Lit : flip the switch [when the power is off]
      %% when Off
      Lit --> Dark : flip the switch
    }
  }
`;

test("a label with a guarded and an unguarded move in one region writes both moves", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "switch.mmd"), switchLamp);
  const r = node("chart-to-tla.mjs", ["switch.mmd", "--module", "Switch"], dir);
  assert.equal(r.status, 0, r.stderr);
  const spec = readFileSync(join(dir, "Switch.tla"), "utf8");
  assert.equal(
    spec.slice(spec.indexOf("\\* flip the switch"), spec.indexOf("\nNext ==")),
    `\\* flip the switch
FlipTheSwitch ==
    /\\ (power \\in {"Off", "On"} \\/ (bulb = "Dark" /\\ power = "Off") \\/ (bulb = "Lit"))
    /\\ \\/ (power = "Off" /\\ power' = "On")
       \\/ (power = "On" /\\ power' = "Off")
       \\/ (power \\notin {"Off", "On"} /\\ UNCHANGED power)
    /\\ \\/ (bulb = "Dark" /\\ power = "Off" /\\ bulb' = "Lit")
       \\/ (bulb = "Lit" /\\ bulb' = "Dark")
       \\/ (~((bulb = "Dark" /\\ power = "Off") \\/ (bulb = "Lit")) /\\ UNCHANGED bulb)
`,
  );
});

test("compare reads a one-region chart as the machine its steps reach, with the steps that keep the state", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const drawn =
    "stateDiagram-v2\n  [*] --> Idle\n  Idle --> Busy : start\n  Busy --> Idle : finish\n";
  writeFileSync(join(dir, "drawn.mmd"), drawn);
  writeFileSync(join(dir, "loop.mmd"), `${drawn}  Idle --> Idle : refresh\n`);
  writeFileSync(join(dir, "orphan.mmd"), `${drawn}  Lost --> Idle : come back\n`);
  const loop = node("compare-charts.mjs", ["loop.mmd", "drawn.mmd"], dir);
  assert.equal(loop.status, 1);
  assert.equal(
    loop.stdout,
    "transitions only in EXPECTED (a guard in the spec blocks them, or the spec renamed the step):\n  Idle --> Idle : refresh\n1 difference(s)\n",
  );
  const orphan = node("compare-charts.mjs", ["orphan.mmd", "drawn.mmd"], dir);
  assert.equal(orphan.status, 1);
  assert.equal(
    orphan.stdout,
    "states the agreed chart's own steps never reach:\n  Lost\n1 difference(s)\n",
  );
});

test("a -- outside a composite is refused, not read as one region", () => {
  const split =
    "stateDiagram-v2\n  [*] --> Online\n  Online --> Offline : the network drops\n  --\n  [*] --> Synced\n  Synced --> Pending : you edit a note\n";
  assert.throws(() => parseMermaid(split), /-- outside a composite/);
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "split.mmd"), split);
  writeFileSync(join(dir, "door.mmd"), door);
  const tla = node("chart-to-tla.mjs", ["split.mmd", "--module", "Split"], dir);
  assert.notEqual(tla.status, 0);
  assert.match(tla.stderr, /-- outside a composite/);
  for (const pair of [
    ["split.mmd", "split.mmd"],
    ["door.mmd", "split.mmd"],
    ["split.mmd", "door.mmd"],
  ]) {
    const r = node("compare-charts.mjs", pair, dir);
    assert.equal(r.status, 2, pair.join(" "));
    assert.match(r.stderr, /^split\.mmd: the chart has -- outside a composite/);
  }
});

test("compare refuses a chart it cannot read, or an ACTUAL chart that is not drawn for comparison", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "agreed.mmd"), door);
  for (const pair of [
    ["agreed.mmd", "missing.mmd"],
    ["missing.mmd", "agreed.mmd"],
  ]) {
    const r = node("compare-charts.mjs", pair, dir);
    assert.equal(r.status, 2, pair.join(" "));
    assert.match(r.stderr, /^missing\.mmd: ENOENT/);
  }
  for (const [extra, why] of [
    ["  U_O --> L_O : 1. tap lock", /--highlight 0/],
    [
      "  %% second model (against): the spec",
      "actual.mmd: it has a second model; draw ACTUAL without --fixed-dot or --against-dot\n",
    ],
    [
      '  state "Locked" as g1 {\n    state "Closed" as L_C2\n  }',
      "actual.mmd: it has boxes; draw ACTUAL with --flat\n",
    ],
  ]) {
    writeFileSync(join(dir, "actual.mmd"), flatDoor([extra]));
    const r = node("compare-charts.mjs", ["agreed.mmd", "actual.mmd"], dir);
    assert.equal(r.status, 2, extra);
    if (typeof why === "string") assert.equal(r.stderr, why);
    else assert.match(r.stderr, why);
  }
});

test("an edge lists every step, writes shared leading words once, and the chart renders at its natural width", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const nodes = [
    ["Home", 1],
    ["Home", 2],
    ["Home", 3],
    ["Away", 1],
    ["Away", 2],
    ["Done", 1],
  ].map(
    ([s, n], i) =>
      `${i + 1} [label="/\\\\ s = \\"${s}\\"\\n/\\\\ n = ${n}"${i ? "" : ",style = filled"}]`,
  );
  const steps = [
    "1 -> 4 TapPay",
    "2 -> 5 TapBack",
    "3 -> 4 TapHome",
    "4 -> 1 OpenThread",
    "5 -> 2 OpenApp",
    "4 -> 6 Finish",
  ];
  writeFileSync(
    join(dir, "nav.dot"),
    `strict digraph DiskGraph {\n${nodes.join("\n")}\n${steps.map((e) => e.replace(/ (\w+)$/, ' [label="$1"];')).join("\n")}\n}\n`,
  );
  writeFileSync(
    join(dir, "nav.map.mjs"),
    `export const state = (v) => v.s;
export const step = (a) => ({ TapPay: "you tap Pay", TapBack: "you tap Back", TapHome: "you tap Home", OpenThread: "you open the thread", OpenApp: "you open the phone app", Finish: "" })[a];
`,
  );
  writeFileSync(
    join(dir, "agreed.mmd"),
    `stateDiagram-v2
  [*] --> Home
  Home --> Away : you tap Pay
  Home --> Away : you tap Back
  Home --> Away : you tap Home
  Away --> Home : you open the thread
  Away --> Home : you open the phone app
  Away --> Done
`,
  );
  const draw = (...extra) => {
    const r = node(
      "tlc-to-chart.mjs",
      [
        "--dot",
        "nav.dot",
        "--map",
        "nav.map.mjs",
        "--highlight",
        "0",
        "--out",
        "chart.mmd",
        ...extra,
      ],
      dir,
    );
    assert.equal(r.status, 0, r.stderr);
    return readFileSync(join(dir, "chart.mmd"), "utf8");
  };
  const chart = draw();
  assert.ok(
    chart.startsWith(
      "---\nconfig:\n  markdownAutoWrap: false\n  state:\n    useMaxWidth: false\n---\nstateDiagram-v2\n",
    ),
    chart,
  );
  const shortened = [
    "Away -> Done : ",
    "Away -> Home : you open the thread or the phone app",
    "Home -> Away : you tap Pay, Back, or Home",
  ];
  assert.deepEqual(edges(parseMermaid(chart).regions.Main), shortened);
  const crlf = chart.replace("---\n", "---  \n").replaceAll("\n", "\r\n");
  assert.deepEqual(edges(parseMermaid(crlf).regions.Main), shortened);
  const refused = node("compare-charts.mjs", ["agreed.mmd", "chart.mmd"], dir);
  assert.equal(refused.status, 2);
  assert.match(refused.stderr, /draw ACTUAL with --full-labels/);
  const full = draw("--full-labels");
  assert.match(full, /^stateDiagram-v2\n {2}%% labels in full\n/m);
  assert.deepEqual(edges(parseMermaid(full).regions.Main), [
    "Away -> Done : ",
    "Away -> Home : you open the thread or you open the phone app",
    "Home -> Away : you tap Pay or you tap Back or you tap Home",
  ]);
  assert.equal(node("compare-charts.mjs", ["agreed.mmd", "chart.mmd"], dir).stdout, "same\n");
});

const NO_TLC =
  "Cannot find TLC. It installs with mise, which cannot start: spawnSync mise ENOENT. Install mise (https://mise.jdx.dev), or set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later).\n";
const FROM_SPEC_USAGE =
  "node statechart.mjs from-spec SPEC.tla [--config FILE] [--fixed FIXED.tla [--fixed-config FILE] | --against AGREED.tla [--against-config FILE]] [--label TEXT] [--map FILE] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--cover] [--png [--theme NAME]]";
const FROM_CHART_USAGE =
  "node statechart.mjs from-chart CHART.mmd [--module NAME] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--png [--theme NAME]]";
const RENDER_USAGE = "node statechart.mjs render CHART.mmd [--theme NAME] [--out FILE]";
const noTlc = { PATH: mkdtempSync(join(tmpdir(), "empty-path-")), TLA2TOOLS: "", JAVA: "" };

test("statechart.mjs writes the spec next to the chart, keeps it on the next run, and stops without TLC", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "notes-app.mmd"), fixture("sync.mmd"));
  const first = node("statechart.mjs", ["from-chart", "notes-app.mmd"], dir, noTlc);
  assert.equal(first.status, 2);
  assert.equal(
    first.stdout,
    "Wrote NotesApp.tla, NotesApp.cfg, and NotesApp.map.mjs from notes-app.mmd.\n",
  );
  assert.equal(first.stderr, NO_TLC);
  assert.equal(
    readFileSync(join(dir, "NotesApp.cfg"), "utf8"),
    "SPECIFICATION Spec\nINVARIANT TypeOK\nINVARIANT NeverSyncedWhileOffline\n",
  );
  const again = node("statechart.mjs", ["from-chart", "notes-app.mmd"], dir, noTlc);
  assert.equal(
    again.stdout,
    "Kept NotesApp.tla. Delete it to write the spec again from notes-app.mmd.\n",
  );
  const spec = node("statechart.mjs", ["from-spec", "NotesApp.tla"], dir, noTlc);
  assert.equal(spec.status, 2);
  assert.equal(spec.stderr, NO_TLC);
  const missingJar = node("statechart.mjs", ["from-spec", "NotesApp.tla"], dir, {
    TLA2TOOLS: "/nonexistent/tla2tools.jar",
  });
  assert.equal(missingJar.status, 2);
  assert.equal(
    missingJar.stderr,
    "TLA2TOOLS is /nonexistent/tla2tools.jar, which does not exist.\n",
  );
  const missingJava = node("statechart.mjs", ["from-spec", "NotesApp.tla"], dir, {
    ...noTlc,
    JAVA: "/nonexistent/java",
  });
  assert.equal(missingJava.status, 2);
  assert.equal(missingJava.stderr, "JAVA is /nonexistent/java, which does not exist.\n");
});

const installCommand = (...tools) =>
  `cd "$(mktemp -d)" && MISE_CEILING_PATHS="$PWD" mise install ${tools.map((t) => `'${t}'`).join(" ")}`;

test("statechart.mjs shows mise's own error when mise fails before it can look for TLC", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const bin = mkdtempSync(join(tmpdir(), "fake-mise-"));
  const said =
    "mise ERROR failed to read the global config\nmise ERROR Run with --verbose for more";
  writeFileSync(join(bin, "mise"), `#!/bin/sh\nprintf '%s\\n' "${said}" >&2\nexit 1\n`, {
    mode: 0o755,
  });
  writeFileSync(join(dir, "Pay.tla"), "---- MODULE Pay ----\n====\n");
  writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\n");
  writeFileSync(join(dir, "Pay.map.mjs"), "export default {};\n");
  const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, {
    PATH: bin,
    TLA2TOOLS: "",
    JAVA: "",
  });
  assert.equal(r.status, 2);
  assert.equal(
    r.stderr,
    `Cannot find TLC, because mise failed:
  mise ERROR failed to read the global config
  mise ERROR Run with --verbose for more
The install command: ${installCommand(JAVA_TOOL, TLC_TOOL)}
Fix that, or set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later).
`,
  );
});

test("statechart.mjs writes no output folder when it refuses the input", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "tla2tools.jar"), "");
  writeFileSync(join(dir, "Pay.tla"), "---- MODULE Pay ----\n====\n");
  writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT Paid\n");
  writeFileSync(join(dir, "cart.mmd"), "stateDiagram-v2\n  [*] --> Cart\n  Cart --> Paid : pay\n");
  for (const args of [
    ["from-spec", "Pya.tla"],
    ["from-spec", "Pay.tla", "--expect-broken", "Unpaid"],
    ["from-spec", "Pay.tla", "--fixed", "PayFixd.tla"],
    ["from-chart", "cart.mmd", "--expect-broken", "Unpaid"],
  ]) {
    const r = node("statechart.mjs", args, dir, { TLA2TOOLS: join(dir, "tla2tools.jar") });
    assert.equal(r.status, 2, r.stderr);
  }
  assert.deepEqual(
    readdirSync(dir).filter((f) => f.endsWith("-statechart")),
    [],
  );
});

test("statechart.mjs does not use an output folder that has files that it did not write", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "tla2tools.jar"), "");
  writeFileSync(join(dir, "Pay.tla"), "---- MODULE Pay ----\n====\n");
  writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\n");
  const env = { TLA2TOOLS: join(dir, "tla2tools.jar") };
  const cwd = node("statechart.mjs", ["from-spec", "Pay.tla", "--out", "."], dir, env);
  assert.equal(cwd.status, 2);
  assert.equal(
    cwd.stderr,
    ". has 3 files that this command did not write, such as Pay.cfg. A run puts its files in place of the whole output folder, so pass --out with a new folder.\n",
  );
  const out = join(dir, "Pay-statechart");
  mkdirSync(join(out, "tlc"), { recursive: true });
  writeFileSync(join(out, "chart.mmd"), "kept\n");
  writeFileSync(join(out, ".DS_Store"), "");
  writeFileSync(join(out, "notes.md"), "mine\n");
  const notes = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, env);
  assert.equal(notes.status, 2);
  assert.equal(
    notes.stderr,
    "Pay-statechart has a file that this command did not write: notes.md. A run puts its files in place of the whole output folder, so pass --out with a new folder.\n",
  );
  assert.deepEqual(readdirSync(dir).sort(), [
    "Pay-statechart",
    "Pay.cfg",
    "Pay.tla",
    "tla2tools.jar",
  ]);
  assert.deepEqual(readdirSync(out).sort(), [".DS_Store", "chart.mmd", "notes.md", "tlc"]);
  assert.equal(readFileSync(join(out, "chart.mmd"), "utf8"), "kept\n");
});

test("statechart.mjs exits 2 and names a helper script that cannot start", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "notes-app.mmd"), fixture("sync.mmd"));
  writeFileSync(join(dir, "no-node.cjs"), 'process.execPath = "/nonexistent/node";\n');
  const r = node("statechart.mjs", ["from-chart", "notes-app.mmd"], dir, {
    NODE_OPTIONS: `--require ${join(dir, "no-node.cjs")}`,
  });
  assert.equal(r.status, 2, r.stderr);
  assert.match(r.stderr, /chart-to-tla\.mjs/);
});

test("statechart.mjs names the chart it refuses and the argument it does not know", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "c.mmd"),
    "stateDiagram-v2\n  [*] --> A\n  A --> B : go\n  %% never Bad: C -- never C\n",
  );
  const refused = node("statechart.mjs", ["from-chart", "c.mmd"], dir);
  assert.equal(refused.status, 2);
  assert.equal(refused.stdout, "");
  assert.equal(refused.stderr, 'c.mmd: never line names "C", which is not a state in the chart\n');
  const unknown = node("statechart.mjs", ["from-chart", "c.mmd", "--fixed", "CFixed.tla"], dir);
  assert.equal(unknown.status, 2);
  assert.equal(
    unknown.stderr,
    "unknown argument --fixed. Run node statechart.mjs from-chart --help for the flags, the output, and the exit codes.\n",
  );
  const sameFile = node("statechart.mjs", ["from-spec", "C.tla", "--fixed", "./C.tla"], dir);
  assert.equal(sameFile.status, 2);
  assert.equal(sameFile.stderr, "--fixed needs a file other than the spec, C.tla.\n");
  const sameAgreed = node("statechart.mjs", ["from-spec", "C.tla", "--against", "C.tla"], dir);
  assert.equal(sameAgreed.stderr, "--against needs a file other than the spec, C.tla.\n");
  for (const [extra, stderr] of [
    [
      ["--fixed", "F.tla", "--against", "A.tla"],
      "use --fixed or --against, not both. Run node statechart.mjs from-spec --help for the flags, the output, and the exit codes.\n",
    ],
    [
      ["--label", "the new build"],
      "--label names the --fixed or --against model; it needs one of them. Run node statechart.mjs from-spec --help for the flags, the output, and the exit codes.\n",
    ],
  ]) {
    const r = node("statechart.mjs", ["from-spec", "C.tla", ...extra], dir);
    assert.equal(r.status, 2, extra.join(" "));
    assert.equal(r.stderr, stderr);
  }
  const valueless = node("statechart.mjs", ["from-chart", "c.mmd", "--out"], dir);
  assert.equal(valueless.status, 2);
  assert.equal(
    valueless.stderr,
    "--out needs a value. Run node statechart.mjs from-chart --help for the flags, the output, and the exit codes.\n",
  );
  for (const [args, stderr] of [
    [
      ["render", "c.mmd", "--theme", "blue"],
      "--theme takes light, dark, or classic. Run node statechart.mjs render --help for the flags, the output, and the exit codes.\n",
    ],
    [
      ["from-chart", "c.mmd", "--theme", "dark"],
      "--theme needs --png. Run node statechart.mjs from-chart --help for the flags, the output, and the exit codes.\n",
    ],
    [
      ["render", "c.mmd", "--png"],
      "unknown argument --png. Run node statechart.mjs render --help for the flags, the output, and the exit codes.\n",
    ],
    [
      ["render"],
      `Usage: ${RENDER_USAGE}\nRun node statechart.mjs render --help for the flags, the output, and the exit codes.\n`,
    ],
  ]) {
    const r = node("statechart.mjs", args, dir);
    assert.equal(r.status, 2, args.join(" "));
    assert.equal(r.stderr, stderr);
  }
  const bare = node("statechart.mjs", [], dir);
  assert.equal(bare.status, 2);
  assert.equal(
    bare.stderr,
    `Usage: ${FROM_SPEC_USAGE}
       ${FROM_CHART_USAGE}
       ${RENDER_USAGE}
Run node statechart.mjs --help for the flags, the output, and the exit codes.
`,
  );
});

test("statechart.mjs prints its help with -h or --help and points at it for an argument it does not know, and each inner script refuses that argument", () => {
  const help = {
    "statechart.mjs": [[], `Usage: ${FROM_SPEC_USAGE}`],
    "statechart.mjs from-spec": [["from-spec"], `Usage: ${FROM_SPEC_USAGE}`],
    "statechart.mjs from-chart": [["from-chart", "notes-app.mmd"], `Usage: ${FROM_CHART_USAGE}`],
  };
  for (const [name, [before, usage]] of Object.entries(help)) {
    const script = name.split(" ")[0];
    for (const flag of ["-h", "--help"]) {
      const r = node(script, [...before, flag], here);
      assert.equal(r.status, 0, `${name} ${flag}`);
      assert.equal(r.stderr, "");
      assert.equal(r.stdout.split("\n")[0], usage);
      assert.match(r.stdout, /\nExit codes\n {2}0 .*\n(.*\n)* {2}1 .*\n(.*\n)* {2}2 /);
    }
  }
  const top = node("statechart.mjs", ["--help"], here).stdout.split("\n");
  assert.equal(top[1], `       ${FROM_CHART_USAGE}`);
  assert.equal(top[2], `       ${RENDER_USAGE}`);
  assert.equal(top[3], "       node statechart.mjs [from-spec|from-chart|render] --help");
  for (const flag of [
    "--fixed FIXED.tla",
    "--label TEXT",
    "--map FILE",
    "--module NAME",
    "--title TEXT",
    "--out DIR",
    "--png",
    "-h, --help",
  ])
    assert.ok(
      top.some((l) => l.startsWith(`  ${flag}  `)),
      flag,
    );
  for (const [script, args, stderr] of [
    [
      "statechart.mjs",
      ["from-spec", "--nope"],
      "unknown argument --nope. Run node statechart.mjs from-spec --help for the flags, the output, and the exit codes.\n",
    ],
    ["chart-to-tla.mjs", ["--nope"], "unknown argument --nope.\n"],
    ["tlc-to-chart.mjs", ["--nope"], "unknown argument --nope.\n"],
    ["compare-charts.mjs", ["--nope"], "unknown argument --nope.\n"],
  ]) {
    const r = node(script, args, here);
    assert.equal(r.status, 2, script);
    assert.equal(r.stdout, "");
    assert.equal(r.stderr, stderr);
  }
});

const tools = (() => {
  try {
    return findTlc();
  } catch {
    return null;
  }
})();
const needsTlc = { skip: tools ? false : "cannot find TLC" };

const realEntry = pathToFileURL(join(cacheDir(), "entry.mjs")).href;
const lib = await loadRenderer().catch(() => null);
const needsPng = { skip: lib ? false : "cannot install Pele and resvg" };

function fakeRenderer() {
  const xdg = mkdtempSync(join(tmpdir(), "xdg-"));
  const dir = join(xdg, "statechart", CACHE_NAME);
  mkdirSync(dir, { recursive: true });
  writeFileSync(
    join(dir, "entry.mjs"),
    `import { appendFileSync } from "node:fs";
import { render as real } from ${JSON.stringify(realEntry)};
export { Resvg } from ${JSON.stringify(realEntry)};
export function render(text, options) {
  const title = JSON.parse(/^title: (.*)$/m.exec(text)?.[1] ?? '""');
  if (process.env.RENDERED) appendFileSync(process.env.RENDERED, \`\${title}\\n\`);
  if (title && process.env.UNRENDERED?.split("|").includes(title))
    throw new Error("Pele cannot lay out this chart");
  return real(text, options);
}
`,
  );
  return xdg;
}

const paeth = (a, b, c) => {
  const [pa, pb, pc] = [a, b, c].map((v) => Math.abs(a + b - c - v));
  return pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
};
const FILTERS = [() => 0, (a) => a, (a, b) => b, (a, b) => (a + b) >> 1, paeth];

function decodePng(png) {
  assert.deepEqual([...png.subarray(0, 8)], [137, 80, 78, 71, 13, 10, 26, 10], "PNG signature");
  const chunks = {};
  for (let at = 8; at < png.length;) {
    const size = png.readUInt32BE(at);
    const type = png.toString("latin1", at + 4, at + 8);
    const crc = crc32(png.subarray(at + 4, at + 8 + size));
    assert.equal(png.readUInt32BE(at + 8 + size), crc, `${type} chunk CRC`);
    (chunks[type] ??= []).push(png.subarray(at + 8, at + 8 + size));
    at += 12 + size;
  }
  const [ihdr] = chunks.IHDR;
  const [width, height] = [ihdr.readUInt32BE(0), ihdr.readUInt32BE(4)];
  assert.deepEqual([ihdr[8], ihdr[9], ihdr[12]], [8, 6, 0], "8-bit RGBA, not interlaced");
  const raw = inflateSync(Buffer.concat(chunks.IDAT));
  const stride = width * 4;
  const px = Buffer.alloc(stride * height);
  for (let y = 0; y < height; y++) {
    const row = y * (stride + 1);
    const filter = FILTERS[raw[row]];
    assert.ok(filter, `row ${y} has PNG filter ${raw[row]}`);
    for (let x = 0; x < stride; x++) {
      const a = x < 4 ? 0 : px[y * stride + x - 4];
      const b = y ? px[(y - 1) * stride + x] : 0;
      const c = x < 4 || !y ? 0 : px[(y - 1) * stride + x - 4];
      px[y * stride + x] = raw[row + 1 + x] + filter(a, b, c);
    }
  }
  const at = (x, y) => (Math.floor(y) * width + Math.floor(x)) * 4;
  return {
    width,
    height,
    pixel: (x, y) => `#${px.subarray(at(x, y), at(x, y) + 3).toString("hex")}`,
  };
}

const xmlText = (s) =>
  s
    .replace(/&lt;/g, "<")
    .replace(/&gt;/g, ">")
    .replace(/&quot;/g, '"')
    .replace(/&#39;/g, "'")
    .replace(/&amp;/g, "&");
const textLines = (text) => {
  const spans = [...text.matchAll(/<tspan\b[^>]*>([^<]*)<\/tspan>/g)].map((m) => m[1]);
  return (spans.length ? spans : [text.replace(/<[^>]+>/g, "")])
    .map(xmlText)
    .filter((l) => l.trim());
};
const width = (rect) => +/\swidth="([\d.]+)"/.exec(rect)[1];

function labeledBoxes(svg) {
  const states = [
    ...svg.matchAll(
      /<g class="pele-node pele-state[^"]*" data-id="([^"]+)"[^>]*>(<rect\b[^>]*\/>)([\s\S]*?)<\/g>/g,
    ),
  ].flatMap(([, id, rect, inside]) => {
    const text = /<text\b[^>]*>[\s\S]*?<\/text>/.exec(inside);
    return text
      ? [{ kind: "state", id, box: width(rect), size: 16, lines: textLines(text[0]) }]
      : [];
  });
  const edges = [
    ...svg.matchAll(
      /<g class="pele-edge-label" data-id="([^"]+)">(<rect\b[^>]*\/>)(<text\b[\s\S]*?<\/text>)/g,
    ),
  ].map(([, id, rect, text]) => ({
    kind: "edge label",
    id,
    box: width(rect),
    size: 14,
    lines: textLines(text),
  }));
  const regions = [
    ...svg.matchAll(
      /<g class="pele-cluster[^"]*" data-id="([^"]+)">(<rect\b[^>]*\/>)[\s\S]*?(<text class="pele-cluster-label"[\s\S]*?<\/text>)/g,
    ),
  ].map(([, id, rect, text]) => ({
    kind: "region title",
    id,
    box: width(rect),
    size: 16,
    lines: textLines(text),
  }));
  return [...states, ...edges, ...regions];
}

function tlc(dir, name) {
  const r = spawnSync(
    tools.java,
    [
      "-cp",
      tools.jar,
      "tlc2.TLC",
      "-metadir",
      mkdtempSync(join(tmpdir(), "tlc-")),
      "-deadlock",
      "-continue",
      "-dump",
      "dot,actionlabels",
      `${name}.dot`,
      "-config",
      `${name}.cfg`,
      `${name}.tla`,
    ],
    { cwd: dir, encoding: "utf8" },
  );
  writeFileSync(join(dir, `${name}.out`), r.stdout);
  return r;
}

const FAKE_MISE = `#!/bin/sh
echo "$PWD $*" >> "$MISE_LOG"
d=$PWD
while :; do
  grep -qs '^locked = true' "$d/mise.toml" && locked=1
  case ":$MISE_CEILING_PATHS:" in *":$d:"*) break;; esac
  [ "$d" = / ] && break
  d=$(dirname "$d")
done
case $1 in
install)
  if [ -n "$FAIL" ]; then echo "mise ERROR cannot download tla2tools.jar" >&2; exit 1; fi
  if [ -n "$locked" ]; then echo "mise ERROR No lockfile URL found for $3 (--locked mode)" >&2; exit 1; fi
  touch "$MISE_STATE/installed"
  if [ -n "$FAIL_AFTER_INSTALL" ]; then echo "mise ERROR failed to rebuild runtime symlinks: File exists (os error 17)" >&2; exit 1; fi
  exit 0;;
where) if [ -e "$MISE_STATE/installed" ]; then echo "$TLAPLUS_HOME"; exit 0; fi;;
which) if [ -e "$MISE_STATE/installed" ]; then echo "$TLC_JAVA"; exit 0; fi;;
esac
echo "mise ERROR $2 is not installed" >&2
exit 1
`;

function outsideRepoWithoutTlc() {
  const root = mkdtempSync(join(tmpdir(), "statechart-outside-"));
  const at = join(root, "skill", "scripts");
  cpSync(scripts, at, { recursive: true, filter: (f) => !f.startsWith(here) });
  const bin = join(root, "bin");
  const state = join(root, "state");
  const dir = join(root, "work");
  for (const d of [bin, state, dir]) mkdirSync(d);
  writeFileSync(join(bin, "mise"), FAKE_MISE, { mode: 0o755 });
  writeFileSync(join(dir, "mise.toml"), '[tools]\njava = "17"\n');
  const log = join(root, "mise.log");
  const env = {
    PATH: `${bin}${delimiter}${process.env.PATH}`,
    TLA2TOOLS: "",
    JAVA: "",
    MISE_STATE: state,
    MISE_LOG: log,
  };
  const calls = () =>
    existsSync(log)
      ? readFileSync(log, "utf8")
          .trim()
          .split("\n")
          .map((line) => {
            const [folder, ...args] = line.split(" ");
            return { folder, args };
          })
      : [];
  return { at, dir, env, calls };
}

function assertMiseRanInARemovedEmptyFolder(dir, calls) {
  const folders = [...new Set(calls.map((c) => c.folder))];
  assert.equal(folders.length > 0, true);
  for (const folder of folders) {
    assert.equal(folder.startsWith(dir), false, folder);
    assert.equal(existsSync(folder), false, folder);
  }
}

const INSTALLING = "Installing TLC and Java with mise. This happens once.\n";

test("statechart.mjs outside the repo installs TLC with mise in an empty folder once and shows mise's error", () => {
  const { at, dir, env, calls } = outsideRepoWithoutTlc();
  writeFileSync(join(dir, "Pay.tla"), "---- MODULE Pay ----\n====\n");
  writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\n");
  writeFileSync(join(dir, "Pay.map.mjs"), "export default {};\n");
  const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, { ...env, FAIL: "1" }, at);
  assert.equal(r.status, 2);
  assert.equal(
    r.stderr,
    `${INSTALLING}Cannot find TLC, and mise could not install it:
  mise ERROR cannot download tla2tools.jar
The install command: ${installCommand(JAVA_TOOL, TLC_TOOL)}
Or set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later).
`,
  );
  const install = ["install", "--quiet", JAVA_TOOL, TLC_TOOL];
  assert.deepEqual(
    calls().map((c) => c.args),
    [
      ["where", TLC_TOOL],
      ["which", "java", "--tool", JAVA_TOOL],
      install,
      ["where", TLC_TOOL],
      ["which", "java", "--tool", JAVA_TOOL],
    ],
  );
  assertMiseRanInARemovedEmptyFolder(dir, calls());
});

test("statechart.mjs with JAVA set installs only TLC with mise", () => {
  const { at, dir, env, calls } = outsideRepoWithoutTlc();
  writeFileSync(join(dir, "Pay.tla"), "---- MODULE Pay ----\n====\n");
  writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\n");
  writeFileSync(join(dir, "Pay.map.mjs"), "export default {};\n");
  const javaEnv = { ...env, JAVA: process.execPath, FAIL: "1" };
  const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, javaEnv, at);
  assert.equal(r.status, 2);
  assert.equal(
    r.stderr,
    `Installing TLC with mise. This happens once.
Cannot find TLC, and mise could not install it:
  mise ERROR cannot download tla2tools.jar
The install command: ${installCommand(TLC_TOOL)}
Or set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later).
`,
  );
  assert.deepEqual(
    calls().map((c) => c.args[0]),
    ["where", "install", "where"],
  );
  assertMiseRanInARemovedEmptyFolder(dir, calls());
});

test(
  "statechart.mjs outside the repo installs a missing TLC with mise once, and leaves the mise files next to the spec alone",
  needsTlc,
  () => {
    const { at, dir, env, calls } = outsideRepoWithoutTlc();
    const tlcEnv = { ...env, TLAPLUS_HOME: dirname(tools.jar), TLC_JAVA: tools.java };
    writeFileSync(join(dir, "upload.mmd"), fixture("upload.mmd"));
    const first = node("statechart.mjs", ["from-chart", "upload.mmd"], dir, tlcEnv, at);
    assert.equal(first.status, 0, first.stderr);
    assert.equal(first.stderr, INSTALLING);
    assert.match(first.stdout, /\nThe spec draws upload\.mmd back unchanged\.\n/);
    const again = node("statechart.mjs", ["from-chart", "upload.mmd"], dir, tlcEnv, at);
    assert.equal(again.status, 0, again.stderr);
    assert.equal(again.stderr, "");
    assert.equal(calls().filter((c) => c.args[0] === "install").length, 1);
    assertMiseRanInARemovedEmptyFolder(dir, calls());
  },
);

test(
  "statechart.mjs uses TLC that mise installed even when mise install then exits non-zero",
  needsTlc,
  () => {
    const { at, dir, env, calls } = outsideRepoWithoutTlc();
    const tlcEnv = {
      ...env,
      TLAPLUS_HOME: dirname(tools.jar),
      TLC_JAVA: tools.java,
      FAIL_AFTER_INSTALL: "1",
    };
    writeFileSync(join(dir, "upload.mmd"), fixture("upload.mmd"));
    const r = node("statechart.mjs", ["from-chart", "upload.mmd"], dir, tlcEnv, at);
    assert.equal(r.status, 0, r.stderr);
    assert.equal(r.stderr, INSTALLING);
    assert.match(r.stdout, /\nThe spec draws upload\.mmd back unchanged\.\n/);
    assert.equal(calls().filter((c) => c.args[0] === "install").length, 1);
  },
);

test(
  "statechart.mjs installs TLC with mise inside a repo whose mise.toml sets locked = true",
  needsTlc,
  () => {
    const { at, dir, env, calls } = outsideRepoWithoutTlc();
    writeFileSync(join(dir, "mise.toml"), "[settings]\nlocked = true\n");
    const specs = join(dir, "specs");
    mkdirSync(specs);
    writeFileSync(join(specs, "upload.mmd"), fixture("upload.mmd"));
    const tlcEnv = { ...env, TLAPLUS_HOME: dirname(tools.jar), TLC_JAVA: tools.java };
    const r = node("statechart.mjs", ["from-chart", "upload.mmd"], specs, tlcEnv, at);
    assert.equal(r.status, 0, r.stderr);
    assert.equal(r.stderr, INSTALLING);
    assert.match(r.stdout, /\nThe spec draws upload\.mmd back unchanged\.\n/);
    assertMiseRanInARemovedEmptyFolder(dir, calls());
  },
);

test(
  "statechart.mjs finds TLC with the real mise when an untrusted mise.toml is next to the spec and above TMPDIR",
  {
    skip:
      !tools || process.env.TLA2TOOLS
        ? "needs TLC from mise, not from TLA2TOOLS"
        : spawnSync("mise", ["--version"]).error
          ? "needs mise"
          : false,
  },
  () => {
    const root = mkdtempSync(join(tmpdir(), "statechart-outside-"));
    const at = join(root, "scripts");
    cpSync(scripts, at, { recursive: true, filter: (f) => !f.startsWith(here) });
    const dir = join(root, "work");
    const tmp = join(dir, "tmp");
    mkdirSync(tmp, { recursive: true });
    writeFileSync(join(dir, "mise.toml"), '[tools]\njava = "17"\n\n[env]\nSTATECHART = "1"\n');
    writeFileSync(join(dir, "upload.mmd"), fixture("upload.mmd"));
    const env = { JAVA: "", TMPDIR: tmp };
    const r = node("statechart.mjs", ["from-chart", "upload.mmd"], dir, env, at);
    assert.equal(r.status, 0, r.stderr);
    assert.equal(r.stderr, "");
    assert.match(r.stdout, /\nThe spec draws upload\.mmd back unchanged\.\n/);
    assert.deepEqual(readdirSync(dir).sort(), [
      "Upload-statechart",
      "Upload.cfg",
      "Upload.map.mjs",
      "Upload.tla",
      "mise.toml",
      "tmp",
      "upload.mmd",
    ]);
  },
);

test("statechart.mjs shows why java cannot start TLC", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "upload.mmd"), fixture("upload.mmd"));
  const setVars =
    "Fix that, or set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later).\n";
  const folder = dirname(tools.jar);
  const notJar = node("statechart.mjs", ["from-chart", "upload.mmd"], dir, {
    TLA2TOOLS: folder,
    JAVA: tools.java,
  });
  assert.equal(notJar.status, 2);
  assert.equal(
    notJar.stderr,
    `cannot run TLC with ${tools.java} -cp ${folder}: java exited 1:
  Error: Could not find or load main class tlc2.TLC
  Caused by: java.lang.ClassNotFoundException: tlc2.TLC
${setVars}`,
  );
  const noJava = node("statechart.mjs", ["from-chart", "upload.mmd"], dir, {
    ...noTlc,
    TLA2TOOLS: tools.jar,
  });
  assert.equal(noJava.status, 2);
  assert.equal(
    noJava.stderr,
    `cannot run TLC with java -cp ${tools.jar}: spawn java ENOENT\n${setVars}`,
  );
});

test("from-chart checks the agreed chart and draws it back unchanged", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "upload.mmd"), fixture("upload.mmd"));
  const r = node("statechart.mjs", ["from-chart", "upload.mmd"], dir);
  assert.equal(r.status, 0, r.stderr);
  assert.equal(
    r.stdout,
    `Wrote Upload.tla, Upload.cfg, and Upload.map.mjs from upload.mmd.
TLC on Upload.tla with Upload.cfg:
  TypeOK holds.
  TLC ran 2 times in N s.

Chart: 5 states and 8 transitions from 5 model states.
5 work, 0 break a rule.

No state breaks an INVARIANT rule.

The spec draws upload.mmd back unchanged.

Wrote chart.mmd, stories.md, summary.json in Upload-statechart.
`,
  );
  assert.equal(r.stderr, "");
});

const ringing = `stateDiagram-v2
  [*] --> Idle
  Idle --> Ringing : a call comes in
  Ringing --> Ringing : it rings again
  Ringing --> Idle : the caller hangs up
`;

test(
  "from-chart counts a self-loop, so a spec that drops it does not draw the chart back",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "call.mmd"), ringing);
    const drawn = node("statechart.mjs", ["from-chart", "call.mmd"], dir);
    assert.equal(drawn.status, 0, drawn.stdout + drawn.stderr);
    assert.match(drawn.stdout, /\nThe spec draws call\.mmd back unchanged\.\n/);

    const spec = readFileSync(join(dir, "Call.tla"), "utf8");
    const dropped = spec.replace(" \\/ ItRingsAgain", "");
    assert.notEqual(dropped, spec);
    writeFileSync(join(dir, "Call.tla"), dropped);
    const r = node("statechart.mjs", ["from-chart", "call.mmd"], dir);
    assert.equal(r.status, 1, r.stdout + r.stderr);
    assert.match(
      r.stdout,
      /\nThe spec does not draw call\.mmd:\n {2}transitions only in EXPECTED [^\n]*\n {4}Ringing --> Ringing : it rings again\n {2}1 difference\(s\)\n/,
    );
  },
);

test("from-chart draws a chart with no transitions back unchanged", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "lone.mmd"), "stateDiagram-v2\n  [*] --> Idle\n");
  const r = node("statechart.mjs", ["from-chart", "lone.mmd"], dir);
  assert.equal(r.status, 0, r.stdout + r.stderr);
  assert.match(r.stdout, /\nThe spec draws lone\.mmd back unchanged\.\n/);
  assert.equal(r.stderr, "");
});

test("TLC reads a label with a guarded and an unguarded move in one region", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "switch.mmd"), switchLamp);
  const r = node("statechart.mjs", ["from-chart", "switch.mmd"], dir);
  assert.equal(r.status, 0, r.stdout + r.stderr);
  assert.match(r.stdout, /\nThe spec draws switch\.mmd back unchanged\.\n/);
});

const syncStory = `## 1. Offline | Synced

Rule broken: You never see "Synced" while you are offline.
In the model, one step leads into this bug: "the server confirms".

0. Start: Online | Synced
1. The network drops. Now: Offline | Waiting to sync
2. The server confirms. Now: Offline | Synced
`;

test("from-chart finds the design bug, and from-spec with the fix marks it fixed", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd"));
  const today = node("statechart.mjs", ["from-chart", "sync.mmd"], dir);
  assert.equal(today.status, 1, today.stderr);
  assert.equal(
    today.stdout,
    `Wrote Sync.tla, Sync.cfg, and Sync.map.mjs from sync.mmd.
TLC on Sync.tla with Sync.cfg:
  TypeOK holds.
  NeverSyncedWhileOffline is broken.
  TLC ran 4 times in N s.

Chart: 4 states and 8 transitions from 4 model states.
3 work, 1 breaks a rule.

${syncStory}
The spec draws sync.mmd back unchanged.

Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in Sync-statechart.
`,
  );
  assert.match(
    readFileSync(join(dir, "Sync-statechart", "bug-1.mmd"), "utf8"),
    /: 2\. the server confirms\n/,
  );

  const spec = readFileSync(join(dir, "Sync.tla"), "utf8");
  const guarded = spec
    .replace("TheServerConfirms ==\n", 'TheServerConfirms ==\n    /\\ connection = "Online"\n')
    .replace("MODULE Sync", "MODULE SyncFixed");
  assert.notEqual(guarded, spec);
  writeFileSync(join(dir, "SyncFixed.tla"), guarded);
  const fixed = node("statechart.mjs", ["from-spec", "Sync.tla", "--fixed", "SyncFixed.tla"], dir);
  assert.equal(fixed.status, 1, fixed.stderr);
  assert.equal(
    fixed.stdout,
    `TLC on Sync.tla with Sync.cfg:
  TypeOK holds.
  NeverSyncedWhileOffline is broken.
  TLC ran 4 times in N s.
TLC on SyncFixed.tla with Sync.cfg:
  TypeOK holds.
  NeverSyncedWhileOffline holds.
  TLC ran 3 times in N s.

Chart: 4 states and 9 transitions from 4 model states.
3 work today, 0 still wrong with the fix, 1 fixed or new with the fix.

${syncStory}
With the fix, step 2 (the server confirms) cannot happen, so you stay at: Offline | Waiting to sync.

Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in Sync-statechart.
`,
  );
  const summary = JSON.parse(readFileSync(join(dir, "Sync-statechart", "summary.json"), "utf8"));
  assert.deepEqual(summary.chartStatus, {
    works: 3,
    wrong: 0,
    fixed: 1,
    mixed: 0,
    after: 0,
    worse: 0,
  });
  assert.equal(summary.classes[0].fix, "Offline | Waiting to sync");

  const map = readFileSync(join(dir, "Sync.map.mjs"), "utf8");
  writeFileSync(join(dir, "Sync.map.mjs"), `${map}export const group = () => "Your notes";\n`);
  const grouped = node(
    "statechart.mjs",
    ["from-spec", "Sync.tla", "--fixed", "SyncFixed.tla"],
    dir,
  );
  assert.equal(grouped.status, 1, grouped.stderr);
  const lines = readFileSync(join(dir, "Sync-statechart", "chart.mmd"), "utf8").split("\n");
  assert.deepEqual(
    lines.filter((l) => /^ {2}(classDef|class) |legend/.test(l)),
    [
      "  classDef plainFixed fill:#f4f6f7,stroke:#1e8449,stroke-width:4px,color:#145a32",
      "  classDef group0 fill:#d6eaf8,stroke:#6b757c,color:#1b2631",
      "  classDef group0Fixed fill:#d6eaf8,stroke:#1e8449,stroke-width:4px,color:#145a32",
      '  state "Legend" as legend {',
      '    state "Your notes" as legendGroup0',
      '    state "Fixed or new with the fix" as legendFixed',
      "  class legendGroup0 group0",
      "  class legendFixed plainFixed",
      "  class s0 group0Fixed",
      "  class s1 group0",
      "  class s2 group0",
      "  class s3 group0",
    ],
  );
  writeFileSync(join(dir, "Sync.map.mjs"), map);

  writeFileSync(join(dir, "Sync.tla"), guarded.replace("MODULE SyncFixed", "MODULE Sync"));
  const coded = node("statechart.mjs", ["from-chart", "sync.mmd"], dir);
  assert.equal(coded.status, 1, coded.stderr);
  assert.equal(
    coded.stdout,
    `Kept Sync.tla. Delete it to write the spec again from sync.mmd.
TLC on Sync.tla with Sync.cfg:
  TypeOK holds.
  NeverSyncedWhileOffline holds.
  TLC ran 3 times in N s.

Chart: 3 states and 5 transitions from 3 model states.
3 work, 0 break a rule.

No state breaks an INVARIANT rule.

The spec does not draw sync.mmd:
  states only in EXPECTED (no path from the start reaches them in the spec, or the spec renamed them):
    Offline | Synced
  transitions only in EXPECTED (a guard in the spec blocks them, or the spec renamed the step):
    Offline | Synced --> Offline | Waiting to sync : the network drops
    Offline | Synced --> Offline | Waiting to sync : you edit a note
    Offline | Synced --> Online | Synced : the network returns
    Offline | Waiting to sync --> Offline | Synced : the server confirms
  5 difference(s)

Wrote chart.mmd, stories.md, summary.json in Sync-statechart.
`,
  );
  assert.deepEqual(readdirSync(join(dir, "Sync-statechart")).sort(), [
    "chart.mmd",
    "stories.md",
    "summary.json",
    "tlc",
  ]);
});

test(
  "a second model with the module name of the spec, in its own folder, keeps its own TLC files",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd"));
    assert.equal(node("statechart.mjs", ["from-chart", "sync.mmd"], dir).status, 1);
    const guarded = readFileSync(join(dir, "Sync.tla"), "utf8").replace(
      "TheServerConfirms ==\n",
      'TheServerConfirms ==\n    /\\ connection = "Online"\n',
    );
    mkdirSync(join(dir, "fix"));
    writeFileSync(join(dir, "fix", "Sync.tla"), guarded);
    writeFileSync(join(dir, "SyncFixed.tla"), guarded.replace("MODULE Sync", "MODULE SyncFixed"));
    const run = (...args) => node("statechart.mjs", ["from-spec", "Sync.tla", ...args], dir);
    const broken = /^Error: Invariant NeverSyncedWhileOffline is violated/m;

    const named = run("--fixed", "SyncFixed.tla", "--out", "named");
    const same = run("--fixed", "fix/Sync.tla", "--out", "same");
    assert.equal(same.status, 1, same.stderr);
    assert.equal(same.stderr, named.stderr.replaceAll("SyncFixed.tla", "fix/Sync.tla"));
    assert.equal(
      same.stdout,
      named.stdout
        .replace("TLC on SyncFixed.tla with", "TLC on fix/Sync.tla with")
        .replace(" in named.\n", " in same.\n"),
    );
    for (const file of ["chart.mmd", "bug-1.mmd", "stories.md"])
      assert.equal(
        readFileSync(join(dir, "same", file), "utf8"),
        readFileSync(join(dir, "named", file), "utf8"),
      );
    const tlcOut = (...parts) => readFileSync(join(dir, "same", "tlc", ...parts), "utf8");
    assert.match(tlcOut("Sync-NeverSyncedWhileOffline.out"), broken);
    assert.doesNotMatch(tlcOut("fixed", "Sync-NeverSyncedWhileOffline.out"), broken);

    cpSync(join(dir, "Sync.cfg"), join(dir, "fix", "Sync.cfg"));
    const agreed = run("--against", "fix/Sync.tla", "--out", "agreed");
    assert.equal(agreed.status, 1, agreed.stderr);
    assert.match(agreed.stdout, /^TLC on fix\/Sync\.tla with fix\/Sync\.cfg:\n/m);
    const agreedOut = (...parts) => readFileSync(join(dir, "agreed", "tlc", ...parts), "utf8");
    assert.match(agreedOut("Sync-NeverSyncedWhileOffline.out"), broken);
    assert.doesNotMatch(agreedOut("against", "Sync-NeverSyncedWhileOffline.out"), broken);
  },
);

const lockSpec = `---- MODULE Lock ----
VARIABLES a, b, locked
vars == <<a, b, locked>>
Init == a = "idle" /\\ b = "idle" /\\ locked = FALSE
CheckA == a = "idle" /\\ ~locked /\\ a' = "checked" /\\ UNCHANGED <<b, locked>>
TakeA == a = "checked" /\\ a' = "critical" /\\ locked' = TRUE /\\ UNCHANGED b
ReleaseA == a = "critical" /\\ a' = "idle" /\\ locked' = FALSE /\\ UNCHANGED b
CheckB == b = "idle" /\\ ~locked /\\ b' = "checked" /\\ UNCHANGED <<a, locked>>
TakeB == b = "checked" /\\ b' = "critical" /\\ locked' = TRUE /\\ UNCHANGED a
ReleaseB == b = "critical" /\\ b' = "idle" /\\ locked' = FALSE /\\ UNCHANGED a
Spec == Init /\\ [][CheckA \\/ TakeA \\/ ReleaseA \\/ CheckB \\/ TakeB \\/ ReleaseB]_vars
\\* Two processes are never in the critical section at once.
MutualExclusion == ~(a = "critical" /\\ b = "critical")
====
`;
const lockMap = `const S = { idle: "outside", checked: "saw the lock free", critical: "in the critical section" };
export const state = (v) => \`A \${S[v.a]}, B \${S[v.b]}\`;
export const step = (a) => ({
  CheckA: "A checks the lock", TakeA: "A takes the lock", ReleaseA: "A releases the lock",
  CheckB: "B checks the lock", TakeB: "B takes the lock", ReleaseB: "B releases the lock",
})[a];
`;

test(
  "from-spec on a lock protocol names every step that leads into the bug, not only the shortest trace",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "Lock.tla"), lockSpec);
    writeFileSync(join(dir, "Lock.cfg"), "SPECIFICATION Spec\nINVARIANT MutualExclusion\n");
    writeFileSync(join(dir, "Lock.map.mjs"), lockMap);
    const r = node(
      "statechart.mjs",
      ["from-spec", "Lock.tla", "--expect-broken", "MutualExclusion"],
      dir,
    );
    assert.equal(r.status, 0, r.stdout + r.stderr);
    const story = `## 1. A in the critical section, B in the critical section

Rule broken: Two processes are never in the critical section at once.
In the model, 2 different steps lead into this bug: "A takes the lock" and "B takes the lock". The steps below are the shortest path that TLC found.

0. Start: A outside, B outside
1. A checks the lock. Now: A saw the lock free, B outside
2. B checks the lock. Now: A saw the lock free, B saw the lock free
3. A takes the lock. Now: A in the critical section, B saw the lock free
4. B takes the lock. Now: A in the critical section, B in the critical section
`;
    assert.equal(
      r.stdout,
      `TLC on Lock.tla with Lock.cfg:
  MutualExclusion is broken (expected).
  TLC ran 3 times in N s.

Chart: 9 states and 18 transitions from 13 model states.
8 work, 1 breaks a rule.

${story}
Broken as expected: MutualExclusion.

Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in Lock-statechart.
`,
    );
    const out = join(dir, "Lock-statechart");
    assert.equal(readFileSync(join(out, "stories.md"), "utf8"), story);
    const [bug] = JSON.parse(readFileSync(join(out, "summary.json"), "utf8")).classes;
    assert.equal(bug.counterexamples, 1);
    assert.deepEqual(bug.lastSteps, ["A takes the lock", "B takes the lock"]);
    assert.equal(bug.startsHere, false);
  },
);

const counterMap = (steps) =>
  `export const state = (v) => \`The counter shows \${v.x}\`;\nexport const step = (a) => (${JSON.stringify(steps)})[a] ?? "the counter moves";\n`;

test(
  "a story does not count the steps into a bug when TLC names them only after the whole next-state action",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Jump.tla"),
      `---- MODULE Jump ----
VARIABLE x
Init == x = 0
Next ==
  \\/ x = 0 /\\ x' = 1
  \\/ x = 1 /\\ x' = 3
  \\/ x = 0 /\\ x' = 3
Spec == Init /\\ [][Next]_x
\\* The counter never shows 3.
NotThree == x # 3
====
`,
    );
    writeFileSync(join(dir, "Jump.cfg"), "SPECIFICATION Spec\nINVARIANT NotThree\n");
    writeFileSync(join(dir, "Jump.map.mjs"), counterMap({}));
    const r = node("statechart.mjs", ["from-spec", "Jump.tla", "--expect-broken", "NotThree"], dir);
    assert.equal(r.status, 0, r.stdout + r.stderr);
    assert.match(
      r.stderr,
      /^Jump\.tla: 3 steps have the name Next, the whole next-state action\./m,
    );
    assert.equal(
      readFileSync(join(dir, "Jump-statechart", "stories.md"), "utf8"),
      `## 1. The counter shows 3

Rule broken: The counter never shows 3.
In the model, steps labeled "the counter moves" lead into this bug. TLC names them Next, the whole next-state action, so the story cannot count them. The steps below are the shortest path that TLC found.

0. Start: The counter shows 0
1. The counter moves. Now: The counter shows 3
`,
    );
  },
);

test(
  "a story says its path is the shortest only when more than one step leads into the bug",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Skip.tla"),
      `---- MODULE Skip ----
EXTENDS Naturals
VARIABLE x
Init == x = 0
Up == x < 2 /\\ x' = x + 1
Skip == x = 0 /\\ x' = 2
Spec == Init /\\ [][Up \\/ Skip]_x
\\* The counter never shows 1.
NotOne == x # 1
\\* The counter never shows 2.
NotTwo == x # 2
====
`,
    );
    writeFileSync(
      join(dir, "Skip.cfg"),
      "SPECIFICATION Spec\nINVARIANT NotOne\nINVARIANT NotTwo\n",
    );
    writeFileSync(join(dir, "Skip.map.mjs"), counterMap({}));
    const r = node(
      "statechart.mjs",
      ["from-spec", "Skip.tla", "--expect-broken", "NotOne,NotTwo"],
      dir,
    );
    assert.equal(r.status, 0, r.stdout + r.stderr);
    assert.equal(
      readFileSync(join(dir, "Skip-statechart", "stories.md"), "utf8"),
      `## 1. The counter shows 1

Rule broken: The counter never shows 1.
In the model, one step leads into this bug: "the counter moves".

0. Start: The counter shows 0
1. The counter moves. Now: The counter shows 1

## 2. The counter shows 2

Rule broken: The counter never shows 2.
In the model, one step leads into this bug: "the counter moves". The steps below are the shortest path that TLC found.

0. Start: The counter shows 0
1. The counter moves. Now: The counter shows 2
`,
    );
  },
);

test(
  "a story says which step into the bug keeps the state, so that no chart draws it",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Panel.tla"),
      `---- MODULE Panel ----
VARIABLES panel, saved
vars == <<panel, saved>>
Init == panel = "closed" /\\ saved = TRUE
Open == panel = "closed" /\\ panel' = "open" /\\ UNCHANGED saved
Close == panel = "open" /\\ panel' = "closed" /\\ UNCHANGED saved
Lose == panel = "open" /\\ saved /\\ saved' = FALSE /\\ UNCHANGED panel
Pop == panel = "closed" /\\ saved /\\ panel' = "open" /\\ saved' = FALSE
Spec == Init /\\ [][Open \\/ Close \\/ Lose \\/ Pop]_vars
\\* The note is never lost.
NeverLost == saved
====
`,
    );
    writeFileSync(join(dir, "Panel.cfg"), "SPECIFICATION Spec\nINVARIANT NeverLost\n");
    writeFileSync(
      join(dir, "Panel.map.mjs"),
      'export const state = (v) => `The panel is ${v.panel}`;\nexport const step = (a) => ({ Open: "you open the panel", Close: "you close the panel", Lose: "the note is lost", Pop: "the panel pops open" })[a];\n',
    );
    const r = node(
      "statechart.mjs",
      ["from-spec", "Panel.tla", "--expect-broken", "NeverLost"],
      dir,
    );
    assert.equal(r.status, 0, r.stdout + r.stderr);
    const out = join(dir, "Panel-statechart");
    assert.match(
      readFileSync(join(out, "stories.md"), "utf8"),
      /^In the model, 2 different steps lead into this bug: "the note is lost" \(the state stays the same\) and "the panel pops open"\. The steps below are the shortest path that TLC found\.\n\n0\. Start: The panel is closed\n1\. The panel pops open\. Now: The panel is open\n$/m,
    );
    for (const chart of readdirSync(out).filter((f) => f.endsWith(".mmd")))
      assert.doesNotMatch(readFileSync(join(out, chart), "utf8"), /the note is lost/, chart);
  },
);

test(
  "--png exits 2 unless every chart renders, even with --expect-broken, and keeps the files it wrote",
  { skip: needsTlc.skip || needsPng.skip },
  () => {
    const args = [
      "from-chart",
      "sync.mmd",
      "--expect-broken",
      "NeverSyncedWhileOffline",
      "--title",
      "Sync",
      "--png",
    ];
    const titles = { chart: "Sync", "bug-1": "Sync, bug 1" };
    const xdg = fakeRenderer();
    for (const [unrendered, status, written] of [
      [["chart", "bug-1"], 2, ["chart.mmd", "bug-1.mmd"]],
      [["bug-1"], 2, ["chart.mmd", "bug-1.mmd", "chart.png"]],
      [[], 0, ["chart.mmd", "bug-1.mmd", "chart.png", "bug-1.png"]],
    ]) {
      const dir = mkdtempSync(join(tmpdir(), "statechart-"));
      writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd"));
      const rendered = join(dir, "rendered");
      const r = node("statechart.mjs", args, dir, {
        XDG_CACHE_HOME: xdg,
        TLA2TOOLS: tools.jar,
        JAVA: tools.java,
        RENDERED: rendered,
        UNRENDERED: unrendered.map((c) => titles[c]).join("|"),
      });
      assert.equal(r.status, status, `${unrendered}: ${r.stdout}${r.stderr}`);
      assert.equal(
        r.stderr,
        unrendered
          .map((c) => `could not render Sync-statechart/${c}.mmd: Pele cannot lay out this chart\n`)
          .join(""),
      );
      assert.deepEqual(
        readFileSync(rendered, "utf8").split("\n").filter(Boolean),
        ["Sync", "Sync, bug 1"],
        "tries every chart",
      );
      assert.match(r.stdout, /\nBroken as expected: NeverSyncedWhileOffline\.\n/);
      assert.equal(
        r.stdout.split("\n").at(-2),
        `Wrote ${[...written, "stories.md", "summary.json"].join(", ")} in Sync-statechart.`,
      );
      const out = join(dir, "Sync-statechart");
      assert.deepEqual(
        readdirSync(out).sort(),
        [...written, "stories.md", "summary.json", "tlc"].sort(),
      );
      for (const png of written.filter((f) => f.endsWith(".png")))
        assert.ok(decodePng(readFileSync(join(out, png))).width > 0, png);
    }
  },
);

const SOURCE = fixture("regions.mmd");
const SOURCE_LINES = [...SOURCE.matchAll(/state "([^"]+)" as|--> \w+ : (.+)$/gm)]
  .flatMap((m) => (m[1] ?? m[2]).split("<br/>"))
  .sort();
const drawnLines = (svg) =>
  labeledBoxes(svg)
    .flatMap((b) => b.lines)
    .sort();

function rectOf(svg, id) {
  const [ox, oy] = /<g transform="translate\(([\d.-]+),([\d.-]+)\)">/
    .exec(svg)
    .slice(1)
    .map(Number);
  const [tx, ty, x, y, w, h] = new RegExp(
    `data-id="${id}"(?: transform="translate\\(([\\d.-]+),([\\d.-]+)\\)")?><rect x="([\\d.-]+)" y="([\\d.-]+)" width="([\\d.]+)" height="([\\d.]+)"`,
  )
    .exec(svg)
    .slice(1)
    .map((v) => +(v ?? 0));
  const [left, top] = [ox + tx + x, oy + ty + y];
  return { left, top, right: left + w, bottom: top + h };
}

test(
  "render writes a PNG at twice the chart's size, next to the chart or at --out",
  needsPng,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "regions.mmd"), SOURCE);
    writeFileSync(join(dir, "regions.txt"), SOURCE);
    for (const [args, file, theme] of [
      [["regions.mmd"], "regions.png", "light"],
      [["regions.txt"], "regions.txt.png", "light"],
      ...Object.keys(THEMES).map((t) => [
        ["regions.mmd", "--theme", t, "--out", join("new", t, "chart.png")],
        join("new", t, "chart.png"),
        t,
      ]),
    ]) {
      const r = node("statechart.mjs", ["render", ...args], dir);
      assert.equal(r.status, 0, r.stderr);
      assert.equal(r.stderr, "");
      assert.equal(r.stdout, `Wrote ${file}.\n`);
      const chart = renderChart(lib, SOURCE, { theme: THEMES[theme] });
      const png = decodePng(readFileSync(join(dir, file)));
      assert.deepEqual([png.width, png.height], [2 * chart.width, 2 * chart.height], file);
      assert.equal(png.pixel(0, 0), THEMES[theme].background, file);
    }
  },
);

test(
  "a chart too big to draw at twice its size draws at about 100 million pixels",
  needsPng,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const steps = Array.from({ length: 60 }, (_, i) =>
      [0, 1, 2].map((k) => `  s${i} --> s${(i * 7 + k * 13 + 1) % 60} : e${i}x${k}`),
    ).flat();
    const src = `stateDiagram-v2\n  [*] --> s0\n${steps.join("\n")}\n`;
    writeFileSync(join(dir, "c.mmd"), src);
    const chart = renderChart(lib, src);
    assert.ok(4 * chart.width * chart.height > 1.2e8, `${chart.width}x${chart.height}`);
    const r = node("statechart.mjs", ["render", "c.mmd"], dir);
    assert.equal(r.status, 0, r.stderr);
    const png = readFileSync(join(dir, "c.png"));
    const pixels = png.readUInt32BE(16) * png.readUInt32BE(20);
    assert.ok(pixels > 0.99e8 && pixels < 1.001e8, `${pixels} pixels`);
  },
);

test(
  "a PNG fills a state with its theme's group color, and a state that breaks a rule with the theme's wrong fill and border",
  needsPng,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "regions.mmd"), SOURCE);
    const chartFill = /classDef group0 fill:(#\w{6})/.exec(SOURCE)[1];
    for (const name of [undefined, ...Object.keys(THEMES)]) {
      const theme = THEMES[name ?? "light"];
      const r = node(
        "statechart.mjs",
        ["render", "regions.mmd", ...(name ? ["--theme", name] : [])],
        dir,
      );
      assert.equal(r.status, 0, r.stderr);
      const png = decodePng(readFileSync(join(dir, "regions.png")));
      const { svg } = renderChart(lib, SOURCE, { theme });
      const inside = (box) => png.pixel(2 * (box.left + 8), box.top + box.bottom);
      const borderWidth = (box) => {
        const [x, y] = [2 * box.left, box.top + box.bottom];
        const ink = png.pixel(x, y);
        let n = 0;
        for (let i = x - 6; i <= x + 6; i++) if (png.pixel(i, y) === ink) n++;
        return n;
      };
      const wrong = rectOf(svg, "r1s3");
      const group = rectOf(svg, "r1s2");
      assert.equal(inside(wrong), theme.wrong.fill, `${name} wrong fill`);
      assert.equal(
        png.pixel(2 * wrong.left, wrong.top + wrong.bottom),
        theme.wrong.border,
        `${name} wrong border`,
      );
      assert.ok(
        borderWidth(wrong) >= 4 && borderWidth(group) <= 3,
        `${name} wrong border is ${borderWidth(wrong)}px and a group border ${borderWidth(group)}px at twice the chart's size`,
      );
      assert.equal(inside(group), theme.groups?.[0] ?? chartFill, `${name} group fill`);
    }
  },
);

test(
  "a PNG draws a state that breaks a rule in some cases, one reached only after a bug, and one that breaks a rule only with the fix, in its theme's colors",
  needsPng,
  () => {
    const source = [
      "stateDiagram-v2",
      ...STATUS_CLASSES.map((c) => `  ${c}`),
      ...["Mixed", "After", "Worse"].map((b) => `  ${groupClassDef("group0", "#d6eaf8", b)}`),
      '  state "Works" as w',
      '  state "Wrong in some cases" as m',
      '  state "Reached after a bug" as a',
      '  state "Wrong only with the fix" as o',
      '  state "Wrong in some cases, in a group" as gm',
      '  state "Reached after a bug, in a group" as ga',
      '  state "Wrong only with the fix, in a group" as go',
      "  [*] --> w",
      "  w --> m : one",
      "  m --> a : two",
      "  a --> o : five",
      "  w --> gm : three",
      "  gm --> ga : four",
      "  ga --> go : six",
      "  class w works",
      "  class m mixed",
      "  class a after",
      "  class o worse",
      "  class gm group0Mixed",
      "  class ga group0After",
      "  class go group0Worse",
      "",
    ].join("\n");
    for (const [name, theme] of Object.entries(THEMES)) {
      const { svg } = renderChart(lib, source, { theme });
      for (const [id, status] of [
        ["m", "mixed"],
        ["a", "after"],
        ["o", "worse"],
        ["gm", "mixed"],
        ["ga", "after"],
        ["go", "worse"],
      ]) {
        const [box, label] = new RegExp(
          `data-id="${id}"[^>]*><rect [^>]*style="([^"]*)"/><text [^>]*style="([^"]*)"`,
        )
          .exec(svg)
          .slice(1)
          .map((s) =>
            Object.fromEntries(
              s
                .split(";")
                .filter(Boolean)
                .map((d) => d.split(":")),
            ),
          );
        assert.deepEqual(
          [box.fill, box.stroke, label.fill],
          [theme[status]?.fill, theme[status]?.border, theme[status]?.text],
          `${name} ${id}`,
        );
      }
    }
  },
);

test("a PNG draws no edge over a group's title band", needsPng, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const source = fixture("band.mmd");
  writeFileSync(join(dir, "band.mmd"), source);
  for (const [name, theme] of Object.entries(THEMES)) {
    const r = node("statechart.mjs", ["render", "band.mmd", "--theme", name], dir);
    assert.equal(r.status, 0, r.stderr);
    const png = decodePng(readFileSync(join(dir, "band.png")));
    const { svg } = renderChart(lib, source, { theme });
    const group = rectOf(svg, "G");
    const [rectY, dividerY] =
      /data-id="G"><rect x="[\d.-]+" y="([\d.-]+)"[^>]*\/><path d="M[\d.-]+,([\d.-]+)H/
        .exec(svg)
        .slice(1)
        .map(Number);
    const divider = group.top + dividerY - rectY;
    const fill = png.pixel(2 * (group.left + 4), group.top + divider);
    const columns = [];
    for (let x = Math.ceil(2 * group.left) + 4; x < 2 * group.right - 4; x++)
      if (png.pixel(x, 2 * (divider + 4)) === theme.edge) columns.push(x);
    assert.ok(columns.length, `${name} draws an edge into the group below its band`);
    for (const x of columns)
      for (let y = Math.ceil(2 * group.top) + 4; y < 2 * divider - 4; y++)
        assert.equal(png.pixel(x, y), fill, `${name} title band at column ${x}, row ${y}`);
  }
});

const fonts = ["DejaVu Sans", "Liberation Sans", "Noto Sans", "Inter"].filter(
  (f) => fcMatch(f)?.name === f,
);
const type1 = ["Nimbus Sans Narrow", "Nimbus Sans", "URW Gothic"].find((f) =>
  /\.(pfb|pfa|t1)$/.test(fcMatch(f)?.file ?? ""),
);
const fcFile = (pattern) =>
  spawnSync("fc-list", [pattern, "file"], { encoding: "utf8" }).stdout?.match(/^(.+): $/m)?.[1];
const type1Styles = [
  "Nimbus Sans:style=Regular:fontformat=CFF",
  "Nimbus Sans:style=Bold:fontformat=Type 1",
  "Nimbus Sans:style=Italic:fontformat=Type 1",
].map(fcFile);
test(
  "each label fits its box in the font it is drawn in, and a wider font gets a wider wrap, so lines break where the chart breaks them",
  {
    skip:
      needsPng.skip ||
      (fonts.length < 2 && "needs two of DejaVu Sans, Liberation Sans, Noto Sans, and Inter"),
  },
  () => {
    const runs = fonts.map((font) => {
      const measure = fontMeasurer(lib.Resvg, font);
      const chart = renderChart(lib, SOURCE, { systemFont: font });
      for (const { kind, id, box, size, lines } of labeledBoxes(chart.svg))
        for (const line of lines)
          assert.ok(
            measure.width(line, size) <= box,
            `${font}: ${kind} ${id} "${line}" fits ${box}`,
          );
      assert.deepEqual(
        drawnLines(chart.svg),
        SOURCE_LINES,
        `${font} breaks lines as the chart does`,
      );
      return {
        font,
        wrap: chart.wrap,
        ink: SOURCE_LINES.reduce((s, l) => s + measure.width(l, 16), 0),
      };
    });
    runs.sort((a, b) => a.ink - b.ink);
    const [narrow, wide] = [runs[0], runs.at(-1)];
    assert.ok(
      wide.wrap > narrow.wrap,
      `${wide.font} wraps at ${wide.wrap}, ${narrow.font} at ${narrow.wrap}`,
    );
  },
);

test(
  "a font that resvg cannot read keeps Pele's widths, so the chart keeps every label",
  { skip: needsPng.skip || (!type1 && "cannot find a Type 1 font") },
  () => {
    assert.deepEqual(drawnLines(renderChart(lib, SOURCE, { systemFont: type1 }).svg), SOURCE_LINES);
  },
);

test(
  "a bold or italic face that resvg cannot read is measured in its regular face, so the chart keeps every label",
  {
    skip:
      needsPng.skip ||
      (!type1Styles.every(Boolean) &&
        "needs Nimbus Sans with an OpenType regular face and Type 1 bold and italic faces"),
  },
  () => {
    const dir = mkdtempSync(join(tmpdir(), "fontconfig-"));
    for (const file of type1Styles) symlinkSync(file, join(dir, basename(file)));
    writeFileSync(
      join(dir, "fonts.conf"),
      `<fontconfig><dir>${dir}</dir><cachedir>${dir}</cachedir></fontconfig>`,
    );
    const styled = SOURCE.replace(/(--> \w+ : )(.+)$/m, "$1<b>$2</b>").replace(
      /(--> \w+ : )([^<].*)$/m,
      "$1<i>$2</i>",
    );
    const run = spawnSync(
      process.execPath,
      [
        "--input-type=module",
        "-e",
        `import { loadRenderer, renderChart } from ${JSON.stringify(pathToFileURL(join(scripts, "render.mjs")).href)};
process.stdout.write(renderChart(await loadRenderer(), ${JSON.stringify(styled)}, { systemFont: "Nimbus Sans" }).svg);`,
      ],
      { encoding: "utf8", env: { ...process.env, FONTCONFIG_FILE: join(dir, "fonts.conf") } },
    );
    assert.equal(run.status, 0, run.stderr);
    assert.deepEqual(drawnLines(run.stdout), SOURCE_LINES);
  },
);

test("a PNG puts parallel regions side by side and the legend above them", needsPng, () => {
  const { svg } = renderChart(lib, SOURCE);
  const [parcel, payment, legend, regions] = ["region0", "region1", "legend", "regions"].map((id) =>
    rectOf(svg, id),
  );
  assert.ok(parcel.top < payment.bottom && payment.top < parcel.bottom, "the regions share rows");
  assert.ok(parcel.right <= payment.left, "the regions do not share columns");
  assert.ok(legend.bottom <= regions.top, "the legend is above the regions");
});

test("a renderer that npm cannot install exits 2 and writes nothing", () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "c.mmd"), SOURCE);
  writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd"));
  const xdg = mkdtempSync(join(tmpdir(), "xdg-"));
  const env = {
    XDG_CACHE_HOME: xdg,
    npm_config_cache: mkdtempSync(join(tmpdir(), "npm-")),
    npm_config_offline: "true",
  };
  for (const args of [
    ["render", "c.mmd"],
    ["from-chart", "sync.mmd", "--png"],
  ]) {
    const r = node("statechart.mjs", args, dir, env);
    assert.equal(r.status, 2, `${args}: ${r.stdout}${r.stderr}`);
    assert.equal(r.stdout, "");
    assert.ok(
      r.stderr.startsWith(
        `Installing pele@1.8.0 and @resvg/resvg-js@2.6.2 with npm in ${join(xdg, "statechart", CACHE_NAME)}. This happens once.\n`,
      ),
      r.stderr,
    );
    assert.match(
      r.stderr,
      /\ncannot install pele@1\.8\.0 and @resvg\/resvg-js@2\.6\.2 with npm:\n/,
    );
    assert.deepEqual(readdirSync(dir).sort(), ["c.mmd", "sync.mmd"]);
    assert.deepEqual(readdirSync(join(xdg, "statechart")), []);
  }
});

test("a renderer that cannot load exits 2, names its folder, and says to delete it", () => {
  const xdg = mkdtempSync(join(tmpdir(), "xdg-"));
  const cache = join(xdg, "statechart", CACHE_NAME);
  mkdirSync(cache, { recursive: true });
  writeFileSync(join(cache, "entry.mjs"), 'export { render } from "no-such-package";\n');
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "c.mmd"), SOURCE);
  const r = node("statechart.mjs", ["render", "c.mmd"], dir, { XDG_CACHE_HOME: xdg });
  assert.equal(r.status, 2);
  assert.equal(r.stdout, "");
  assert.ok(r.stderr.startsWith(`cannot load Pele and resvg from ${cache}: `), r.stderr);
  assert.ok(r.stderr.endsWith("\nDelete that folder to install them again.\n"), r.stderr);
  assert.deepEqual(readdirSync(dir), ["c.mmd"]);
});

test("a chart too long for Pele exits 2, writes no PNG, and says how to get one", needsPng, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const lines = Array.from({ length: 3000 }, (_, i) => `  s${i} --> s${i + 1} : step ${i}`);
  writeFileSync(join(dir, "c.mmd"), `stateDiagram-v2\n${lines.join("\n")}\n`);
  const r = node("statechart.mjs", ["render", "c.mmd"], dir);
  assert.equal(r.status, 2);
  assert.equal(r.stdout, "");
  assert.ok(r.stderr.startsWith("could not render c.mmd: "), r.stderr);
  assert.ok(
    r.stderr.endsWith(
      " The chart is too big for one PNG, and the .mmd file still has all of it. A chart with fewer states fits. Run node statechart.mjs from-spec SPEC.tla --cover --png to draw a smaller overview of the spec.\n",
    ),
    r.stderr,
  );
  assert.deepEqual(readdirSync(dir), ["c.mmd"]);
});

const pay = (name, charge) => `---- MODULE ${name} ----
EXTENDS Naturals
VARIABLES screen, charges
vars == <<screen, charges>>
Init == screen = "Cart" /\\ charges = 0
Pay == screen = "Cart" /\\ screen' = "Paying" /\\ UNCHANGED charges
Charge == ${charge}
Refund == charges = 2 /\\ charges' = 1 /\\ screen' = "Refunded"
Next == Pay \\/ Charge \\/ Refund
Spec == Init /\\ [][Next]_vars
NoDoubleCharge == charges <= 1
====
`;
const payMap = `export const readerActions = ["Pay"];
export const state = (v) => v.screen + ["", ", charged", ", charged twice"][v.charges];
export const step = (action) => ({ Pay: "you pay", Charge: "the bank charges you", Refund: "the bank refunds you" })[action] ?? "";
export const cause = () => "each charge request charges again";
`;

test(
  "from-spec checks each PROPERTY in its own TLC run, and names the counterexample of a broken one",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay("Pay", `screen = "Paying" /\\ charges = 0 /\\ charges' = 1 /\\ UNCHANGED screen`).replace(
        "====",
        'ChargedAtMostOnce == [](charges <= 1)\nEventuallyPaying == <>(screen = "Paying")\n====',
      ),
    );
    writeFileSync(
      join(dir, "Pay.cfg"),
      "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\nPROPERTIES ChargedAtMostOnce EventuallyPaying\n",
    );
    writeFileSync(join(dir, "Pay.map.mjs"), payMap);
    const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    assert.equal(
      r.stdout.split("\n\n")[0],
      `TLC on Pay.tla with Pay.cfg:
  NoDoubleCharge holds.
  ChargedAtMostOnce holds.
  EventuallyPaying is broken. The chart draws only INVARIANT rules, so read TLC's counterexample in ${join("Pay-statechart", "tlc", "Pay-EventuallyPaying.out")}.
  TLC ran 4 times in N s.`,
    );
    const stories = `## Broken rules that the chart does not draw

Rule broken: \`EventuallyPaying\`. The run stops in "Cart" forever. TLC's counterexample is in ${join("tlc", "Pay-EventuallyPaying.out")}.
`;
    assert.ok(r.stdout.includes(`\nNo state breaks an INVARIANT rule.\n\n${stories}`), r.stdout);
    const tlcDir = join(dir, "Pay-statechart", "tlc");
    assert.match(
      readFileSync(join(tlcDir, "Pay-EventuallyPaying.out"), "utf8"),
      /^Error: Temporal properties were violated\./m,
    );
    assert.deepEqual(
      readdirSync(tlcDir)
        .filter((f) => f.endsWith(".cfg") && /PROPERT/.test(readFileSync(join(tlcDir, f), "utf8")))
        .sort(),
      ["Pay-ChargedAtMostOnce.cfg", "Pay-EventuallyPaying.cfg"],
    );
    const expected = node(
      "statechart.mjs",
      ["from-spec", "Pay.tla", "--expect-broken", "EventuallyPaying"],
      dir,
    );
    assert.equal(expected.status, 0, expected.stderr);
    assert.match(expected.stdout, /\n {2}EventuallyPaying is broken \(expected\)\. /);
  },
);

test(
  "from-spec names the reader states that a broken PROPERTY's counterexample loops through, without a state twice in a row and without the states before the loop",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Bell.tla"),
      `---- MODULE Bell ----
VARIABLES door, bell, knocked
vars == <<door, bell, knocked>>
Init == door = "closed" /\\ bell = "off" /\\ knocked = FALSE
SwitchOn == bell = "off" /\\ bell' = "quiet" /\\ UNCHANGED <<door, knocked>>
Knock == bell = "quiet" /\\ ~knocked /\\ knocked' = TRUE /\\ UNCHANGED <<door, bell>>
Ring == knocked /\\ bell' = "ringing" /\\ knocked' = FALSE /\\ UNCHANGED door
Hush == bell = "ringing" /\\ bell' = "quiet" /\\ UNCHANGED <<door, knocked>>
Open == bell = "ringing" /\\ door' = "open" /\\ UNCHANGED <<bell, knocked>>
Spec == Init /\\ [][SwitchOn \\/ Knock \\/ Ring \\/ Hush \\/ Open]_vars /\\ WF_vars(SwitchOn \\/ Knock \\/ Ring \\/ Hush)
EventuallyOpen == <>(door = "open")
====
`,
    );
    writeFileSync(join(dir, "Bell.cfg"), "SPECIFICATION Spec\nPROPERTY EventuallyOpen\n");
    writeFileSync(
      join(dir, "Bell.map.mjs"),
      `export const readerActions = ["Open"];
export const state = (v, facts) => v.door === "open" ? "Door open" : v.bell === "off" ? "Bell off" : facts.enabled.has("Hush") ? "Bell ringing" : "Waiting";
export const step = (action) => action;
`,
    );
    const r = node(
      "statechart.mjs",
      ["from-spec", "Bell.tla", "--expect-broken", "EventuallyOpen"],
      dir,
    );
    assert.equal(r.status, 0, r.stderr);
    const out = join(dir, "Bell-statechart");
    assert.match(
      readFileSync(join(out, "tlc", "Bell-EventuallyOpen.out"), "utf8"),
      /^Back to state 2: /m,
    );
    const stories = `## Broken rules that the chart does not draw

Rule broken: \`EventuallyOpen\`. The run loops through "Waiting" and "Bell ringing" forever. TLC's counterexample is in ${join("tlc", "Bell-EventuallyOpen.out")}.
`;
    assert.ok(r.stdout.includes(`\nNo state breaks an INVARIANT rule.\n\n${stories}`), r.stdout);
    assert.deepEqual(
      JSON.parse(readFileSync(join(out, "summary.json"), "utf8")).brokenProperties[0].repeats,
      { states: ["Waiting", "Bell ringing"], stutters: false },
    );
  },
);

test(
  "from-spec checks a rule that the config lists as both PROPERTY and INVARIANT once, as the INVARIANT, and charts its bug",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(
      join(dir, "Pay.cfg"),
      "SPECIFICATION Spec\nPROPERTY NoDoubleCharge\nINVARIANT NoDoubleCharge\n",
    );
    writeFileSync(join(dir, "Pay.map.mjs"), payMap);
    const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    assert.equal(
      r.stdout.split("\n\n")[0],
      `TLC on Pay.tla with Pay.cfg:
  NoDoubleCharge is broken.
  TLC ran 3 times in N s.`,
    );
    assert.match(r.stdout, /\nRule broken: `NoDoubleCharge`\n/);
    assert.equal(
      r.stdout.split("\n").at(-2),
      "Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in Pay-statechart.",
    );
    const unknown = node(
      "statechart.mjs",
      ["from-spec", "Pay.tla", "--expect-broken", "Nope"],
      dir,
    );
    assert.match(unknown.stderr, /, whose rules are NoDoubleCharge\.\n/);
  },
);

test("from-spec reports a broken PROPERTY in each form that TLC reports it in", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "Pay.tla"),
    pay(
      "Pay",
      `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
    ).replace(
      "====",
      `ChargedAtMostOnce == [](charges <= 1)\nNeverChargedAgain == [][charges' <= 1]_charges\nStartsPaying == screen = "Paying"\nNeverTwiceNorRefunded == [](charges <= 1) /\\ [](screen # "Refunded")\nStartsPayingUncharged == screen = "Paying" /\\ charges = 0\n====`,
    ),
  );
  writeFileSync(
    join(dir, "Pay.cfg"),
    "SPECIFICATION Spec\nPROPERTIES ChargedAtMostOnce NeverChargedAgain StartsPaying NeverTwiceNorRefunded StartsPayingUncharged\n",
  );
  writeFileSync(join(dir, "Pay.map.mjs"), payMap);
  const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir);
  assert.equal(r.status, 1, r.stderr);
  const broken = (p) =>
    `  ${p} is broken. The chart draws only INVARIANT rules, so read TLC's counterexample in ${join("Pay-statechart", "tlc", `Pay-${p}.out`)}.`;
  const initialOnly = (p) =>
    ` TLC checked ${p} only in the initial states, because it has no [], <>, or ~>. List it as an INVARIANT to check every state.`;
  assert.equal(
    r.stdout.split("\n\n")[0],
    `TLC on Pay.tla with Pay.cfg:
  Pay.cfg has no INVARIANT, so the chart marks no state broken.
${broken("ChargedAtMostOnce")}
${broken("NeverChargedAgain")}
${broken("StartsPaying")}${initialOnly("StartsPaying")}
${broken("NeverTwiceNorRefunded")}
${broken("StartsPayingUncharged")}${initialOnly("StartsPayingUncharged")}
  TLC ran 6 times in N s.`,
  );
  const tlcDir = join(dir, "Pay-statechart", "tlc");
  assert.match(
    readFileSync(join(tlcDir, "Pay-NeverTwiceNorRefunded.out"), "utf8"),
    /^Error: Invariant line \d+, col \d+ to line \d+, col \d+ of module Pay is violated\.$/m,
  );
  assert.match(
    readFileSync(join(tlcDir, "Pay-StartsPayingUncharged.out"), "utf8"),
    /^Error: Property line \d+, col \d+ to line \d+, col \d+ of module Pay is violated by the initial state:$/m,
  );
});

test(
  "from-spec reports a broken refinement of an instanced module in its output, the stories, and the summary",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "TicketApi.tla"),
      `---- MODULE TicketApi ----
VARIABLE status
Init == status = "open"
Take == status = "open" /\\ status' = "taken"
Close == status = "taken" /\\ status' = "closed"
Spec == Init /\\ [][Take \\/ Close]_status
====
`,
    );
    writeFileSync(
      join(dir, "Desk.tla"),
      `---- MODULE Desk ----
VARIABLES phase, agent
vars == <<phase, agent>>
Init == phase = "open" /\\ agent = "none"
Assign == phase = "open" /\\ phase' = "taken" /\\ agent' = "ana"
Finish == phase = "taken" /\\ phase' = "closed" /\\ UNCHANGED agent
Drop == phase = "open" /\\ phase' = "closed" /\\ UNCHANGED agent
Spec == Init /\\ [][Assign \\/ Finish \\/ Drop]_vars
Known == phase \\in {"open", "taken", "closed"}
Api == INSTANCE TicketApi WITH status <- phase
\\* A ticket closes only after someone takes it.
ApiRefines == Api!Spec
StartsOpen == phase = "open"
====
`,
    );
    writeFileSync(
      join(dir, "Desk.cfg"),
      "SPECIFICATION Spec\nINVARIANT Known\nPROPERTIES ApiRefines StartsOpen\n",
    );
    writeFileSync(
      join(dir, "Desk.map.mjs"),
      `export const readerActions = [];
export const state = (v) => "Ticket " + v.phase;
export const step = (action) => ({ Assign: "an agent takes it", Finish: "the agent closes it", Drop: "it closes unassigned" })[action];
`,
    );
    const r = node(
      "statechart.mjs",
      ["from-spec", "Desk.tla", "--expect-broken", "ApiRefines"],
      dir,
    );
    assert.equal(r.status, 0, r.stderr);
    const out = join(dir, "Desk-statechart");
    assert.equal(
      r.stdout.split("\n\n")[0],
      `TLC on Desk.tla with Desk.cfg:
  Known holds.
  ApiRefines is broken (expected). The chart draws only INVARIANT rules, so read TLC's counterexample in ${join("Desk-statechart", "tlc", "Desk-ApiRefines.out")}.
  StartsOpen holds. TLC checked StartsOpen only in the initial states, because it has no [], <>, or ~>. List it as an INVARIANT to check every state.
  TLC ran 4 times in N s.`,
    );
    const stories = `## Broken rules that the chart does not draw

Rule broken: A ticket closes only after someone takes it. TLC's counterexample is in ${join("tlc", "Desk-ApiRefines.out")}.
`;
    assert.ok(r.stdout.includes(`\nNo state breaks an INVARIANT rule.\n\n${stories}`), r.stdout);
    assert.equal(readFileSync(join(out, "stories.md"), "utf8"), stories);
    assert.deepEqual(JSON.parse(readFileSync(join(out, "summary.json"), "utf8")).brokenProperties, [
      {
        spec: "Desk.tla",
        property: "ApiRefines",
        rule: "A ticket closes only after someone takes it.",
        repeats: null,
        counterexample: join("tlc", "Desk-ApiRefines.out"),
      },
    ]);
  },
);

test(
  "from-spec explains an invariant and a property that name rules of a named INSTANCE with substitutions in the instanced module's words",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "LampRules.tla"), lampRules);
    writeFileSync(
      join(dir, "Lamp.tla"),
      `---- MODULE Lamp ----
VARIABLES lamp, cable
Rules == INSTANCE LampRules WITH light <- lamp, wire <- cable
Safe == Rules!SafeLight
Sound ==
  Rules!NeverShorts
${lampSteps}`,
    );
    writeFileSync(join(dir, "Lamp.cfg"), "SPECIFICATION Spec\nINVARIANT Safe\nPROPERTIES Sound\n");
    writeFileSync(join(dir, "Lamp.map.mjs"), lampMap);
    const r = node(
      "statechart.mjs",
      ["from-spec", "Lamp.tla", "--expect-broken", "Safe", "--expect-broken", "Sound"],
      dir,
    );
    assert.equal(r.status, 0, r.stderr);
    const out = join(dir, "Lamp-statechart");
    const stories = readFileSync(join(out, "stories.md"), "utf8");
    assert.match(stories, /^Rule broken: The light never comes on over a shorted wire\.$/m);
    assert.match(stories, /^1\. The wire shorts\. Now: Off\n2\. You switch it on\. Now: On$/m);
    assert.ok(
      stories.includes(
        `\nRule broken: The wire never shorts. TLC's counterexample is in ${join("tlc", "Lamp-Sound.out")}.\n`,
      ),
      stories,
    );
    assert.deepEqual(
      JSON.parse(readFileSync(join(out, "summary.json"), "utf8")).brokenProperties.map(
        (b) => b.rule,
      ),
      ["The wire never shorts."],
    );
  },
);

test(
  "a state reached only after a bug gets its own color, and the fix edge leaves the state before the changed step",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const cfg = "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n";
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(
      join(dir, "PayFixed.tla"),
      pay(
        "PayFixed",
        `screen = "Paying" /\\ charges < 2 /\\ IF charges = 0 THEN charges' = 1 /\\ UNCHANGED screen ELSE screen' = "Paid" /\\ UNCHANGED charges`,
      ),
    );
    writeFileSync(join(dir, "Pay.cfg"), cfg);
    writeFileSync(join(dir, "PayFixed.cfg"), cfg);
    writeFileSync(join(dir, "pay.map.mjs"), payMap);
    assert.match(tlc(dir, "Pay").stdout, /Invariant NoDoubleCharge is violated/);
    assert.doesNotMatch(tlc(dir, "PayFixed").stdout, /is violated/);

    const args = [
      "--dot",
      "Pay.dot",
      "--map",
      "pay.map.mjs",
      "--traces",
      "Pay.out",
      "--highlight",
      "0",
      "--out",
      "chart.mmd",
    ];
    assert.equal(node("tlc-to-chart.mjs", args, dir).status, 0);
    assert.deepEqual(statusOf(readFileSync(join(dir, "chart.mmd"), "utf8")), {
      Cart: "works",
      Paying: "works",
      "Paying, charged": "works",
      "Paying, charged twice": "wrong",
      "Refunded, charged": "after",
    });

    const withFix = [
      ...args,
      "--fixed-dot",
      "PayFixed.dot",
      "--fixed-traces",
      "PayFixed.out",
      "--fixed-rules",
      "NoDoubleCharge",
    ];
    assert.equal(node("tlc-to-chart.mjs", withFix, dir).status, 0);
    const chart = readFileSync(join(dir, "chart.mmd"), "utf8");
    assert.deepEqual(statusOf(chart), {
      Cart: "works",
      "Paid, charged": "fixed",
      Paying: "works",
      "Paying, charged": "works",
      "Paying, charged twice": "fixed",
      "Refunded, charged": "fixed",
    });
    assert.deepEqual(
      [...chart.matchAll(/^ {4}state "([^"]+)" as legend\w+$/gm)].map((m) => m[1]),
      ["Works today", "Fixed or new with the fix"],
    );
    assert.match(chart, /^stateDiagram-v2\n {2}%% second model \(fix\): the fix\n/m);
    const fixEdges = parseMermaid(chart).regions.Main.transitions.filter((t) =>
      t.label.startsWith("with the fix, "),
    );
    assert.deepEqual(
      fixEdges.map((t) => `${t.from} --> ${t.to} : ${t.label}`),
      ["Paying, charged --> Paid, charged : with the fix, the bank charges you"],
    );
  },
);

test(
  "a rule that the second model does not check reads not checked, and a rule it checks reads unchanged",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(join(dir, "pay.map.mjs"), payMap);
    assert.match(tlc(dir, "Pay").stdout, /Invariant NoDoubleCharge is violated/);
    const story = (...extra) => {
      const r = node(
        "tlc-to-chart.mjs",
        [
          ...["--dot", "Pay.dot", "--map", "pay.map.mjs", "--traces", "Pay.out"],
          ...["--against-dot", "Pay.dot", ...extra, "--story", "story.md", "--out", "chart.mmd"],
        ],
        dir,
      );
      assert.equal(r.status, 0, r.stderr);
      return readFileSync(join(dir, "story.md"), "utf8");
    };
    assert.match(
      story(),
      /^In the spec you see the same states and steps, but the spec does not check this rule\.$/m,
    );
    assert.match(
      story("--against-traces", "Pay.out", "--against-rules", "NoDoubleCharge"),
      /^In the spec you see the same states and steps, so the spec does not change this path\.$/m,
    );
  },
);

test(
  "from-spec writes a mapping to fill in, then draws each bug in every view the mapping has",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ).replace("Next ==", 'Wait == screen = "Paying" /\\ UNCHANGED vars\nNext =='),
    );
    writeFileSync(
      join(dir, "Pay.cfg"),
      "SPECIFICATION Spec\n\\* The reader's rule.\nINVARIANTS\n  NoDoubleCharge\n",
    );
    const first = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, {
      TLA2TOOLS: join(dir, "no-tlc.jar"),
    });
    assert.equal(first.status, 2);
    assert.equal(first.stdout, "");
    assert.equal(
      first.stderr,
      "Wrote Pay.map.mjs. Fill in its labels, then run this command again.\n",
    );
    const scaffold = readFileSync(join(dir, "Pay.map.mjs"), "utf8");
    assert.match(scaffold, /^\/\/ Variables: screen, charges\.$/m);
    assert.match(
      scaffold,
      /^const STEPS = \{\n\tCharge: "Charge",\n\tPay: "Pay",\n\tRefund: "Refund",\n\tWait: "Wait",\n\};$/m,
    );
    assert.equal(existsSync(join(dir, "Pay-statechart")), false);

    writeFileSync(
      join(dir, "Pay.map.mjs"),
      `${payMap}export const detail = (v) => \`charges = \${v.charges}\`;\n`,
    );
    const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    assert.equal(
      r.stdout,
      `TLC on Pay.tla with Pay.cfg:
  NoDoubleCharge is broken.
  TLC ran 3 times in N s.

Chart: 5 states and 4 transitions from 5 model states.
3 work, 1 breaks a rule, 1 reached only after a bug.

## 1. Paying, charged twice

Rule broken: \`NoDoubleCharge\`
Why: each charge request charges again.
In the model, one step leads into this bug: "the bank charges you".

0. Start: Cart
1. You pay. Now: Paying
2. The bank charges you. Now: Paying, charged
3. The bank charges you. Now: Paying, charged twice

Wrote chart.mmd, bug-1.mmd, bug-1-developer.mmd, bug-1-layered.mmd, stories.md, summary.json in Pay-statechart.
`,
    );
    assert.match(
      readFileSync(join(dir, "Pay-statechart", "bug-1-layered.mmd"), "utf8"),
      /state "Paying, charged twice" as g\d \{\n {4}state "charges = 2" as s\d\n/,
    );
    assert.deepEqual(readdirSync(join(dir, "Pay-statechart")).sort(), [
      "bug-1-developer.mmd",
      "bug-1-layered.mmd",
      "bug-1.mmd",
      "chart.mmd",
      "stories.md",
      "summary.json",
      "tlc",
    ]);
    assert.equal(
      readFileSync(join(dir, "Pay-statechart", "tlc", "Pay.cfg"), "utf8"),
      "SPECIFICATION Spec\nINVARIANT StatechartRules\n",
    );
    assert.equal(
      readFileSync(join(dir, "Pay-statechart", "tlc", "Pay-NoDoubleCharge.cfg"), "utf8"),
      "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\nCONSTRAINT NoDoubleCharge\n",
    );
  },
);

test("a rule broken by a start state marks that state wrong", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "Start.tla"),
    `---- MODULE Start ----
VARIABLES conn, badge
vars == <<conn, badge>>
Init == conn \\in {"Online", "Offline"} /\\ badge = "Synced"
Drop == conn = "Online" /\\ conn' = "Offline" /\\ badge' = "Waiting"
Next == Drop
Spec == Init /\\ [][Next]_vars
NeverSyncedWhileOffline == ~(conn = "Offline" /\\ badge = "Synced")
====
`,
  );
  writeFileSync(join(dir, "Start.cfg"), "SPECIFICATION Spec\nINVARIANT NeverSyncedWhileOffline\n");
  writeFileSync(
    join(dir, "start.map.mjs"),
    'export const state = (v) => `${v.conn} | ${v.badge}`;\nexport const step = () => "the network drops";\n',
  );
  assert.match(tlc(dir, "Start").stdout, /is violated by the initial state/);
  const args = [
    "--dot",
    "Start.dot",
    "--map",
    "start.map.mjs",
    "--traces",
    "Start.out",
    "--summary",
    "summary.json",
    "--out",
    "chart.mmd",
  ];
  const r = node("tlc-to-chart.mjs", args, dir);
  assert.equal(r.status, 0, r.stderr);
  const summary = JSON.parse(readFileSync(join(dir, "summary.json"), "utf8"));
  assert.deepEqual(
    summary.classes.map((c) => [c.end, c.readerSteps]),
    [["Offline | Synced", 0]],
  );
  assert.deepEqual(summary.chartStatus, { works: 2, wrong: 1, fixed: 0, mixed: 0, after: 0 });
});

test(
  "a screen that a clean path reaches is marked wrong in some cases when a state under it breaks a rule after a bug",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Fork.tla"),
      `---- MODULE Fork ----
VARIABLE screen
Init == screen = "start"
Slip == screen = "start" /\\ screen' = "bad"
Go == screen = "start" /\\ screen' = "good"
Fall == screen = "bad" /\\ screen' = "worse"
Spec == Init /\\ [][Slip \\/ Go \\/ Fall]_screen
NeverBroken == screen \\notin {"bad", "worse"}
====
`,
    );
    writeFileSync(join(dir, "Fork.cfg"), "SPECIFICATION Spec\nINVARIANT NeverBroken\n");
    writeFileSync(
      join(dir, "Fork.map.mjs"),
      'export const state = (v) => ({ start: "Home", bad: "Error", good: "Done", worse: "Done" })[v.screen];\nexport const step = (a) => ({ Slip: "you slip", Go: "you go", Fall: "you fall" })[a];\n',
    );
    const r = node("statechart.mjs", ["from-spec", "Fork.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    const out = join(dir, "Fork-statechart");
    assert.deepEqual(statusOf(readFileSync(join(out, "chart.mmd"), "utf8")), {
      Done: "mixed",
      Error: "wrong",
      Home: "works",
    });
    const summary = JSON.parse(readFileSync(join(out, "summary.json"), "utf8"));
    assert.deepEqual(summary.chartStatus, { works: 1, wrong: 1, fixed: 0, mixed: 1, after: 0 });
    assert.deepEqual(summary.mixedStatus, ["Done"]);
    assert.match(
      r.stdout,
      /\n1 work, 1 breaks a rule, 1 breaks a rule in some cases\.\n\nThis state breaks a rule in some cases and not in others:\n {2}Done\n/,
    );
  },
);

test(
  "a bug that ends on the start screen's label marks that screen wrong in some cases, and a screen reached only after the bug gets its own color",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Echo.tla"),
      `---- MODULE Echo ----
VARIABLE screen
Init == screen = "idle"
Lose == screen = "idle" /\\ screen' = "lost"
Leave == screen = "lost" /\\ screen' = "gone"
Spec == Init /\\ [][Lose \\/ Leave]_screen
NeverLost == screen # "lost"
====
`,
    );
    writeFileSync(join(dir, "Echo.cfg"), "SPECIFICATION Spec\nINVARIANT NeverLost\n");
    writeFileSync(
      join(dir, "Echo.map.mjs"),
      'export const state = (v) => (v.screen === "gone" ? "Away" : "Home");\nexport const step = (a) => ({ Lose: "the note is lost", Leave: "you leave" })[a];\n',
    );
    const r = node("statechart.mjs", ["from-spec", "Echo.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    const out = join(dir, "Echo-statechart");
    const chart = readFileSync(join(out, "chart.mmd"), "utf8");
    assert.deepEqual(statusOf(chart), { Away: "after", Home: "mixed" });
    assert.deepEqual(
      [...chart.matchAll(/^ {4}state "([^"]+)" as legend\w+$/gm)].map((m) => m[1]),
      ["Breaks a rule in some cases", "Reached only after a bug"],
    );
    const summary = JSON.parse(readFileSync(join(out, "summary.json"), "utf8"));
    assert.deepEqual(summary.chartStatus, { works: 0, wrong: 0, fixed: 0, mixed: 1, after: 1 });
    assert.deepEqual(summary.mixedStatus, ["Home"]);
  },
);

test(
  "a bug story numbers the step into the bug and each step that changes what the rule reads, and names the steps it hides",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Reads.tla"),
      `---- MODULE Reads ----
EXTENDS Naturals
VARIABLES screen, reads, ticks
vars == <<screen, reads, ticks>>
Init == screen = "Idle" /\\ reads = 0 /\\ ticks = 0
Open == screen = "Idle" /\\ screen' = "Open" /\\ UNCHANGED <<reads, ticks>>
Read == screen = "Open" /\\ reads < 2 /\\ ticks = 2 * reads /\\ reads' = reads + 1 /\\ UNCHANGED <<screen, ticks>>
Tick == screen = "Open" /\\ ticks < 2 * reads /\\ ticks' = ticks + 1 /\\ UNCHANGED <<screen, reads>>
Spec == Init /\\ [][Open \\/ Read \\/ Tick]_vars
ReadOnce == reads <= 1
====
`,
    );
    writeFileSync(join(dir, "Reads.cfg"), "SPECIFICATION Spec\nINVARIANT ReadOnce\n");
    writeFileSync(
      join(dir, "reads.map.mjs"),
      'export const state = (v) => v.screen;\nexport const step = (a) => ({ Open: "you open the page", Read: "the page is read" })[a] ?? "";\n',
    );
    assert.match(tlc(dir, "Reads").stdout, /Invariant ReadOnce is violated/);
    const run = (...flags) => {
      const r = node(
        "tlc-to-chart.mjs",
        [
          ...["--dot", "Reads.dot", "--map", "reads.map.mjs", "--traces", "Reads.out", ...flags],
          ...["--story", "story.md", "--summary", "summary.json", "--out", "chart.mmd"],
        ],
        dir,
      );
      assert.equal(r.status, 0, r.stderr);
      const story = readFileSync(join(dir, "story.md"), "utf8");
      return {
        steps: story.slice(story.indexOf("0. Start")),
        readerSteps: JSON.parse(readFileSync(join(dir, "summary.json"), "utf8")).classes[0]
          .readerSteps,
        numbered: edges(parseMermaid(readFileSync(join(dir, "chart.mmd"), "utf8")).regions.Main),
      };
    };
    assert.deepEqual(run("--spec", "Reads.tla"), {
      steps: `0. Start: Idle
1. You open the page. Now: Open
2. The page is read. Now: Open
   (2 hidden steps: Tick)
3. The page is read. Now: Open
`,
      readerSteps: 3,
      numbered: ["Idle -> Open : 1. you open the page", "Open -> Open : 2, 3. the page is read"],
    });
    assert.equal(
      run().steps,
      `0. Start: Idle
1. You open the page. Now: Open
   (3 hidden steps: the page is read, Tick)
2. The page is read. Now: Open
`,
    );
  },
);

test(
  "a story of a bug that only the spec has numbers a step that changes what the spec's rule reads, skips the variables that the spec lacks, and a step that the spec lacks cannot happen in the spec",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Code.tla"),
      `---- MODULE Code ----
VARIABLES s, cache
vars == <<s, cache>>
Init == s = "Idle" /\\ cache = "fresh"
Go == s = "Idle" /\\ s' = "Busy" /\\ UNCHANGED cache
Rot == s = "Busy" /\\ cache = "fresh" /\\ cache' = "stale" /\\ UNCHANGED s
Spec == Init /\\ [][Go \\/ Rot]_vars
NoStale == ~(s = "Busy" /\\ cache = "stale")
====
`,
    );
    writeFileSync(
      join(dir, "Agreed.tla"),
      `---- MODULE Agreed ----
VARIABLES s, n
vars == <<s, n>>
Init == s = "Idle" /\\ n = 0
Go == s = "Idle" /\\ s' = "Busy" /\\ UNCHANGED n
Tick == s = "Busy" /\\ n = 0 /\\ n' = 1 /\\ UNCHANGED s
Fail == s = "Busy" /\\ n = 1 /\\ s' = "Broken" /\\ UNCHANGED n
Spec == Init /\\ [][Go \\/ Tick \\/ Fail]_vars
NoStale == ~(s = "Broken" /\\ n = 1)
====
`,
    );
    for (const name of ["Code", "Agreed"])
      writeFileSync(join(dir, `${name}.cfg`), "SPECIFICATION Spec\nINVARIANT NoStale\n");
    writeFileSync(join(dir, "Code.map.mjs"), "export const state = (v) => v.s;\n");
    const r = node(
      "statechart.mjs",
      ["from-spec", "Code.tla", "--against", "Agreed.tla", "--expect-broken", "NoStale"],
      dir,
    );
    assert.equal(r.status, 0, r.stderr);
    const stories = readFileSync(join(dir, "Code-statechart", "stories.md"), "utf8");
    assert.match(
      stories,
      /^## 2\. Only in the spec: Broken\n[^#]*\n0\. Start: Idle\n1\. Go\. Now: Busy\n2\. Tick\. Now: Busy\n3\. Fail\. Now: Broken\n/m,
    );
    assert.match(
      stories,
      /^1\. Go\. Now: Busy\n2\. Rot\. Now: Busy\n\nIn the spec, step 2 \(Rot\) cannot happen, so you stay at: Busy\.\n/m,
    );
  },
);

const edit = (name, fixed) => `---- MODULE ${name} ----
VARIABLES s, flashed
vars == <<s, flashed>>
Init == s = "Idle" /\\ flashed = FALSE
Tap == s = "Idle" /\\ s' = "Saving" /\\ UNCHANGED flashed
Lose == s = "Saving" /\\ s' = "Lost edit" /\\ UNCHANGED flashed
Flash == s = "Saving" /\\ s' = "Flash" /\\ flashed' = ${fixed ? "TRUE" : "FALSE"}
Back == s \\in {"Lost edit", "Flash"} /\\ s' = "Idle" /\\ flashed' = FALSE
Next == Tap \\/ Flash \\/ Back${fixed ? "" : " \\/ Lose"}
Spec == Init /\\ [][Next]_vars
NoLostEdit == s # "Lost edit" /\\ ~(s = "Flash" /\\ flashed)
====
`;

test(
  "a bug that only the fixed model has is numbered after the current bugs and drawn as breaking a rule only with the fix",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const cfg = "SPECIFICATION Spec\nINVARIANT NoLostEdit\n";
    for (const [name, fixed] of [
      ["Edit", false],
      ["EditFixed", true],
    ]) {
      writeFileSync(join(dir, `${name}.tla`), edit(name, fixed));
      writeFileSync(join(dir, `${name}.cfg`), cfg);
      assert.match(tlc(dir, name).stdout, /Invariant NoLostEdit is violated/);
    }
    writeFileSync(
      join(dir, "edit.map.mjs"),
      'export const readerActions = ["Tap"];\nexport const state = (v) => v.s;\nexport const step = (a) => ({ Tap: "you tap Save", Lose: "the save fails", Flash: "the screen flashes", Back: "you go back" })[a] ?? "";\n',
    );
    const args = [
      "--dot",
      "Edit.dot",
      "--map",
      "edit.map.mjs",
      "--traces",
      "Edit.out",
      "--fixed-dot",
      "EditFixed.dot",
      "--fixed-traces",
      "EditFixed.out",
      "--fixed-rules",
      "NoLostEdit",
    ];
    const r = node(
      "tlc-to-chart.mjs",
      [
        ...args,
        "--cover",
        "--highlight",
        "0",
        "--story",
        "story.md",
        "--summary",
        "summary.json",
        "--out",
        "chart.mmd",
      ],
      dir,
    );
    assert.equal(r.status, 0, r.stderr);
    assert.match(r.stderr, /1 bug\(s\), 1 new with the fix/);
    const summary = JSON.parse(readFileSync(join(dir, "summary.json"), "utf8"));
    assert.deepEqual(
      summary.classes.map((c) => [c.n, c.end, c.fix]),
      [
        [1, "Lost edit", "Saving"],
        [2, "Flash", "new with the fix"],
      ],
    );
    assert.deepEqual(summary.chartStatus, {
      works: 2,
      wrong: 0,
      fixed: 1,
      mixed: 0,
      after: 0,
      worse: 1,
    });
    assert.equal(statusOf(readFileSync(join(dir, "chart.mmd"), "utf8")).Flash, "worse");
    assert.match(readFileSync(join(dir, "story.md"), "utf8"), /^## 2\. New with the fix: Flash$/m);
    const two = node(
      "tlc-to-chart.mjs",
      [...args, "--highlight", "2", "--path-only", "--out", "bug2.mmd"],
      dir,
    );
    assert.equal(two.status, 0, two.stderr);
    assert.match(readFileSync(join(dir, "bug2.mmd"), "utf8"), /: 2\. the screen flashes\n/);
  },
);

test(
  "with --fixed, a state that breaks a rule only with the fix has its own status, legend line, and count",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const counter = (name, leap) => `---- MODULE ${name} ----
EXTENDS Naturals
VARIABLE x
Init == x = 0
CountUp == x < 2 /\\ x' = x + 1
Leap == x \\in {1, 2} /\\ x' = 5
Spec == Init /\\ [][CountUp${leap ? " \\/ Leap" : ""}]_x
\\* The counter never shows five.
NotFive == x # 5
====
`;
    writeFileSync(join(dir, "Counter.tla"), counter("Counter", false));
    writeFileSync(join(dir, "CounterFixed.tla"), counter("CounterFixed", true));
    writeFileSync(join(dir, "Counter.cfg"), "SPECIFICATION Spec\nINVARIANT NotFive\n");
    writeFileSync(
      join(dir, "Counter.map.mjs"),
      `export const state = (v) => \`The counter shows \${v.x}\`;
export const step = (a) => ({ CountUp: "the counter goes up", Leap: "the counter leaps" })[a];
`,
    );
    const r = node(
      "statechart.mjs",
      ["from-spec", "Counter.tla", "--fixed", "CounterFixed.tla"],
      dir,
    );
    assert.equal(r.status, 1, r.stdout + r.stderr);
    assert.match(
      r.stdout,
      /\n3 work today, 0 still wrong with the fix, 0 fixed or new with the fix, 1 breaks a rule only with the fix\.\n\n## 1\. New with the fix: The counter shows 5\n/,
    );
    const out = join(dir, "Counter-statechart");
    const chart = readFileSync(join(out, "chart.mmd"), "utf8");
    assert.equal(statusOf(chart)["The counter shows 5"], "worse");
    assert.deepEqual(
      [...chart.matchAll(/^ {4}state "([^"]+)" as legend\w+$/gm)].map((m) => m[1]),
      ["Works today", "Breaks a rule only with the fix"],
    );
    assert.deepEqual(JSON.parse(readFileSync(join(out, "summary.json"), "utf8")).chartStatus, {
      works: 3,
      wrong: 0,
      fixed: 0,
      mixed: 0,
      after: 0,
      worse: 1,
    });
  },
);

test(
  "only --cover trims the overview, and it lists what it leaves out and counts every state",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Route.tla"),
      `---- MODULE Route ----
VARIABLE x
Init == x = "start"
Side == x = "start" /\\ x' = "porch"
Front == x = "start" /\\ x' = "hall"
Arrive == x = "porch" /\\ x' = "attic"
Leave == x = "attic" /\\ x' = "start"
Spec == Init /\\ [][Side \\/ Front \\/ Arrive \\/ Leave]_x
NoPorch == x # "porch"
====
`,
    );
    writeFileSync(join(dir, "Route.cfg"), "SPECIFICATION Spec\nINVARIANT NoPorch\n");
    const mapping = (readerActions) =>
      `export const readerActions = ${JSON.stringify(readerActions)};
export const state = (v) => v.x;
export const step = (a) => ({ Side: "you take the side door", Front: "you take the front door", Arrive: "you climb the stairs", Leave: "the lights go out" })[a];
`;
    writeFileSync(join(dir, "Route.map.mjs"), mapping(["Side", "Front", "Arrive"]));
    writeFileSync(join(dir, "nobody.map.mjs"), mapping(["Knock"]));
    const run = (out, ...flags) => {
      const r = node(
        "statechart.mjs",
        ["from-spec", "Route.tla", "--expect-broken", "NoPorch", "--out", out, ...flags],
        dir,
      );
      assert.equal(r.status, 0, r.stdout + r.stderr);
      return { r, summary: JSON.parse(readFileSync(join(dir, out, "summary.json"), "utf8")) };
    };

    const whole = run("whole");
    assert.equal(whole.summary.chartStates, 4);
    assert.equal(whole.summary.chartTransitions, 4);
    assert.deepEqual(whole.summary.chartStatus, {
      works: 2,
      wrong: 1,
      fixed: 0,
      mixed: 0,
      after: 1,
    });
    assert.equal(whole.summary.cover, undefined);
    assert.doesNotMatch(whole.r.stdout, /--cover/);

    const covered = run("covered", "--cover");
    assert.equal(covered.summary.chartStates, 3);
    assert.equal(covered.summary.chartTransitions, 2);
    assert.deepEqual(covered.summary.chartStatus, {
      works: 2,
      wrong: 1,
      fixed: 0,
      mixed: 0,
      after: 1,
    });
    assert.deepEqual(covered.summary.cover, {
      drawn: true,
      states: 4,
      transitions: 4,
      leftOutStates: ["attic"],
      leftOutTransitions: [
        "attic --> start: the lights go out",
        "porch --> attic: you climb the stairs",
      ],
    });
    assert.match(
      covered.r.stdout,
      /^--cover leaves out 1 of 4 states and 2 of 4 transitions\. The counts of states that work or break a rule include the states it leaves out\.\nStates left out:\n {2}attic\nTransitions left out:\n {2}attic --> start: the lights go out\n {2}porch --> attic: you climb the stairs\n2 work, 1 breaks a rule, 1 reached only after a bug\.$/m,
    );

    const none = run("none", "--cover", "--map", "nobody.map.mjs");
    assert.equal(none.summary.chartStates, 4);
    assert.equal(none.summary.chartTransitions, 4);
    assert.deepEqual(none.summary.cover, {
      drawn: false,
      why: "no step in TLC's graph is a reader action",
    });
    assert.match(
      none.r.stdout,
      /^--cover draws every state, because no step in TLC's graph is a reader action\.$/m,
    );
  },
);

function flatEdges(mmd) {
  const names = new Map();
  const members = new Map();
  let box = null;
  for (const line of mmd.split("\n")) {
    const opens = /^ {2}state "([^"]+)" as (g\d+) \{$/.exec(line);
    const state = /^ +state "([^"]+)" as (s\d+)$/.exec(line);
    const said = (s) => s.replaceAll("<br/>", " ");
    if (opens) {
      box = { id: opens[2], name: said(opens[1]) };
      members.set(box.id, []);
    } else if (line === "  }") box = null;
    else if (state) {
      names.set(state[2], box ? `${box.name}: ${said(state[1])}` : said(state[1]));
      if (box) members.get(box.id).push(state[2]);
    }
  }
  return [...mmd.matchAll(/^ {2}([gs]\d+) --> (s\d+) : (.*)$/gm)]
    .flatMap(([, from, to, label]) =>
      (members.get(from) ?? [from]).map((f) => `${names.get(f)} --> ${names.get(to)} : ${label}`),
    )
    .sort();
}

test(
  "states of one context sit in one box, and an arrow from the box's border stands for the same step from each",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Window.tla"),
      `---- MODULE Window ----
VARIABLES where, reply
vars == <<where, reply>>
Init == where = "Starting" /\\ reply = "none"
Boot == where = "Starting" /\\ where' = "Chat open" /\\ UNCHANGED reply
Ask == where = "Chat open" /\\ reply = "none" /\\ reply' = "pending" /\\ UNCHANGED where
Answer == reply = "pending" /\\ reply' = "shown" /\\ UNCHANGED where
Close == where = "Chat open" /\\ where' = "Window closed" /\\ UNCHANGED reply
Open == where = "Window closed" /\\ where' = "Chat open" /\\ reply' = "none"
Next == Boot \\/ Ask \\/ Answer \\/ Close \\/ Open
Spec == Init /\\ [][Next]_vars
NoReplyWhileClosed == ~(where = "Window closed" /\\ reply = "shown")
====
`,
    );
    writeFileSync(join(dir, "Window.cfg"), "SPECIFICATION Spec\nINVARIANT NoReplyWhileClosed\n");
    writeFileSync(
      join(dir, "window.map.mjs"),
      `const R = { none: "no question", pending: "reply on its way", shown: "reply shown" };
export const state = (v) => \`\${v.where}: \${v.where === "Starting" ? "loading" : R[v.reply]}\`;
export const step = (a) => ({ Boot: "the app starts", Ask: "you ask", Answer: "the reply arrives", Close: "you close the window", Open: "you open the window" })[a];
`,
    );
    assert.match(tlc(dir, "Window").stdout, /Invariant NoReplyWhileClosed is violated/);
    const args = ["--dot", "Window.dot", "--map", "window.map.mjs", "--traces", "Window.out"];
    const draw = (extra, out) => {
      const r = node("tlc-to-chart.mjs", [...args, ...extra, "--out", out], dir);
      assert.equal(r.status, 0, r.stderr);
      return readFileSync(join(dir, out), "utf8");
    };
    const boxed = draw([], "boxed.mmd");
    const flat = draw(["--flat"], "flat.mmd");

    assert.match(
      boxed,
      /^ {2}state "Chat open" as g0 \{\n {4}state "no question" as s0\n {4}state "reply on its way" as s1\n {4}state "reply shown" as s2\n {2}\}\n {2}state "Window closed" as g1 \{\n {4}state "no question" as s3\n {4}state "reply on its way" as s4\n {4}state "reply shown" as s5\n {2}\}\n {2}state "Starting: loading" as s6\n/m,
    );
    assert.deepEqual(
      boxed.split("\n").filter((l) => /you open the window/.test(l)),
      ["  g1 --> s0 : you open the window"],
    );
    assert.equal(flat.split("\n").filter((l) => /you open the window/.test(l)).length, 3);
    assert.doesNotMatch(flat, /as g\d+ \{/);
    assert.deepEqual(flatEdges(boxed), flatEdges(flat));
    assert.match(boxed, /^ {2}class s5 wrongPath$/m);
    assert.match(boxed, /^ {2}s\d --> s5 : 4\. /m);
    assert.match(boxed, /state "Breaks a rule" as legendWrong/);
  },
);

const save = (name, code) => `---- MODULE ${name} ----
VARIABLES screen, note${code ? ", retries" : ""}
vars == <<screen, note${code ? ", retries" : ""}>>
Init == screen = "Editing" /\\ note = [text |-> "draft"${code ? `, rev |-> 0] /\\ retries = 0` : "]"}
Save == screen = "Editing" /\\ screen' = "Saving" /\\ UNCHANGED <<note${code ? ", retries" : ""}>>
Confirm == screen = "Saving" /\\ screen' = "Saved" /\\ note' = [text |-> "stored"${code ? `, rev |-> 1] /\\ UNCHANGED retries` : "]"}
Edit == screen = "Saved" /\\ screen' = "Editing" /\\ note' = [note EXCEPT !.text = "draft"]${code ? " /\\ retries' = 0" : ""}
${
  code
    ? `Retry == screen = "Saving" /\\ retries = 0 /\\ retries' = 1 /\\ UNCHANGED <<screen, note>>
TimeOut == screen = "Saving" /\\ retries = 1 /\\ screen' = "Saved" /\\ UNCHANGED <<note, retries>>
Next == Save \\/ Retry \\/ Confirm \\/ TimeOut \\/ Edit`
    : "Next == Save \\/ Confirm \\/ Edit"
}
Spec == Init /\\ [][Next]_vars
TypeOK == screen \\in {"Editing", "Saving", "Saved"}
\\* You never see "Saved" while the note is still a draft.
NoFalseSaved == ~(screen = "Saved" /\\ note.text = "draft")
====
`;

test(
  "from-spec --against compares the code with the spec on the parts both have, and --expect-broken sets the exit code",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "SaveCode.tla"), save("SaveCode", true));
    writeFileSync(join(dir, "SaveAgreed.tla"), save("SaveAgreed", false));
    writeFileSync(
      join(dir, "SaveCode.cfg"),
      "SPECIFICATION Spec\nINVARIANT TypeOK\nINVARIANT NoFalseSaved\n",
    );
    writeFileSync(
      join(dir, "SaveCode.map.mjs"),
      `export const readerActions = ["Save", "Edit"];
export const state = (v) => \`\${v.screen}, \${v.note.text}\`;
export const step = (a) => ({ Save: "you press Save", Retry: "the app tries again", Confirm: "the server stores the note", TimeOut: "the save times out", Edit: "you edit the note" })[a] ?? "";
export const cause = () => "the app stops after one retry and shows Saved anyway";
`,
    );
    const base = [
      "from-spec",
      "SaveCode.tla",
      "--against",
      "SaveAgreed.tla",
      "--label",
      "the agreed chart",
    ];
    const noCfg = node("statechart.mjs", base, dir);
    assert.equal(noCfg.status, 2);
    assert.equal(
      noCfg.stderr,
      "SaveAgreed.cfg does not exist. Pass --against-config with the config to check SaveAgreed.tla with. The configs beside it: SaveCode.cfg.\n",
    );
    const run = (...extra) =>
      node("statechart.mjs", [...base, "--against-config", "SaveCode.cfg", ...extra], dir);

    const unknown = run("--expect-broken", "NoLostNote");
    assert.equal(unknown.status, 2);
    assert.equal(
      unknown.stderr,
      "--expect-broken NoLostNote: not a rule in SaveCode.cfg, whose rules are TypeOK, NoFalseSaved.\n",
    );

    const expected = run("--expect-broken", "NoFalseSaved");
    assert.equal(expected.status, 0, expected.stderr);
    assert.equal(
      expected.stdout,
      `TLC on SaveCode.tla with SaveCode.cfg:
  TypeOK holds.
  NoFalseSaved is broken (expected).
  TLC ran 4 times in N s.
TLC on SaveAgreed.tla with SaveCode.cfg:
  TypeOK holds.
  NoFalseSaved holds.
  TLC ran 3 times in N s.

Chart: 4 states and 6 transitions from 10 model states.
3 work, 1 breaks a rule, 0 only in the agreed chart.

## 1. Saved, draft

Rule broken: You never see "Saved" while the note is still a draft.
Why: the app stops after one retry and shows Saved anyway.
In the model, one step leads into this bug: "the save times out". The steps below are the shortest path that TLC found.

0. Start: Editing, draft
1. You press Save. Now: Saving, draft
   (1 hidden step: the app tries again)
2. The save times out. Now: Saved, draft

In the agreed chart, step 2 (the save times out) cannot happen, so you stay at: Saving, draft.

Broken as expected: NoFalseSaved.

Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in SaveCode-statechart.
`,
    );
    const uncitedWarning = `SaveCode.tla: TypeOK holds, but a rule can also hold because the model waits for a condition that the code does not check. No comment gives the file and line of the code that checks these conditions:
  SaveCode.tla:8 Retry: screen = "Saving"
  SaveCode.tla:9 TimeOut: retries = 1
Put that file and line in a comment on each condition, as in \\* pay.ts:120, or remove the condition when no code checks it.
`;
    const warnings = `No config beside SaveAgreed.tla has an "\\* expect:" line for SaveAgreed, so the stories cannot say whether SaveAgreed already lists each bug. When SaveAgreed.tla is a copy, pass the spec in its own folder.
${uncitedWarning}`;
    assert.equal(expected.stderr, warnings);
    const out = join(dir, "SaveCode-statechart");
    const chart = readFileSync(join(out, "chart.mmd"), "utf8");
    assert.match(chart, /^stateDiagram-v2\n {2}%% second model \(against\): the agreed chart\n/m);
    assert.deepEqual(
      [...chart.matchAll(/^ {4}state "([^"]+)" as legend\w+$/gm)].map((m) => m[1]),
      ["Works", "Breaks a rule"],
    );
    assert.match(
      chart,
      /^ {2}s3 --> s3 : in the agreed chart, the save<br\/>times out cannot happen at<br\/>step 2 of bug 1$/m,
    );
    const bug = readFileSync(join(out, "bug-1.mmd"), "utf8");
    assert.deepEqual([...bug.matchAll(/^ {2}state "([^"]+)" as s\d+$/gm)].map((m) => m[1]).sort(), [
      "Editing, draft",
      "Saved, draft",
      "Saving, draft",
    ]);
    const summary = JSON.parse(readFileSync(join(out, "summary.json"), "utf8"));
    assert.deepEqual(summary.second.role, "against");
    assert.deepEqual(summary.second.lacks.sort(), ["note.rev", "retries"]);
    assert.equal(summary.classes[0].against, "Saving, draft");
    assert.deepEqual(summary.codeLike, []);
    assert.deepEqual(summary.uncited, {
      "SaveCode.tla": [
        { line: 8, action: "Retry", condition: 'screen = "Saving"' },
        { line: 9, action: "TimeOut", condition: "retries = 1" },
      ],
    });
    assert.equal(summary.second.listed, undefined);

    const unexpected = run();
    assert.equal(unexpected.status, 1, unexpected.stderr);
    const holds = run("--expect-broken", "TypeOK");
    assert.equal(holds.status, 1, holds.stderr);
    assert.match(
      holds.stdout,
      /\nBroken but not expected: NoFalseSaved\.\n\nExpected to break but holds: TypeOK\.\n/,
    );
    const listed = run("--expect-broken", "NoFalseSaved,TypeOK");
    assert.equal(listed.status, 1, listed.stderr);
    assert.match(listed.stdout, /\nExpected to break but holds: TypeOK\.\n/);
    assert.doesNotMatch(listed.stdout, /Broken but not expected/);

    writeFileSync(
      join(dir, "code.map.mjs"),
      readFileSync(join(out, "../SaveCode.map.mjs"), "utf8").replace(
        '"the app stops after one retry and shows Saved anyway"',
        '"retryCount hit maxRetries"',
      ),
    );
    const coded = run("--map", "code.map.mjs", "--expect-broken", "NoFalseSaved");
    assert.equal(coded.status, 0, coded.stderr);
    assert.match(
      coded.stdout,
      /These labels or causes read like code\. Write them in the reader's words in code\.map\.mjs:\n {2}retryCount hit maxRetries\n/,
    );

    writeFileSync(
      join(dir, "rev.map.mjs"),
      readFileSync(join(dir, "SaveCode.map.mjs"), "utf8").replace(
        "${v.note.text}`",
        "${v.note.text} r${v.note.rev}`",
      ),
    );
    const tmp = join(dir, "tmp");
    mkdirSync(tmp);
    const lacks = node(
      "statechart.mjs",
      [
        ...base,
        "--against-config",
        "SaveCode.cfg",
        "--map",
        "rev.map.mjs",
        "--expect-broken",
        "NoFalseSaved",
      ],
      dir,
      { TMPDIR: tmp },
    );
    assert.equal(lacks.status, 2);
    const [, kept] = lacks.stderr.match(
      / The files that this run wrote are in (tmp\/statechart-\w+)\.\n$/,
    );
    assert.equal(
      lacks.stderr,
      `${warnings}rev.map.mjs: the agreed chart has no note.rev, and the mapping reads v.note.rev on its states. Label states and steps only from what both models have, or test "rev" in v.note first. The files that this run wrote are in ${kept}.\n`,
    );
    assert.match(
      readFileSync(join(dir, kept, "tlc", "SaveCode-NoFalseSaved.out"), "utf8"),
      /^Error: Invariant NoFalseSaved is violated/m,
    );
    writeFileSync(
      join(dir, "rev.map.mjs"),
      readFileSync(join(dir, "SaveCode.map.mjs"), "utf8").replace(
        "${v.note.text}`",
        '${v.note.text}${"rev" in v.note ? ` r${v.note.rev}` : ""}`',
      ),
    );
    const tested = run("--map", "rev.map.mjs", "--expect-broken", "NoFalseSaved");
    assert.equal(tested.status, 0, tested.stderr);

    writeFileSync(
      join(dir, "SaveBoth.cfg"),
      "SPECIFICATION Spec\nINVARIANT TypeOK\nINVARIANT NoFalseSaved\nPROPERTY NoFalseSaved\n",
    );
    const both = node(
      "statechart.mjs",
      [
        ...base,
        "--config",
        "SaveBoth.cfg",
        "--against-config",
        "SaveBoth.cfg",
        "--expect-broken",
        "NoFalseSaved",
      ],
      dir,
    );
    assert.equal(both.status, 0, both.stderr);
    assert.equal(both.stderr, warnings);

    writeFileSync(join(dir, "SaveAgreedType.cfg"), "SPECIFICATION Spec\nINVARIANT TypeOK\n");
    const unchecked = node(
      "statechart.mjs",
      [...base, "--against-config", "SaveAgreedType.cfg", "--expect-broken", "NoFalseSaved"],
      dir,
    );
    assert.equal(unchecked.status, 0, unchecked.stderr);
    assert.match(
      unchecked.stdout,
      /^TLC on SaveAgreed\.tla with SaveAgreedType\.cfg:\n {2}TypeOK holds\.\n/m,
    );
    assert.equal(
      unchecked.stderr,
      `SaveAgreedType.cfg does not check NoFalseSaved, so the stories cannot say whether SaveAgreed.tla keeps it.\n${warnings}`,
    );

    const listedCfg = (rule) =>
      writeFileSync(
        join(dir, "SaveAgreedBug.cfg"),
        `\\* module: SaveAgreed\n\\* expect: ${rule}\nSPECIFICATION Spec\nINVARIANT ${rule}\n`,
      );
    listedCfg("NoFalseSaved");
    const known = run("--expect-broken", "NoFalseSaved");
    assert.equal(known.status, 0, known.stderr);
    assert.equal(known.stderr, uncitedWarning);
    assert.match(
      known.stdout,
      /\nWhy: .*\nListed: SaveAgreedBug\.cfg, a config of SaveAgreed\.tla, expects TLC to break this rule\.\n/,
    );
    const listedSummary = JSON.parse(readFileSync(join(out, "summary.json"), "utf8"));
    assert.deepEqual(listedSummary.second.listed, {
      spec: "SaveAgreed.tla",
      breaks: { "SaveAgreedBug.cfg": "NoFalseSaved" },
    });
    assert.deepEqual(listedSummary.classes[0].listed, ["SaveAgreedBug.cfg"]);
    listedCfg("TypeOK");
    const fresh = run("--expect-broken", "NoFalseSaved");
    assert.equal(fresh.status, 0, fresh.stderr);
    assert.match(
      fresh.stdout,
      /\nNot listed: no config of SaveAgreed\.tla expects TLC to break this rule\. Its configs expect TLC to break `TypeOK`\.\n/,
    );
  },
);

const cartCode = `---- MODULE CartCode ----
VARIABLES phase, note, tag, mark, extra
vars == <<phase, note, tag, mark, extra>>
Init == phase = "cart" /\\ note = [text |-> "hi"] /\\ tag = [id |-> "a"] /\\ mark = [on |-> TRUE] /\\ extra = "kept"
Pay == phase = "cart" /\\ phase' = "paid" /\\ note' = [text |-> note.text, rev |-> 1] /\\ UNCHANGED <<tag, mark, extra>>
Back == phase = "paid" /\\ phase' = "cart" /\\ UNCHANGED <<note, tag, mark, extra>>
Spec == Init /\\ [][Pay \\/ Back]_vars
Ok == phase \\in {"cart", "paid"}
====
`;
const cartAgreed = `---- MODULE CartAgreed ----
VARIABLES phase, note, tag, mark
vars == <<phase, note, tag, mark>>
Init == phase = "cart" /\\ note = [text |-> "hi"] /\\ tag = "a" /\\ mark = [on |-> TRUE]
Pay == phase = "cart" /\\ phase' = "paid" /\\ mark' = [off |-> TRUE] /\\ UNCHANGED <<note, tag>>
Back == phase = "paid" /\\ phase' = "cart" /\\ UNCHANGED <<note, tag, mark>>
Spec == Init /\\ [][Pay \\/ Back]_vars
Ok == phase \\in {"cart", "paid"}
====
`;

test(
  "from-spec --against stops when the mapping reads what the spec lacks through a spread, a later state, a field of another type, or a field some states lack",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "CartCode.tla"), cartCode);
    writeFileSync(join(dir, "CartAgreed.tla"), cartAgreed);
    writeFileSync(join(dir, "CartCode.cfg"), "SPECIFICATION Spec\nINVARIANT Ok\n");
    const map = (name, state, more = "") =>
      writeFileSync(
        join(dir, name),
        `export const readerActions = ["Pay", "Back"];
export const state = ${state};
export const step = (a) => ({ Pay: "you pay", Back: "you go back" })[a];
${more}`,
      );
    const tmp = join(dir, "tmp");
    mkdirSync(tmp);
    const stops = (name, message) => {
      const r = node(
        "statechart.mjs",
        [
          "from-spec",
          "CartCode.tla",
          "--against",
          "CartAgreed.tla",
          "--label",
          "the agreed chart",
          "--against-config",
          "CartCode.cfg",
          "--map",
          name,
        ],
        dir,
        { TMPDIR: tmp },
      );
      assert.equal(r.status, 2, r.stdout);
      const [, kept] =
        r.stderr.match(/ The files that this run wrote are in (tmp\/statechart-\w+)\.\n$/) ?? [];
      assert.equal(r.stderr, `${message} The files that this run wrote are in ${kept}.\n`);
    };

    map("spread.map.mjs", "(v) => { const c = { ...v }; return `${c.phase} ${c.extra}`; }");
    stops(
      "spread.map.mjs",
      "spread.map.mjs: the agreed chart has no extra, and the mapping lists the fields of v on its states. Label states and steps only from what both models have, and read the fields it needs by name.",
    );

    map("later.map.mjs", "(v) => `${v.phase} ${v.note.rev}`");
    stops(
      "later.map.mjs",
      'later.map.mjs: the agreed chart has no note.rev, and the mapping reads v.note.rev on its states. Label states and steps only from what both models have, or test "rev" in v.note first.',
    );

    map("typed.map.mjs", "(v) => `${v.phase} ${v.tag.id}`");
    stops(
      "typed.map.mjs",
      "typed.map.mjs: the agreed chart has tag as a value of another type, and the mapping reads v.tag on its states. Label states and steps only from what both models have.",
    );

    map("partial.map.mjs", "(v) => `${v.phase} ${v.mark.on}`");
    stops(
      "partial.map.mjs",
      'partial.map.mjs: the mapping labels a state of the agreed chart "paid undefined", so it reads a field the agreed chart does not have there. Label states and steps only from what both models have.',
    );

    map(
      "guarded.map.mjs",
      "(v) => v.phase",
      "export const guard = (a, b) => `tag ${b.mark.on}`;\n",
    );
    stops(
      "guarded.map.mjs",
      'guarded.map.mjs: the mapping labels a step of the agreed chart "tag undefined", so it reads a field the agreed chart does not have there. Label states and steps only from what both models have.',
    );
  },
);

const seatsSpec = `---- MODULE Seats ----
VARIABLES seat, grid
vars == <<seat, grid>>
Init == seat = <<"empty", "empty">> /\\ grid = << <<"a", "b">>, <<"c", "d">> >>
Fill == seat[1] = "empty" /\\ seat' = [seat EXCEPT ![1] = "full"] /\\ UNCHANGED grid
Next == Fill
Spec == Init /\\ [][Next]_vars
====
`;

function seats() {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "Seats.tla"), seatsSpec);
  writeFileSync(join(dir, "Seats.cfg"), "SPECIFICATION Spec\n");
  const draw = (name, map) => {
    writeFileSync(join(dir, `${name}.map.mjs`), map);
    return node(
      "statechart.mjs",
      ["from-spec", "Seats.tla", "--map", `${name}.map.mjs`, "--out", name],
      dir,
    );
  };
  const chartOf = (name) => readFileSync(join(dir, name, "chart.mmd"), "utf8");
  const states = (name, map) => {
    const r = draw(name, map);
    assert.equal(r.status, 0, r.stderr);
    return Object.keys(statusOf(chartOf(name))).sort();
  };
  return { draw, chartOf, states };
}

test(
  "a map reads a tuple from 1, as in TLA+, stops when it reads index 0, and keeps length, array methods, spread, and JSON",
  needsTlc,
  () => {
    const { draw, chartOf } = seats();

    const first = draw(
      "first",
      'export const state = (v) => `first seat ${v.seat[1]}`;\nexport const step = () => "you take the first seat";\n',
    );
    assert.equal(first.status, 0, first.stderr);
    assert.deepEqual(edges(parseMermaid(chartOf("first")).regions.Main), [
      "first seat empty -> first seat full : you take the first seat",
    ]);

    const zero = draw("zero", "export const state = (v) => `first seat ${v.seat[0]}`;\n");
    assert.equal(zero.status, 2, zero.stdout);
    assert.match(
      zero.stderr,
      /^zero\.map\.mjs: the mapping reads v\.seat\[0\], .*reads from 1.*\bv\.seat\[1\]/m,
    );

    const shapes = draw(
      "shapes",
      'export const state = (v) =>\n  `${v.seat.filter((s) => s === "full").length} of ${v.seat.length} full, ${[...v.seat].join(" and ")}, corner ${v.grid[1][2]}`;\nexport const step = (action, before, after) => JSON.stringify(after);\n',
    );
    assert.equal(shapes.status, 0, shapes.stderr);
    const chart = chartOf("shapes");
    assert.deepEqual(Object.keys(statusOf(chart)).sort(), [
      "0 of 2 full, empty and empty, corner b",
      "1 of 2 full, full and empty, corner b",
    ]);
    assert.deepEqual(
      [...chart.matchAll(/^ {2}s\d+ --> s\d+ : (.*)$/gm)].map((m) => m[1]),
      [
        JSON.stringify({
          grid: [
            ["a", "b"],
            ["c", "d"],
          ],
          seat: ["full", "empty"],
        }),
      ],
    );
  },
);

const zeroIndex = (at) =>
  new RegExp(
    String.raw`the mapping looks for index 0 in ${at}, .*reads from 1, as in TLA\+\. Use \[\.\.\.${at}\] for an array that reads from 0\.`,
  );

test(
  "a map's in and hasOwnProperty see a tuple's indexes from 1, and asking for index 0 stops the run",
  needsTlc,
  () => {
    const { draw, states } = seats();
    assert.deepEqual(
      states(
        "has",
        "export const state = (v) =>\n  `${v.seat[1]}: ${[1, 2, 3].map((i) => i in v.seat)} ${v.seat.hasOwnProperty(2)}`;\n",
      ),
      ["empty: true,true,false true", "full: true,true,false true"],
    );

    const zero = draw("zero", "export const state = (v) => `${0 in v.seat}`;\n");
    assert.equal(zero.status, 2, zero.stdout);
    assert.match(
      zero.stderr,
      new RegExp(`^zero\\.map\\.mjs: ${zeroIndex("v\\.seat").source}`, "m"),
    );
  },
);

test("a map's Object.keys and Object.entries list a tuple's indexes from 1", needsTlc, () => {
  const { states } = seats();
  assert.deepEqual(
    states(
      "keys",
      'export const state = (v) =>\n  `${v.seat[1]}: ${Object.keys(v.seat)} ${Object.entries(v.seat).map(([i, s]) => `${i}=${s}`).join(" ")}`;\n',
    ),
    ["empty: 1,2 1=empty 2=empty", "full: 1,2 1=full 2=empty"],
  );
});

test("a map that spreads a tuple into an object gets its items at keys from 1", needsTlc, () => {
  const { states } = seats();
  assert.deepEqual(
    states(
      "spread",
      "export const state = (v) => {\n  const s = { ...v.seat };\n  return `${s[1]} ${s[2]} ${0 in s}`;\n};\n",
    ),
    ["empty empty false", "full empty false"],
  );
});

test(
  "a map that hands a tuple to concat stops the run and names the tuple it wrote",
  needsTlc,
  () => {
    const { draw } = seats();
    const r = draw("concat", 'export const state = (v) => [].concat(v.seat).join(" ");\n');
    assert.equal(r.status, 2, r.stdout);
    assert.match(r.stderr, new RegExp(`^concat\\.map\\.mjs: ${zeroIndex("v\\.seat").source}`, "m"));
  },
);

test(
  "a map flattens nested tuples with flat and flatMap, and flattening an array that holds a tuple stops the run",
  needsTlc,
  () => {
    const { draw, states } = seats();
    assert.deepEqual(
      states(
        "flat",
        'export const state = (v) =>\n  `${v.seat[1]} ${v.grid.flat().join("")} ${v.grid.flatMap((row) => row).join("")} ${v.grid.flat(Infinity).join("")}`;\n',
      ),
      ["empty abcd abcd abcd", "full abcd abcd abcd"],
    );

    const inArray = draw("inarray", 'export const state = (v) => [v.seat].flat().join(" ");\n');
    assert.equal(inArray.status, 2, inArray.stdout);
    assert.match(
      inArray.stderr,
      new RegExp(`^inarray\\.map\\.mjs: ${zeroIndex("v\\.seat").source}`, "m"),
    );
  },
);

test("a map flattens a set of tuples with flat and flatMap", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "Pairs.tla"),
    `---- MODULE Pairs ----
VARIABLES sent
Init == sent = {<<1, "a">>}
Send == sent = {<<1, "a">>} /\\ sent' = sent \\cup {<<2, "b">>}
Spec == Init /\\ [][Send]_sent
====
`,
  );
  writeFileSync(join(dir, "Pairs.cfg"), "SPECIFICATION Spec\n");
  writeFileSync(
    join(dir, "Pairs.map.mjs"),
    'export const state = (v) =>\n  `${v.sent.flat().join("")} ${v.sent.flatMap((m) => m).join("")} ${structuredClone(v.sent).flat().join("")}`;\n',
  );
  const r = node("statechart.mjs", ["from-spec", "Pairs.tla", "--out", "out"], dir);
  assert.equal(r.status, 0, r.stderr);
  assert.deepEqual(
    Object.keys(statusOf(readFileSync(join(dir, "out", "chart.mmd"), "utf8"))).sort(),
    ["1a 1a 1a", "1a2b 1a2b 1a2b"],
  );
});

test("a map's structuredClone copies tuples that still read and write from 1", needsTlc, () => {
  const { draw, states } = seats();
  assert.deepEqual(
    states(
      "clone",
      'export const state = (v) => {\n  const c = structuredClone(v);\n  c.seat[2] = "held";\n  return `${c.seat[1]} ${c.seat[2]} ${v.seat[2]} ${c.grid[2][1]} ${Object.keys(c.seat)} ${structuredClone(v.grid)[2][2]}`;\n};\n',
    ),
    ["empty held empty c 1,2 d", "full held empty c 1,2 d"],
  );

  const zero = draw(
    "clonezero",
    'export const state = (v) => {\n  const c = structuredClone(v);\n  c.seat[0] = "held";\n  return c.seat[1];\n};\n',
  );
  assert.equal(zero.status, 2, zero.stdout);
  assert.match(
    zero.stderr,
    /^clonezero\.map\.mjs: the mapping writes v\.seat\[0\], but a tuple reads from 1, as in TLA\+\. Write v\.seat\[1\] for its first item\./m,
  );
});

test(
  "from-spec --against draws a step that step() does not name by its action in the developer and layered views",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const packing = (name, more = "") => `---- MODULE ${name} ----
VARIABLES phase
Init == phase = "cart"
Pay == phase = "cart" /\\ phase' = "paid"
Pack == phase = "paid" /\\ phase' = "packed"
Ship == phase = "packed" /\\ phase' = "shipped"
${more}Spec == Init /\\ [][Pay \\/ Pack \\/ Ship${more && " \\/ Refund"}]_phase
NotShipped == phase # "shipped"
====
`;
    writeFileSync(join(dir, "PackCode.tla"), packing("PackCode"));
    writeFileSync(
      join(dir, "PackAgreed.tla"),
      packing("PackAgreed", `Refund == phase = "paid" /\\ phase' = "cart"\n`),
    );
    writeFileSync(join(dir, "PackCode.cfg"), "SPECIFICATION Spec\nINVARIANT NotShipped\n");
    writeFileSync(
      join(dir, "pack.map.mjs"),
      `export const readerActions = ["Pay"];
export const state = (v) => v.phase;
export const detail = (v) => v.phase;
export const step = (a) => ({ Pay: "you pay", Ship: "we ship" })[a];
`,
    );
    const r = node(
      "statechart.mjs",
      [
        ...["from-spec", "PackCode.tla", "--against", "PackAgreed.tla"],
        ...["--label", "the agreed chart", "--against-config", "PackCode.cfg"],
        ...["--map", "pack.map.mjs", "--out", "out"],
      ],
      dir,
    );
    assert.equal(r.status, 1, r.stderr);
    assert.doesNotMatch(r.stderr, /the mapping labels/);
    for (const view of ["developer", "layered"]) {
      const chart = readFileSync(join(dir, "out", `bug-1-${view}.mmd`), "utf8");
      assert.doesNotMatch(chart, /undefined/, view);
      assert.match(chart, /--> s\d+ : 2\. Pack$/m, view);
    }
  },
);

test(
  "from-spec --against compares a rule's variable of another type without blaming the mapping",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "ShopCode.tla"),
      `---- MODULE ShopCode ----
VARIABLES phase, tag
vars == <<phase, tag>>
Init == phase = "cart" /\\ tag = [id |-> "a"]
Pay == phase = "cart" /\\ phase' = "paid" /\\ UNCHANGED tag
Spec == Init /\\ [][Pay]_vars
Ok == ~(phase = "paid" /\\ tag = tag)
====
`,
    );
    writeFileSync(
      join(dir, "ShopAgreed.tla"),
      `---- MODULE ShopAgreed ----
VARIABLES phase, tag, seen
vars == <<phase, tag, seen>>
Init == phase = "cart" /\\ tag = "a" /\\ seen = FALSE
Peek == ~seen /\\ seen' = TRUE /\\ tag' = "b" /\\ UNCHANGED phase
Pay == phase = "cart" /\\ phase' = "paid" /\\ UNCHANGED <<tag, seen>>
Spec == Init /\\ [][Peek \\/ Pay]_vars
Ok == ~(phase = "paid" /\\ tag = tag)
====
`,
    );
    writeFileSync(join(dir, "ShopCode.cfg"), "SPECIFICATION Spec\nINVARIANT Ok\n");
    writeFileSync(
      join(dir, "shop.map.mjs"),
      `export const readerActions = ["Pay"];
export const state = (v) => v.phase;
export const step = (a) => ({ Pay: "you pay" })[a];
`,
    );
    const r = node(
      "statechart.mjs",
      [
        "from-spec",
        "ShopCode.tla",
        "--against",
        "ShopAgreed.tla",
        "--label",
        "the agreed chart",
        "--against-config",
        "ShopCode.cfg",
        "--map",
        "shop.map.mjs",
      ],
      dir,
    );
    assert.equal(r.status, 1, r.stderr);
    assert.doesNotMatch(r.stderr, /the mapping reads/);
  },
);

const shipCode = `---- MODULE ShipCode ----
EXTENDS Naturals
VARIABLES phase, n, mark
vars == <<phase, n, mark>>
Init == phase = "cart" /\\ n = 0 /\\ mark = [on |-> TRUE]
Pay == phase = "cart" /\\ phase' = "paid" /\\ n' = 1 /\\ UNCHANGED mark
Ship == phase = "paid" /\\ phase' = "shipped" /\\ UNCHANGED <<n, mark>>
Spec == Init /\\ [][Pay \\/ Ship]_vars
Ok == phase \\in {"cart", "paid", "shipped"}
NotShipped == phase # "shipped"
====
`;
const shipAgreed = `---- MODULE ShipAgreed ----
VARIABLES phase, n, mark
vars == <<phase, n, mark>>
Init == phase = "cart" /\\ n = "0" /\\ mark = [on |-> TRUE]
Pay == phase = "cart" /\\ phase' = "paid" /\\ n' = "1" /\\ UNCHANGED mark
Ship == phase = "paid" /\\ phase' = "shipped" /\\ mark' = "off" /\\ UNCHANGED n
Spec == Init /\\ [][Pay \\/ Ship]_vars
Ok == phase \\in {"cart", "paid", "shipped"}
NotShipped == phase # "shipped"
====
`;
const shipMap = (state) => `export const readerActions = ["Pay", "Ship"];
export const state = ${state};
export const step = (a) => ({ Pay: "you pay", Ship: "we ship" })[a];
`;
const stopsWith = (r, message) => {
  assert.equal(r.status, 2, r.stdout);
  const [, kept] =
    r.stderr.match(/ The files that this run wrote are in (tmp\/statechart-\w+)\.\n$/) ?? [];
  assert.equal(r.stderr, `${message} The files that this run wrote are in ${kept}.\n`);
};
const codeAgainstAgreed = [
  ...["ShipCode.tla", "--against", "ShipAgreed.tla", "--label", "the agreed chart"],
  ...["--against-config", "ShipCode.cfg"],
];
function shipAgainst(map, models = codeAgainstAgreed, agreed = shipAgreed) {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "ShipCode.tla"), shipCode);
  writeFileSync(join(dir, "ShipAgreed.tla"), agreed);
  writeFileSync(join(dir, "ShipCode.cfg"), "SPECIFICATION Spec\nINVARIANT Ok\n");
  writeFileSync(join(dir, "ship.map.mjs"), map);
  mkdirSync(join(dir, "tmp"));
  return node("statechart.mjs", ["from-spec", ...models, "--map", "ship.map.mjs"], dir, {
    TMPDIR: join(dir, "tmp"),
  });
}

test(
  "from-spec --against stops when the mapping reads a field that one model has as a number and the other as a string",
  needsTlc,
  () => {
    stopsWith(
      shipAgainst(shipMap('(v) => `${v.phase}, ${v.n === 0 ? "free" : "charged"}`')),
      "ship.map.mjs: the agreed chart has n as a value of another type, and the mapping reads v.n on its states. Label states and steps only from what both models have.",
    );
    stopsWith(
      shipAgainst(shipMap('(v) => `${v.phase}, ${v.n === "0" ? "free" : "charged"}`'), [
        "ShipAgreed.tla",
        "--config",
        "ShipCode.cfg",
        "--against",
        "ShipCode.tla",
      ]),
      "ship.map.mjs: the spec has n as a value of another type, and the mapping reads v.n on its states. Label states and steps only from what both models have.",
    );
  },
);

test(
  "from-spec --against stops when the mapping reads a field that is a record in some of the spec's states and not in others",
  needsTlc,
  () => {
    stopsWith(
      shipAgainst(shipMap('(v) => `${v.phase}, ${v.mark.on ? "marked" : "plain"}`')),
      "ship.map.mjs: the agreed chart has mark as a value of another type, and the mapping reads v.mark on its states. Label states and steps only from what both models have.",
    );

    const where = shipAgainst(
      shipMap(
        '(v) => (v.phase === "shipped" ? v.phase : `${v.phase}, ${v.mark.on ? "marked" : "plain"}`)',
      ),
    );
    assert.equal(where.status, 0, where.stderr);
  },
);

test(
  "from-spec --against checks the fields of a record that is a record in only some of the spec's states",
  needsTlc,
  () => {
    const recordStates = shipMap(
      '(v) => (v.phase === "shipped" ? v.phase : `${v.phase}, ${v.mark.on === true ? "marked" : "plain"}`)',
    );
    stopsWith(
      shipAgainst(recordStates, codeAgainstAgreed, shipAgreed.replaceAll("[on |->", "[off |->")),
      'ship.map.mjs: the agreed chart has no mark.on, and the mapping reads v.mark.on on its states. Label states and steps only from what both models have, or test "on" in v.mark first.',
    );
    stopsWith(
      shipAgainst(recordStates, codeAgainstAgreed, shipAgreed.replaceAll("TRUE", '"yes"')),
      "ship.map.mjs: the agreed chart has mark.on as a value of another type, and the mapping reads v.mark.on on its states. Label states and steps only from what both models have.",
    );
  },
);

test(
  "tlc-to-chart stops when the mapping reads a field of another type that only a trace of the second model has",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "ShipCode.tla"), shipCode);
    writeFileSync(join(dir, "ShipAgreed.tla"), shipAgreed);
    writeFileSync(join(dir, "ShipCode.cfg"), "SPECIFICATION Spec\nINVARIANT NotShipped\n");
    writeFileSync(join(dir, "ShipAgreed.cfg"), "SPECIFICATION Spec\nINVARIANT NotShipped\n");
    tlc(dir, "ShipCode");
    tlc(dir, "ShipAgreed");
    renameSync(join(dir, "ShipAgreed.out"), join(dir, "ShipAgreedTraces.out"));
    writeFileSync(join(dir, "ShipAgreed.cfg"), "SPECIFICATION Spec\nCONSTRAINT NotShipped\n");
    tlc(dir, "ShipAgreed");
    assert.doesNotMatch(readFileSync(join(dir, "ShipAgreed.dot"), "utf8"), /shipped/);
    writeFileSync(
      join(dir, "ship.map.mjs"),
      shipMap('(v) => `${v.phase}, ${v.mark.on ? "marked" : "plain"}`'),
    );
    const r = node(
      "tlc-to-chart.mjs",
      [
        ...["--dot", "ShipCode.dot", "--map", "ship.map.mjs", "--traces", "ShipCode.out"],
        ...["--against-dot", "ShipAgreed.dot", "--against-traces", "ShipAgreedTraces.out"],
        ...["--against-rules", "NotShipped", "--label", "the agreed chart", "--out", "chart.mmd"],
      ],
      dir,
    );
    assert.equal(r.status, 1, r.stdout);
    assert.match(
      r.stderr,
      /^Error: the agreed chart has mark as a value of another type, and the mapping reads v\.mark on its states\./m,
    );
  },
);

test(
  "from-spec --against names the group when the mapping groups a state of the spec by a field that state lacks",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "CartCode.tla"), cartCode);
    writeFileSync(join(dir, "CartAgreed.tla"), cartAgreed);
    writeFileSync(join(dir, "CartCode.cfg"), "SPECIFICATION Spec\nINVARIANT Ok\n");
    writeFileSync(
      join(dir, "group.map.mjs"),
      `export const readerActions = ["Pay", "Back"];
export const state = (v) => v.phase;
export const step = (a) => ({ Pay: "you pay", Back: "you go back" })[a];
export const group = (v) => \`mark \${v.mark.on}\`;
`,
    );
    mkdirSync(join(dir, "tmp"));
    const r = node(
      "statechart.mjs",
      [
        "from-spec",
        "CartCode.tla",
        "--against",
        "CartAgreed.tla",
        "--label",
        "the agreed chart",
        "--against-config",
        "CartCode.cfg",
        "--map",
        "group.map.mjs",
      ],
      dir,
      { TMPDIR: join(dir, "tmp") },
    );
    stopsWith(
      r,
      'group.map.mjs: the mapping puts a state of the agreed chart in group "mark undefined", so it reads a field the agreed chart does not have there. Label states and steps only from what both models have.',
    );
  },
);

test(
  "from-chart checks a chart whose regions guard each other, and draws it back unchanged",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "lamp.mmd"), lamp);
    const r = node(
      "statechart.mjs",
      ["from-chart", "lamp.mmd", "--expect-broken", "LitWhileOff"],
      dir,
    );
    assert.equal(r.status, 0, r.stdout + r.stderr);
    assert.match(r.stdout, /\nThe spec draws lamp\.mmd back unchanged\.\n/);
  },
);

const doorSpec = `---- MODULE Door ----
VARIABLES where, reply
vars == <<where, reply>>
Init == where = "Open" /\\ reply = "none"
Ask == reply = "none" /\\ reply' = "pending" /\\ UNCHANGED where
Answer == where = "Open" /\\ reply = "pending" /\\ reply' = "shown" /\\ UNCHANGED where
Drop == where = "Closed" /\\ reply = "pending" /\\ reply' = "lost" /\\ UNCHANGED where
Close == where = "Open" /\\ where' = "Closed" /\\ UNCHANGED reply
Reopen == where = "Closed" /\\ where' = "Open" /\\ (reply' = reply \\/ (reply = "pending" /\\ reply' = "shown"))
Next == Ask \\/ Answer \\/ Drop \\/ Close \\/ Reopen
Spec == Init /\\ [][Next]_vars
NoLostReply == reply # "lost"
NoShownWhileClosed == ~(where = "Closed" /\\ reply = "shown")
====
`;

const doorMap = `const W = { Open: "Window open", Closed: "Window closed" };
const R = { none: "no question", pending: "reply on its way", shown: "reply shown", lost: "reply lost" };
export const regionNames = ["Where you are", "Your reply"];
export const state = (v) => \`\${W[v.where]}: \${R[v.reply]}\`;
export const step = (a) => ({ Ask: "you ask", Answer: "the reply arrives", Drop: "the app drops the reply", Close: "you close the window", Reopen: "you open the window" })[a];
`;

function runDoor(map) {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(join(dir, "Door.tla"), doorSpec);
  writeFileSync(join(dir, "Door.map.mjs"), map);
  const out = join(dir, "Door-statechart");
  const read = (f) => readFileSync(join(out, f), "utf8").replaceAll("<br/>", " ");
  return (rule) => {
    writeFileSync(join(dir, "Door.cfg"), `SPECIFICATION Spec\nINVARIANT ${rule}\n`);
    const r = node("statechart.mjs", ["from-spec", "Door.tla", "--expect-broken", rule], dir);
    assert.equal(r.status, 0, r.stdout + r.stderr);
    const every = join(out, "tlc", "regions-all.mmd");
    return {
      stdout: r.stdout,
      chart: read("chart.mmd"),
      every: existsSync(every) ? read("tlc/regions-all.mmd") : null,
      bug: read("bug-1.mmd"),
      out,
    };
  };
}

test(
  "from-spec draws parallel regions only when they combine back into TLC's graph, and boxes otherwise",
  needsTlc,
  () => {
    const run = runDoor(doorMap);
    const proved = run("NoLostReply");
    assert.match(
      proved.stdout,
      /\nChart: 6 states and 5 transitions from 8 model states\.\nIt has 2 parallel regions, of 2 and 4 states\. Proof: their 7 arrows together make exactly the 8 states and 13 labeled steps of Door-statechart\/tlc\/regions-proof\.mmd, and the 5 drawn arrows make only steps among them\. Door-statechart\/tlc\/regions-all\.mmd has all 7 arrows\.\n5 work, 1 breaks a rule\.\n/,
    );
    const lines = proved.chart.split("\n");
    assert.ok(lines.includes('    state "Where you are" as region0 {'));
    assert.ok(lines.includes("    --"));
    const guarded = lines.findIndex((l) => /: the reply arrives \[when Window open\]$/.test(l));
    assert.match(lines[guarded + 1], /^ {6}%% when r0s\d$/);
    assert.doesNotMatch(proved.chart, /^ {6}r1s\d --> r1s\d : you open the window/m);
    assert.equal(
      proved.every
        .split("\n")
        .filter((l) => /^ {6}(r1s\d) --> \1 : you open the window \[when Window closed\]$/.test(l))
        .length,
      1,
    );
    const again = node(
      "compare-charts.mjs",
      ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"],
      proved.out,
    );
    assert.equal(again.stdout, "same\n", again.stderr);

    const boxed = run("NoShownWhileClosed");
    assert.equal(boxed.every, null);
    assert.match(
      boxed.stdout,
      /\nIt has no parallel regions, because "Window closed: reply shown" is "Breaks a rule", and its two region states would show "Works"\.\n/,
    );
    assert.doesNotMatch(boxed.chart, /^ +--$/m);
    assert.match(boxed.chart, /^ {2}state "Window closed" as g\d \{$/m);
  },
);

test(
  "from-spec draws parallel regions whose arrows together make a step back to the same state, which the overview leaves out",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Knobs.tla"),
      `---- MODULE Knobs ----
VARIABLES dial, light
vars == <<dial, light>>
Init == dial = "low" /\\ light = "off"
Turn == dial = "low" /\\ light = "off" /\\ dial' \\in {"low", "mid"} /\\ light' \\in {"off", "on"}
Push == dial = "mid" /\\ dial' = "high" /\\ UNCHANGED light
Next == Turn \\/ Push
Spec == Init /\\ [][Next]_vars
====
`,
    );
    writeFileSync(join(dir, "Knobs.cfg"), "SPECIFICATION Spec\nCHECK_DEADLOCK FALSE\n");
    writeFileSync(
      join(dir, "Knobs.map.mjs"),
      `export const regionNames = ["Dial", "Light"];
export const state = (v) => \`\${v.dial}: \${v.light}\`;
export const step = (a) => ({ Turn: "you turn", Push: "you push" })[a];
`,
    );
    const r = node("statechart.mjs", ["from-spec", "Knobs.tla"], dir);
    assert.equal(r.status, 0, r.stdout + r.stderr);
    assert.match(r.stdout, /\nIt has 2 parallel regions, of 3 and 2 states\. /);
    const again = node(
      "compare-charts.mjs",
      ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"],
      join(dir, "Knobs-statechart"),
    );
    assert.equal(again.stdout, "same\n", again.stderr);
  },
);

test(
  "the mapping's guard words show on an arrow only when every model step behind it has them",
  needsTlc,
  () => {
    const run = runDoor(
      `${doorMap}export const guard = (a, before) =>
  ({ Answer: "window open", Drop: "window closed", Ask: before.where === "Open" ? "window open" : "" })[a] ?? "";
`,
    );
    const proved = run("NoLostReply");
    const lines = proved.chart.split("\n");
    for (const words of [
      /: the reply arrives \[window open\]$/,
      /: the app drops the reply \[window closed\]$/,
    ])
      assert.match(lines[lines.findIndex((l) => words.test(l)) + 1], /^ {6}%% when r0s\d$/);
    assert.ok(lines.some((l) => /^ {6}r1s\d --> r1s\d : you ask$/.test(l)));
    const again = node(
      "compare-charts.mjs",
      ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"],
      proved.out,
    );
    assert.equal(again.stdout, "same\n", again.stderr);
    assert.match(proved.bug, / : \d\. the app drops the reply \[window closed\]$/m);

    const boxed = run("NoShownWhileClosed");
    assert.match(boxed.chart, / : you ask \[window open\]$/m);
    assert.match(boxed.chart, / : you ask$/m);
  },
);

test(
  "the mapping's timer() writes after N s on timer steps, and refuses a value that is not seconds",
  needsTlc,
  () => {
    const timed = runDoor(
      `${doorMap}export const timer = (a) => (a === "Drop" ? 30 : undefined);\n`,
    )("NoLostReply");
    assert.match(timed.chart, / : after 30 s, the app drops the reply \[when Window closed\]$/m);
    assert.match(timed.bug, / : \d\. after 30 s, the app drops the reply$/m);
    const again = node(
      "compare-charts.mjs",
      ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"],
      timed.out,
    );
    assert.equal(again.stdout, "same\n", again.stderr);

    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "Door.tla"), doorSpec);
    writeFileSync(join(dir, "Door.cfg"), "SPECIFICATION Spec\nINVARIANT NoLostReply\n");
    writeFileSync(join(dir, "Door.map.mjs"), `${doorMap}export const timer = () => "soon";\n`);
    const r = node("statechart.mjs", ["from-spec", "Door.tla"], dir);
    assert.notEqual(r.status, 0);
    assert.match(
      r.stderr,
      /timer\(\) must return a number of seconds above 0, or nothing; got "soon" for \w+/,
    );
  },
);

const groupMap = `${doorMap}export const group = (v) =>
  ({ none: "Nothing to show", pending: "Waiting", shown: "Reply shown", lost: "Reply shown" })[v.reply];
export const groupColors = { "Reply shown": "#d1f2eb", Waiting: null, "Never drawn": "#ffffff" };
`;

test(
  "group() fills each state with its group's color, and the legend lists only the groups the chart draws",
  needsTlc,
  () => {
    const run = runDoor(groupMap)("NoLostReply");
    const lines = run.chart.split("\n");
    assert.deepEqual(lines.slice(0, lines.indexOf('  state "At the same time" as regions {')), [
      "---",
      "config:",
      "  markdownAutoWrap: false",
      "  state:",
      "    useMaxWidth: false",
      "---",
      "stateDiagram-v2",
      "  classDef plain fill:#f4f6f7,stroke:#566573,color:#1b2631",
      "  classDef plainWrong fill:#f4f6f7,stroke:#c0392b,stroke-width:4px,color:#7b241c",
      "  classDef group0 fill:#d1f2eb,stroke:#697976,color:#1b2631",
      "  classDef group0Wrong fill:#d1f2eb,stroke:#c0392b,stroke-width:4px,color:#7b241c",
      "  classDef group1 fill:#d6eaf8,stroke:#6b757c,color:#1b2631",
      "  classDef group2 fill:#fdebd0,stroke:#7f7668,color:#1b2631",
      '  state "Legend" as legend {',
      '    state "Reply shown" as legendGroup0',
      '    state "Waiting" as legendGroup1',
      '    state "Nothing to show" as legendGroup2',
      '    state "Breaks a rule" as legendWrong',
      "  }",
      "  class legendGroup0 group0",
      "  class legendGroup1 group1",
      "  class legendGroup2 group2",
      "  class legendWrong plainWrong",
    ]);
    assert.ok(lines.includes('      state "reply lost" as r1s1'));
    assert.deepEqual(
      lines.filter((l) => l.startsWith("  class r")),
      [
        "  class r0s0 plain",
        "  class r0s1 plain",
        "  class r1s0 group2",
        "  class r1s1 group0Wrong",
        "  class r1s2 group1",
        "  class r1s3 group0",
      ],
    );
    assert.match(run.stdout, /\n5 work, 1 breaks a rule\.\n/);
    const again = node(
      "compare-charts.mjs",
      ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"],
      run.out,
    );
    assert.equal(again.stdout, "same\n", again.stderr);

    const bug = run.bug.split("\n");
    assert.ok(
      bug.includes(
        "  classDef group1Path fill:#d6eaf8,stroke:#1f3a93,stroke-width:4px,color:#1b2631",
      ),
    );
    assert.deepEqual(
      bug.filter((l) => /^ {2}class s\d/.test(l)),
      [
        "  class s0 group0Wrong",
        "  class s1 group1Path",
        "  class s2 group2Path",
        "  class s3 group1Path",
      ],
    );

    const summary = JSON.parse(readFileSync(join(run.out, "summary.json"), "utf8"));
    assert.deepEqual(summary.chartGroups, [
      { name: "Reply shown", color: "#d1f2eb", states: 2 },
      { name: "Waiting", color: "#d6eaf8", states: 1 },
      { name: "Nothing to show", color: "#fdebd0", states: 1 },
    ]);
    assert.deepEqual(summary.mixedGroups, []);
  },
);

test(
  "the mapping cannot hide a broken rule, and refuses a status name, a dark or bad color, or a group that is not a name",
  needsTlc,
  () => {
    const run = runDoor(groupMap)("NoLostReply");
    const tlcDir = join(run.out, "tlc");
    const chart = (map, ...extra) => {
      writeFileSync(join(tlcDir, "probe.map.mjs"), map);
      return node(
        "tlc-to-chart.mjs",
        [
          "--dot",
          "Door.dot",
          "--map",
          "probe.map.mjs",
          "--traces",
          "Door-NoLostReply.out",
          "--broken",
          "Door.out",
          "--highlight",
          "0",
          ...extra,
        ],
        tlcDir,
      );
    };

    const hidden = chart(
      `${doorMap}export const group = () => "All good";\nexport const groupColors = { "All good": "#e9f7ef" };\n`,
      "--regions",
    );
    assert.equal(hidden.status, 0, hidden.stderr);
    const lines = hidden.stdout.split("\n");
    assert.ok(
      lines.includes(
        "  classDef group0Wrong fill:#e9f7ef,stroke:#c0392b,stroke-width:4px,color:#7b241c",
      ),
    );
    const legend = lines.indexOf('  state "Legend" as legend {');
    assert.deepEqual(lines.slice(legend, legend + 6), [
      '  state "Legend" as legend {',
      '    state "All good" as legendGroup0',
      '    state "Breaks a rule" as legendWrong',
      "  }",
      "  class legendGroup0 group0",
      "  class legendWrong plainWrong",
    ]);
    assert.ok(lines.includes("  class r1s1 group0Wrong"));
    assert.equal(lines.filter((l) => / group0Wrong$/.test(l)).length, 1);

    const coarse = chart(
      `const W = { Open: "Window open", Closed: "Window closed" };
export const state = (v) => W[v.where];
export const group = (v) => (v.reply === "shown" ? "Reply shown" : "Waiting");
`,
      "--summary",
      "coarse.json",
    );
    assert.equal(coarse.status, 0, coarse.stderr);
    assert.deepEqual(
      coarse.stdout.split("\n").filter((l) => /^ {2}(class|classDef) /.test(l)),
      [
        "  classDef plainMixed fill:#f4f6f7,stroke:#d35400,stroke-width:4px,color:#7e5109",
        "  class legendMixed plainMixed",
        "  class s0 plainMixed",
        "  class s1 plainMixed",
      ],
    );
    const summary = JSON.parse(readFileSync(join(tlcDir, "coarse.json"), "utf8"));
    assert.deepEqual(summary.chartGroups, []);
    assert.deepEqual(summary.mixedGroups, ["Window closed", "Window open"]);

    for (const [map, error] of [
      [
        `export const group = (v) => (v.reply === "lost" ? "Breaks a rule" : "Fine");`,
        /group "Breaks a rule" has the name of a status; TLC decides the status, so name the group for what the reader sees/,
      ],
      [`export const group = () => "fixed";`, /group "fixed" has the name of a status/],
      [
        `export const group = () => "All good";\nexport const groupColors = { "All good": "#123" };`,
        /groupColors\["All good"\] "#123" is too dark for the status borders to show on it/,
      ],
      [
        `export const group = () => "All good";\nexport const groupColors = { "All good": "red" };`,
        /groupColors\["All good"\] "red" is not "#rgb" or "#rrggbb"/,
      ],
      [
        `export const group = () => "All good";\nexport const groupColors = ["#ffffff"];`,
        /groupColors must be an object from a group name to a color such as #d6eaf8/,
      ],
      [`export const group = () => 1;`, /group\(\) must return a group name or nothing; got 1/],
    ]) {
      const r = chart(`${doorMap}${map}\n`, "--regions");
      assert.equal(r.status, 1, map);
      assert.equal(r.stdout, "", map);
      assert.match(r.stderr, error);
    }
  },
);

const order = (name, note, charge) => `---- MODULE ${name} ----
EXTENDS Naturals
VARIABLES screen, charges, note
vars == <<screen, charges, note>>
Init == screen = "Cart" /\\ charges = 0 /\\ note = 0
Pay == screen = "Cart" /\\ screen' = "Paying" /\\ note' = ${note} /\\ UNCHANGED charges
Charge == screen = "Paying" /\\ charges < 2 /\\ ${charge}
Next == Pay \\/ Charge
Spec == Init /\\ [][Next]_vars
NoDoubleCharge == charges <= 1
====
`;
const chargeAgain = "charges' = charges + 1 /\\ UNCHANGED <<screen, note>>";
const chargeOnce = `IF charges = 0 THEN charges' = 1 /\\ UNCHANGED <<screen, note>> ELSE screen' = "Paid" /\\ UNCHANGED <<charges, note>>`;
const chargeFirstOnly = "charges = 0 /\\ charges' = 1 /\\ UNCHANGED <<screen, note>>";

test(
  "the fix changes a bug only at the first step that the reader sees differently",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(join(dir, "Order.tla"), order("Order", 0, chargeAgain));
    writeFileSync(join(dir, "Order.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    const withFix = (charge, map = payMap) => {
      writeFileSync(join(dir, "Order.map.mjs"), map);
      writeFileSync(join(dir, "OrderFixed.tla"), order("OrderFixed", 1, charge));
      const r = node(
        "statechart.mjs",
        ["from-spec", "Order.tla", "--fixed", "OrderFixed.tla"],
        dir,
      );
      assert.equal(r.status, 1, r.stderr);
      const transitions = (f) =>
        parseMermaid(readFileSync(join(dir, "Order-statechart", f), "utf8")).regions.Main
          .transitions;
      return {
        story: readFileSync(join(dir, "Order-statechart", "stories.md"), "utf8"),
        fixEdges: transitions("chart.mmd")
          .filter((t) => t.label.includes("with the fix"))
          .map((t) => `${t.from} --> ${t.to} : ${t.label}`),
        bugLoops: transitions("bug-1.mmd")
          .filter((t) => t.from === t.to)
          .map((t) => `${t.from} --> ${t.to} : ${t.label}`)
          .sort(),
      };
    };
    const hidden = withFix(chargeAgain);
    assert.deepEqual(hidden.fixEdges, []);
    assert.match(
      hidden.story,
      /^With the fix you see the same states and steps, so the fix does not change this path\.$/m,
    );
    const once = withFix(chargeOnce);
    assert.deepEqual(once.fixEdges, [
      "Paying, charged --> Paid, charged : with the fix, the bank charges you",
    ]);
    assert.match(
      once.story,
      /^With the fix, step 3 \(the bank charges you\) takes you to: Paid, charged\.$/m,
    );
    const unlabeledMap = payMap.replace(
      /^export const state = .*$/m,
      "export const state = (v) => v.screen;",
    );
    const unseen = withFix(chargeOnce, unlabeledMap);
    assert.deepEqual(unseen.fixEdges, ["Paying --> Paid : with the fix, the bank charges you"]);
    assert.match(
      unseen.story,
      /^With the fix, step 3 \(the bank charges you\) takes you to: Paid\.$/m,
    );
    const blocked = withFix(chargeFirstOnly, unlabeledMap);
    assert.deepEqual(blocked.fixEdges, [
      "Paying --> Paying : with the fix, the bank charges you cannot happen at step 3 of bug 1",
    ]);
    assert.deepEqual(blocked.bugLoops, [
      "Paying --> Paying : 2, 3. the bank charges you",
      "Paying --> Paying : with the fix, the bank charges you cannot happen at step 3",
    ]);
    assert.match(
      blocked.story,
      /^With the fix, step 3 \(the bank charges you\) cannot happen, so you stay at: Paying\.$/m,
    );
  },
);

test(
  "a step that the fix cannot take keeps its own loop when the fix keeps another bug on the same state",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const shop = (name, steps) => `---- MODULE ${name} ----
VARIABLES screen, charged, refunded, declined
vars == <<screen, charged, refunded, declined>>
Init == screen = "Cart" /\\ charged = FALSE /\\ refunded = FALSE /\\ declined = FALSE
Pay == screen = "Cart" /\\ screen' = "Paying" /\\ UNCHANGED <<charged, refunded, declined>>
${steps}
Spec == Init /\\ [][Next]_vars
NoCharge == ~charged
NoRefund == ~refunded
====
`;
    writeFileSync(
      join(dir, "Shop.tla"),
      shop(
        "Shop",
        `Charge == screen = "Paying" /\\ ~charged /\\ charged' = TRUE /\\ UNCHANGED <<screen, refunded, declined>>
Refund == screen = "Paying" /\\ ~refunded /\\ refunded' = TRUE /\\ UNCHANGED <<screen, charged, declined>>
Next == Pay \\/ Charge \\/ Refund`,
      ),
    );
    writeFileSync(
      join(dir, "ShopFixed.tla"),
      shop(
        "ShopFixed",
        `Charge == screen = "Paying" /\\ ~declined /\\ declined' = TRUE /\\ UNCHANGED <<screen, charged, refunded>>
Next == Pay \\/ Charge`,
      ),
    );
    writeFileSync(
      join(dir, "Shop.cfg"),
      "SPECIFICATION Spec\nINVARIANT NoCharge\nINVARIANT NoRefund\n",
    );
    writeFileSync(
      join(dir, "Shop.map.mjs"),
      `export const readerActions = ["Pay", "Charge", "Refund"];
export const state = (v) => v.screen;
export const step = (a, v, w) => ({ Pay: "you pay", Charge: w.charged ? "the bank charges you" : "the bank declines", Refund: "the bank refunds you" })[a];
export const cause = () => null;
`,
    );
    const r = node("statechart.mjs", ["from-spec", "Shop.tla", "--fixed", "ShopFixed.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    const loops = parseMermaid(readFileSync(join(dir, "Shop-statechart", "chart.mmd"), "utf8"))
      .regions.Main.transitions.filter((t) => t.from === t.to)
      .map((t) => t.label)
      .sort();
    assert.deepEqual(loops, [
      "the bank charges you or refunds you with the fix, the bank declines",
      "with the fix, the bank refunds you cannot happen at step 2 of bug 2",
    ]);
  },
);

test(
  "the replay on the fix skips only the steps that the story hides, so a step that the fix stops cannot happen",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Order.tla"),
      `---- MODULE Order ----
EXTENDS Naturals
VARIABLES screen, charges
vars == <<screen, charges>>
Init == screen = "Cart" /\\ charges = 0
Pay == screen = "Cart" /\\ screen' = "Paying" /\\ UNCHANGED charges
Charge == screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen
Spec == Init /\\ [][Pay \\/ Charge]_vars
NoDoubleCharge == charges <= 1
====
`,
    );
    writeFileSync(
      join(dir, "OrderFixed.tla"),
      `---- MODULE OrderFixed ----
EXTENDS Naturals
VARIABLES screen, charges
vars == <<screen, charges>>
Init == screen = "Cart" /\\ charges = 0
Pay == screen = "Cart" /\\ screen' = "Paying" /\\ UNCHANGED charges
Charge == screen = "Paying" /\\ charges < 1 /\\ charges' = charges + 1 /\\ UNCHANGED screen
Refund == charges = 1 /\\ charges' = 0 /\\ UNCHANGED screen
Spec == Init /\\ [][Pay \\/ Charge \\/ Refund]_vars
NoDoubleCharge == charges <= 1
====
`,
    );
    writeFileSync(join(dir, "Order.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(join(dir, "Order.map.mjs"), "export const state = (v) => v.screen;\n");
    const r = node("statechart.mjs", ["from-spec", "Order.tla", "--fixed", "OrderFixed.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    const story = readFileSync(join(dir, "Order-statechart", "stories.md"), "utf8");
    assert.match(
      story,
      /\n0\. Start: Cart\n1\. Pay\. Now: Paying\n2\. Charge\. Now: Paying\n3\. Charge\. Now: Paying\n\nWith the fix, step 3 \(Charge\) cannot happen, so you stay at: Paying\.\n/,
    );
  },
);

const retry = (name, act, again) => `---- MODULE ${name} ----
EXTENDS Naturals
VARIABLES screen, charges, key
vars == <<screen, charges, key>>
Init == screen = "Cart" /\\ charges = 0 /\\ key = FALSE
Pay == screen = "Cart" /\\ screen' = "Paying" /\\ charges' = 1 /\\ UNCHANGED key
FetchKey == screen = "Paying" /\\ ~key /\\ key' = TRUE /\\ UNCHANGED <<screen, charges>>
${act} == screen = "Paying" /\\ ${again}
Spec == Init /\\ [][Pay \\/ FetchKey \\/ ${act}]_vars
NoDoubleCharge == charges <= 1
====
`;

test(
  "the replay takes only the trace's own steps, matches a step by its words between the same two states, and quotes the second model's words",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Retry.tla"),
      retry(
        "Retry",
        "Retry",
        "charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED <<screen, key>>",
      ),
    );
    writeFileSync(join(dir, "Retry.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(
      join(dir, "Retry.map.mjs"),
      `export const state = (v) => v.screen;
export const step = (a, before, after) =>
  a === "Pay" ? "you pay"
  : a === "FetchKey" ? "the key arrives"
  : after.charges > before.charges ? "you retry and the bank charges you again"
  : "you retry and see the first charge";
`,
    );
    const withFix = (act, again) => {
      writeFileSync(join(dir, "RetryFixed.tla"), retry("RetryFixed", act, again));
      const r = node(
        "statechart.mjs",
        ["from-spec", "Retry.tla", "--fixed", "RetryFixed.tla"],
        dir,
      );
      assert.equal(r.status, 1, r.stderr);
      const story = readFileSync(join(dir, "Retry-statechart", "stories.md"), "utf8");
      assert.match(
        story,
        /\n0\. Start: Cart\n1\. You pay\. Now: Paying\n2\. You retry and the bank charges you again\. Now: Paying\n\n/,
      );
      return story.split("\n").find((l) => l.startsWith("With the fix"));
    };
    assert.equal(
      withFix("Retry", `key /\\ screen' = "Paid" /\\ UNCHANGED <<charges, key>>`),
      "With the fix, step 2 (you retry and the bank charges you again) cannot happen, so you stay at: Paying.",
    );
    assert.equal(
      withFix("Retry", `screen' = "Paid" /\\ UNCHANGED <<charges, key>>`),
      'With the fix, step 2 (you retry and the bank charges you again) happens as "you retry and see the first charge" and takes you to: Paid.',
    );
    assert.equal(
      withFix(
        "Recharge",
        "charges < 2 /\\ charges' = charges + 1 /\\ key' = TRUE /\\ UNCHANGED screen",
      ),
      "With the fix you see the same states and steps, so the fix does not change this path.",
    );
  },
);

const upload = (name, cache, copy) => `---- MODULE ${name} ----
EXTENDS Naturals
VARIABLES screen, cached, copies, merged
vars == <<screen, cached, copies, merged>>
Init == screen = "Picking" /\\ cached = FALSE /\\ copies = 0 /\\ merged = FALSE
Pick == screen = "Picking" /\\ screen' = "Ready" /\\ UNCHANGED <<cached, copies, merged>>
Cache == screen = "Ready" /\\ ~cached /\\ cached' = TRUE /\\ ${cache}
Upload == screen = "Ready" /\\ cached /\\ copies < 2 /\\ copies' = copies + 1 /\\ ${copy}
Spec == Init /\\ [][Pick \\/ Cache \\/ Upload]_vars
OneCopy == copies <= 1 \\/ merged
====
`;

test(
  "the replay says which hidden step goes elsewhere in the fix, and when the rule holds on the same states and steps",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const keepCache = "UNCHANGED <<screen, copies, merged>>";
    const keepCopy = "UNCHANGED <<screen, cached, merged>>";
    writeFileSync(join(dir, "Upload.tla"), upload("Upload", keepCache, keepCopy));
    writeFileSync(join(dir, "Upload.cfg"), "SPECIFICATION Spec\nINVARIANT OneCopy\n");
    writeFileSync(join(dir, "Upload.map.mjs"), "export const state = (v) => v.screen;\n");
    const withFix = (cache, copy) => {
      writeFileSync(join(dir, "UploadFixed.tla"), upload("UploadFixed", cache, copy));
      const r = node(
        "statechart.mjs",
        ["from-spec", "Upload.tla", "--fixed", "UploadFixed.tla"],
        dir,
      );
      assert.equal(r.status, 1, r.stderr);
      const story = readFileSync(join(dir, "Upload-statechart", "stories.md"), "utf8");
      assert.match(
        story,
        /\n0\. Start: Picking\n1\. Pick\. Now: Ready\n {3}\(1 hidden step: Cache\)\n2\. Upload\. Now: Ready\n3\. Upload\. Now: Ready\n\n/,
      );
      return story.split("\n").find((l) => l.startsWith("With the fix"));
    };
    assert.equal(
      withFix(`screen' = "Cached" /\\ UNCHANGED <<copies, merged>>`, keepCopy),
      'With the fix, after step 1, "Cache" happens and takes you to: Cached.',
    );
    assert.equal(
      withFix(keepCache, "merged' = (copies = 1) /\\ UNCHANGED <<screen, cached>>"),
      "With the fix you see the same states and steps, yet the rule holds, so the state labels do not show what the fix changes.",
    );
  },
);

const notify = (name, mutedArrive) => `---- MODULE ${name} ----
EXTENDS Naturals
VARIABLES screen, muted, banner, badge, missed, msgs, syncs
vars == <<screen, muted, banner, badge, missed, msgs, syncs>>
Init == screen = "Inbox" /\\ muted = FALSE /\\ banner = FALSE /\\ badge = FALSE
        /\\ missed = FALSE /\\ msgs = 0 /\\ syncs = 0
OpenThread == screen = "Inbox" /\\ screen' = "Thread" /\\ UNCHANGED <<muted, banner, badge, missed, msgs, syncs>>
OpenSettings == screen \\in {"Inbox", "Thread"} /\\ screen' = "Settings" /\\ UNCHANGED <<muted, banner, badge, missed, msgs, syncs>>
TapBack == screen \\in {"Thread", "Settings"} /\\ screen' = "Inbox" /\\ UNCHANGED <<muted, banner, badge, missed, msgs, syncs>>
Mute == screen = "Settings" /\\ ~muted /\\ muted' = TRUE /\\ UNCHANGED <<screen, banner, badge, missed, msgs, syncs>>
Refresh == syncs < 2 /\\ syncs' = syncs + 1 /\\ UNCHANGED <<screen, muted, banner, badge, missed, msgs>>
Arrive == msgs < syncs /\\ msgs' = msgs + 1
          /\\ (IF muted THEN ${mutedArrive} ELSE banner' = TRUE /\\ UNCHANGED <<badge, missed>>)
          /\\ UNCHANGED <<screen, muted, syncs>>
Next == OpenThread \\/ OpenSettings \\/ TapBack \\/ Mute \\/ Refresh \\/ Arrive
Spec == Init /\\ [][Next]_vars
NeverMissed == ~missed
NoBannerOnThread == ~(banner /\\ screen = "Thread")
====
`;

test(
  "a step the reader does not see breaks the rule, and the fix shows it on another screen",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Notify.tla"),
      notify("Notify", "missed' = TRUE /\\ UNCHANGED <<banner, badge>>"),
    );
    writeFileSync(
      join(dir, "NotifyBadge.tla"),
      notify("NotifyBadge", "badge' = TRUE /\\ UNCHANGED <<banner, missed>>"),
    );
    writeFileSync(
      join(dir, "Notify.cfg"),
      "SPECIFICATION Spec\nINVARIANT NeverMissed\nINVARIANT NoBannerOnThread\n",
    );
    writeFileSync(
      join(dir, "Notify.map.mjs"),
      `export const readerActions = ["OpenThread", "OpenSettings", "TapBack", "Mute", "Refresh"];
export const state = (v) => [v.screen, v.muted && "muted", v.banner && "banner", v.badge && "badge"].filter(Boolean).join(", ");
export const step = (a) => ({ OpenThread: "you open the thread", OpenSettings: "you open settings", TapBack: "you tap Back", Mute: "you mute alerts", Refresh: "you pull to refresh", Arrive: "a message arrives" })[a];
export const cause = () => null;
`,
    );
    const r = node(
      "statechart.mjs",
      ["from-spec", "Notify.tla", "--fixed", "NotifyBadge.tla", "--label", "the badge fix"],
      dir,
    );
    assert.equal(r.status, 1, r.stderr);
    const out = (f) => readFileSync(join(dir, "Notify-statechart", f), "utf8");
    const fixEdges = (f) =>
      parseMermaid(out(f))
        .regions.Main.transitions.filter((t) => t.label.includes("with the badge fix"))
        .map((t) => `${t.from} --> ${t.to} : ${t.label}`);
    const { classes } = JSON.parse(out("summary.json"));
    assert.deepEqual(
      classes.map((c) => [c.invariant, c.end, c.fix]),
      [
        ["NoBannerOnThread", "Thread, banner", "unchanged"],
        ["NeverMissed", "Settings, muted", "Settings, muted, badge"],
        ["NeverMissed", "Inbox, muted", "Inbox, muted, badge"],
        ["NeverMissed", "Settings, muted, banner", "Settings, muted, banner, badge"],
        ["NeverMissed", "Thread, muted", "Thread, muted, badge"],
        ["NoBannerOnThread", "Thread, muted, banner", "unchanged"],
        ["NeverMissed", "Inbox, muted, banner", "Inbox, muted, banner, badge"],
        ["NeverMissed", "Thread, muted, banner", "Thread, muted, banner, badge"],
        ["NoBannerOnThread", "Thread, muted, banner, badge", "new with the badge fix"],
      ],
    );
    const missed = classes.filter((c) => c.invariant === "NeverMissed");

    const story = out("stories.md");
    assert.doesNotMatch(story, /do not show what/);
    assert.match(
      story,
      /^With the badge fix, step 4 \(a message arrives\) takes you to: Settings, muted, badge\.$/m,
    );
    const settings = classes.find((c) => c.end === "Settings, muted");
    assert.deepEqual(fixEdges(`bug-${settings.n}.mmd`), [
      "Settings, muted --> Settings, muted, badge : with the badge fix, a message arrives",
    ]);
    const drawn = fixEdges("chart.mmd");
    assert.equal(new Set(drawn).size, drawn.length);
    for (const c of missed)
      assert.ok(
        drawn.includes(`${c.end} --> ${c.end}, badge : with the badge fix, a message arrives`),
        `bug ${c.n}`,
      );
  },
);

test(
  "each looping step on a bug path keeps its own label, a null cause groups bugs by end state, and the mapping names the key's colors",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Browse.tla"),
      `---- MODULE Browse ----
EXTENDS Naturals
VARIABLES screen, looks, scrolled
vars == <<screen, looks, scrolled>>
Init == screen = "Cart" /\\ looks = 0 /\\ scrolled = FALSE
Look == screen = "Cart" /\\ looks < 3 /\\ looks' = looks + 1 /\\ UNCHANGED <<screen, scrolled>>
Scroll == screen = "Cart" /\\ looks = 1 /\\ ~scrolled /\\ scrolled' = TRUE /\\ UNCHANGED <<screen, looks>>
Pay == screen = "Cart" /\\ looks = 3 /\\ scrolled /\\ screen' = "Paying" /\\ UNCHANGED <<looks, scrolled>>
Fail == screen = "Paying" /\\ screen' = "Failed" /\\ UNCHANGED <<looks, scrolled>>
Hang == screen = "Paying" /\\ screen' = "Stuck" /\\ UNCHANGED <<looks, scrolled>>
Next == Look \\/ Scroll \\/ Pay \\/ Fail \\/ Hang
Spec == Init /\\ [][Next]_vars
NeverLost == screen \\notin {"Failed", "Stuck"}
====
`,
    );
    writeFileSync(join(dir, "Browse.cfg"), "SPECIFICATION Spec\nINVARIANT NeverLost\n");
    writeFileSync(
      join(dir, "Browse.map.mjs"),
      `export const readerActions = ["Look", "Scroll", "Pay"];
export const state = (v) => v.screen;
export const step = (a) => ({ Look: "you look", Scroll: "you scroll", Pay: "you pay", Fail: "the payment fails", Hang: "the payment hangs" })[a];
export const cause = () => null;
export const legend = { works: "Works on main", wrong: "Wrong on main" };
`,
    );
    const r = node("statechart.mjs", ["from-spec", "Browse.tla"], dir);
    assert.equal(r.status, 1, r.stderr);
    const out = (f) => readFileSync(join(dir, "Browse-statechart", f), "utf8");
    assert.deepEqual(
      JSON.parse(out("summary.json")).classes.map((c) => [c.end, c.cause]),
      [
        ["Failed", null],
        ["Stuck", null],
      ],
    );
    assert.doesNotMatch(out("stories.md"), /^Why:|null/m);
    const loops = (chart) => [...chart.matchAll(/^ {2}(s\d+) --> \1 : (.*)$/gm)].map((m) => m[2]);
    assert.deepEqual(loops(out("bug-1.mmd")), ["1. you look<br/>2. you scroll<br/>3, 4. you look"]);
    assert.deepEqual(loops(out("chart.mmd")), ["you look or you scroll"]);
    const chart = out("chart.mmd");
    assert.ok(chart.includes('state "Works on main" as legendWorks'));
    assert.ok(chart.includes('state "Wrong on main" as legendWrong'));
    assert.doesNotMatch(chart, /legendFixed/);
  },
);

test("a rule that stays broken reports only the step that broke it", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "Buzz.tla"),
    `---- MODULE Buzz ----
EXTENDS Naturals
VARIABLES x, y, buzzed
vars == <<x, y, buzzed>>
Init == x = 0 /\\ y = 0 /\\ buzzed = FALSE
IncX == x < 6 /\\ x' = x + 1 /\\ UNCHANGED <<y, buzzed>>
IncY == y < 6 /\\ y' = y + 1 /\\ UNCHANGED <<x, buzzed>>
Ring == x = 2 /\\ ~buzzed /\\ buzzed' = TRUE /\\ UNCHANGED <<x, y>>
Next == IncX \\/ IncY \\/ Ring
Spec == Init /\\ [][Next]_vars
NeverBuzzed == ~buzzed
====
`,
  );
  writeFileSync(join(dir, "Buzz.cfg"), "SPECIFICATION Spec\nINVARIANT NeverBuzzed\n");
  writeFileSync(
    join(dir, "Buzz.map.mjs"),
    'export const state = (v) => (v.buzzed ? "Buzzed" : "Quiet");\nexport const step = () => "time passes";\n',
  );
  const r = node("statechart.mjs", ["from-spec", "Buzz.tla"], dir);
  assert.equal(r.status, 1, r.stderr);
  const traces = parseTraces(
    readFileSync(join(dir, "Buzz-statechart", "tlc", "Buzz-NeverBuzzed.out"), "utf8"),
  );
  assert.equal(traces.length, 7);
  for (const t of traces)
    assert.equal(
      t.steps.findIndex((s) => s.vars.buzzed),
      t.steps.length - 1,
    );
});

test("from-spec warns when steps carry the name of the whole next-state action", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const count = (next) => `---- MODULE Count ----
EXTENDS Naturals
VARIABLES x
Init == x = 0
Inc == x < 3 /\\ x' = x + 1
${next}
Spec == \\* not [][Inc]_x
        Init /\\ [][Next]_x
====
`;
  writeFileSync(join(dir, "Count.cfg"), "SPECIFICATION Spec\n");
  writeFileSync(join(dir, "Count.map.mjs"), "export const state = (v) => String(v.x);\n");
  writeFileSync(join(dir, "Count.tla"), count("Next == Inc \\/ (x = 3 /\\ x' = 0)"));
  const unnamed = node("statechart.mjs", ["from-spec", "Count.tla"], dir);
  assert.equal(unnamed.status, 0, unnamed.stderr);
  assert.match(
    unnamed.stderr,
    /^Count\.tla: 1 step has the name Next, the whole next-state action/,
  );
  writeFileSync(
    join(dir, "Count.tla"),
    count("Reset == x = 3 /\\ x' = 0\nNext == (Inc \\/ Reset) /\\ x \\in 0..3"),
  );
  const conjunct = node("statechart.mjs", ["from-spec", "Count.tla"], dir);
  assert.equal(conjunct.status, 0, conjunct.stderr);
  assert.equal(
    conjunct.stderr,
    "Count.tla: 4 steps have the name Next, the whole next-state action. TLC goes down from Next through each \\/, \\E, LET, and definition, and names each step after the last definition on that path. It stops at any other expression, such as /\\, IF, or CASE. If the reader must tell these steps apart, join a definition for each kind of step with \\/ in Next, as in Next == Pay \\/ Charge, and move each conjunct of Next into those definitions.\n",
  );
  writeFileSync(join(dir, "Count.tla"), count("Next == Inc"));
  const named = node("statechart.mjs", ["from-spec", "Count.tla"], dir);
  assert.equal(named.status, 0, named.stderr);
  assert.equal(named.stderr, "");
});

const writeLamp = (dir) => {
  writeFileSync(
    join(dir, "Lamp.tla"),
    "---- MODULE Lamp ----\nVARIABLE on\nInit == on = FALSE\nOn == on' = TRUE\nOff == on' = FALSE\nSpec == Init /\\ [][On \\/ Off]_on\n====\n",
  );
  writeFileSync(join(dir, "Lamp.cfg"), "SPECIFICATION Spec\n");
  writeFileSync(
    join(dir, "Lamp.map.mjs"),
    'export const state = (v) => (v.on ? "On" : "Off");\nexport const step = () => "you flip the switch";\n',
  );
  return join(dir, "Lamp-statechart");
};

test("a rerun without --png removes the chart.png of an earlier run", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const out = writeLamp(dir);
  mkdirSync(out);
  writeFileSync(join(out, "chart.png"), "");
  const r = node("statechart.mjs", ["from-spec", "Lamp.tla"], dir);
  assert.equal(r.status, 0, r.stderr);
  assert.deepEqual(
    readdirSync(out).filter((f) => f.endsWith(".png")),
    [],
  );
});

const writeSlowPay = (dir, ticks, paid = "Paid") => {
  writeFileSync(
    join(dir, "Pay.tla"),
    `---- MODULE Pay ----
EXTENDS Naturals
VARIABLES screen, charges, ticks
vars == <<screen, charges, ticks>>
Init == screen = "Cart" /\\ charges = 0 /\\ ticks = 0
TapPay == screen = "Cart" /\\ screen' = "Paying" /\\ UNCHANGED <<charges, ticks>>
Charge == screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED <<screen, ticks>>
Done == screen = "Paying" /\\ charges > 0 /\\ screen' = "${paid}" /\\ UNCHANGED <<charges, ticks>>
Tick == ticks < ${ticks} /\\ ticks' = ticks + 1 /\\ UNCHANGED <<screen, charges>>
Spec == Init /\\ [][TapPay \\/ Charge \\/ Done \\/ Tick]_vars
ChargedAtMostTwice == charges <= 2
====
`,
  );
  writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT ChargedAtMostTwice\n");
  writeFileSync(
    join(dir, "Pay.map.mjs"),
    'export const state = (v) => v.screen;\nexport const step = (a) => ({ TapPay: "you tap Pay", Charge: "the charge goes through", Done: "the receipt shows" })[a] ?? "";\n',
  );
  return join(dir, "Pay-statechart");
};
const startRun = (dir, { wrap = [], env = {}, args = ["from-spec", "Pay.tla"] } = {}) => {
  const [command, ...rest] = [...wrap, process.execPath, join(scripts, "statechart.mjs"), ...args];
  const child = spawn(command, rest, {
    cwd: dir,
    env: { ...process.env, ...env },
    stdio: ["ignore", "ignore", "pipe"],
    detached: true,
  });
  let stderr = "";
  child.stderr.on("data", (d) => {
    stderr += d;
  });
  return {
    child,
    done: new Promise((done) => child.on("close", (status) => done({ status, stderr }))),
  };
};
const until = async (ready) => {
  while (!ready()) await sleep(20);
};
const ownTmp = (dir, name) => {
  const tmp = join(dir, name);
  mkdirSync(tmp);
  return tmp;
};
const tlcStarted = (tmp) => readdirSync(tmp).some((f) => f.startsWith("tlc-"));
const tlcChecking = (tmp) => {
  try {
    return readdirSync(tmp, { recursive: true }).some((f) =>
      /^tlc-[^/]+\/[^/]+\/[^/]+\.fp$/.test(f),
    );
  } catch {
    return false;
  }
};
const dumpChecking = (tmp) =>
  readdirSync(tmp).some(
    (f) => f.startsWith("statechart-") && existsSync(join(tmp, f, "tlc", "Pay.cfg")),
  ) && tlcChecking(tmp);
const staged = (dir) => readdirSync(dir).filter((f) => f.startsWith("."));

test(
  "a run whose Node is killed mid-TLC leaves the output folder as it was, and a rerun charts its own spec",
  needsTlc,
  async () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const out = writeSlowPay(dir, 60000);
    const tmp = ownTmp(dir, "tmp");
    const first = startRun(dir, { env: { TMPDIR: tmp } });
    await until(() => tlcStarted(tmp));
    await sleep(300);
    first.child.kill("SIGTERM");
    await first.done;
    assert.doesNotThrow(() => process.kill(-first.child.pid, 0), "TLC outlives its Node");
    assert.equal(existsSync(out), false);

    writeSlowPay(dir, 200, "Receipt");
    const second = node("statechart.mjs", ["from-spec", "Pay.tla"], dir);
    try {
      process.kill(-first.child.pid, "SIGKILL");
    } catch (error) {
      if (error.code !== "ESRCH") throw error;
    }
    assert.equal(second.status, 0, second.stderr);
    for (const file of ["chart.mmd", join("tlc", "Pay.dot")]) {
      const text = readFileSync(join(out, file), "utf8");
      assert.match(text, /Receipt/);
      assert.doesNotMatch(text, /Paid/);
    }
    assert.deepEqual(staged(dir), []);
  },
);

const changedMidRun = async ({ wrap = [], env = {} }) => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const out = writeSlowPay(dir, 20000);
  const tmp = ownTmp(dir, "tmp-a");
  const first = startRun(dir, { wrap, env: { ...env, TMPDIR: tmp } });
  await until(() => dumpChecking(tmp));
  writeSlowPay(dir, 20000, "Receipt");
  const second = startRun(dir, { wrap, env: { ...env, TMPDIR: ownTmp(dir, "tmp-b") } });
  const [paid, receipt] = await Promise.all([first.done, second.done]);
  assert.equal(receipt.status, 0, receipt.stderr);
  assert.equal(paid.status, 2, paid.stderr);
  const [, kept] = paid.stderr.match(
    /^Pay\.tla changed while this run read it, so the run left Pay-statechart as it was\. Run the command again\. The files that this run wrote are in (tmp-a\/statechart-\w+)\.\n$/,
  );
  assert.match(readFileSync(join(dir, kept, "chart.mmd"), "utf8"), /Paid/);
  const chart = readFileSync(join(out, "chart.mmd"), "utf8");
  assert.match(chart, /Receipt/);
  assert.doesNotMatch(chart, /Paid/);
  assert.deepEqual(staged(dir), []);
};

test(
  "a run whose spec changes while it reads it leaves the output folder, and the run that read the new spec charts it",
  needsTlc,
  () => changedMidRun({}),
);

test(
  "a run whose inputs get new times and a new inode but the same content still charts them",
  needsTlc,
  async () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const out = writeSlowPay(dir, 20000);
    const tmp = ownTmp(dir, "tmp");
    const run = startRun(dir, { env: { TMPDIR: tmp } });
    await until(() => tlcStarted(tmp));
    await sleep(500);
    const later = new Date(Date.now() + 60_000);
    for (const name of ["Pay.tla", "Pay.cfg", "Pay.map.mjs"]) {
      const file = join(dir, name);
      const before = statSync(file);
      writeFileSync(`${file}.new`, readFileSync(file));
      renameSync(`${file}.new`, file);
      utimesSync(file, later, later);
      const after = statSync(file);
      assert.notEqual(after.ino, before.ino);
      assert.notEqual(after.ctimeMs, before.ctimeMs);
    }
    const r = await run.done;
    assert.equal(r.status, 0, r.stderr);
    assert.equal(r.stderr, "");
    assert.match(readFileSync(join(out, "chart.mmd"), "utf8"), /Paid/);
    assert.deepEqual(staged(dir), []);
  },
);

const unshare = ["unshare", "--user", "--map-root-user", "--pid", "--fork", "--mount-proc"];
const hidePidNamespace = `#define _GNU_SOURCE
#include <dlfcn.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
ssize_t readlink(const char *path, char *buf, size_t size) {
  static ssize_t (*real)(const char *, char *, size_t);
  if (!real) real = dlsym(RTLD_NEXT, "readlink");
  if (path && strcmp(path, "/proc/self/ns/pid") == 0) { errno = EIO; return -1; }
  return real(path, buf, size);
}
`;
const hidingPreload = (() => {
  if (spawnSync(unshare[0], [...unshare.slice(1), "true"]).status !== 0) return null;
  const dir = mkdtempSync(join(tmpdir(), "statechart-preload-"));
  writeFileSync(join(dir, "hide.c"), hidePidNamespace);
  const so = join(dir, "hide.so");
  const cc = spawnSync("cc", ["-shared", "-fPIC", "-o", so, join(dir, "hide.c"), "-ldl"]);
  return cc.status === 0 ? so : null;
})();
test(
  "runs in PID namespaces that hide which namespace they are in chart only their own spec",
  {
    skip:
      needsTlc.skip ||
      (!hidingPreload && "cannot make a PID namespace, or cannot compile a readlink preload"),
  },
  () => changedMidRun({ wrap: unshare, env: { LD_PRELOAD: hidingPreload } }),
);

test(
  "a file that is put in the output folder during a run stays, and the run exits 2",
  needsTlc,
  async () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const out = writeSlowPay(dir, 20000);
    const tmp = ownTmp(dir, "tmp");
    const run = startRun(dir, { env: { TMPDIR: tmp } });
    await until(() => tlcStarted(tmp));
    mkdirSync(out);
    writeFileSync(join(out, "notes.md"), "mine\n");
    const r = await run.done;
    assert.equal(r.status, 2);
    assert.match(
      r.stderr,
      /^Pay-statechart has a file that this command did not write: notes\.md\. A run puts its files in place of the whole output folder, so pass --out with a new folder\. The files that this run wrote are in tmp\/statechart-\w+\.\n$/,
    );
    assert.deepEqual(readdirSync(out), ["notes.md"]);
    assert.deepEqual(staged(dir), []);
  },
);

const failRenames = `#define _GNU_SOURCE
#include <dirent.h>
#include <dlfcn.h>
#include <errno.h>
#include <ftw.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>
static size_t hits;
static int raced;
static int removeOne(const char *path, const struct stat *s, int type, struct FTW *at) {
  return remove(path);
}
static int hasFiles(const char *dir) {
  DIR *d = opendir(dir);
  if (!d) return 0;
  struct dirent *e;
  int found = 0;
  while (!found && (e = readdir(d))) found = strcmp(e->d_name, ".") && strcmp(e->d_name, "..");
  closedir(d);
  return found;
}
static int named(const char *path, const char *tail) {
  size_t n = strlen(path), t = strlen(tail);
  return n >= t && strcmp(path + n - t, tail) == 0 && (n == t || path[n - t - 1] == '/');
}
static void makeAnotherRunsFolder(const char *shared) {
  static int (*make)(const char *, mode_t);
  if (!make) make = dlsym(RTLD_NEXT, "mkdir");
  char chart[4096];
  make(shared, 0777);
  snprintf(chart, sizeof chart, "%s/chart.mmd", shared);
  FILE *f = fopen(chart, "w");
  fputs("another run\\n", f);
  fclose(f);
}
static int chosen(const char *race) {
  const char *run = getenv("ANOTHER_RUN");
  return run && !raced && strcmp(run, race) == 0;
}
static int racing(const char *race) {
  return chosen(race) && (raced = 1);
}
static void takeOver(const char *shared) {
  rmdir(shared);
  makeAnotherRunsFolder(shared);
}
int mkdir(const char *path, mode_t mode) {
  static int (*real)(const char *, mode_t);
  static int (*move)(const char *, const char *);
  if (!real) real = dlsym(RTLD_NEXT, "mkdir");
  if (!move) move = dlsym(RTLD_NEXT, "rename");
  if (named(path, "shared") && racing("before-copy")) makeAnotherRunsFolder(path);
  if (named(path, "shared") && chosen("when-made")) {
    int made = real(path, mode);
    if (made == 0 && racing("when-made")) takeOver(path);
    return made;
  }
  if (named(path, "shared/tlc") && racing("during-copy")) {
    char shared[4096], aside[4200];
    snprintf(shared, sizeof shared, "%.*s", (int)(strlen(path) - strlen("/tlc")), path);
    snprintf(aside, sizeof aside, "%s-aside", shared);
    move(shared, aside);
    makeAnotherRunsFolder(shared);
    real(path, mode);
  }
  if (named(path, "shared/tlc") && racing("removed-during-copy")) {
    char shared[4096];
    snprintf(shared, sizeof shared, "%.*s", (int)(strlen(path) - strlen("/tlc")), path);
    nftw(shared, removeOne, 16, FTW_DEPTH | FTW_PHYS);
    real(shared, 0777);
  }
  return real(path, mode);
}
int rename(const char *from, const char *to) {
  static int (*real)(const char *, const char *);
  if (!real) real = dlsym(RTLD_NEXT, "rename");
  const char *base = strrchr(to, '/'), *fails = getenv("RENAME_FAILS");
  const char *cannot = getenv("RENAME_CANNOT");
  base = base ? base + 1 : to;
  if (named(to, "shared") && !hasFiles(from) && racing("before-copy")) makeAnotherRunsFolder(to);
  if (cannot && strstr(base, "shared") && hasFiles(from)) {
    errno = strcmp(cannot, "EXDEV") == 0 ? EXDEV : access(to, F_OK) == 0 ? EISDIR : ENOSYS;
    return -1;
  }
  if (fails && strcmp(base, "shared") == 0 && hits < strlen(fails)) {
    errno = fails[hits++] == 'N' ? ENOTEMPTY : EIO;
    return -1;
  }
  int renamed = real(from, to);
  if (renamed == 0 && named(to, "shared") && racing("when-made")) takeOver(to);
  return renamed;
}
`;
const failingRenames = (() => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-preload-"));
  writeFileSync(join(dir, "rename.c"), failRenames);
  const so = join(dir, "rename.so");
  const cc = spawnSync("cc", ["-shared", "-fPIC", "-o", so, join(dir, "rename.c"), "-ldl"]);
  return cc.status === 0 ? so : null;
})();
test(
  "a run whose rename fails after it moves the output folder aside puts the folder back, or says where it is",
  { skip: needsTlc.skip || (!failingRenames && "cannot compile a rename preload") },
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeLamp(dir);
    const args = ["from-spec", "Lamp.tla", "--out", "shared"];
    const shared = join(dir, "shared");
    const first = node("statechart.mjs", args, dir);
    assert.equal(first.status, 0, first.stderr);
    const chart = readFileSync(join(shared, "chart.mmd"), "utf8");
    const run = (fails) =>
      node("statechart.mjs", args, dir, { LD_PRELOAD: failingRenames, RENAME_FAILS: fails });

    const back = run("NI");
    assert.equal(back.status, 2, back.stderr);
    const [, kept] = back.stderr.match(
      /^cannot replace shared: EIO: .*\. The run left shared as it was\. The files that this run wrote are in (\/\S+)\.\n$/,
    );
    assert.equal(readFileSync(join(kept, "chart.mmd"), "utf8"), chart);
    assert.equal(readFileSync(join(shared, "chart.mmd"), "utf8"), chart);
    assert.deepEqual(staged(dir), []);

    const stuck = run("NII");
    assert.equal(stuck.status, 2, stuck.stderr);
    const named = stuck.stderr.match(
      /^cannot replace shared: EIO: .*\. This run moved the previous shared to (\.shared-\w+-old) and could not put it back\. The files that this run wrote are in \/\S+\.\n$/,
    );
    assert.ok(named, stuck.stderr);
    const aside = named[1];
    assert.equal(existsSync(shared), false);
    assert.equal(readFileSync(join(dir, aside, "chart.mmd"), "utf8"), chart);
    assert.deepEqual(staged(dir), [aside]);
  },
);

test(
  "a run on a filesystem that cannot rename copies its files into place",
  { skip: needsTlc.skip || (!failingRenames && "cannot compile a rename preload") },
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeLamp(dir);
    const args = ["from-spec", "Lamp.tla", "--out", "shared"];
    for (const [cannot, label] of [
      ["ENOSYS", "you flip the switch"],
      ["EXDEV", "you press the switch"],
      ["ENOSYS", "you tap the switch"],
    ]) {
      writeFileSync(
        join(dir, "Lamp.map.mjs"),
        `export const state = (v) => (v.on ? "On" : "Off");\nexport const step = () => "${label}";\n`,
      );
      const r = node("statechart.mjs", args, dir, {
        LD_PRELOAD: failingRenames,
        RENAME_CANNOT: cannot,
      });
      assert.equal(r.status, 0, r.stderr);
      assert.match(readFileSync(join(dir, "shared", "chart.mmd"), "utf8"), new RegExp(label));
      assert.deepEqual(staged(dir), []);
    }
  },
);

test(
  "a run that cannot rename replaces a folder that another run makes before its copy, and keeps one that another run makes during its copy",
  { skip: needsTlc.skip || (!failingRenames && "cannot compile a rename preload") },
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeLamp(dir);
    const shared = join(dir, "shared", "chart.mmd");
    const run = (anotherRun) =>
      node("statechart.mjs", ["from-spec", "Lamp.tla", "--out", "shared"], dir, {
        LD_PRELOAD: failingRenames,
        RENAME_CANNOT: "ENOSYS",
        ANOTHER_RUN: anotherRun,
      });

    const before = run("before-copy");
    assert.equal(before.status, 0, before.stderr);
    assert.match(readFileSync(shared, "utf8"), /you flip the switch/);
    assert.deepEqual(staged(dir), []);

    const during = run("during-copy");
    assert.equal(during.status, 2, during.stderr);
    const named = during.stderr.match(
      /^cannot replace shared: \S*EEXIST\S*: .*\. This run moved the previous shared to (\.shared-\w+-old) and could not put it back\. The files that this run wrote are in \/\S+\.\n$/,
    );
    assert.ok(named, during.stderr);
    assert.equal(readFileSync(shared, "utf8"), "another run\n");
    assert.deepEqual(readdirSync(join(dir, "shared", "tlc")), []);
    assert.match(readFileSync(join(dir, named[1], "chart.mmd"), "utf8"), /you flip the switch/);
    assert.deepEqual(staged(dir), [named[1]]);
  },
);

test(
  "a run that cannot rename stops when another run removes its folder during its copy and makes an empty one in its place, and keeps that folder",
  { skip: needsTlc.skip || (!failingRenames && "cannot compile a rename preload") },
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeLamp(dir);
    const r = node("statechart.mjs", ["from-spec", "Lamp.tla", "--out", "shared"], dir, {
      LD_PRELOAD: failingRenames,
      RENAME_CANNOT: "ENOSYS",
      ANOTHER_RUN: "removed-during-copy",
    });
    assert.equal(r.status, 2, r.stderr);
    assert.match(
      r.stderr,
      /^cannot replace shared: another run replaced the folder during the copy\. The run left shared as it was\. The files that this run wrote are in \/\S+\.\n$/,
    );
    assert.ok(existsSync(join(dir, "shared")));
    assert.deepEqual(staged(dir), []);
  },
);

test(
  "a run that cannot rename keeps the folder that another run puts in place of its folder as soon as the run makes it",
  { skip: needsTlc.skip || (!failingRenames && "cannot compile a rename preload") },
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeLamp(dir);
    const r = node("statechart.mjs", ["from-spec", "Lamp.tla", "--out", "shared"], dir, {
      LD_PRELOAD: failingRenames,
      RENAME_CANNOT: "ENOSYS",
      ANOTHER_RUN: "when-made",
    });
    assert.equal(r.status, 2, r.stderr);
    assert.match(
      r.stderr,
      /^cannot replace shared: \S*EEXIST\S*: .*\. The run left shared as it was\. The files that this run wrote are in \/\S+\.\n$/,
    );
    assert.equal(readFileSync(join(dir, "shared", "chart.mmd"), "utf8"), "another run\n");
    assert.deepEqual(staged(dir), []);
  },
);

test(
  "a run whose input changes before --png renders stops before it renders, and keeps its files",
  { skip: needsTlc.skip || needsPng.skip },
  async () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeSlowPay(dir, 20000);
    const rendered = join(dir, "rendered");
    const tmp = ownTmp(dir, "tmp");
    const run = startRun(dir, {
      args: ["from-spec", "Pay.tla", "--png"],
      env: {
        TMPDIR: tmp,
        XDG_CACHE_HOME: fakeRenderer(),
        RENDERED: rendered,
        TLA2TOOLS: tools.jar,
        JAVA: tools.java,
      },
    });
    await until(() => tlcStarted(tmp));
    const map = join(dir, "Pay.map.mjs");
    writeFileSync(map, `${readFileSync(map, "utf8")}// edited\n`);
    const r = await run.done;
    assert.equal(r.status, 2, r.stderr);
    const [, kept] = r.stderr.match(
      /^Pay\.map\.mjs changed while this run read it, so the run left Pay-statechart as it was\. Run the command again\. The files that this run wrote are in (tmp\/statechart-\w+)\.\n$/,
    );
    assert.ok(existsSync(join(dir, kept, "chart.mmd")));
    assert.equal(existsSync(rendered), false);
  },
);

const writeCount = (dir) => {
  writeFileSync(
    join(dir, "Count.tla"),
    "---- MODULE Count ----\nEXTENDS Naturals, \\* the bound\n  Limits\nVARIABLE n\nInit == n = 0\nUp == n < Max /\\ n' = n + 1\nNext == Up\nSpec == Init /\\ [][Next]_n\nSmall == n <= 2\nLast == n <= 2\n====\n",
  );
  writeFileSync(join(dir, "Limits.tla"), "---- MODULE Limits ----\nMax == 2\n====\n");
  writeFileSync(join(dir, "Count.cfg"), "SPECIFICATION Spec\nINVARIANT Small\nINVARIANT Last\n");
  writeFileSync(join(dir, "labels.mjs"), 'export const up = "you add one";\n');
  writeFileSync(
    join(dir, "Count.map.mjs"),
    'import { up } from "./labels.mjs";\nexport const state = (v) => `count ${v.n}`;\nexport const step = () => up;\n',
  );
  return join(dir, "Count-statechart");
};
const EDIT_DURING_TLC = `#!/bin/sh
case "$*" in
*Count-Small.cfg*) cp "$EDITED" "$TARGET";;
*Count-Last.cfg*) [ -z "$RESTORE" ] || cp "$RESTORE" "$TARGET";;
esac
exec "$REAL_JAVA" "$@"
`;
const editDuringTlc = (file, edit, putBack) => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  const out = writeCount(dir);
  const side = ownTmp(dir, "side");
  const target = join(dir, file);
  writeFileSync(join(side, "edited"), edit(readFileSync(target, "utf8")));
  writeFileSync(join(side, "original"), readFileSync(target));
  writeFileSync(join(side, "java"), EDIT_DURING_TLC, { mode: 0o755 });
  const r = node("statechart.mjs", ["from-spec", "Count.tla"], dir, {
    JAVA: join(side, "java"),
    TLA2TOOLS: tools.jar,
    REAL_JAVA: tools.java,
    TARGET: target,
    EDITED: join(side, "edited"),
    RESTORE: putBack ? join(side, "original") : "",
  });
  return { r, out };
};

test(
  "a spec or a module it EXTENDS that changes during a run and changes back gets the results of the files that the run started with",
  needsTlc,
  () => {
    for (const [file, edit] of [
      ["Count.tla", (s) => s.replace("n < Max", "n < 5")],
      ["Limits.tla", (s) => s.replace("Max == 2", "Max == 5")],
    ]) {
      const { r, out } = editDuringTlc(file, edit, true);
      assert.equal(r.status, 0, `${file}: ${r.stdout}${r.stderr}`);
      assert.match(r.stdout, /^ {2}Small holds\.\n {2}Last holds\.$/m, file);
      assert.match(r.stdout, /^No state breaks an INVARIANT rule\.$/m, file);
      assert.ok(existsSync(join(out, "chart.mmd")), file);
    }
  },
);

test(
  "a module that the spec EXTENDS or a file that the map imports, changed during a run, stops the run with exit 2",
  needsTlc,
  () => {
    for (const [file, edit] of [
      ["Limits.tla", (s) => s.replace("Max == 2", "Max == 5")],
      ["labels.mjs", (s) => s.replace("one", "two")],
    ]) {
      const { r, out } = editDuringTlc(file, edit, false);
      assert.equal(r.status, 2, `${file}: ${r.stdout}${r.stderr}`);
      assert.match(
        r.stderr,
        new RegExp(
          `^${file.replace(".", "\\.")} changed while this run read it, so the run left Count-statechart as it was\\. Run the command again\\. The files that this run wrote are in \\S+\\.\\n$`,
        ),
      );
      assert.equal(existsSync(out), false, file);
    }
  },
);

test("a copy keeps the folders of its input under the snapshot folder, on a Windows drive or share too", () => {
  assert.equal(copyPath("/tmp/r", "/home/u/Count.tla", posix), "/tmp/r/home/u/Count.tla");
  assert.equal(
    copyPath("C:\\Temp\\r", "C:\\Users\\u\\Count.tla", win32),
    "C:\\Temp\\r\\C\\Users\\u\\Count.tla",
  );
  assert.equal(
    copyPath("C:\\Temp\\r", "\\\\host\\share\\Count.tla", win32),
    "C:\\Temp\\r\\hostshare\\Count.tla",
  );
});

test(
  "a rule that TLC finds broken before TLC stops on an error is broken, and the run draws the paths TLC printed",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(join(dir, "Pay.map.mjs"), payMap);
    writeFileSync(
      join(dir, "crash.txt"),
      `Error: Invariant NoDoubleCharge is violated.\n${tlcThrew(
        "java.lang.ArrayIndexOutOfBoundsException",
        "Index 123 out of bounds for length 4",
      ).replaceAll("Small", "NoDoubleCharge")}\n${stoppedEarly}`,
    );
    const java = join(dir, "java");
    writeFileSync(
      java,
      `#!/bin/sh
"$REAL_JAVA" "$@" > "$0.$$.out"; s=$?
if grep -q '^Error: Invariant' "$0.$$.out"; then
  sed '/^Model checking completed/,$d' "$0.$$.out"; cat "$CRASH"; s=75
else
  cat "$0.$$.out"
fi
rm "$0.$$.out"
exit $s
`,
      { mode: 0o755 },
    );
    const r = node(
      "statechart.mjs",
      ["from-spec", "Pay.tla", "--expect-broken", "NoDoubleCharge"],
      dir,
      { JAVA: java, TLA2TOOLS: tools.jar, REAL_JAVA: tools.java, CRASH: join(dir, "crash.txt") },
    );
    assert.equal(r.status, 0, r.stderr);
    assert.match(r.stdout, /^ {2}NoDoubleCharge is broken \(expected\)\.$/m);
    assert.match(
      r.stderr,
      /^Pay-statechart\/tlc\/Pay-NoDoubleCharge\.out: TLC found that NoDoubleCharge is broken, and then stopped on an error: java\.lang\.ArrayIndexOutOfBoundsException: Index 123 out of bounds for length 4\. The paths that TLC printed before it stopped are complete, but TLC did not check every state, so the charts can miss states that break NoDoubleCharge\. A smaller constant can let TLC finish\.$/m,
    );
    assert.match(r.stdout, /^## 1\. Paying, charged twice$/m);
  },
);

test(
  "each TLC run writes the standard modules in its own temp folder, so overlapping runs cannot rewrite them under each other",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeSlowPay(dir, 0);
    const tmp = ownTmp(dir, "tmp");
    const log = join(dir, "java.log");
    const java = join(dir, "java");
    writeFileSync(
      java,
      `#!/bin/sh
for a; do case "$a" in -Djava.io.tmpdir=*) t="\${a#-Djava.io.tmpdir=}";; esac; done
"$REAL_JAVA" "$@" > "$LOG.$$"; s=$?
cat "$LOG.$$"
echo "$t: $(grep 'Naturals.tla' "$LOG.$$")" >> "$LOG"
rm "$LOG.$$"
exit $s
`,
      { mode: 0o755 },
    );
    const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, {
      JAVA: java,
      TLA2TOOLS: tools.jar,
      REAL_JAVA: tools.java,
      LOG: log,
      TMPDIR: tmp,
    });
    assert.equal(r.status, 0, r.stderr);
    const runs = readFileSync(log, "utf8").trim().split("\n");
    assert.ok(runs.length > 0);
    const folders = new Set();
    for (const line of runs) {
      const [folder, parsed] = line.split(": ");
      assert.ok(folder.startsWith(join(tmp, "tlc-")), line);
      assert.ok(parsed.startsWith(`Parsing file ${folder}/`), line);
      folders.add(folder);
    }
    assert.equal(folders.size, runs.length);
  },
);

test(
  "a run that TLC stops on an error keeps TLC's output and writes no output folder",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      "---- MODULE Pay ----\nVARIABLE x\nASSUME FALSE\nInit == x = 0\nSpec == Init /\\ [][x' = x]_x\n====\n",
    );
    writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\n");
    writeFileSync(join(dir, "Pay.map.mjs"), 'export const state = () => "Cart";\n');
    const tmp = ownTmp(dir, "tmp");
    const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, { TMPDIR: tmp });
    assert.equal(r.status, 2);
    const [, file] = r.stderr.match(
      /^(\S+\/tlc\/Pay\.out): TLC stopped on an error that is not a broken rule: Assumption .* is false\.\n$/,
    );
    assert.ok(file.startsWith(tmp), file);
    assert.match(readFileSync(file, "utf8"), /Assumption .* is false/);
    assert.equal(existsSync(join(dir, "Pay-statechart")), false);
  },
);

test(
  "a state graph too large for one string prints the rule results, keeps TLC's output, and draws no chart",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(join(dir, "Pay.map.mjs"), payMap);
    const java = join(dir, "java");
    writeFileSync(
      java,
      `#!/bin/sh
"$REAL_JAVA" "$@"; s=$?
while [ $# -gt 0 ]; do
  [ "$1" = -dump ] && "$NODE" -e 'require("fs").truncateSync(process.argv[1], +process.argv[2])' "$3" "$SIZE"
  shift
done
exit $s
`,
      { mode: 0o755 },
    );
    const tmp = ownTmp(dir, "tmp");
    const r = node(
      "statechart.mjs",
      ["from-spec", "Pay.tla", "--expect-broken", "NoDoubleCharge"],
      dir,
      {
        JAVA: java,
        TLA2TOOLS: tools.jar,
        REAL_JAVA: tools.java,
        NODE: process.execPath,
        SIZE: String(constants.MAX_STRING_LENGTH + 1),
        TMPDIR: tmp,
      },
    );
    assert.equal(r.status, 2, r.stderr);
    assert.match(r.stdout, /^ {2}NoDoubleCharge is broken \(expected\)\.$/m);
    const [, kept] = r.stderr.match(
      /^Pay\.tla: TLC's state graph has [\d,]+ bytes, more than the [\d,]+ that the command can read, so it draws no chart\. The rule results above stand\. Smaller constants make a smaller graph\. The files that this run wrote are in (tmp\/statechart-\w+)\.\n$/,
    );
    assert.match(
      readFileSync(join(dir, kept, "tlc", "Pay-NoDoubleCharge.out"), "utf8"),
      /^Error: Invariant NoDoubleCharge is violated/m,
    );
    assert.equal(existsSync(join(dir, "Pay-statechart")), false);
    rmSync(dir, { recursive: true, force: true });
  },
);

test(
  "a graph dump that grows past one string is stopped, and the rule results stay",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(join(dir, "Pay.map.mjs"), payMap);
    const pid = join(dir, "dump.pid");
    const java = join(dir, "java");
    writeFileSync(
      java,
      `#!/bin/sh
for a; do [ "$a" = -dump ] && dumping=1; done
[ -z "$dumping" ] && exec "$REAL_JAVA" "$@"
while [ "$1" != -dump ]; do shift; done
printf 'TLC2 Version 2.19\\n'
"$NODE" -e 'require("fs").writeFileSync(process.argv[1], ""); require("fs").truncateSync(process.argv[1], +process.argv[2])' "$3" "$SIZE"
echo $$ > "$PID"
exec sleep 20
`,
      { mode: 0o755 },
    );
    const tmp = ownTmp(dir, "tmp");
    const r = node(
      "statechart.mjs",
      ["from-spec", "Pay.tla", "--expect-broken", "NoDoubleCharge"],
      dir,
      {
        JAVA: java,
        TLA2TOOLS: tools.jar,
        REAL_JAVA: tools.java,
        NODE: process.execPath,
        SIZE: String(constants.MAX_STRING_LENGTH + 1),
        PID: pid,
        TMPDIR: tmp,
      },
    );
    assert.equal(r.status, 2, r.stderr);
    assert.match(r.stdout, /^ {2}NoDoubleCharge is broken \(expected\)\.$/m);
    const [, kept] = r.stderr.match(
      /^Pay\.tla: TLC's state graph passed [\d,]+ bytes, the most that the command can read, so the command stopped TLC and draws no chart\. The rule results above stand\. Smaller constants make a smaller graph\. The files that this run wrote are in (tmp\/statechart-\w+)\.\n$/,
    );
    assert.throws(() => process.kill(Number(readFileSync(pid, "utf8")), 0), { code: "ESRCH" });
    assert.match(
      readFileSync(join(dir, kept, "tlc", "Pay-NoDoubleCharge.out"), "utf8"),
      /^Error: Invariant NoDoubleCharge is violated/m,
    );
    assert.equal(existsSync(join(dir, "Pay-statechart")), false);
    rmSync(dir, { recursive: true, force: true });
  },
);

test("TLC output that grows past one string stops TLC, and the command exits 2", needsTlc, () => {
  const dir = mkdtempSync(join(tmpdir(), "statechart-"));
  writeFileSync(
    join(dir, "Pay.tla"),
    pay("Pay", `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`),
  );
  writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
  writeFileSync(join(dir, "Pay.map.mjs"), payMap);
  const pid = join(dir, "tlc.pid");
  const java = join(dir, "java");
  writeFileSync(
    java,
    `#!/bin/sh
echo $$ > "$PID"
exec "$NODE" -e '
const size = +process.argv[1];
const chunk = "x".repeat(1 << 16);
let sent = 0;
process.stdout.write("TLC2 Version 2.19\\n");
(function more() {
  while (sent <= size) {
    sent += chunk.length;
    if (!process.stdout.write(chunk)) return process.stdout.once("drain", more);
  }
  setTimeout(() => {}, 20000);
})();
' "$SIZE"
`,
    { mode: 0o755 },
  );
  const tmp = ownTmp(dir, "tmp");
  const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, {
    JAVA: java,
    TLA2TOOLS: tools.jar,
    NODE: process.execPath,
    SIZE: String(constants.MAX_STRING_LENGTH),
    PID: pid,
    TMPDIR: tmp,
  });
  assert.equal(r.status, 2, r.stderr);
  const [, out] = r.stderr.match(
    /^(\/\S+\/tlc\/Pay-NoDoubleCharge\.out): TLC printed more than [\d,]+ characters, the most that the command can read, so the command stopped TLC\. Smaller constants make TLC print less\.\n$/,
  );
  assert.throws(() => process.kill(Number(readFileSync(pid, "utf8")), 0), { code: "ESRCH" });
  assert.equal(existsSync(out), true);
  assert.equal(existsSync(join(dir, "Pay-statechart")), false);
  rmSync(dir, { recursive: true, force: true });
});

test(
  "the rule results print before the graph dump, and stay when TLC stops on an error in the dump",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(join(dir, "Pay.map.mjs"), payMap);
    const java = join(dir, "java");
    writeFileSync(
      java,
      `#!/bin/sh
for a; do
  if [ "$a" = -dump ]; then
    printf 'TLC2 Version 2.19\\nError: TLC threw an unexpected exception.\\n'
    exit 1
  fi
done
exec "$REAL_JAVA" "$@"
`,
      { mode: 0o755 },
    );
    const tmp = ownTmp(dir, "tmp");
    const r = node(
      "statechart.mjs",
      ["from-spec", "Pay.tla", "--expect-broken", "NoDoubleCharge"],
      dir,
      { JAVA: java, TLA2TOOLS: tools.jar, REAL_JAVA: tools.java, TMPDIR: tmp },
    );
    assert.equal(r.status, 2, r.stderr);
    assert.match(r.stdout, /^ {2}NoDoubleCharge is broken \(expected\)\.$/m);
    const [, kept] = r.stderr.match(
      /^(\/\S+)\/tlc\/Pay\.out: TLC stopped on an error that is not a broken rule: TLC threw an unexpected exception\.$/m,
    );
    assert.match(
      readFileSync(join(kept, "tlc", "Pay-NoDoubleCharge.out"), "utf8"),
      /^Error: Invariant NoDoubleCharge is violated/m,
    );
    rmSync(dir, { recursive: true, force: true });
  },
);

test(
  "an error after TLC runs keeps TLC's output, and the message names its folder",
  needsTlc,
  () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    writeFileSync(
      join(dir, "Pay.tla"),
      pay(
        "Pay",
        `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`,
      ),
    );
    writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n");
    writeFileSync(
      join(dir, "Pay.map.mjs"),
      payMap.replace(
        /^export const state = .*$/m,
        `export const state = () => { throw new Error("the map cannot read this state"); };`,
      ),
    );
    const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, {
      TMPDIR: ownTmp(dir, "tmp"),
    });
    assert.equal(r.status, 2, r.stderr);
    const [, kept] = r.stderr.match(
      / The files that this run wrote are in (tmp\/statechart-\w+)\.\n$/,
    );
    assert.match(
      readFileSync(join(dir, kept, "tlc", "Pay-NoDoubleCharge.out"), "utf8"),
      /^Error: Invariant NoDoubleCharge is violated/m,
    );
    assert.equal(existsSync(join(dir, "Pay-statechart")), false);
    rmSync(dir, { recursive: true, force: true });
  },
);

test(
  "runs of two specs that overlap on one output folder all finish, and the folder always holds one run's files",
  needsTlc,
  async () => {
    const dir = mkdtempSync(join(tmpdir(), "statechart-"));
    const out = writeSlowPay(dir, 400);
    writeLamp(dir);
    const pay = ["from-spec", "Pay.tla", "--out", "shared"];
    const lamp = ["from-spec", "Lamp.tla", "--out", "shared"];
    const alone = {};
    for (const args of [pay, lamp]) {
      const solo = join(dir, `${args[1]}-alone`);
      const r = node("statechart.mjs", [...args.slice(0, 2), "--out", solo], dir);
      assert.equal(r.status, 0, r.stderr);
      alone[args[1]] = {
        top: readdirSync(solo).sort().join(),
        tlc: readdirSync(join(solo, "tlc")).sort().join(),
        chart: readFileSync(join(solo, "chart.mmd"), "utf8"),
        summary: readFileSync(join(solo, "summary.json"), "utf8"),
      };
    }
    const shared = join(dir, "shared");
    const seen = new Set();
    let watching = true;
    const watch = (async () => {
      while (watching) {
        try {
          seen.add(readdirSync(join(shared, "tlc")).sort().join());
        } catch (e) {
          if (e.code !== "ENOENT") throw e;
        }
        await sleep(5);
      }
    })();
    const runs = [];
    for (let i = 0; i < 6; i++) {
      runs.push(startRun(dir, { args: i % 2 ? lamp : pay }).done);
      await sleep(150);
    }
    const finished = await Promise.all(runs);
    watching = false;
    await watch;
    for (const r of finished) assert.equal(r.status, 0, r.stderr);
    const runsOf = new Map(Object.entries(alone).map(([spec, a]) => [a.tlc, spec]));
    for (const listing of seen) assert.ok(runsOf.has(listing), `tlc/ had ${listing}`);
    const last = alone[runsOf.get(readdirSync(join(shared, "tlc")).sort().join())];
    assert.equal(readdirSync(shared).sort().join(), last.top);
    assert.equal(readFileSync(join(shared, "chart.mmd"), "utf8"), last.chart);
    assert.equal(readFileSync(join(shared, "summary.json"), "utf8"), last.summary);
    assert.equal(existsSync(out), false);
    assert.deepEqual(staged(dir), []);
  },
);

test("no file in scripts/ passes 1000 lines", () => {
  const long = readdirSync(scripts, { withFileTypes: true })
    .filter((e) => e.isFile())
    .map((e) => [
      e.name,
      readFileSync(join(scripts, e.name), "utf8").replace(/\n$/, "").split("\n").length,
    ])
    .filter(([, lines]) => lines > 1000);
  assert.deepEqual(long, [], "move cohesive parts of each listed file into their own modules");
});

stateDiagram-v2
  state "Notes app" as App {
    state "Connection" as Connection {
      [*] --> Online
      Online --> Offline : the network drops
      Offline --> Online : the network returns
    }
    --
    state "Sync badge" as Sync {
      state "Synced" as Synced
      state "Waiting to sync" as Pending
      [*] --> Synced
      Synced --> Pending : you edit a note
      Synced --> Pending : the network drops
      Pending --> Synced : the server confirms
    }
  }
  [*] --> App
  %% never NeverSyncedWhileOffline: Offline & Synced -- You never see "Synced" while you are offline.

stateDiagram-v2
  state "Nothing chosen" as Idle
  state "Uploading" as Uploading {
    state "Sending the file" as Sending
    state "Checking the file" as Checking
    [*] --> Sending
    Sending --> Checking : the last byte arrives
  }
  state "Uploaded" as Done
  state "Upload failed" as Failed
  [*] --> Idle
  Idle --> Uploading : you choose a file
  Checking --> Done : the check passes
  Uploading --> Failed : the network drops
  Failed --> Uploading : you retry
  Uploading --> Idle : you cancel

import process from "node:process";

export const args = {
  traces: [],
  fixedTraces: [],
  againstTraces: [],
  fixedRules: [],
  againstRules: [],
  specs: [],
  next: [],
  view: "customer",
  highlight: 1,
};
for (let i = 2; i < process.argv.length; i++) {
  const a = process.argv[i];
  const next = () => process.argv[++i];
  if (a === "--dot") args.dot = next();
  else if (a === "--map") args.map = next();
  else if (a === "--traces") args.traces.push(next());
  else if (a === "--broken") args.broken = next();
  else if (a === "--fixed-dot") args.fixedDot = next();
  else if (a === "--fixed-traces") args.fixedTraces.push(next());
  else if (a === "--fixed-rules") args.fixedRules.push(...next().split(","));
  else if (a === "--fixed-broken") args.fixedBroken = next();
  else if (a === "--against-dot") args.againstDot = next();
  else if (a === "--against-traces") args.againstTraces.push(next());
  else if (a === "--against-broken") args.againstBroken = next();
  else if (a === "--against-rules") args.againstRules.push(...next().split(","));
  else if (a === "--listed") args.listed = next();
  else if (a === "--label") args.label = next();
  else if (a === "--spec") args.specs.push(next());
  else if (a === "--next") args.next.push(next());
  else if (a === "--view") args.view = next();
  else if (a === "--highlight") args.highlight = Number(next());
  else if (a === "--path-only") args.pathOnly = true;
  else if (a === "--full-labels") args.fullLabels = true;
  else if (a === "--flat") args.flat = true;
  else if (a === "--loops") args.loops = true;
  else if (a === "--regions") args.regions = true;
  else if (a === "--proof") args.proof = next();
  else if (a === "--regions-all") args.regionsAll = next();
  else if (a === "--cover") args.cover = true;
  else if (a === "--title") args.title = next();
  else if (a === "--out") args.out = next();
  else if (a === "--story") args.story = next();
  else if (a === "--summary") args.summary = next();
  else {
    console.error(`unknown argument ${a}.`);
    process.exit(2);
  }
}
if (args.listed !== undefined) args.listed = JSON.parse(args.listed);

#!/usr/bin/env node
import fs from "node:fs";
import path from "node:path";
import process from "node:process";
import { pathToFileURL } from "node:url";
import {
  FULL_LABELS,
  GROUP_PALETTE,
  LEGEND_ID,
  PLAIN_FILL,
  escapeMermaidQuotes,
  groupClassDef,
  groupColorProblem,
  isRecord,
  joinAnd,
  joinLabels,
  parseDot,
  parseTraces,
  stateKey,
  tlcOutputWarning,
  wrap,
  STATUS_CLASSES,
} from "./lib.mjs";
import { args } from "./tlc-to-chart-args.mjs";
import { ruleBook } from "./rule-book.mjs";
import { SEP, addGuard, edgeId, frontMatter, guarded } from "./chart-parts.mjs";
import {
  badStates,
  byOrder,
  diverges,
  firstBad,
  labelStatus,
  readBroken,
  worst,
} from "./bug-states.mjs";
import { chartEdges } from "./chart-edges.mjs";
import { regionsChart } from "./regions-chart.mjs";
import { mapView } from "./map-view.mjs";
import { stepsIntoBugs, waysLine } from "./ways-in.mjs";
import { divergence, replaySecond } from "./second-replay.mjs";
import { readCheck } from "./read-check.mjs";

const role = args.fixedDot ? "fix" : args.againstDot ? "against" : null;
const L = args.label ?? (role === "fix" ? "the fix" : "the spec");
const within = role === "fix" ? "with" : "in";
const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);

const mapping = await import(pathToFileURL(path.resolve(args.map)).href);
if (typeof mapping.state !== "function")
  throw new Error("the mapping module must export state(vars)");
if (args.view !== "customer" && typeof mapping.detail !== "function")
  throw new Error(`--view ${args.view} needs detail(vars) in the mapping module`);

const rules = new Map();
const ruleReads = new Map();
for (const spec of args.specs)
  for (const [name, { sentence, reads }] of ruleBook(spec)) {
    if (sentence && !rules.has(name)) rules.set(name, sentence);
    ruleReads.set(name, new Set([...(ruleReads.get(name) ?? []), ...reads]));
  }

const readerActions = new Set(mapping.readerActions ?? []);
const factsFrom = (enabled) => ({
  enabled,
  settled: [...enabled].every((a) => readerActions.has(a)),
});
function keyOf(vars, facts) {
  if (args.view === "developer") return String(mapping.detail(vars, facts));
  const outer = mapping.state(vars, facts);
  if (typeof outer !== "string")
    throw new Error(`state() must return a string; got ${JSON.stringify(outer)}`);
  if (args.view !== "layered") return outer;
  return [outer, String(mapping.detail(vars, facts))]
    .map((part) => part.trim())
    .filter(Boolean)
    .join(SEP);
}
function stepLabel(action, before, after, view = args.view) {
  const said = typeof mapping.step === "function" ? mapping.step(action, before, after) : action;
  const named =
    view === "customer" || said === action ? said : said ? `${said} [${action}]` : action;
  const seconds = typeof mapping.timer === "function" ? mapping.timer(action, before, after) : null;
  if (seconds === undefined || seconds === null || seconds === "" || !named) return named;
  if (typeof seconds !== "number" || !Number.isFinite(seconds) || seconds <= 0)
    throw new Error(
      `timer() must return a number of seconds above 0, or nothing; got ${JSON.stringify(seconds)} for ${action}`,
    );
  return `after ${seconds} s, ${named}`;
}
function stepGuard(action, before, after) {
  if (typeof mapping.guard !== "function") return "";
  return String(mapping.guard(action, before, after) ?? "")
    .replace(/[[\]]/g, "")
    .trim();
}

const definedLabel = (label, what) => {
  if (typeof label !== "string" || !/\bundefined\b/.test(label)) return label;
  const does = what === "group" ? `puts a state of ${L} in group` : `labels a ${what} of ${L}`;
  throw new Error(
    `the mapping ${does} "${label.replaceAll(SEP, " ")}", so it reads a field ${L} does not have there. Label states and steps only from what both models have.`,
  );
};

function modelOf(graph, guarded = (vars) => vars, checked = (label) => label) {
  const byId = new Map([...graph.nodes.keys()].map((id) => [id, new Set()]));
  for (const e of [...graph.edges, ...graph.loops]) byId.get(e.from).add(e.action);
  const stateKeys = new Map([...graph.nodes.values()].map((n) => [n.id, stateKey(n.vars)]));
  const index = new Map([...stateKeys].map(([id, k]) => [k, byId.get(id)]));
  const facts = (vars) => factsFrom(index.get(stateKey(vars)) ?? new Set());
  const forMap = (vars) => guarded(mapView(vars));
  return {
    graph,
    stateKeys,
    facts,
    key: (vars) => checked(keyOf(forMap(vars), facts(vars)), "state"),
    customer: (vars) => checked(String(mapping.state(forMap(vars), facts(vars))), "state"),
    step: (action, before, after, view) =>
      checked(stepLabel(action, forMap(before), forMap(after), view), "step"),
    guard: (action, before, after) =>
      checked(stepGuard(action, forMap(before), forMap(after)), "step"),
    cause: (vars, invariant) => {
      const why =
        typeof mapping.cause === "function"
          ? mapping.cause(forMap(vars), facts(vars), invariant)
          : null;
      return why === undefined || why === null ? null : checked(String(why), "bug");
    },
    group: (vars) => checked(mapping.group(forMap(vars), facts(vars)), "group"),
  };
}

function quotient(m) {
  const { graph } = m;
  const keys = new Map();
  for (const n of graph.nodes.values()) keys.set(n.id, m.key(n.vars));
  const nodes = new Set(keys.values());
  const initial = new Set(
    [...graph.nodes.values()].filter((n) => n.init).map((n) => keys.get(n.id)),
  );
  const edges = new Map();
  for (const e of [...graph.edges, ...graph.loops]) {
    const from = keys.get(e.from);
    const to = keys.get(e.to);
    if (from === to && !args.loops) continue;
    const id = edgeId(from, to);
    if (!edges.has(id)) edges.set(id, { from, to, counts: new Map(), guards: new Map() });
    const [before, after] = [graph.nodes.get(e.from).vars, graph.nodes.get(e.to).vars];
    const label = m.step(e.action, before, after);
    if (!label) continue;
    edges.get(id).counts.set(label, (edges.get(id).counts.get(label) ?? 0) + 1);
    addGuard(edges.get(id).guards, label, m.guard(e.action, before, after));
  }
  for (const e of edges.values())
    e.labels = new Set([...e.counts].sort((a, b) => b[1] - a[1]).map(([l]) => l));
  const settled = new Set(
    [...graph.nodes.values()].filter((n) => m.facts(n.vars).settled).map((n) => keys.get(n.id)),
  );
  return { nodes, initial, edges, keys, settled };
}

const graph = parseDot(fs.readFileSync(args.dot, "utf8"));
const main = modelOf(graph);
const now = quotient(main);

const secondDot = args.fixedDot ?? args.againstDot;
const secondGraph = secondDot ? parseDot(fs.readFileSync(secondDot, "utf8")) : null;
const rawTraces = readTraces(args.traces);
const secondTraceFiles = role === "fix" ? args.fixedTraces : args.againstTraces;
const secondRules = new Set(role === "fix" ? args.fixedRules : args.againstRules);
const rawSecondTraces = readTraces(secondTraceFiles);
const traces = firstBad(rawTraces);
const secondTraces = firstBad(rawSecondTraces);
const { lacks, extra, guard } = secondGraph
  ? readCheck({ graph, rawTraces, secondGraph, rawSecondTraces, L })
  : {};
const second = secondGraph && modelOf(secondGraph, guard, definedLabel);
const secondQ = second && quotient(second);

const hiddenStep = (rule, sameLabel, action, before, after) =>
  sameLabel &&
  !readerActions.has(action) &&
  ![...(ruleReads.get(rule) ?? [])].some(
    (v) => v in before && stateKey(before[v]) !== stateKey(after[v]),
  );

function readerPath(trace, m, key, view) {
  const last = trace.steps.length - 1;
  const out = [{ key: key(trace.steps[0].vars), label: null, modelStep: 0 }];
  for (let i = 1; i < trace.steps.length; i++) {
    const { action } = trace.steps[i];
    const k = key(trace.steps[i].vars);
    const [before, after] = [trace.steps[i - 1].vars, trace.steps[i].vars];
    const sameLabel = k === out[out.length - 1].key;
    if (i < last && hiddenStep(trace.invariant, sameLabel, action, before, after)) continue;
    const label = m.step(action, before, after, view) || action;
    const guard = m.guard(action, before, after);
    out.push({ key: k, label, guard, action, modelStep: i });
  }
  return out;
}

const mainActions = new Set([...graph.edges, ...graph.loops].map((e) => e.action));

function readTraces(files) {
  return files.flatMap((f) => {
    const text = fs.readFileSync(f, "utf8");
    const warning = tlcOutputWarning(text, f);
    if (warning) console.error(`${f}: ${warning}`);
    return parseTraces(text);
  });
}
function group(cuts, m) {
  const byId = new Map();
  for (const trace of cuts) {
    const rp = readerPath(trace, m, m.customer);
    const last = trace.steps[trace.steps.length - 1].vars;
    const cause = m.cause(last, trace.invariant);
    const id = `${trace.invariant}${SEP}${cause ?? rp[rp.length - 1].key}`;
    const prev = byId.get(id);
    const ends = new Set([...(prev?.ends ?? []), stateKey(last)]);
    if (
      !prev ||
      rp.length < prev.steps ||
      (rp.length === prev.steps && trace.steps.length < prev.trace.steps.length)
    ) {
      byId.set(id, { id, cause, steps: rp.length, trace, invariant: trace.invariant, ends });
    } else prev.ends = ends;
  }
  return byId;
}
const inSecond = (l) => `${within} ${L}, ${l}`;
const modelEdges = new Map(now.edges);
if (secondQ)
  for (const [id, e] of secondQ.edges)
    if (!modelEdges.has(id))
      modelEdges.set(id, {
        ...e,
        labels: new Set([...e.labels].map(inSecond)),
        guards: new Map([...e.guards].map(([l, words]) => [inSecond(l), words])),
        secondOnly: true,
      });
const withPath = (c, m) => {
  const path = readerPath(c.trace, m, m.key);
  return { ...c, path, end: path[path.length - 1].key };
};
const classesById = group(traces, main);
const mainClasses = [...classesById.values()].sort(byOrder).map((c, i) => {
  const bug = withPath(c, main);
  return {
    ...bug,
    second: divergence(
      replaySecond(c.trace, {
        main,
        lacks,
        extra,
        second,
        hiddenStep,
        readerPath,
        mainActions,
        secondRules,
        rawSecondTraces,
      }),
      bug.path,
      i + 1,
      { inSecond, modelEdges },
    ),
  };
});
const introduced = second
  ? [...group(secondTraces, second).values()]
      .filter((c) => !classesById.has(c.id))
      .sort(byOrder)
      .map((c) => ({ ...withPath(c, second), second: null, introduced: true }))
  : [];
const classes = [
  ...stepsIntoBugs(mainClasses, main, rawTraces, args),
  ...stepsIntoBugs(introduced, second, rawSecondTraces, args),
];

const brokenNow = readBroken(args.broken);
const statusNow = labelStatus(main, now.keys, badStates(rawTraces, brokenNow));
const statusSecond = second
  ? labelStatus(
      second,
      secondQ.keys,
      badStates(rawSecondTraces, readBroken(args.fixedBroken ?? args.againstBroken)),
    )
  : () => undefined;
const statusUnchecked =
  role === "fix"
    ? labelStatus(
        main,
        now.keys,
        badStates(rawTraces, brokenNow, (r) => !secondRules.has(r)),
      )
    : () => undefined;
const allNodes = new Set([...now.nodes, ...(secondQ?.nodes ?? [])]);
const initial = new Set([...now.initial, ...(secondQ?.initial ?? [])]);
const status = (k) => {
  if (role === "against") {
    const s = worst(statusNow(k), statusSecond(k));
    return s === "works" && !now.nodes.has(k) ? "fixed" : s;
  }
  if (role === "fix") {
    const s = worst(statusSecond(k), statusUnchecked(k));
    if (s === "wrong" && !["wrong", "mixed"].includes(statusNow(k))) return "worse";
    return s === "works" && statusNow(k) !== "works" ? "fixed" : s;
  }
  return statusNow(k);
};

const chosen = args.highlight > 0 ? classes[args.highlight - 1] : null;
if (args.highlight > 0 && classes.length > 0 && !chosen)
  throw new Error(`--highlight ${args.highlight}: only ${classes.length} classes`);
const onPath = new Set(chosen ? chosen.path.map((p) => p.key) : []);
if (chosen && diverges(chosen)) onPath.add(chosen.second.key);

const coverOff =
  args.cover &&
  ![graph, secondGraph]
    .filter(Boolean)
    .some((g) => [...g.edges, ...g.loops].some((e) => readerActions.has(e.action)))
    ? "no step in TLC's graph is a reader action"
    : null;
if (coverOff && !args.pathOnly) console.error(`--cover: drew every state, because ${coverOff}`);
const { edges, pathNumbers, coverEdges } = chartEdges({
  args,
  now,
  secondQ,
  modelEdges,
  classes,
  chosen,
  coverOff,
});

const LEGEND = {
  works: ["legendWorks", mapping.legend?.works ?? (role === "fix" ? "Works today" : "Works")],
  wrong: [
    "legendWrong",
    mapping.legend?.wrong ?? (role === "fix" ? `Still wrong with ${L}` : "Breaks a rule"),
  ],
  fixed: [
    "legendFixed",
    mapping.legend?.fixed ?? (role === "fix" ? `Fixed or new with ${L}` : `Only in ${L}`),
  ],
  mixed: [
    "legendMixed",
    mapping.legend?.mixed ?? `Breaks a rule in some cases${role === "fix" ? ` with ${L}` : ""}`,
  ],
  after: [
    "legendAfter",
    mapping.legend?.after ?? `Reached only after a bug${role === "fix" ? ` with ${L}` : ""}`,
  ],
  ...(role === "fix"
    ? { worse: ["legendWorse", mapping.legend?.worse ?? `Breaks a rule only with ${L}`] }
    : {}),
};

const grouping = typeof mapping.group === "function";
const groupsOf = new Map();
const groupOf = (k) => (groupsOf.get(k)?.size === 1 ? [...groupsOf.get(k)][0] : "");
const groupNames = [];
const fills = new Map();
if (grouping) {
  const add = (k, vars, m) => {
    const g = m.group(vars);
    if (g !== undefined && g !== null && typeof g !== "string")
      throw new Error(`group() must return a group name or nothing; got ${JSON.stringify(g)}`);
    if (!groupsOf.has(k)) groupsOf.set(k, new Set());
    groupsOf.get(k).add((g ?? "").replace(/\s+/g, " ").trim());
  };
  for (const n of graph.nodes.values()) add(now.keys.get(n.id), n.vars, main);
  if (second)
    for (const n of second.graph.nodes.values()) add(secondQ.keys.get(n.id), n.vars, second);

  const given = mapping.groupColors ?? {};
  if (!isRecord(given))
    throw new Error("groupColors must be an object from a group name to a color such as #d6eaf8");
  const statusNames = new Set(
    [
      "Works",
      "Works today",
      "Breaks a rule",
      "Still wrong",
      "Fixed",
      ...Object.values(LEGEND).map(([, t]) => t),
    ].map((t) => t.toLowerCase()),
  );
  const found = new Set([...groupsOf.values()].flatMap((gs) => [...gs]).filter(Boolean));
  for (const g of found)
    if (statusNames.has(g.toLowerCase()))
      throw new Error(
        `group "${g}" has the name of a status; TLC decides the status, so name the group for what the reader sees`,
      );
  groupNames.push(
    ...Object.keys(given).filter((g) => found.has(g)),
    ...[...found].filter((g) => !Object.hasOwn(given, g)).sort(),
  );
  for (const [g, color] of Object.entries(given)) {
    if (color === undefined || color === null || color === "") continue;
    const why = groupColorProblem(color);
    if (why) throw new Error(`groupColors["${g}"] ${JSON.stringify(color)} ${why}`);
    if (found.has(g)) fills.set(g, color.toLowerCase());
  }
  const free = GROUP_PALETTE.filter((c) => ![...fills.values()].includes(c));
  for (const g of groupNames) {
    if (fills.has(g)) continue;
    if (!free.length)
      throw new Error(
        `the mapping has ${groupNames.length} groups, more than the ${GROUP_PALETTE.length} colors of the palette; give the others a color in groupColors`,
      );
    fills.set(g, free.shift());
  }
}
const mixedGroups = [...groupsOf].filter(([, gs]) => gs.size > 1).map(([k]) => k);

const BORDER = {
  works: "",
  wrong: "Wrong",
  fixed: "Fixed",
  mixed: "Mixed",
  after: "After",
  worse: "Worse",
};
const classFor = (g, s, path) =>
  grouping
    ? `${g ? `group${groupNames.indexOf(g)}` : "plain"}${BORDER[s] || (path ? "Path" : "")}`
    : `${s}${path ? "Path" : ""}`;
const drawnState = (g, s, path = false) => ({ group: g, status: s, cls: classFor(g, s, path) });
const groupCounts = (drawn) =>
  groupNames
    .map((g) => ({
      name: g,
      color: fills.get(g),
      states: drawn.filter((d) => d.group === g).length,
    }))
    .filter((g) => g.states > 0);

function head(drawn) {
  const out = [...frontMatter(args.title), "stateDiagram-v2"];
  if (role) out.push(`  %% second model (${role}): ${L}`);
  if (args.fullLabels) out.push(`  ${FULL_LABELS}`);
  const used = Object.keys(LEGEND).filter((s) => drawn.some((d) => d.status === s));
  const legend = grouping
    ? [
        ...groupCounts(drawn).map(({ name }) => {
          const i = groupNames.indexOf(name);
          return [`legendGroup${i}`, name, `group${i}`];
        }),
        ...used.filter((s) => BORDER[s]).map((s) => [...LEGEND[s], `plain${BORDER[s]}`]),
      ]
    : used.map((s) => [...LEGEND[s], s]);
  if (grouping) {
    const styleClasses = new Set([...drawn.map((d) => d.cls), ...legend.map(([, , c]) => c)]);
    const bases = [["plain", PLAIN_FILL], ...groupNames.map((g, i) => [`group${i}`, fills.get(g)])];
    for (const [base, fill] of bases)
      for (const border of [...Object.values(BORDER), "Path"])
        if (styleClasses.has(base + border)) out.push(`  ${groupClassDef(base, fill, border)}`);
  } else for (const c of STATUS_CLASSES) out.push(`  ${c}`);
  if (legend.length) {
    out.push(`  state "Legend" as ${LEGEND_ID} {`);
    for (const [id, text] of legend) out.push(`    state "${escapeMermaidQuotes(text)}" as ${id}`);
    out.push("  }");
    for (const [id, , c] of legend) out.push(`  class ${id} ${c}`);
  }
  return out;
}

const regions = args.regions
  ? regionsChart({
      states: allNodes,
      starts: [...initial],
      edges,
      loops: Boolean(args.loops),
      classes,
      proofPath: args.proof,
      allPath: args.regionsAll,
      mapping,
      status,
      LEGEND,
      groupOf,
      drawnState,
      groupCounts,
      head,
    })
  : null;
if (regions?.why) console.error(`regions: not drawn, because ${regions.why}`);

const flatStates =
  args.pathOnly && chosen
    ? onPath
    : coverEdges
      ? new Set([
          ...initial,
          ...[...coverEdges].flatMap((id) => [edges.get(id).from, edges.get(id).to]),
        ])
      : allNodes;
const sorted = [...flatStates].sort();
const drawn = sorted.map((k) => drawnState(groupOf(k), status(k), onPath.has(k)));

const boxes = new Map();
const boxOf = new Map();
const inBox = (k, box) => {
  if (!boxes.has(box)) boxes.set(box, []);
  boxes.get(box).push(k);
};
if (args.view === "layered" && !args.flat) {
  for (const k of sorted) if (k.includes(SEP)) inBox(k, k.slice(0, k.indexOf(SEP)));
} else if (args.view === "customer" && !args.flat) {
  for (const k of sorted) {
    const at = k.indexOf(": ");
    if (at > 0 && at + 2 < k.length) inBox(k, k.slice(0, at));
  }
  for (const [box, members] of boxes) if (members.length < 2) boxes.delete(box);
}
const boxIds = new Map([...boxes.keys()].map((box, i) => [box, `g${i}`]));
for (const [box, members] of boxes) for (const k of members) boxOf.set(k, box);
const declared = [...[...boxes.values()].flat(), ...sorted.filter((k) => !boxOf.has(k))];
const stateIds = new Map(declared.map((k, i) => [k, `s${i}`]));
const idOf = (k) => stateIds.get(k);
const show = (k) => (args.view === "layered" ? k.replace(SEP, ": ") : k);
const caption = (k) => (boxOf.has(k) ? show(k).slice(boxOf.get(k).length + 2) : show(k));

function numbered(steps) {
  const runs = [];
  for (const { n, shown } of steps) {
    const last = runs.at(-1);
    if (last?.shown === shown && last.n.at(-1) === n - 1) last.n.push(n);
    else runs.push({ shown, n: [n] });
  }
  return runs.map(({ shown, n }) => `${n.join(", ")}. ${shown}`);
}
const drawnLabels = new Set();
const arrows = new Map();
for (const [id, e] of edges) {
  if (!flatStates.has(e.from) || !flatStates.has(e.to)) continue;
  if (args.pathOnly && chosen && !pathNumbers.has(id) && id !== chosen.second?.edge) continue;
  if (coverEdges && !coverEdges.has(id)) continue;
  const pair = e.apart ? id : edgeId(e.from, e.to);
  if (!arrows.has(pair))
    arrows.set(pair, { from: e.from, to: e.to, groups: [[], [], []], plain: true, labels: [] });
  const a = arrows.get(pair);
  const [numbers, current, other] = a.groups;
  const all = [...e.labels];
  const shown = all.map((l) => guarded(e.guards, l));
  const said = args.fullLabels ? shown.join(" or ") : joinLabels(shown);
  const p = pathNumbers.get(id);
  const chosenStep = chosen?.second && id === chosen.second.edge;
  if (p) numbers.push(...numbered(p));
  else if (!e.secondOnly) current.push(said);
  else other.push(args.pathOnly && chosenStep ? chosen.second.text : said);
  if (chosenStep && !e.secondOnly) other.push(chosen.second.text);
  if (p || chosenStep || id.endsWith(`${SEP}second`)) a.plain = false;
  a.labels.push(...all);
  for (const l of p ? p.map((s) => s.label) : all) drawnLabels.add(l);
}
const transitions = [...arrows.values()].map(({ from, to, groups, plain, labels }) => ({
  from,
  to,
  // ";" ends a Mermaid statement, even inside a transition label.
  text: groups
    .map((g) =>
      g
        .filter(Boolean)
        .map((l) => wrap(l.replaceAll(";", ","), 30))
        .join("<br/>"),
    )
    .filter(Boolean)
    .join("<br/>#160;<br/>"),
  plain,
  labels: labels.sort(),
}));
const fromBox = [];
const folded = new Set();
const plainNames = new Set(sorted.filter((k) => !boxOf.has(k)).map(caption));
for (const [box, members] of boxes) {
  if (plainNames.has(box)) continue;
  const mine = new Set(members);
  const byStep = new Map();
  for (const l of transitions) {
    if (!l.plain || !mine.has(l.from) || mine.has(l.to)) continue;
    const step = `${l.to}${SEP}${l.text}${SEP}${l.labels.join(SEP)}`;
    if (!byStep.has(step)) byStep.set(step, []);
    byStep.get(step).push(l);
  }
  for (const same of byStep.values()) {
    if (new Set(same.map((l) => l.from)).size !== members.length) continue;
    for (const l of same) folded.add(l);
    fromBox.push({ ...same[0], box });
  }
}

const out = head(drawn);
for (const [box, members] of boxes) {
  out.push(`  state "${escapeMermaidQuotes(wrap(box))}" as ${boxIds.get(box)} {`);
  for (const k of members)
    out.push(`    state "${escapeMermaidQuotes(wrap(caption(k)))}" as ${idOf(k)}`);
  out.push("  }");
}
for (const k of sorted)
  if (!boxOf.has(k)) out.push(`  state "${escapeMermaidQuotes(wrap(caption(k)))}" as ${idOf(k)}`);
for (const k of sorted)
  if (initial.has(k) && (!args.pathOnly || k === chosen?.path[0].key))
    out.push(`  [*] --> ${idOf(k)}`);
const arrow = (from, l) => `  ${from} --> ${idOf(l.to)}${l.text ? ` : ${l.text}` : ""}`;
for (const l of fromBox) out.push(arrow(boxIds.get(l.box), l));
for (const l of transitions) if (!folded.has(l)) out.push(arrow(idOf(l.from), l));
sorted.forEach((k, i) => out.push(`  class ${idOf(k)} ${drawn[i].cls}`));
const mermaid = regions?.mermaid ?? out.join("\n") + "\n";
if (args.out) fs.writeFileSync(args.out, mermaid);
else process.stdout.write(mermaid);

const ruleOf = (c) => rules.get(c.invariant) ?? `\`${c.invariant}\``;
function secondLine(c) {
  const W = cap(within);
  if (c.introduced) return `Only ${L} has this bug. The steps above happen ${within} ${L}.`;
  const s = c.second;
  if (!s) return null;
  if (s.sameEnd)
    return !s.checked
      ? `${W} ${L} you see the same states and steps, but ${L} does not check this rule.`
      : s.ruleHolds
        ? `${W} ${L} you see the same states and steps, yet the rule holds, so the state labels do not show what ${L} changes.`
        : `${W} ${L} you see the same states and steps, so ${L} does not change this path.`;
  if (s.reason) return `${cap(L)} cannot take these steps: it ${s.reason}.`;
  const outcome = s.disabled
    ? "cannot happen, so you stay at"
    : s.key === s.from
      ? "keeps you at"
      : "takes you to";
  const as = s.own && s.own !== s.said ? ` as "${s.own}"` : "";
  if (s.hidden) {
    const when = s.step ? `after step ${s.step}` : "before your first step";
    return `${W} ${L}, ${when}, "${s.said}" happens${as} and ${outcome}: ${show(s.key)}.`;
  }
  const happens = as ? `happens${as} and ` : "";
  return `${W} ${L}, step ${s.step} (${s.said}) ${happens}${outcome}: ${show(s.key)}.`;
}
const listedIn = (c) =>
  Object.keys(args.listed.breaks).filter((cfg) => args.listed.breaks[cfg] === c.invariant);
function listedLine(c) {
  const { spec, breaks } = args.listed;
  const cfgs = listedIn(c);
  if (cfgs.length)
    return `Listed: ${joinAnd(cfgs)}, ${cfgs.length === 1 ? "a config" : "configs"} of ${spec}, expect${cfgs.length === 1 ? "s" : ""} TLC to break this rule.`;
  const others = [...new Set(Object.values(breaks))].sort().map((r) => `\`${r}\``);
  return `Not listed: no config of ${spec} expects TLC to break this rule. ${others.length ? `Its configs expect TLC to break ${joinAnd(others)}.` : "None of its configs expects TLC to break a rule."}`;
}
if (args.story) {
  const lines = [];
  const header = role === "fix" ? `New with ${L}: ` : `Only in ${L}: `;
  classes.forEach((c, i) => {
    lines.push(`## ${i + 1}. ${c.introduced ? header : ""}${show(c.end)}`, "");
    lines.push(`Rule broken: ${ruleOf(c)}`);
    if (c.cause) lines.push(`Why: ${c.cause.replace(/\.$/, "")}.`);
    if (args.listed) lines.push(listedLine(c));
    const ways = waysLine(c);
    lines.push(...(ways ? [ways] : []), "");
    lines.push(`0. Start: ${show(c.path[0].key)}`);
    const m = c.introduced ? second : main;
    c.path.slice(1).forEach((p, j) => {
      const from = c.path[j].modelStep + 1;
      const hidden = c.trace.steps
        .slice(from, p.modelStep)
        .map(
          (s, h) =>
            m.step(s.action, c.trace.steps[from + h - 1].vars, s.vars, "customer") || s.action,
        );
      if (hidden.length)
        lines.push(
          `   (${hidden.length} hidden step${hidden.length === 1 ? "" : "s"}: ${[...new Set(hidden)].join(", ")})`,
        );
      lines.push(`${j + 1}. ${cap(p.label)}. Now: ${show(p.key)}`);
    });
    lines.push("");
    const said = secondLine(c);
    if (said) lines.push(said, "");
  });
  fs.writeFileSync(args.story, lines.join("\n"));
}
const CODE_LIKE = /\b[a-z]{2,}[A-Z][a-z]|\b\w+_\w+\b|\b[A-Za-z_]\w*\(|\b[A-Z][a-z]+[A-Z][a-z]/;
const codeLike = [
  ...new Set([
    ...(args.view === "customer" ? [...sorted, ...drawnLabels] : []),
    ...classes.map((c) => c.cause).filter(Boolean),
  ]),
].filter((t) => CODE_LIKE.test(t));
const secondOf = (c) =>
  c.introduced
    ? role === "fix"
      ? `new with ${L}`
      : `only in ${L}`
    : c.second
      ? c.second.sameEnd
        ? !c.second.checked
          ? "same states, rule not checked"
          : c.second.ruleHolds
            ? "same states, but the rule holds"
            : "unchanged"
        : (c.second.reason ?? show(c.second.key))
      : null;
function coverSummary() {
  if (coverOff || regions?.mermaid)
    return { drawn: false, why: coverOff ?? "the overview has parallel regions" };
  const pairs = new Set();
  const missed = new Map();
  for (const [id, e] of edges) {
    const pair = e.apart ? id : edgeId(e.from, e.to);
    pairs.add(pair);
    if (coverEdges.has(id)) continue;
    if (!missed.has(pair)) missed.set(pair, { from: e.from, to: e.to, labels: [] });
    missed.get(pair).labels.push(...[...e.labels].map((l) => guarded(e.guards, l)));
  }
  return {
    drawn: true,
    states: allNodes.size,
    transitions: pairs.size,
    leftOutStates: [...allNodes]
      .filter((k) => !flatStates.has(k))
      .map(show)
      .sort(),
    leftOutTransitions: [...missed.values()]
      .map((m) => `${show(m.from)} --> ${show(m.to)}: ${joinLabels(m.labels)}`)
      .sort(),
  };
}
const summary = {
  view: args.view,
  ...(role
    ? {
        second: {
          role,
          label: L,
          lacks: lacks.map((p) => p.join(".")),
          ...(args.listed ? { listed: args.listed } : {}),
        },
      }
    : {}),
  modelStates: graph.nodes.size,
  modelTransitions: graph.edges.length,
  chartStates: regions?.mermaid ? regions.states[0] + regions.states[1] : flatStates.size,
  chartTransitions: regions?.mermaid ? regions.transitions : transitions.length,
  chartStatus: regions?.mermaid
    ? regions.status
    : Object.fromEntries(
        Object.keys(LEGEND).map((s) => [
          s,
          [...(args.pathOnly && chosen ? onPath : allNodes)].filter((k) => status(k) === s).length,
        ]),
      ),
  mixedStatus: [...allNodes]
    .filter((k) => status(k) === "mixed")
    .map(show)
    .sort(),
  ...(args.cover ? { cover: coverSummary() } : {}),
  ...(grouping
    ? {
        chartGroups: regions?.mermaid ? regions.groups : groupCounts(drawn),
        mixedGroups: mixedGroups.map(show).sort(),
      }
    : {}),
  ...(regions
    ? {
        regions: regions.mermaid
          ? {
              drawn: true,
              states: regions.states,
              transitions: regions.transitions,
              all: regions.all,
              flat: regions.flat,
            }
          : { drawn: false, why: regions.why },
      }
    : {}),
  classes: classes.map((c, i) => ({
    n: i + 1,
    end: show(c.end),
    invariant: c.invariant,
    rule: rules.get(c.invariant) ?? null,
    cause: c.cause,
    readerSteps: c.path.length - 1,
    modelSteps: c.trace.steps.length,
    counterexamples: c.ends.size,
    lastSteps: c.lastSteps,
    startsHere: c.startsHere,
    [role ?? "fix"]: secondOf(c),
    ...(args.listed ? { listed: listedIn(c) } : {}),
  })),
  codeLike,
};
if (args.summary) fs.writeFileSync(args.summary, JSON.stringify(summary, null, 2) + "\n");
const extraBugs = introduced.length
  ? `, ${introduced.length} ${role === "fix" ? `new with ${L}` : `only in ${L}`}`
  : "";
const drawnAs = regions?.mermaid
  ? ` of ${regions.all} in 2 regions (proved against ${regions.flat.states} states, ${regions.flat.transitions} transitions)`
  : "";
console.error(
  `chart: ${summary.chartStates} states, ${summary.chartTransitions} transitions${drawnAs} from ${summary.modelStates} model states; ` +
    `${mainClasses.length} bug(s)${extraBugs}`,
);

import { spawnSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import process from "node:process";

// TLC's v1.8.0 is a rolling pre-release whose jar is re-uploaded, so pin the newest immutable
// release. The scripts read 1.7.4's output, which has no trace spec.
export const TLC_TOOL =
  "github:tlaplus/tlaplus[asset_pattern=tla2tools.jar,checksum=sha256:936a262061c914694dfd669a543be24573c45d5aa0ff20a8b96b23d01e050e88]@1.7.4";
export const JAVA_TOOL = "java@temurin-25";

const SET_TLC_VARS =
  "set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later).";
const indent = (text) => text.replace(/^/gm, "  ");

export function findTlc() {
  const { TLA2TOOLS, JAVA } = process.env;
  for (const [name, file] of Object.entries({ JAVA, TLA2TOOLS }))
    if (file && !fs.existsSync(file)) throw new Error(`${name} is ${file}, which does not exist.`);
  if (TLA2TOOLS) return { jar: TLA2TOOLS, java: JAVA || "java" };
  const command = (tools) =>
    `cd "$(mktemp -d)" && MISE_CEILING_PATHS="$PWD" mise install ${tools.map((t) => `'${t}'`).join(" ")}`;
  const empty = fs.mkdtempSync(path.join(os.tmpdir(), "statechart-mise-"));
  const env = { ...process.env, MISE_CEILING_PATHS: empty };
  const run = (...args) => spawnSync("mise", args, { cwd: empty, env, encoding: "utf8" });
  const mise = (...args) => {
    const r = run(...args);
    if (r.error)
      throw new Error(
        `Cannot find TLC. It installs with mise, which cannot start: ${r.error.message}. Install mise (https://mise.jdx.dev), or ${SET_TLC_VARS}`,
      );
    if (r.status === 0) return r.stdout.trim();
    const said = (r.stderr ?? "").trim();
    if (!said || /not installed|mise bin/.test(said)) return "";
    throw new Error(
      `Cannot find TLC, because mise failed:\n${indent(said)}\nThe install command: ${command(JAVA ? [TLC_TOOL] : [JAVA_TOOL, TLC_TOOL])}\nFix that, or ${SET_TLC_VARS}`,
    );
  };
  const resolve = () => {
    const home = mise("where", TLC_TOOL);
    const jar = home && path.join(home, "tla2tools.jar");
    const java = JAVA || mise("which", "java", "--tool", JAVA_TOOL);
    return { jar: jar && fs.existsSync(jar) ? jar : "", java };
  };
  try {
    const found = resolve();
    if (found.jar && found.java) return found;
    const tools = [!found.java && JAVA_TOOL, !found.jar && TLC_TOOL].filter(Boolean);
    const names = [!found.jar && "TLC", !found.java && "Java"].filter(Boolean);
    console.error(`Installing ${names.join(" and ")} with mise. This happens once.`);
    const r = run("install", "--quiet", ...tools);
    const installed = resolve();
    if (installed.jar && installed.java) return installed;
    const said =
      `${r.stderr ?? ""}${r.stdout ?? ""}`.trim() ||
      `mise install exited ${r.status}, with no output`;
    throw new Error(
      `Cannot find TLC, and mise could not install it:\n${indent(said)}\nThe install command: ${command(tools)}\nOr ${SET_TLC_VARS}`,
    );
  } finally {
    fs.rmSync(empty, { recursive: true, force: true });
  }
}

export function cannotRunTlc({ java, jar }, r) {
  const said = `java exited ${r.status ?? r.signal}:\n${indent(`${r.stderr}${r.stdout}`.trim())}`;
  return `cannot run TLC with ${java} -cp ${jar}: ${r.error?.message ?? said}\nFix that, or ${SET_TLC_VARS}`;
}

import { joinAnd } from "./lib.mjs";
import { badOf, reachableAvoiding } from "./bug-states.mjs";

export function stepsIntoBugs(cs, m, raw, { story, summary, next }) {
  if (!cs.length || (!story && !summary)) return cs;
  const { graph: g, stateKeys } = m;
  const unnamed = new Set(next);
  const rules = new Set(cs.map((c) => c.invariant));
  const clean = new Map([...rules].map((r) => [r, reachableAvoiding(m, badOf(raw, r))]));
  const byEnd = new Map();
  for (const c of cs) for (const k of c.ends) byEnd.set(k, [...(byEnd.get(k) ?? []), c]);
  const ways = new Map(cs.map((c) => [c, { steps: new Map(), n: 0, nameless: 0, action: null }]));
  for (const e of g.edges) {
    const into = byEnd.get(stateKeys.get(e.to))?.filter((c) => clean.get(c.invariant).has(e.from));
    if (!into?.length) continue;
    const [before, after] = [g.nodes.get(e.from).vars, g.nodes.get(e.to).vars];
    const label = m.step(e.action, before, after) || e.action;
    const moves = m.key(before) !== m.key(after);
    for (const c of into) {
      const w = ways.get(c);
      const s = w.steps.get(label) ?? { n: 0, moves: false };
      w.steps.set(label, { n: s.n + 1, moves: s.moves || moves });
      w.n++;
      if (!unnamed.has(e.action)) continue;
      w.nameless++;
      w.action = e.action;
    }
  }
  const starts = [...g.nodes.values()].filter((n) => n.init).map((n) => stateKeys.get(n.id));
  return cs.map((c) => {
    const { steps, n, nameless, action } = ways.get(c);
    const lastSteps = [...steps]
      .sort((a, b) => b[1].n - a[1].n || (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
      .map(([l]) => l);
    const onPath = new Set(c.path.slice(1).map((p) => p.label));
    const startsIn = starts.filter((k) => c.ends.has(k)).length;
    return {
      ...c,
      lastSteps,
      keptSteps: new Set(lastSteps.filter((l) => !steps.get(l).moves && !onPath.has(l))),
      nameless: nameless ? { action, all: nameless === n } : null,
      waysIn: n + startsIn,
      startsHere: startsIn > 0,
    };
  });
}

export function waysLine(c) {
  const quoted = c.lastSteps.map(
    (l) => `"${l}"${c.keptSteps.has(l) ? " (the state stays the same)" : ""}`,
  );
  const named = quoted.slice(0, 5);
  const more = quoted.length - named.length;
  const list = joinAnd(more ? [...named, `${more} more`] : named);
  const steps = c.nameless
    ? `In the model, steps labeled ${list} lead into this bug. TLC names ${c.nameless.all ? "them" : "some of them"} ${c.nameless.action}, the whole next-state action, so the story cannot count them.`
    : c.lastSteps.length === 1
      ? `In the model, one step leads into this bug: ${list}.`
      : c.lastSteps.length
        ? `In the model, ${c.lastSteps.length} different steps lead into this bug: ${list}.`
        : "";
  const start = !c.startsHere
    ? ""
    : steps
      ? "The model can also start in this bug."
      : "The model starts in this bug.";
  const shortest = c.waysIn > 1 ? "The steps below are the shortest path that TLC found." : "";
  return [steps, start, shortest].filter(Boolean).join(" ");
}

---
name: statechart
description: "Draw how any system moves between states, such as a product flow, a protocol, or a service, as a Mermaid statechart from a TLA+ model. Each bug is a numbered path with blue borders to a state that breaks a rule. Use for /statechart, to show a bug as a path through states, or to turn an agreed chart into a TLA+ skeleton."
disable-model-invocation: true
---

# Statechart

The chart shows how a system moves between states, in the words of the person who reads it. The scripts call that person the reader, as in `readerActions` and reader steps. The reader decides whether the behavior is right. The reader can be a PM who reads a product flow, an engineer who reads a protocol or a service, or a reviewer who reads a design. Label each state with what the reader can observe or cares about, such as "Paying" in an app or "Lease held, write pending" in a lock service. Label each step with the event that moves the system, such as "tap Pay" in an app, "the request reads the count" in a service, or "the lease expires" in a lock service. Keep variable and action names out of labels.

Run `node <skill dir>/scripts/statechart.mjs --help` for the commands and for how to read a chart. Work in a scratch folder outside the repo. The command writes its files next to its input. The first run installs TLC and Java with mise, which downloads about 305 MB and needs the network. The help's TLC section tells how to use a TLC and Java that you have.

## Pick the direction

Use `from-spec` when a TLA+ model exists, or when the code or design is concrete enough to model. Use `from-chart` when there is no model, and the people who own the behavior should agree on it before anyone builds or changes it.

If the code already has a TLA+ spec, start from a copy of that spec. Add the variables that the labels and rules need, and keep the spec's existing invariants. To audit the code against that spec, make the copy model what the code does, and pass the spec unchanged as `--against`. Check it with the config that its authors say it passes, and pass that config as `--against-config` unless it has the spec's file name. One mapping labels both models, so label states and steps from variables that both have. A label that reads a variable that only the copy has must test `"name" in v` first, and label the spec's states another way. When a model describes code, tie every variable and action to code that a reviewer can open, and take its name from that code. Make each action one indivisible step in the code. Put the file and line of the code that checks each condition of an action in a comment on that condition, as in `\* pay.ts:120`.

## Spec to chart

1. Choose the chart's states. When the reader cares about something that a label would hide, put it in the label, such as "Paying, charged twice" when the screen still says "Paying" after a second charge. Start with few states. Split a state when the split separates two bugs, or when the reader must see a step that leaves the label the same, such as a request that reads a count, because the chart does not draw such a step.
2. Write each rule that the reader agrees to as one invariant, with the reader's sentence as its comment. A rule can be about any state in the model: what a screen shows, what a request returns, a stored value, or a message between parts. When the model describes code, the rule also names the code that can change that state. If the model has no variable for what a rule is about, add the variable. Do not drop the rule. For a rule that applies once everything settles, define `Settled == ~ENABLED System`, where `System` is the disjunction of the actions that happen without the reader. For a rule that applies at a narrower point, such as after each request finishes, write a predicate for that point and make the rule hold where it is true. For a goal that the system must be able to reach, write a rule that says the goal never happens, and pass that rule with `--expect-broken`. The path that breaks it is then a way to the goal. The chart still draws the goal as a state that breaks a rule, and `stories.md` tells it as a bug, so name each goal rule in the hand-off. Report each other broken rule as a bug. Never weaken a rule to make the chart pass.
3. Run `from-spec`, then fill in the mapping file it writes. Put the labels in `state` and `step`. When the chart must separate what the reader does from what happens around the reader, list the reader's actions in `readerActions` by action name. Leave the list empty when every action counts the same. When the overview is too large to read, add `--cover`. The overview then keeps only the shortest path to each settled state, plus every bug path, and the command lists what it leaves out. When two bugs end in the same state for different reasons, add `cause` and make it name each reason. To color the states by what the reader cares about, such as "Order shipped", return that group from `group`. The legend names the groups, and in the PNG a state that breaks a rule is red in place of its group color.
4. If there is a proposed fix, model it and pass that model as `--fixed`.
5. Render each chart with `--png` and look at every PNG. Check that each numbered path reads in order. If a label reads like code, fix `state` or `step` and run the command again.
6. When the model describes code, replay each bug's story against the real code, as a test or a live repro, one step per model action. Drive only entry points that a user, a client, or another part of the system reaches, and assert only what they can observe. A test that asserts a flag that it sets, or that searches the source text, proves nothing. When a run proves part of the story and reading the code proves the rest, say which part each proves. When the test copies code that it cannot import, give the commit and line range of the copy, and list what the copy leaves out. If a bug does not reproduce, assume the model is wrong until you show otherwise. Fix the model, not the rule. For a design with no code yet, the TLC trace is the evidence, and the hand-off must say so.

## Chart to spec

1. Draw the chart that the reader agrees to. Use one region for each part that changes independently, such as a device's connection and the job that the device runs. Add one `%% never` line per rule, with the reader's sentence. Draw an event that stops or restarts a part, such as "the app closes" or "the process restarts", as an edge to the state that comes next. Run `render CHART.mmd` to get a PNG of the chart for the reader.
2. Run `from-chart`. If a rule breaks, the agreed chart has a design bug. Take the bug to the people who agreed to the chart.
3. Add the real code's guards and variables to the spec that `from-chart` wrote, and run `from-chart` again. For each difference it prints, ask the reader whether the code is wrong or the chart needs a correction.

## Hand off

Give the PNG and the Mermaid source of each chart to the person who must decide. Add one line per bug with the rule it breaks, its steps as the chart numbers them, whether it reproduced, and whether the proposed fix fixes it. A broken PROPERTY has no path on the chart, so give the TLC counterexample that `stories.md` names for it. With `--against`, also say whether the spec already lists it: in the configs that `stories.md` names, in the spec's notes on what the model leaves out, or not at all. When the model describes code, do not report that a rule holds while the command lists conditions with no file and line. Take every count you quote from `summary.json`. Attach `stories.md` and the command that regenerates everything. Say what the model leaves out.