@shware/workflow 0.0.0-stage → 0.1.0

package/dist/cloudflare/index.d.mts

@@ -0,0 +1,19 @@
+import { JourneyObserver, MessageTracking, OutboundMessage, PushDevice, SendResult } from "../engine/ports.mjs";
+import { EmailAddress } from "../config.mjs";
+import { D1DatabaseLike, EmailBindingLike, JourneyEnv, JourneyParams, KVNamespaceLike, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WorkflowBindingLike, WorkflowInstanceLike, wakeExpired } from "./bindings.mjs";
+import { D1JourneyStore } from "../store/d1.mjs";
+import { JourneyFactSource } from "../store/facts.mjs";
+import { SqlClientLike } from "../store/sql.mjs";
+import { PostgresJourneyStore, PostgresJourneyStoreOptions } from "../store/postgres.mjs";
+import { PostgresReporting } from "../store/postgres-reporting.mjs";
+import { Engagement, EntryInput, EntryOutcome, EventInput, JourneyReporting, JourneyStore, MessageRecord, ProfileProps, SchemaMismatchError, SegmentTriggerRoute, StoreLease, TriggerRoute } from "../store/index.mjs";
+import { d1Store } from "./d1-env.mjs";
+import { BundleIntegrityError, DeployResult, DeviceRegistration, IdentifyResult, IngestInput, IngestResult, SweepResult, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.mjs";
+import { JourneyRunner } from "./runner.mjs";
+import { CfEmailOptions, CfEmailSender, EmailRenderer, LogMessageSender, WebhookMessageSender, routeByChannel, routeByPlatform, trackEmail } from "./senders.mjs";
+import { ChannelsConfig, channelsFromConfig, journeyMode, runtimeFromConfig } from "./channels.mjs";
+import { reportingObserver } from "../reporting/observer.mjs";
+import { TrackingOptions, handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
+import { BURST_WINDOW_MS, ClassifyOptions, ClickFacts, DEFAULT_QUICK_MS, RequestFacts, Verdict, classifyClick, classifyOpen } from "../reporting/classify.mjs";
+import { EnvValidationError, ExecutionContextLike, JourneyWorker, JourneyWorkerOptions, journeyWorker } from "./worker.mjs";
+export { BURST_WINDOW_MS, BundleIntegrityError, type CfEmailOptions, CfEmailSender, type ChannelsConfig, type ClassifyOptions, type ClickFacts, type D1DatabaseLike, D1JourneyStore, DEFAULT_QUICK_MS, type DeployResult, type DeviceRegistration, type EmailAddress, type EmailBindingLike, type EmailRenderer, type Engagement, type EntryInput, type EntryOutcome, EnvValidationError, type EventInput, type ExecutionContextLike, type IdentifyResult, type IngestInput, type IngestResult, type JourneyEnv, JourneyFactSource, type JourneyObserver, type JourneyParams, type JourneyReporting, JourneyRunner, type JourneyStore, type JourneyWorker, type JourneyWorkerOptions, type KVNamespaceLike, LogMessageSender, type MessageRecord, type MessageTracking, type OutboundMessage, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type ProfileProps, type PushDevice, type RequestFacts, SchemaMismatchError, type SegmentTriggerRoute, type SendResult, type SqlClientLike, type StoreLease, type SweepResult, type TrackingOptions, type TriggerRoute, type Verdict, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, type WorkflowBindingLike, type WorkflowInstanceLike, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };

package/dist/cloudflare/index.mjs

@@ -0,0 +1,16 @@
+import { PostgresReporting } from "../store/postgres-reporting.mjs";
+import { PostgresJourneyStore } from "../store/postgres.mjs";
+import { WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, wakeExpired } from "./bindings.mjs";
+import { BURST_WINDOW_MS, DEFAULT_QUICK_MS, classifyClick, classifyOpen } from "../reporting/classify.mjs";
+import { handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
+import { JourneyFactSource } from "../store/facts.mjs";
+import { D1JourneyStore } from "../store/d1.mjs";
+import { SchemaMismatchError } from "../store/index.mjs";
+import { d1Store } from "./d1-env.mjs";
+import { BundleIntegrityError, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.mjs";
+import { CfEmailSender, LogMessageSender, WebhookMessageSender, routeByChannel, routeByPlatform, trackEmail } from "./senders.mjs";
+import { channelsFromConfig, journeyMode, runtimeFromConfig } from "./channels.mjs";
+import { JourneyRunner } from "./runner.mjs";
+import { reportingObserver } from "../reporting/observer.mjs";
+import { EnvValidationError, journeyWorker } from "./worker.mjs";
+export { BURST_WINDOW_MS, BundleIntegrityError, CfEmailSender, D1JourneyStore, DEFAULT_QUICK_MS, EnvValidationError, JourneyFactSource, JourneyRunner, LogMessageSender, PostgresJourneyStore, PostgresReporting, SchemaMismatchError, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };

package/dist/cloudflare/router.cjs

@@ -0,0 +1,516 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_hash = require("../hash.cjs");
+const require_ir = require("../ir.cjs");
+const require_contract = require("../contract.cjs");
+const require_cloudflare_bindings = require("./bindings.cjs");
+const require_engine_bucket = require("../engine/bucket.cjs");
+const require_engine_condition = require("../engine/condition.cjs");
+const require_reporting_tracking = require("../reporting/tracking.cjs");
+const require_store_facts = require("../store/facts.cjs");
+const require_store_index = require("../store/index.cjs");
+const require_cloudflare_d1_env = require("./d1-env.cjs");
+let zod_mini = require("zod/mini");
+zod_mini = require_runtime.__toESM(zod_mini, 1);
+//#region src/cloudflare/router.ts
+async function ingestEvent(env, input, store = require_cloudflare_d1_env.d1Store(env)) {
+	if (input.event.startsWith("$")) throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);
+	const ts = input.ts ?? Date.now();
+	const payload = input.payload ?? {};
+	const id = input.id ?? crypto.randomUUID();
+	const stored = await store.insertEvent({
+		id,
+		userId: input.userId,
+		event: input.event,
+		ts,
+		payload
+	});
+	const woke = await wakeSubscribers(env, store, input.userId, input.event);
+	const started = await startTriggeredJourneys(env, store, {
+		...input,
+		payload
+	}, ts);
+	started.push(...await refreshSegmentTriggers(env, store, input.userId, ts));
+	return {
+		id,
+		stored,
+		woke,
+		started
+	};
+}
+async function wakeSubscribers(env, store, userId, event) {
+	let woke = 0;
+	for (const handle of await store.findWakeHandles(userId, event)) {
+		let instance;
+		try {
+			instance = await env.JOURNEY.get(handle);
+		} catch {
+			await store.unsubscribe(handle);
+			continue;
+		}
+		try {
+			await instance.sendEvent({
+				type: require_cloudflare_bindings.WAKE_EVENT_TYPE,
+				payload: { event }
+			});
+			woke++;
+		} catch {}
+	}
+	return woke;
+}
+async function startTriggeredJourneys(env, store, input, ts) {
+	const started = [];
+	for (const route of await store.findTriggers(input.event)) {
+		if (route.where !== null && !require_engine_condition.matchesWhere(input.payload, route.where)) continue;
+		if (route.filter !== null) {
+			const facts = new require_store_facts.JourneyFactSource(store, input.userId);
+			if (!await require_engine_condition.evaluateCondition(route.filter, facts, ts)) continue;
+		}
+		const instanceId = await startJourney(env, store, route.workflow, route.hash, input.userId, ts, {
+			event: input.event,
+			payload: input.payload
+		});
+		if (instanceId !== null) started.push(instanceId);
+	}
+	return started;
+}
+/**
+* Segment-entry triggers, maintained lazily: on each ingest/identify for a
+* user, re-evaluate every trigger-routed segment for that user and act on the
+* membership transition (enter → start journeys, leave → drop membership so a
+* later re-entry is observable). Purely time-driven drift (an inactivity
+* segment turning true by clock alone) has no event to ride on: the scheduled
+* sweep catches it (`sweepSegments`).
+*/
+async function refreshSegmentTriggers(env, store, userId, ts) {
+	return refreshSegments(env, store, userId, ts, await store.listSegmentTriggers());
+}
+/**
+* Re-evaluate segments for one user — the routed ones only, or with `segments` every one named —
+* and act on each membership transition: entering records the membership and starts the
+* segment's routed workflows, leaving drops it. A segment trigger therefore starts journeys for
+* users who enter after it is deployed; a user already a member is not entered again.
+*/
+async function refreshSegments(env, store, userId, ts, routes, segments = [], definitions = /* @__PURE__ */ new Map()) {
+	const bySegment = new Map(segments.map((name) => [name, []]));
+	for (const route of routes) {
+		const list = bySegment.get(route.segment) ?? [];
+		list.push({
+			workflow: route.workflow,
+			hash: route.hash
+		});
+		bySegment.set(route.segment, list);
+	}
+	if (bySegment.size === 0) return [];
+	const facts = new require_store_facts.JourneyFactSource(store, userId);
+	const started = [];
+	const failures = [];
+	for (const [segmentId, segmentRoutes] of bySegment) {
+		if (!definitions.has(segmentId)) definitions.set(segmentId, await store.getSegmentCondition(segmentId));
+		const definition = definitions.get(segmentId);
+		if (definition === void 0) continue;
+		const matches = await require_engine_condition.evaluateCondition(definition, facts, ts);
+		const member = await store.isSegmentMember(segmentId, userId);
+		if (matches && !member) await store.addSegmentMember(segmentId, userId, ts, segmentRoutes.map((route) => route.workflow));
+		else if (!matches && member) {
+			await store.removeSegmentMember(segmentId, userId);
+			continue;
+		}
+		if (!matches) continue;
+		const pending = new Set(await store.pendingSegmentStarts(segmentId, userId));
+		for (const route of segmentRoutes) {
+			if (!pending.has(route.workflow)) continue;
+			try {
+				const instanceId = await startJourney(env, store, route.workflow, route.hash, userId, ts, {
+					event: "$segment_entry",
+					payload: { segment: segmentId }
+				});
+				if (instanceId !== null) started.push(instanceId);
+				await store.completeSegmentStart(segmentId, userId, route.workflow);
+			} catch (error) {
+				failures.push(error);
+			}
+		}
+	}
+	if (failures.length > 0) throw failures[0];
+	return started;
+}
+/**
+* The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a
+* journey's conditions run on, so a member is exactly who a journey would see in it. Membership
+* follows (joiners keep the time they joined, leavers are removed), segment triggers start the
+* journeys of whoever entered by the clock alone, and the store records each segment's size.
+* It walks users one by one: fine for thousands, a large audience wants SQL-side evaluation.
+*/
+async function sweepSegments(env, store, now = Date.now()) {
+	const erasing = /* @__PURE__ */ new Set();
+	for (const userId of await store.pendingErasures()) try {
+		const { erased } = await eraseUser(env, userId, store);
+		if (!erased) erasing.add(userId);
+	} catch (error) {
+		erasing.add(userId);
+		console.error(`[workflow] erasure of ${userId} failed`, error);
+	}
+	const segments = (await store.listSegments()).map((segment) => segment.id);
+	const routes = await store.listSegmentTriggers();
+	const users = (await store.listUserIds()).filter((userId) => !erasing.has(userId));
+	const started = [];
+	const definitions = /* @__PURE__ */ new Map();
+	for (const userId of users) try {
+		started.push(...await refreshSegments(env, store, userId, now, routes, segments, definitions));
+	} catch (error) {
+		console.error(`[workflow] segment refresh for ${userId} failed`, error);
+	}
+	const sizes = await store.reporting?.snapshotSegments(now) ?? [];
+	return {
+		users: users.length,
+		started,
+		sizes
+	};
+}
+/**
+* Create one journey instance behind the entry ledger. Returns null when the
+* once-policy blocks the entry (the store's attempt is atomic, so concurrent
+* ingests cannot double-enter). A pair whose previous instance is recorded as
+* 'failed' is reclaimed rather than barred forever over one outage.
+*/
+async function startJourney(env, store, workflow, hash, userId, ts, trigger) {
+	const instanceId = buildInstanceId(workflow, hash, userId, ts);
+	const params = {
+		workflowId: workflow,
+		contentHash: hash,
+		userId,
+		trigger
+	};
+	const outcome = await store.enterJourney({
+		workflow,
+		userId,
+		instanceId,
+		hash,
+		ts
+	});
+	if (outcome === null) return null;
+	try {
+		await env.JOURNEY.create({
+			id: instanceId,
+			params
+		});
+	} catch (error) {
+		if (outcome === "reclaimed") await store.setEntryStatus(instanceId, "failed");
+		else await store.removeEntry(instanceId);
+		throw error;
+	}
+	return instanceId;
+}
+const utf8 = new TextEncoder();
+/**
+* Instance id: addressable (the router gets it directly to wake it), ≤100
+* chars, legal charset. The murmur3 fingerprint keeps ids distinct when the
+* sanitized/truncated userId alone would collide.
+*/
+function buildInstanceId(workflow, hash, userId, ts) {
+	const uid = userId.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 24);
+	const fingerprint = require_engine_bucket.murmur3(utf8.encode(userId)).toString(36);
+	return `${workflow.slice(0, 32)}-${hash.slice(0, 8)}-${uid}-${fingerprint}-${ts.toString(36)}`;
+}
+/**
+* Merge-patch profile properties (a null removes one), then wake property waits
+* and re-evaluate segment triggers. The merge is one statement in the store, so
+* two identifies landing together cannot lose each other's fields.
+*/
+async function identifyUser(env, userId, props, store = require_cloudflare_d1_env.d1Store(env)) {
+	const ts = Date.now();
+	return {
+		ok: true,
+		props: await store.mergeProfile(userId, props),
+		woke: await wakeSubscribers(env, store, userId, require_engine_condition.PROFILE_UPDATED_EVENT),
+		started: await refreshSegmentTriggers(env, store, userId, ts)
+	};
+}
+/**
+* A push token registered for the user (or moved to them from another account: a token belongs
+* to one user at a time). Wakes the waits that read devices (`reachable('push')` inside
+* `waitUntil`), for the new owner and the previous one.
+*/
+async function registerDevice(env, device, store = require_cloudflare_d1_env.d1Store(env)) {
+	const previous = await store.removeDevice(device.token);
+	await store.upsertDevice({
+		...device,
+		ts: device.ts ?? Date.now()
+	});
+	let woke = await wakeSubscribers(env, store, device.userId, require_engine_condition.DEVICES_UPDATED_EVENT);
+	if (previous !== void 0 && previous !== device.userId) woke += await wakeSubscribers(env, store, previous, require_engine_condition.DEVICES_UPDATED_EVENT);
+	return {
+		ok: true,
+		woke
+	};
+}
+/**
+* A deleted account: everything the engine keeps about the user is erased and the journeys still
+* running for them are terminated, so nothing more is sent. Idempotent.
+*/
+/** Workflow instance states that will never run another step. */
+const STOPPED_STATUSES = /* @__PURE__ */ new Set([
+	"complete",
+	"errored",
+	"terminated"
+]);
+/**
+* Stop one instance for good; true once it is known not to run again. An instance the platform
+* no longer knows, or one already finished (terminate refuses those), counts as stopped. Any other
+* failure is not taken for "already gone": it answers false, and the erasure waits for a retry.
+*/
+async function stopInstance(env, instanceId) {
+	let instance;
+	try {
+		instance = await env.JOURNEY.get(instanceId);
+	} catch (error) {
+		if (/not[_ ]found/i.test(String(error))) return true;
+		console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);
+		return false;
+	}
+	if (instance.terminate === void 0) return false;
+	try {
+		await instance.terminate();
+		return true;
+	} catch (error) {
+		const status = await instance.status?.().catch(() => void 0);
+		if (status !== void 0 && STOPPED_STATUSES.has(status.status)) return true;
+		console.warn(`[workflow] terminating ${instanceId} failed`, error);
+		return false;
+	}
+}
+/**
+* Carry out a recorded erasure: stop every running instance of the user, and only once all have
+* stopped erase their data (the request with it). Stopping first means no step can write rows
+* back after the erase; erasing nothing until then keeps the entries that name the instances
+* still to stop, so a retry can finish the job.
+*/
+async function eraseUser(env, userId, store) {
+	const pending = [];
+	for (const instanceId of await store.runningInstances(userId)) if (!await stopInstance(env, instanceId)) pending.push(instanceId);
+	if (pending.length > 0) return {
+		erased: false,
+		pending
+	};
+	await store.forgetUser(userId);
+	return {
+		erased: true,
+		pending
+	};
+}
+/**
+* Forget a user (a deleted account): the request is recorded first, then carried out. An
+* instance that will not stop leaves it pending — nothing erased yet — and the scheduled sweep
+* retries it; `erased: false` says so.
+*/
+async function forgetUser(env, userId, store = require_cloudflare_d1_env.d1Store(env), now = Date.now()) {
+	await store.requestErasure(userId, now);
+	return {
+		ok: true,
+		...await eraseUser(env, userId, store)
+	};
+}
+/**
+* The user signed out on the device: the token stays registered, bound to nobody, so the next
+* sign-in only has to bind it again. Wakes the former owner's device waits (`reachable('push')`
+* may no longer hold).
+*/
+async function unbindDevice(env, token, store = require_cloudflare_d1_env.d1Store(env)) {
+	const owner = await store.unbindDevice(token);
+	return {
+		ok: true,
+		woke: owner === void 0 ? 0 : await wakeSubscribers(env, store, owner, require_engine_condition.DEVICES_UPDATED_EVENT)
+	};
+}
+/** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */
+async function removeDevice(env, token, store = require_cloudflare_d1_env.d1Store(env)) {
+	const owner = await store.removeDevice(token);
+	return {
+		ok: true,
+		woke: owner === void 0 ? 0 : await wakeSubscribers(env, store, owner, require_engine_condition.DEVICES_UPDATED_EVENT)
+	};
+}
+/** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */
+var BundleIntegrityError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BundleIntegrityError";
+	}
+};
+/**
+* Recompute every declared contentHash and refuse the bundle if one disagrees.
+*
+* The contentHash is the address an in-flight journey reads its IR from, so
+* a hash that does not describe its own content is a way to change what a
+* pinned instance executes: submit an edited flow under the old hash and the
+* next replay picks it up. The compiler always computes the hash it ships, so
+* a mismatch means a hand-rolled payload or a stale client — neither should be
+* able to overwrite a version that journeys are running.
+*
+* Each hash is recomputed exactly the way its compiler produced it: a workflow
+* hashes its whole IR (contentHash strips itself), a segment hashes only its
+* condition. Mirroring them is load-bearing — recomputing a segment over the
+* whole record would reject every honest deploy.
+*/
+function verifyBundleHashes(parsed) {
+	const mismatched = [];
+	for (const workflow of parsed.workflows) if (require_hash.semanticHash(workflow) !== workflow.contentHash) mismatched.push(`workflow '${workflow.id}'`);
+	for (const segment of parsed.segments) if (require_hash.semanticHash(segment.condition) !== segment.contentHash) mismatched.push(`segment '${segment.id}'`);
+	if (mismatched.length > 0) throw new BundleIntegrityError(`contentHash does not match content for ${mismatched.join(", ")} — recompile the bundle instead of editing it by hand`);
+}
+/** Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed deploy leaves only harmless orphans), then the routing swap. */
+async function deployBundle(env, bundle, store = require_cloudflare_d1_env.d1Store(env)) {
+	const parsed = require_ir.BundleIR.parse(bundle);
+	verifyBundleHashes(parsed);
+	const problems = await store.checkSchema?.() ?? [];
+	if (problems.length > 0) throw new require_store_index.SchemaMismatchError(problems);
+	for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);
+	await store.replaceRoutes(parsed);
+	const unrouted = parsed.workflows.filter((workflow) => workflow.trigger.type === "date" || workflow.trigger.type === "webhook").map((workflow) => ({
+		workflow: workflow.id,
+		trigger: workflow.trigger.type
+	}));
+	return {
+		workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),
+		unrouted
+	};
+}
+/**
+* Request bodies are untrusted JSON. They are read as unknown fields and
+* checked, never cast into the shape they are supposed to have: a cast only
+* silences the compiler, and what arrives here reaches SQL parameters.
+*/
+async function readBody(request) {
+	const body = await request.json();
+	return isPlainObject(body) ? body : {};
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+async function handleRequest(request, env, store = require_cloudflare_d1_env.d1Store(env), validation = {}) {
+	const url = new URL(request.url);
+	const json = (body, status = 200) => new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+	const { contract } = validation;
+	const enforce = validation.mode !== "report";
+	/** The contract's verdict: the value to use, or the response refusing the request. */
+	const checked = (result, original, what) => {
+		if (result.ok) return { value: result.data };
+		const issues = result.issues.map((i) => `${i.path || "(root)"}: ${i.message}`);
+		if (!enforce) {
+			console.warn(`[workflow router] contract would refuse ${what}: ${issues.join("; ")}`);
+			return { value: original };
+		}
+		return { refused: json({
+			error: `${what} refused by the contract`,
+			issues: result.issues
+		}, 400) };
+	};
+	if (request.method === "GET" && url.pathname === "/health") return json({ ok: true });
+	if (env.API_TOKEN !== void 0) {
+		if (request.headers.get("authorization") !== `Bearer ${env.API_TOKEN}`) return json({ error: "unauthorized" }, 401);
+	}
+	try {
+		if (request.method === "POST" && url.pathname === "/events") {
+			const { id, userId, event, payload, ts } = await readBody(request);
+			if (!isNonEmptyString(userId) || !isNonEmptyString(event)) return json({ error: "userId and event required" }, 400);
+			if (event.startsWith("$")) return json({ error: "event names starting with $ are reserved" }, 400);
+			if (id !== void 0 && !isNonEmptyString(id)) return json({ error: "id must be a non-empty string" }, 400);
+			if (ts !== void 0 && typeof ts !== "number") return json({ error: "ts must be a number" }, 400);
+			if (payload !== void 0 && !isPlainObject(payload)) return json({ error: "payload must be an object" }, 400);
+			let accepted = payload;
+			if (contract !== void 0) {
+				const verdict = checked(require_contract.checkEvent(contract, event, payload ?? {}), accepted ?? {}, `event '${event}'${typeof id === "string" ? ` (${id})` : ""}`);
+				if ("refused" in verdict) return verdict.refused;
+				accepted = verdict.value;
+			}
+			return json(await ingestEvent(env, {
+				id,
+				userId,
+				event,
+				payload: accepted,
+				ts
+			}, store));
+		}
+		if (request.method === "POST" && url.pathname === "/identify") {
+			const { userId, props } = await readBody(request);
+			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
+			if (!isPlainObject(props)) return json({ error: "props must be an object" }, 400);
+			let patch = props;
+			if (contract !== void 0) {
+				const verdict = checked(contract.parseProfilePatch(props), patch, "identify");
+				if ("refused" in verdict) return verdict.refused;
+				patch = verdict.value;
+			}
+			return json(await identifyUser(env, userId, patch, store));
+		}
+		if (request.method === "POST" && url.pathname === "/devices") {
+			const { userId, token, platform, ts } = await readBody(request);
+			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
+			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
+			if (platform !== "ios" && platform !== "android" && platform !== "web") return json({ error: "platform must be 'ios', 'android' or 'web'" }, 400);
+			if (ts !== void 0 && typeof ts !== "number") return json({ error: "ts must be a number" }, 400);
+			return json(await registerDevice(env, {
+				userId,
+				token,
+				platform,
+				...ts === void 0 ? {} : { ts }
+			}, store));
+		}
+		if (request.method === "POST" && url.pathname === "/messages/opened") {
+			const { userId, messageId } = await readBody(request);
+			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
+			if (!isNonEmptyString(messageId)) return json({ error: "messageId required" }, 400);
+			return json({
+				ok: true,
+				recorded: store.reporting !== void 0 && await require_reporting_tracking.recordPushOpen(store.reporting, userId, messageId)
+			});
+		}
+		if (request.method === "POST" && url.pathname === "/users/forget") {
+			const { userId } = await readBody(request);
+			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
+			return json(await forgetUser(env, userId, store));
+		}
+		if (request.method === "POST" && url.pathname === "/devices/unbind") {
+			const { token } = await readBody(request);
+			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
+			return json(await unbindDevice(env, token, store));
+		}
+		if (request.method === "POST" && url.pathname === "/devices/remove") {
+			const { token } = await readBody(request);
+			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
+			return json(await removeDevice(env, token, store));
+		}
+		if (request.method === "POST" && url.pathname === "/deploy") return json(await deployBundle(env, await request.json(), store));
+		return json({ error: "not found" }, 404);
+	} catch (error) {
+		if (error instanceof zod_mini.core.$ZodError) return json({ error: `invalid payload: ${error.message}` }, 400);
+		if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);
+		if (error instanceof require_store_index.SchemaMismatchError) return json({
+			error: error.message,
+			problems: error.problems
+		}, 503);
+		console.error("[workflow router]", error);
+		return json({ error: "internal error" }, 500);
+	}
+}
+//#endregion
+exports.BundleIntegrityError = BundleIntegrityError;
+exports.deployBundle = deployBundle;
+exports.forgetUser = forgetUser;
+exports.handleRequest = handleRequest;
+exports.identifyUser = identifyUser;
+exports.ingestEvent = ingestEvent;
+exports.refreshSegmentTriggers = refreshSegmentTriggers;
+exports.registerDevice = registerDevice;
+exports.removeDevice = removeDevice;
+exports.sweepSegments = sweepSegments;
+exports.unbindDevice = unbindDevice;
+
+//# sourceMappingURL=router.cjs.map

package/dist/cloudflare/router.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.cjs","names":["d1Store","WAKE_EVENT_TYPE","matchesWhere","JourneyFactSource","evaluateCondition","murmur3","PROFILE_UPDATED_EVENT","DEVICES_UPDATED_EVENT","semanticHash","BundleIR","SchemaMismatchError","checkEvent","recordPushOpen","z"],"sources":["../../src/cloudflare/router.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport { murmur3 } from '../engine/bucket';\nimport {\n  DEVICES_UPDATED_EVENT,\n  PROFILE_UPDATED_EVENT,\n  evaluateCondition,\n  matchesWhere,\n} from '../engine/condition';\nimport { semanticHash } from '../hash';\nimport { BundleIR, type ConditionIR, type TriggerIR } from '../ir';\nimport { recordPushOpen } from '../reporting/tracking';\nimport { JourneyFactSource } from '../store/facts';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  type SegmentTriggerRoute,\n} from '../store/index';\nimport {\n  type JourneyEnv,\n  type JourneyParams,\n  WAKE_EVENT_TYPE,\n  type WorkflowInstanceLike,\n} from './bindings';\nimport { d1Store } from './d1-env';\n\n/**\n * Ingest router. An incoming event does four things: it is stored, it wakes\n * waiting instances, it is matched against event triggers, and it re-evaluates\n * segment-trigger membership. Plus /deploy (persist a bundle) and /identify\n * (merge a profile — which wakes property-condition waits via\n * PROFILE_UPDATED_EVENT and re-evaluates segment triggers too).\n *\n * Storage goes through a JourneyStore; the `store` argument defaults to the\n * D1 + KV store built from the env's bindings, so a Worker that only has those\n * calls these functions exactly as before.\n */\n\nexport interface IngestInput {\n  userId: string;\n  event: string;\n  payload?: Record<string, unknown>;\n  ts?: number;\n  /**\n   * This occurrence's identity, and with it the idempotency of sending it.\n   *\n   * Only the sender can know whether two deliveries describe one occurrence or\n   * two, so the engine does not decide: an id it has already stored makes the\n   * second delivery a no-op. That matters because ingest is reachable from two\n   * retrying callers — an HTTP client retrying a 500, and the interpreter's\n   * send_event step being retried after it already committed its row — and a\n   * second copy of an event silently changes every count- and window-based\n   * condition that reads the log.\n   *\n   * Callers that retry should send an id they can reproduce. Omitting it gets\n   * a fresh one, which records the event as its own occurrence.\n   */\n  id?: string;\n}\n\nexport interface IngestResult {\n  /** The occurrence's identity: the caller's `id`, or the one minted for it. */\n  id: string;\n  /** False when that id was already in the log: nothing was written this time. */\n  stored: boolean;\n  woke: number;\n  started: string[];\n}\n\nexport async function ingestEvent(\n  env: JourneyEnv,\n  input: IngestInput,\n  store: JourneyStore = d1Store(env)\n): Promise<IngestResult> {\n  if (input.event.startsWith('$')) {\n    throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);\n  }\n  const ts = input.ts ?? Date.now();\n  const payload = input.payload ?? {};\n  // No id means the sender is not claiming this is a repeat of anything, which\n  // a fresh one states truthfully — unlike a key derived from the contents,\n  // which would silently collapse two identical events a second apart.\n  const id = input.id ?? crypto.randomUUID();\n\n  const stored = await store.insertEvent({\n    id,\n    userId: input.userId,\n    event: input.event,\n    ts,\n    payload,\n  });\n\n  /*\n   * The rest runs even for a duplicate. A retry arrives precisely because the\n   * first attempt did not finish — it committed the row and then failed — so\n   * returning early would strand the journeys the retry exists to start. Both\n   * halves are independently idempotent: waking an instance that already moved\n   * on is a no-op, and the entry ledger refuses a second entry.\n   */\n  const woke = await wakeSubscribers(env, store, input.userId, input.event);\n  const started = await startTriggeredJourneys(env, store, { ...input, payload }, ts);\n  started.push(...(await refreshSegmentTriggers(env, store, input.userId, ts)));\n  return { id, stored, woke, started };\n}\n\nasync function wakeSubscribers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  event: string\n): Promise<number> {\n  let woke = 0;\n  for (const handle of await store.findWakeHandles(userId, event)) {\n    let instance: WorkflowInstanceLike;\n    try {\n      instance = await env.JOURNEY.get(handle);\n    } catch {\n      // Unknown instance (errored out without cleanup): drop the dangling subscription\n      await store.unsubscribe(handle);\n      continue;\n    }\n    try {\n      await instance.sendEvent({ type: WAKE_EVENT_TYPE, payload: { event } });\n      woke++;\n    } catch {\n      // Transient send failure (or an instance finishing right now): keep the\n      // subscription — a later event retries it, and the wait's own timeout\n      // bounds the damage. Deleting here would silence all future wake-ups.\n    }\n  }\n  return woke;\n}\n\nasync function startTriggeredJourneys(\n  env: JourneyEnv,\n  store: JourneyStore,\n  input: IngestInput & { payload: Record<string, unknown> },\n  ts: number\n): Promise<string[]> {\n  const started: string[] = [];\n  for (const route of await store.findTriggers(input.event)) {\n    // where: the payload gate — evaluated against the incoming event first\n    if (route.where !== null && !matchesWhere(input.payload, route.where)) continue;\n\n    // filter: the profile gate\n    if (route.filter !== null) {\n      const facts = new JourneyFactSource(store, input.userId);\n      if (!(await evaluateCondition(route.filter, facts, ts))) continue;\n    }\n\n    const instanceId = await startJourney(\n      env,\n      store,\n      route.workflow,\n      route.hash,\n      input.userId,\n      ts,\n      {\n        event: input.event,\n        payload: input.payload,\n      }\n    );\n    if (instanceId !== null) started.push(instanceId);\n  }\n  return started;\n}\n\n/**\n * Segment-entry triggers, maintained lazily: on each ingest/identify for a\n * user, re-evaluate every trigger-routed segment for that user and act on the\n * membership transition (enter → start journeys, leave → drop membership so a\n * later re-entry is observable). Purely time-driven drift (an inactivity\n * segment turning true by clock alone) has no event to ride on: the scheduled\n * sweep catches it (`sweepSegments`).\n */\nexport async function refreshSegmentTriggers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number\n): Promise<string[]> {\n  return refreshSegments(env, store, userId, ts, await store.listSegmentTriggers());\n}\n\n/**\n * Re-evaluate segments for one user — the routed ones only, or with `segments` every one named —\n * and act on each membership transition: entering records the membership and starts the\n * segment's routed workflows, leaving drops it. A segment trigger therefore starts journeys for\n * users who enter after it is deployed; a user already a member is not entered again.\n */\nasync function refreshSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number,\n  routes: readonly SegmentTriggerRoute[],\n  segments: readonly string[] = [],\n  // A sweep loads each definition once for all its users, not once per user\n  definitions = new Map<string, ConditionIR | undefined>()\n): Promise<string[]> {\n  const bySegment = new Map<string, { workflow: string; hash: string }[]>(\n    segments.map((name) => [name, []])\n  );\n  for (const route of routes) {\n    const list = bySegment.get(route.segment) ?? [];\n    list.push({ workflow: route.workflow, hash: route.hash });\n    bySegment.set(route.segment, list);\n  }\n  if (bySegment.size === 0) return [];\n\n  const facts = new JourneyFactSource(store, userId);\n  const started: string[] = [];\n  const failures: unknown[] = [];\n  for (const [segmentId, segmentRoutes] of bySegment) {\n    if (!definitions.has(segmentId)) {\n      definitions.set(segmentId, await store.getSegmentCondition(segmentId));\n    }\n    const definition = definitions.get(segmentId);\n    if (definition === undefined) continue; // route without a definition: broken deploy, skip\n\n    const matches = await evaluateCondition(definition, facts, ts);\n    const member = await store.isSegmentMember(segmentId, userId);\n\n    if (matches && !member) {\n      // Entry transition: the membership and the starts it owes, recorded together\n      await store.addSegmentMember(\n        segmentId,\n        userId,\n        ts,\n        segmentRoutes.map((route) => route.workflow)\n      );\n    } else if (!matches && member) {\n      await store.removeSegmentMember(segmentId, userId);\n      continue;\n    }\n    if (!matches) continue;\n\n    // Every start the entry still owes — a fresh entry's, or one an earlier evaluation failed on.\n    // Each is crossed off once its instance exists, so one workflow failing neither blocks the\n    // others nor gets lost: the next evaluation (the sweep, the user's next event) retries it.\n    const pending = new Set(await store.pendingSegmentStarts(segmentId, userId));\n    for (const route of segmentRoutes) {\n      if (!pending.has(route.workflow)) continue;\n      try {\n        const instanceId = await startJourney(env, store, route.workflow, route.hash, userId, ts, {\n          event: '$segment_entry',\n          payload: { segment: segmentId },\n        });\n        if (instanceId !== null) started.push(instanceId);\n        await store.completeSegmentStart(segmentId, userId, route.workflow);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n  }\n  // Surface a failure to the caller (an ingest answers 500) once every start had its chance\n  if (failures.length > 0) throw failures[0];\n  return started;\n}\n\nexport interface SweepResult {\n  users: number;\n  /** Journeys the segments' entries started. */\n  started: string[];\n  /** Each deployed segment's size after the sweep (empty when the store keeps no reporting). */\n  sizes: { segment: string; size: number }[];\n}\n\n/**\n * The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a\n * journey's conditions run on, so a member is exactly who a journey would see in it. Membership\n * follows (joiners keep the time they joined, leavers are removed), segment triggers start the\n * journeys of whoever entered by the clock alone, and the store records each segment's size.\n * It walks users one by one: fine for thousands, a large audience wants SQL-side evaluation.\n */\nexport async function sweepSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<SweepResult> {\n  // Erasures left unfinished (an instance would not stop) first: their users are not evaluated\n  const erasing = new Set<string>();\n  for (const userId of await store.pendingErasures()) {\n    try {\n      const { erased } = await eraseUser(env, userId, store);\n      if (!erased) erasing.add(userId);\n    } catch (error) {\n      // Still pending: the next sweep tries again, and the rest of this one goes on\n      erasing.add(userId);\n      console.error(`[workflow] erasure of ${userId} failed`, error);\n    }\n  }\n  const segments = (await store.listSegments()).map((segment) => segment.id);\n  const routes = await store.listSegmentTriggers();\n  const users = (await store.listUserIds()).filter((userId) => !erasing.has(userId));\n  const started: string[] = [];\n  const definitions = new Map<string, ConditionIR | undefined>();\n  for (const userId of users) {\n    try {\n      started.push(\n        ...(await refreshSegments(env, store, userId, now, routes, segments, definitions))\n      );\n    } catch (error) {\n      // One user's failed start is kept for the next sweep; it must not stop everyone else's\n      console.error(`[workflow] segment refresh for ${userId} failed`, error);\n    }\n  }\n  const sizes = (await store.reporting?.snapshotSegments(now)) ?? [];\n  return { users: users.length, started, sizes };\n}\n\n/**\n * Create one journey instance behind the entry ledger. Returns null when the\n * once-policy blocks the entry (the store's attempt is atomic, so concurrent\n * ingests cannot double-enter). A pair whose previous instance is recorded as\n * 'failed' is reclaimed rather than barred forever over one outage.\n */\nasync function startJourney(\n  env: JourneyEnv,\n  store: JourneyStore,\n  workflow: string,\n  hash: string,\n  userId: string,\n  ts: number,\n  trigger: { event: string; payload: Record<string, unknown> }\n): Promise<string | null> {\n  const instanceId = buildInstanceId(workflow, hash, userId, ts);\n  const params: JourneyParams = { workflowId: workflow, contentHash: hash, userId, trigger };\n\n  const outcome = await store.enterJourney({ workflow, userId, instanceId, hash, ts });\n  if (outcome === null) return null; // already entered, and still alive\n\n  try {\n    await env.JOURNEY.create({ id: instanceId, params });\n  } catch (error) {\n    if (outcome === 'reclaimed') {\n      // Put the corpse back rather than deleting it: the entry is still a\n      // failure, and dropping the row would erase that from the ledger.\n      await store.setEntryStatus(instanceId, 'failed');\n    } else {\n      // Roll the ledger back so a retried ingest can enter — otherwise the\n      // once-policy would permanently record an entry that never ran.\n      await store.removeEntry(instanceId);\n    }\n    throw error;\n  }\n  return instanceId;\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * Instance id: addressable (the router gets it directly to wake it), ≤100\n * chars, legal charset. The murmur3 fingerprint keeps ids distinct when the\n * sanitized/truncated userId alone would collide.\n */\nfunction buildInstanceId(workflow: string, hash: string, userId: string, ts: number): string {\n  const uid = userId.replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 24);\n  const fingerprint = murmur3(utf8.encode(userId)).toString(36);\n  return `${workflow.slice(0, 32)}-${hash.slice(0, 8)}-${uid}-${fingerprint}-${ts.toString(36)}`;\n}\n\n/* --------------------------------- identify --------------------------------- */\n\nexport interface IdentifyResult {\n  ok: true;\n  props: ProfileProps;\n  woke: number;\n  started: string[];\n}\n\n/**\n * Merge-patch profile properties (a null removes one), then wake property waits\n * and re-evaluate segment triggers. The merge is one statement in the store, so\n * two identifies landing together cannot lose each other's fields.\n */\nexport async function identifyUser(\n  env: JourneyEnv,\n  userId: string,\n  props: ProfileProps,\n  store: JourneyStore = d1Store(env)\n): Promise<IdentifyResult> {\n  const ts = Date.now();\n  const merged = await store.mergeProfile(userId, props);\n  // Property-condition waits subscribe to this reserved event (see relevantEvents)\n  const woke = await wakeSubscribers(env, store, userId, PROFILE_UPDATED_EVENT);\n  // A profile change can move the user into (or out of) a trigger-routed segment\n  const started = await refreshSegmentTriggers(env, store, userId, ts);\n  return { ok: true, props: merged, woke, started };\n}\n\nexport interface DeviceRegistration {\n  userId: string;\n  token: string;\n  platform: string;\n  ts?: number;\n}\n\n/**\n * A push token registered for the user (or moved to them from another account: a token belongs\n * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside\n * `waitUntil`), for the new owner and the previous one.\n */\nexport async function registerDevice(\n  env: JourneyEnv,\n  device: DeviceRegistration,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const previous = await store.removeDevice(device.token);\n  await store.upsertDevice({ ...device, ts: device.ts ?? Date.now() });\n  let woke = await wakeSubscribers(env, store, device.userId, DEVICES_UPDATED_EVENT);\n  if (previous !== undefined && previous !== device.userId) {\n    woke += await wakeSubscribers(env, store, previous, DEVICES_UPDATED_EVENT);\n  }\n  return { ok: true, woke };\n}\n\n/**\n * A deleted account: everything the engine keeps about the user is erased and the journeys still\n * running for them are terminated, so nothing more is sent. Idempotent.\n */\n/** Workflow instance states that will never run another step. */\nconst STOPPED_STATUSES = new Set(['complete', 'errored', 'terminated']);\n\n/**\n * Stop one instance for good; true once it is known not to run again. An instance the platform\n * no longer knows, or one already finished (terminate refuses those), counts as stopped. Any other\n * failure is not taken for \"already gone\": it answers false, and the erasure waits for a retry.\n */\nasync function stopInstance(env: JourneyEnv, instanceId: string): Promise<boolean> {\n  let instance: WorkflowInstanceLike;\n  try {\n    instance = await env.JOURNEY.get(instanceId);\n  } catch (error) {\n    if (/not[_ ]found/i.test(String(error))) return true;\n    console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);\n    return false;\n  }\n  if (instance.terminate === undefined) return false;\n  try {\n    await instance.terminate();\n    return true;\n  } catch (error) {\n    const status = await instance.status?.().catch(() => undefined);\n    if (status !== undefined && STOPPED_STATUSES.has(status.status)) return true;\n    console.warn(`[workflow] terminating ${instanceId} failed`, error);\n    return false;\n  }\n}\n\n/**\n * Carry out a recorded erasure: stop every running instance of the user, and only once all have\n * stopped erase their data (the request with it). Stopping first means no step can write rows\n * back after the erase; erasing nothing until then keeps the entries that name the instances\n * still to stop, so a retry can finish the job.\n */\nasync function eraseUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore\n): Promise<{ erased: boolean; pending: string[] }> {\n  const pending: string[] = [];\n  for (const instanceId of await store.runningInstances(userId)) {\n    if (!(await stopInstance(env, instanceId))) pending.push(instanceId);\n  }\n  if (pending.length > 0) return { erased: false, pending };\n  await store.forgetUser(userId);\n  return { erased: true, pending };\n}\n\n/**\n * Forget a user (a deleted account): the request is recorded first, then carried out. An\n * instance that will not stop leaves it pending — nothing erased yet — and the scheduled sweep\n * retries it; `erased: false` says so.\n */\nexport async function forgetUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore = d1Store(env),\n  now = Date.now()\n): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n  await store.requestErasure(userId, now);\n  return { ok: true, ...(await eraseUser(env, userId, store)) };\n}\n\n/**\n * The user signed out on the device: the token stays registered, bound to nobody, so the next\n * sign-in only has to bind it again. Wakes the former owner's device waits (`reachable('push')`\n * may no longer hold).\n */\nexport async function unbindDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.unbindDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT);\n  return { ok: true, woke };\n}\n\n/** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */\nexport async function removeDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.removeDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT);\n  return { ok: true, woke };\n}\n\n/* ---------------------------------- deploy ---------------------------------- */\n\nexport interface DeployResult {\n  workflows: string[];\n  /**\n   * Workflows whose trigger type has no runtime routing yet — they deploy (the\n   * IR is stored and versioned) but will never start until the routing lands.\n   * Currently: date (TODO — needs cron + Queues, instance creation is\n   * rate-limited and a date trigger fans out to the whole audience at once)\n   * and webhook (TODO — needs endpoint allocation).\n   */\n  unrouted: { workflow: string; trigger: TriggerIR['type'] }[];\n}\n\n/** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */\nexport class BundleIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'BundleIntegrityError';\n  }\n}\n\n/**\n * Recompute every declared contentHash and refuse the bundle if one disagrees.\n *\n * The contentHash is the address an in-flight journey reads its IR from, so\n * a hash that does not describe its own content is a way to change what a\n * pinned instance executes: submit an edited flow under the old hash and the\n * next replay picks it up. The compiler always computes the hash it ships, so\n * a mismatch means a hand-rolled payload or a stale client — neither should be\n * able to overwrite a version that journeys are running.\n *\n * Each hash is recomputed exactly the way its compiler produced it: a workflow\n * hashes its whole IR (contentHash strips itself), a segment hashes only its\n * condition. Mirroring them is load-bearing — recomputing a segment over the\n * whole record would reject every honest deploy.\n */\nfunction verifyBundleHashes(parsed: BundleIR): void {\n  const mismatched: string[] = [];\n  for (const workflow of parsed.workflows) {\n    if (semanticHash(workflow) !== workflow.contentHash) {\n      mismatched.push(`workflow '${workflow.id}'`);\n    }\n  }\n  for (const segment of parsed.segments) {\n    if (semanticHash(segment.condition) !== segment.contentHash) {\n      mismatched.push(`segment '${segment.id}'`);\n    }\n  }\n  if (mismatched.length > 0) {\n    throw new BundleIntegrityError(\n      `contentHash does not match content for ${mismatched.join(', ')} — recompile the bundle instead of editing it by hand`\n    );\n  }\n}\n\n/** Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed deploy leaves only harmless orphans), then the routing swap. */\nexport async function deployBundle(\n  env: JourneyEnv,\n  bundle: unknown,\n  store: JourneyStore = d1Store(env)\n): Promise<DeployResult> {\n  const parsed = BundleIR.parse(bundle);\n  // Before any write: a bad hash must not reach the store, where it would address content it does not describe\n  verifyBundleHashes(parsed);\n  // Nor a bundle the database cannot hold: the host migrates, the engine only checks\n  const problems = (await store.checkSchema?.()) ?? [];\n  if (problems.length > 0) throw new SchemaMismatchError(problems);\n\n  for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);\n  await store.replaceRoutes(parsed);\n\n  const unrouted = parsed.workflows\n    .filter((workflow) => workflow.trigger.type === 'date' || workflow.trigger.type === 'webhook')\n    .map((workflow) => ({ workflow: workflow.id, trigger: workflow.trigger.type }));\n\n  return {\n    workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),\n    unrouted,\n  };\n}\n\n/* ----------------------------------- http ----------------------------------- */\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body: unknown = await request.json();\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\nexport async function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore = d1Store(env),\n  validation: IngestValidation = {}\n): Promise<Response> {\n  const url = new URL(request.url);\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n  const { contract } = validation;\n  const enforce = validation.mode !== 'report';\n  /** The contract's verdict: the value to use, or the response refusing the request. */\n  const checked = <T>(\n    result: ContractResult<T>,\n    original: T,\n    what: string\n  ): { value: T } | { refused: Response } => {\n    if (result.ok) return { value: result.data };\n    const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n    if (!enforce) {\n      console.warn(`[workflow router] contract would refuse ${what}: ${issues.join('; ')}`);\n      return { value: original };\n    }\n    return {\n      refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n    };\n  };\n\n  if (request.method === 'GET' && url.pathname === '/health') {\n    return json({ ok: true });\n  }\n\n  // Bearer auth on everything mutating. An unset token means an open dev\n  // instance (see JourneyEnv.API_TOKEN) — production must configure it.\n  if (env.API_TOKEN !== undefined) {\n    if (request.headers.get('authorization') !== `Bearer ${env.API_TOKEN}`) {\n      return json({ error: 'unauthorized' }, 401);\n    }\n  }\n\n  try {\n    if (request.method === 'POST' && url.pathname === '/events') {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && typeof ts !== 'number') {\n        return json({ error: 'ts must be a number' }, 400);\n      }\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (contract !== undefined) {\n        const verdict = checked(\n          checkEvent(contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/identify') {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      let patch = props as ProfileProps;\n      if (contract !== undefined) {\n        const verdict = checked(contract.parseProfilePatch(props), patch, 'identify');\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices') {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && typeof ts !== 'number')\n        return json({ error: 'ts must be a number' }, 400);\n      return json(\n        await registerDevice(\n          env,\n          { userId, token, platform, ...(ts === undefined ? {} : { ts }) },\n          store\n        )\n      );\n    }\n\n    if (request.method === 'POST' && url.pathname === '/messages/opened') {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded =\n        store.reporting !== undefined && (await recordPushOpen(store.reporting, userId, messageId));\n      return json({ ok: true, recorded });\n    }\n\n    if (request.method === 'POST' && url.pathname === '/users/forget') {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices/unbind') {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices/remove') {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/deploy') {\n      return json(await deployBundle(env, await request.json(), store));\n    }\n\n    return json({ error: 'not found' }, 404);\n  } catch (error) {\n    // Validation problems are the caller's to fix; anything else stays out of\n    // the response body (internals are logged, not leaked).\n    if (error instanceof z.core.$ZodError) {\n      return json({ error: `invalid payload: ${error.message}` }, 400);\n    }\n    // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n    if (error instanceof BundleIntegrityError) {\n      return json({ error: error.message }, 400);\n    }\n    // The operator's to fix (run the migrations), so the response says what is missing\n    if (error instanceof SchemaMismatchError) {\n      return json({ error: error.message, problems: error.problems }, 503);\n    }\n    console.error('[workflow router]', error);\n    return json({ error: 'internal error' }, 500);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAsEA,eAAsB,YACpB,KACA,OACA,QAAsBA,0BAAAA,QAAQ,GAAG,GACV;CACvB,IAAI,MAAM,MAAM,WAAW,GAAG,GAC5B,MAAM,IAAI,MAAM,eAAe,MAAM,MAAM,uCAAuC;CAEpF,MAAM,KAAK,MAAM,MAAM,KAAK,IAAI;CAChC,MAAM,UAAU,MAAM,WAAW,CAAC;CAIlC,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW;CAEzC,MAAM,SAAS,MAAM,MAAM,YAAY;EACrC;EACA,QAAQ,MAAM;EACd,OAAO,MAAM;EACb;EACA;CACF,CAAC;CASD,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,MAAM,KAAK;CACxE,MAAM,UAAU,MAAM,uBAAuB,KAAK,OAAO;EAAE,GAAG;EAAO;CAAQ,GAAG,EAAE;CAClF,QAAQ,KAAK,GAAI,MAAM,uBAAuB,KAAK,OAAO,MAAM,QAAQ,EAAE,CAAE;CAC5E,OAAO;EAAE;EAAI;EAAQ;EAAM;CAAQ;AACrC;AAEA,eAAe,gBACb,KACA,OACA,QACA,OACiB;CACjB,IAAI,OAAO;CACX,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,QAAQ,KAAK,GAAG;EAC/D,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,IAAI,QAAQ,IAAI,MAAM;EACzC,QAAQ;GAEN,MAAM,MAAM,YAAY,MAAM;GAC9B;EACF;EACA,IAAI;GACF,MAAM,SAAS,UAAU;IAAE,MAAMC,4BAAAA;IAAiB,SAAS,EAAE,MAAM;GAAE,CAAC;GACtE;EACF,QAAQ,CAIR;CACF;CACA,OAAO;AACT;AAEA,eAAe,uBACb,KACA,OACA,OACA,IACmB;CACnB,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,MAAM,MAAM,aAAa,MAAM,KAAK,GAAG;EAEzD,IAAI,MAAM,UAAU,QAAQ,CAACC,yBAAAA,aAAa,MAAM,SAAS,MAAM,KAAK,GAAG;EAGvE,IAAI,MAAM,WAAW,MAAM;GACzB,MAAM,QAAQ,IAAIC,oBAAAA,kBAAkB,OAAO,MAAM,MAAM;GACvD,IAAI,CAAE,MAAMC,yBAAAA,kBAAkB,MAAM,QAAQ,OAAO,EAAE,GAAI;EAC3D;EAEA,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,MAAM,QACN,IACA;GACE,OAAO,MAAM;GACb,SAAS,MAAM;EACjB,CACF;EACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;CAClD;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,uBACpB,KACA,OACA,QACA,IACmB;CACnB,OAAO,gBAAgB,KAAK,OAAO,QAAQ,IAAI,MAAM,MAAM,oBAAoB,CAAC;AAClF;;;;;;;AAQA,eAAe,gBACb,KACA,OACA,QACA,IACA,QACA,WAA8B,CAAC,GAE/B,8BAAc,IAAI,IAAqC,GACpC;CACnB,MAAM,YAAY,IAAI,IACpB,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CACnC;CACA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OAAO,UAAU,IAAI,MAAM,OAAO,KAAK,CAAC;EAC9C,KAAK,KAAK;GAAE,UAAU,MAAM;GAAU,MAAM,MAAM;EAAK,CAAC;EACxD,UAAU,IAAI,MAAM,SAAS,IAAI;CACnC;CACA,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,IAAID,oBAAAA,kBAAkB,OAAO,MAAM;CACjD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,WAAW,kBAAkB,WAAW;EAClD,IAAI,CAAC,YAAY,IAAI,SAAS,GAC5B,YAAY,IAAI,WAAW,MAAM,MAAM,oBAAoB,SAAS,CAAC;EAEvE,MAAM,aAAa,YAAY,IAAI,SAAS;EAC5C,IAAI,eAAe,KAAA,GAAW;EAE9B,MAAM,UAAU,MAAMC,yBAAAA,kBAAkB,YAAY,OAAO,EAAE;EAC7D,MAAM,SAAS,MAAM,MAAM,gBAAgB,WAAW,MAAM;EAE5D,IAAI,WAAW,CAAC,QAEd,MAAM,MAAM,iBACV,WACA,QACA,IACA,cAAc,KAAK,UAAU,MAAM,QAAQ,CAC7C;OACK,IAAI,CAAC,WAAW,QAAQ;GAC7B,MAAM,MAAM,oBAAoB,WAAW,MAAM;GACjD;EACF;EACA,IAAI,CAAC,SAAS;EAKd,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,qBAAqB,WAAW,MAAM,CAAC;EAC3E,KAAK,MAAM,SAAS,eAAe;GACjC,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG;GAClC,IAAI;IACF,MAAM,aAAa,MAAM,aAAa,KAAK,OAAO,MAAM,UAAU,MAAM,MAAM,QAAQ,IAAI;KACxF,OAAO;KACP,SAAS,EAAE,SAAS,UAAU;IAChC,CAAC;IACD,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;IAChD,MAAM,MAAM,qBAAqB,WAAW,QAAQ,MAAM,QAAQ;GACpE,SAAS,OAAO;IACd,SAAS,KAAK,KAAK;GACrB;EACF;CACF;CAEA,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CACxC,OAAO;AACT;;;;;;;;AAiBA,eAAsB,cACpB,KACA,OACA,MAAM,KAAK,IAAI,GACO;CAEtB,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,GAC/C,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,UAAU,KAAK,QAAQ,KAAK;EACrD,IAAI,CAAC,QAAQ,QAAQ,IAAI,MAAM;CACjC,SAAS,OAAO;EAEd,QAAQ,IAAI,MAAM;EAClB,QAAQ,MAAM,yBAAyB,OAAO,UAAU,KAAK;CAC/D;CAEF,MAAM,YAAY,MAAM,MAAM,aAAa,EAAA,CAAG,KAAK,YAAY,QAAQ,EAAE;CACzE,MAAM,SAAS,MAAM,MAAM,oBAAoB;CAC/C,MAAM,SAAS,MAAM,MAAM,YAAY,EAAA,CAAG,QAAQ,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC;CACjF,MAAM,UAAoB,CAAC;CAC3B,MAAM,8BAAc,IAAI,IAAqC;CAC7D,KAAK,MAAM,UAAU,OACnB,IAAI;EACF,QAAQ,KACN,GAAI,MAAM,gBAAgB,KAAK,OAAO,QAAQ,KAAK,QAAQ,UAAU,WAAW,CAClF;CACF,SAAS,OAAO;EAEd,QAAQ,MAAM,kCAAkC,OAAO,UAAU,KAAK;CACxE;CAEF,MAAM,QAAS,MAAM,MAAM,WAAW,iBAAiB,GAAG,KAAM,CAAC;CACjE,OAAO;EAAE,OAAO,MAAM;EAAQ;EAAS;CAAM;AAC/C;;;;;;;AAQA,eAAe,aACb,KACA,OACA,UACA,MACA,QACA,IACA,SACwB;CACxB,MAAM,aAAa,gBAAgB,UAAU,MAAM,QAAQ,EAAE;CAC7D,MAAM,SAAwB;EAAE,YAAY;EAAU,aAAa;EAAM;EAAQ;CAAQ;CAEzF,MAAM,UAAU,MAAM,MAAM,aAAa;EAAE;EAAU;EAAQ;EAAY;EAAM;CAAG,CAAC;CACnF,IAAI,YAAY,MAAM,OAAO;CAE7B,IAAI;EACF,MAAM,IAAI,QAAQ,OAAO;GAAE,IAAI;GAAY;EAAO,CAAC;CACrD,SAAS,OAAO;EACd,IAAI,YAAY,aAGd,MAAM,MAAM,eAAe,YAAY,QAAQ;OAI/C,MAAM,MAAM,YAAY,UAAU;EAEpC,MAAM;CACR;CACA,OAAO;AACT;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAS,gBAAgB,UAAkB,MAAc,QAAgB,IAAoB;CAC3F,MAAM,MAAM,OAAO,QAAQ,mBAAmB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAC9D,MAAM,cAAcC,sBAAAA,QAAQ,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE;CAC5D,OAAO,GAAG,SAAS,MAAM,GAAG,EAAE,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,YAAY,GAAG,GAAG,SAAS,EAAE;AAC7F;;;;;;AAgBA,eAAsB,aACpB,KACA,QACA,OACA,QAAsBL,0BAAAA,QAAQ,GAAG,GACR;CACzB,MAAM,KAAK,KAAK,IAAI;CAMpB,OAAO;EAAE,IAAI;EAAM,OAAO,MALL,MAAM,aAAa,QAAQ,KAAK;EAKnB,MAAA,MAHf,gBAAgB,KAAK,OAAO,QAAQM,yBAAAA,qBAAqB;EAGpC,SAAA,MADlB,uBAAuB,KAAK,OAAO,QAAQ,EAAE;CACnB;AAClD;;;;;;AAcA,eAAsB,eACpB,KACA,QACA,QAAsBN,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,WAAW,MAAM,MAAM,aAAa,OAAO,KAAK;CACtD,MAAM,MAAM,aAAa;EAAE,GAAG;EAAQ,IAAI,OAAO,MAAM,KAAK,IAAI;CAAE,CAAC;CACnE,IAAI,OAAO,MAAM,gBAAgB,KAAK,OAAO,OAAO,QAAQO,yBAAAA,qBAAqB;CACjF,IAAI,aAAa,KAAA,KAAa,aAAa,OAAO,QAChD,QAAQ,MAAM,gBAAgB,KAAK,OAAO,UAAUA,yBAAAA,qBAAqB;CAE3E,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;;;;;AAOA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAY;CAAW;AAAY,CAAC;;;;;;AAOtE,eAAe,aAAa,KAAiB,YAAsC;CACjF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,IAAI,QAAQ,IAAI,UAAU;CAC7C,SAAS,OAAO;EACd,IAAI,gBAAgB,KAAK,OAAO,KAAK,CAAC,GAAG,OAAO;EAChD,QAAQ,KAAK,yBAAyB,WAAW,qBAAqB,KAAK;EAC3E,OAAO;CACT;CACA,IAAI,SAAS,cAAc,KAAA,GAAW,OAAO;CAC7C,IAAI;EACF,MAAM,SAAS,UAAU;EACzB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9D,IAAI,WAAW,KAAA,KAAa,iBAAiB,IAAI,OAAO,MAAM,GAAG,OAAO;EACxE,QAAQ,KAAK,0BAA0B,WAAW,UAAU,KAAK;EACjE,OAAO;CACT;AACF;;;;;;;AAQA,eAAe,UACb,KACA,QACA,OACiD;CACjD,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,cAAc,MAAM,MAAM,iBAAiB,MAAM,GAC1D,IAAI,CAAE,MAAM,aAAa,KAAK,UAAU,GAAI,QAAQ,KAAK,UAAU;CAErE,IAAI,QAAQ,SAAS,GAAG,OAAO;EAAE,QAAQ;EAAO;CAAQ;CACxD,MAAM,MAAM,WAAW,MAAM;CAC7B,OAAO;EAAE,QAAQ;EAAM;CAAQ;AACjC;;;;;;AAOA,eAAsB,WACpB,KACA,QACA,QAAsBP,0BAAAA,QAAQ,GAAG,GACjC,MAAM,KAAK,IAAI,GAC4C;CAC3D,MAAM,MAAM,eAAe,QAAQ,GAAG;CACtC,OAAO;EAAE,IAAI;EAAM,GAAI,MAAM,UAAU,KAAK,QAAQ,KAAK;CAAG;AAC9D;;;;;;AAOA,eAAsB,aACpB,KACA,OACA,QAAsBA,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAOO,yBAAAA,qBAAqB;CAClE;AAC1B;;AAGA,eAAsB,aACpB,KACA,OACA,QAAsBP,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAOO,yBAAAA,qBAAqB;CAClE;AAC1B;;AAiBA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,mBAAmB,QAAwB;CAClD,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,YAAY,OAAO,WAC5B,IAAIC,aAAAA,aAAa,QAAQ,MAAM,SAAS,aACtC,WAAW,KAAK,aAAa,SAAS,GAAG,EAAE;CAG/C,KAAK,MAAM,WAAW,OAAO,UAC3B,IAAIA,aAAAA,aAAa,QAAQ,SAAS,MAAM,QAAQ,aAC9C,WAAW,KAAK,YAAY,QAAQ,GAAG,EAAE;CAG7C,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,qBACR,0CAA0C,WAAW,KAAK,IAAI,EAAE,sDAClE;AAEJ;;AAGA,eAAsB,aACpB,KACA,QACA,QAAsBR,0BAAAA,QAAQ,GAAG,GACV;CACvB,MAAM,SAASS,WAAAA,SAAS,MAAM,MAAM;CAEpC,mBAAmB,MAAM;CAEzB,MAAM,WAAY,MAAM,MAAM,cAAc,KAAM,CAAC;CACnD,IAAI,SAAS,SAAS,GAAG,MAAM,IAAIC,oBAAAA,oBAAoB,QAAQ;CAE/D,KAAK,MAAM,YAAY,OAAO,WAAW,MAAM,MAAM,cAAc,QAAQ;CAC3E,MAAM,MAAM,cAAc,MAAM;CAEhC,MAAM,WAAW,OAAO,UACrB,QAAQ,aAAa,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ,SAAS,SAAS,CAAC,CAC7F,KAAK,cAAc;EAAE,UAAU,SAAS;EAAI,SAAS,SAAS,QAAQ;CAAK,EAAE;CAEhF,OAAO;EACL,WAAW,OAAO,UAAU,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,GAAG;EAC7E;CACF;AACF;;;;;;AASA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAgB,MAAM,QAAQ,KAAK;CACzC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAaA,eAAsB,cACpB,SACA,KACA,QAAsBV,0BAAAA,QAAQ,GAAG,GACjC,aAA+B,CAAC,GACb;CACnB,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CACH,MAAM,EAAE,aAAa;CACrB,MAAM,UAAU,WAAW,SAAS;;CAEpC,MAAM,WACJ,QACA,UACA,SACyC;EACzC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;EAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;EAC7E,IAAI,CAAC,SAAS;GACZ,QAAQ,KAAK,2CAA2C,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;GACpF,OAAO,EAAE,OAAO,SAAS;EAC3B;EACA,OAAO,EACL,SAAS,KAAK;GAAE,OAAO,GAAG,KAAK;GAA2B,QAAQ,OAAO;EAAO,GAAG,GAAG,EACxF;CACF;CAEA,IAAI,QAAQ,WAAW,SAAS,IAAI,aAAa,WAC/C,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC;CAK1B,IAAI,IAAI,cAAc,KAAA,GAChB;MAAA,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI,aACzD,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CAAA;CAI9C,IAAI;EACF,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,WAAW;GAC3D,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,OAAO,OAAO,UACpC,OAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GAEnD,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,UAAU,QACdW,iBAAAA,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACzC,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAM,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,aAAa;GAC7D,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAChF,IAAI,QAAQ;GACZ,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,GAAG,OAAO,UAAU;IAC5E,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAM,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,YAAY;GAC5D,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,OAAO,OAAO,UACpC,OAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GACnD,OAAO,KACL,MAAM,eACJ,KACA;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG,GAC/D,KACF,CACF;EACF;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,oBAAoB;GACpE,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAGlF,OAAO,KAAK;IAAE,IAAI;IAAM,UADtB,MAAM,cAAc,KAAA,KAAc,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GAC1D,CAAC;EACpC;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,iBAAiB;GACjE,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAM,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,mBAAmB;GACnE,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,mBAAmB;GACnE,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,WAChD,OAAO,KAAK,MAAM,aAAa,KAAK,MAAM,QAAQ,KAAK,GAAG,KAAK,CAAC;EAGlE,OAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;CACzC,SAAS,OAAO;EAGd,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;EAGjE,IAAI,iBAAiB,sBACnB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;EAG3C,IAAI,iBAAiBH,oBAAAA,qBACnB,OAAO,KAAK;GAAE,OAAO,MAAM;GAAS,UAAU,MAAM;EAAS,GAAG,GAAG;EAErE,QAAQ,MAAM,qBAAqB,KAAK;EACxC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAC9C;AACF"}