chore(deps): bump @camcima/finita from 4.1.0 to 4.2.0 in the production-dependencies group

[dependabot]

Bumps the production-dependencies group with 1 update: @camcima/finita.

Updates @camcima/finita from 4.1.0 to 4.2.0

Release notes

Sourced from @​camcima/finita's releases.

v4.2.0

Remediation of the 2026-08 architecture review (#52). Two reproduced bugs fixed, four API-consistency gaps closed, no breaking changes. Coverage of src/ remains 100% across 389 tests.

Fixed

A failed lock release is no longer silent. MutexInterface.releaseLock() signals failure two ways — it throws, or it returns false. Only the throw was handled. A false return (what a PostgreSQL advisory unlock or a Redis DEL that removed nothing produces) meant the operation resolved successfully, onReleaseError never fired, and isLockAcquired() stayed true forever — after which every subsequent operation piggybacked on the stuck lock and never released it. Both failure modes now raise the new LockCanNotBeReleasedError.

Behavior change to check if you use a custom mutex. An operation whose release fails now rejects where it previously resolved. Implementations conforming to MaybePromise<boolean> are unaffected, and the default NullMutex always returns true — but a mutex returning undefined (untyped JavaScript, or a loose test double) will now surface an error instead of passing silently.

whenIdle() no longer deadlocks. It was missing the re-entrancy guard triggerEvent/checkTransitions received in v4. Awaiting it inside an observer could never resolve — the machine cannot reach idle while the runner is blocked on that very callback — so the machine wedged permanently and silently. It now throws ReentrancyError.

LockAdapterMutex no longer double-acquires. The acquired flag is only set after the adapter resolves, so two overlapping acquireLock() calls both passed the guard and acquired twice on a non-idempotent adapter. Overlapping calls now share one in-flight acquire; a failed acquire is still retryable.

Observer accessors return snapshots. getBeforeObservers(), getAfterObservers(), and Event.getObservers() handed out their live collections, so a later detach mutated a list a caller already held.

Added

• Factory accepts engine options — a third constructor argument typed FactoryStatemachineOptions, forwarding maxQueueLength, maxAutomaticHops, autoreleaseLock, onChainedOperationError, and onReleaseError to every machine it creates. Previously factory-created machines silently ran on defaults, with no back-pressure and no diagnostic sinks — precisely the fleet-of-machines case those options exist for. The three fields the factory derives per subject (initialStateName, mutex, transitionSelector) are excluded at the type level.
• LockCanNotBeReleasedError — typed error for the failed-release path, with code lockCanNotBeReleased.
• AmbiguousTransitionError.candidates — the competing transitions (target, event, condition, weight), also rendered into the message. A bare count never identified the culprits.
• Statemachine.releaseLock() now reports failures through onReleaseError. Its Promise<void> signature is unchanged; returning the boolean is breaking and is queued for v5 (#55).

Documentation

Release-failure semantics, the factory options template, whenIdle re-entrancy, and two things easy to misread from the API alone: Timeout schedules nothing — it only fires when something drives the machine — and event observers are shared by every machine built from the same process.

Also

Deprecation notices previously marked "removed in v4" are re-dated to v5, and the Codecov project floor moved from 80% to 95% (#65).

Outstanding work from the review is tracked in #64, with the breaking items batched under the v5 milestone.

Full changelog: camcima/finita@v4.1.0...v4.2.0

Changelog

Sourced from @​camcima/finita's changelog.

4.2.0 (2026-08-19)

Remediation of the 2026-08 architecture review (#52). Full notes: v4.2.0 release.

Features

• Factory accepts a FactoryStatemachineOptions template, forwarding engine options to every machine it creates (f67bb12)
• add LockCanNotBeReleasedError for a release that fails by returning false (f67bb12)
• add AmbiguousTransitionError.candidates carrying the competing transitions (f67bb12)

Bug Fixes

• surface a failed lock release instead of resolving as if the lock were freed (f67bb12)
• guard whenIdle() against re-entrant calls that deadlocked the machine (f67bb12)
• share one in-flight acquire in LockAdapterMutex (f67bb12)
• return observer snapshots from the accessor methods (f67bb12)

Commits

• ff9c708 chore: release v4.2.0
• f67bb12 fix: address architecture review findings (#52)
• a350deb ci(codecov): raise the project coverage floor to 95% (#65)
• 9932a58 build(deps-dev): bump release-it from 20.2.1 to 21.0.2 (#49)
• 1d1583d build(deps-dev): bump the dev-dependencies group across 1 directory with 5 up...
• 0523e25 build(deps): bump github/codeql-action from 4.37.4 to 4.37.7 (#46)
• 25a12f2 build(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 (#47)
• da42301 ci: group action updates and add concurrency control (#50)
• c84435d Merge pull request #42 from camcima/chore/combined-dependency-updates
• 35ce773 chore(deps): fold in remaining action bumps and clear OSV advisory
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.71%. Comparing base (d65eb23) to head (1d47a36).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #85   +/-   ##
=======================================
  Coverage   99.71%   99.71%           
=======================================
  Files          44       44           
  Lines        1414     1414           
  Branches      265      265           
=======================================
  Hits         1410     1410           
  Misses          4        4           

Flag	Coverage Δ
unit	99.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.