@shware/workflow 0.1.0 → 0.3.0

package/dist/cloudflare/bindings.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.cjs","names":[],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../config';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\nexport interface KVNamespaceLike {\n  get(key: string): Promise<string | null>;\n  put(key: string, value: string): Promise<void>;\n}\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\nexport interface WorkflowInstanceLike {\n  id: string;\n  sendEvent(event: { type: string; payload?: unknown }): Promise<void>;\n  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */\n  terminate?(): Promise<void>;\n  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */\n  status?(): Promise<{ status: string }>;\n}\n\nexport interface WorkflowBindingLike {\n  create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike>;\n  get(id: string): Promise<WorkflowInstanceLike>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Every binding the journey engine needs (names match the wrangler config). */\nexport interface JourneyEnv {\n  /**\n   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:\n   * a Worker on another JourneyStore (Postgres, say) does not declare it.\n   */\n  WORKFLOW_KV?: KVNamespaceLike;\n  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */\n  DB?: D1DatabaseLike;\n  /** JourneyRunner's workflow binding (creating instances and waking them). */\n  JOURNEY: WorkflowBindingLike;\n  /** Optional message-delivery webhook (defaults to the console logging sender). */\n  MESSAGE_WEBHOOK_URL?: string;\n  /**\n   * Bearer token required on every mutating HTTP endpoint (`Authorization:\n   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in\n   * particular rewrites the whole routing table, so production must set this.\n   */\n  API_TOKEN?: string;\n  /**\n   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'\n   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.\n   */\n  WORKFLOW_ORIGIN?: string;\n  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */\n  ENVIRONMENT?: string;\n  /** Cloudflare Email Sending, when the config has `emails`. */\n  EMAIL?: EmailBindingLike;\n  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */\n  APNS_PRIVATE_KEY_BASE64?: string;\n  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */\n  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;\n  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */\n  VAPID_PUBLIC_KEY?: string;\n  VAPID_PRIVATE_KEY?: string;\n  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */\n  APNS_RELAY_ORIGIN?: string;\n}\n\n/** The event type the router uses to wake waiting instances (sendEvent's `type`). */\nexport const WAKE_EVENT_TYPE = 'wake';\n\n/** Journey instance parameters, passed by the ingest router when it creates one. */\nexport interface JourneyParams {\n  workflowId: string;\n  /** The IR version pinned at entry. */\n  contentHash: string;\n  userId: string;\n  trigger: { event: string; payload: Record<string, unknown> };\n  [key: string]: unknown;\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. The\n * adapter used to read them all as timeouts, which made an infrastructure\n * fault indistinguishable from \"the user never did it\": the journey took its\n * onTimeout branch, early and silently. Only the clock can tell them apart.\n */\nexport function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean {\n  return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);\n}\n"],"mappings":";;;AA8GA,MAAa,kBAAkB;;;;;;AAiB/B,MAAa,4BAA4B;;;;;;;;;;AAWzC,SAAgB,YAAY,WAAmB,WAAmB,KAAsB;CACtF,OAAO,MAAM,aAAa,KAAK,IAAI,GAAG,YAAY,yBAAyB;AAC7E"}
+{"version":3,"file":"bindings.cjs","names":[],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../config';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\nexport interface KVNamespaceLike {\n  get(key: string): Promise<string | null>;\n  put(key: string, value: string): Promise<void>;\n}\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\nexport interface WorkflowInstanceLike {\n  id: string;\n  sendEvent(event: { type: string; payload?: unknown }): Promise<void>;\n  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */\n  terminate?(): Promise<void>;\n  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */\n  status?(): Promise<{ status: string }>;\n}\n\nexport interface WorkflowBindingLike {\n  create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike>;\n  get(id: string): Promise<WorkflowInstanceLike>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Every binding the journey engine needs (names match the wrangler config). */\nexport interface JourneyEnv {\n  /**\n   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:\n   * a Worker on another JourneyStore (Postgres, say) does not declare it.\n   */\n  WORKFLOW_KV?: KVNamespaceLike;\n  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */\n  DB?: D1DatabaseLike;\n  /** JourneyRunner's workflow binding (creating instances and waking them). */\n  JOURNEY: WorkflowBindingLike;\n  /** Optional message-delivery webhook (defaults to the console logging sender). */\n  MESSAGE_WEBHOOK_URL?: string;\n  /**\n   * Bearer token required on every mutating HTTP endpoint (`Authorization:\n   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in\n   * particular rewrites the whole routing table, so production must set this.\n   */\n  API_TOKEN?: string;\n  /**\n   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'\n   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.\n   */\n  WORKFLOW_ORIGIN?: string;\n  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */\n  ENVIRONMENT?: string;\n  /** Cloudflare Email Sending, when the config has `emails`. */\n  EMAIL?: EmailBindingLike;\n  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */\n  APNS_PRIVATE_KEY_BASE64?: string;\n  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */\n  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;\n  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */\n  VAPID_PUBLIC_KEY?: string;\n  VAPID_PRIVATE_KEY?: string;\n  /**\n   * Cloudflare's version metadata binding (wrangler `\"version_metadata\": { \"binding\":\n   * \"CF_VERSION_METADATA\" }`). With it, and a store that records the live version (Postgres),\n   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler\n   * deploy` is the whole deploy.\n   */\n  CF_VERSION_METADATA?: { id: string; tag?: string; timestamp: string };\n  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */\n  APNS_RELAY_ORIGIN?: string;\n}\n\n/** The event type the router uses to wake waiting instances (sendEvent's `type`). */\nexport const WAKE_EVENT_TYPE = 'wake';\n\n/** Journey instance parameters, passed by the ingest router when it creates one. */\nexport interface JourneyParams {\n  workflowId: string;\n  /** The IR version pinned at entry. */\n  contentHash: string;\n  userId: string;\n  trigger: { event: string; payload: Record<string, unknown> };\n  [key: string]: unknown;\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. The\n * adapter used to read them all as timeouts, which made an infrastructure\n * fault indistinguishable from \"the user never did it\": the journey took its\n * onTimeout branch, early and silently. Only the clock can tell them apart.\n */\nexport function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean {\n  return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);\n}\n"],"mappings":";;;AAqHA,MAAa,kBAAkB;;;;;;AAiB/B,MAAa,4BAA4B;;;;;;;;;;AAWzC,SAAgB,YAAY,WAAmB,WAAmB,KAAsB;CACtF,OAAO,MAAM,aAAa,KAAK,IAAI,GAAG,YAAY,yBAAyB;AAC7E"}

package/dist/cloudflare/bindings.d.cts

@@ -107,6 +107,17 @@ export interface JourneyEnv {
   /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */
   VAPID_PUBLIC_KEY?: string;
   VAPID_PRIVATE_KEY?: string;
+  /**
+   * Cloudflare's version metadata binding (wrangler `"version_metadata": { "binding":
+   * "CF_VERSION_METADATA" }`). With it, and a store that records the live version (Postgres),
+   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler
+   * deploy` is the whole deploy.
+   */
+  CF_VERSION_METADATA?: {
+    id: string;
+    tag?: string;
+    timestamp: string;
+  };
   /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */
   APNS_RELAY_ORIGIN?: string;
 }

package/dist/cloudflare/bindings.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.cts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;iBAWiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;iBAGN;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;;;;;;iBAaV;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;EAEA;;;qBAIW;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}
+{"version":3,"file":"bindings.d.cts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;iBAWiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;iBAGN;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;;;;;;iBAaV;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;;;;;;EAOA;IAAwB;IAAY;IAAc;;;EAElD;;;qBAIW;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}

package/dist/cloudflare/bindings.d.mts

@@ -107,6 +107,17 @@ export interface JourneyEnv {
   /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */
   VAPID_PUBLIC_KEY?: string;
   VAPID_PRIVATE_KEY?: string;
+  /**
+   * Cloudflare's version metadata binding (wrangler `"version_metadata": { "binding":
+   * "CF_VERSION_METADATA" }`). With it, and a store that records the live version (Postgres),
+   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler
+   * deploy` is the whole deploy.
+   */
+  CF_VERSION_METADATA?: {
+    id: string;
+    tag?: string;
+    timestamp: string;
+  };
   /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */
   APNS_RELAY_ORIGIN?: string;
 }

package/dist/cloudflare/bindings.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.mts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;iBAWiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;iBAGN;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;;;;;;iBAaV;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;EAEA;;;qBAIW;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}
+{"version":3,"file":"bindings.d.mts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;iBAWiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;iBAGN;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;;;;;;iBAaV;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;;;;;;EAOA;IAAwB;IAAY;IAAc;;;EAElD;;;qBAIW;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}

package/dist/cloudflare/bindings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.mjs","names":[],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../config';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\nexport interface KVNamespaceLike {\n  get(key: string): Promise<string | null>;\n  put(key: string, value: string): Promise<void>;\n}\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\nexport interface WorkflowInstanceLike {\n  id: string;\n  sendEvent(event: { type: string; payload?: unknown }): Promise<void>;\n  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */\n  terminate?(): Promise<void>;\n  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */\n  status?(): Promise<{ status: string }>;\n}\n\nexport interface WorkflowBindingLike {\n  create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike>;\n  get(id: string): Promise<WorkflowInstanceLike>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Every binding the journey engine needs (names match the wrangler config). */\nexport interface JourneyEnv {\n  /**\n   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:\n   * a Worker on another JourneyStore (Postgres, say) does not declare it.\n   */\n  WORKFLOW_KV?: KVNamespaceLike;\n  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */\n  DB?: D1DatabaseLike;\n  /** JourneyRunner's workflow binding (creating instances and waking them). */\n  JOURNEY: WorkflowBindingLike;\n  /** Optional message-delivery webhook (defaults to the console logging sender). */\n  MESSAGE_WEBHOOK_URL?: string;\n  /**\n   * Bearer token required on every mutating HTTP endpoint (`Authorization:\n   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in\n   * particular rewrites the whole routing table, so production must set this.\n   */\n  API_TOKEN?: string;\n  /**\n   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'\n   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.\n   */\n  WORKFLOW_ORIGIN?: string;\n  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */\n  ENVIRONMENT?: string;\n  /** Cloudflare Email Sending, when the config has `emails`. */\n  EMAIL?: EmailBindingLike;\n  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */\n  APNS_PRIVATE_KEY_BASE64?: string;\n  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */\n  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;\n  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */\n  VAPID_PUBLIC_KEY?: string;\n  VAPID_PRIVATE_KEY?: string;\n  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */\n  APNS_RELAY_ORIGIN?: string;\n}\n\n/** The event type the router uses to wake waiting instances (sendEvent's `type`). */\nexport const WAKE_EVENT_TYPE = 'wake';\n\n/** Journey instance parameters, passed by the ingest router when it creates one. */\nexport interface JourneyParams {\n  workflowId: string;\n  /** The IR version pinned at entry. */\n  contentHash: string;\n  userId: string;\n  trigger: { event: string; payload: Record<string, unknown> };\n  [key: string]: unknown;\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. The\n * adapter used to read them all as timeouts, which made an infrastructure\n * fault indistinguishable from \"the user never did it\": the journey took its\n * onTimeout branch, early and silently. Only the clock can tell them apart.\n */\nexport function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean {\n  return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);\n}\n"],"mappings":";;AA8GA,MAAa,kBAAkB;;;;;;AAiB/B,MAAa,4BAA4B;;;;;;;;;;AAWzC,SAAgB,YAAY,WAAmB,WAAmB,KAAsB;CACtF,OAAO,MAAM,aAAa,KAAK,IAAI,GAAG,YAAY,yBAAyB;AAC7E"}
+{"version":3,"file":"bindings.mjs","names":[],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../config';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\nexport interface KVNamespaceLike {\n  get(key: string): Promise<string | null>;\n  put(key: string, value: string): Promise<void>;\n}\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\nexport interface WorkflowInstanceLike {\n  id: string;\n  sendEvent(event: { type: string; payload?: unknown }): Promise<void>;\n  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */\n  terminate?(): Promise<void>;\n  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */\n  status?(): Promise<{ status: string }>;\n}\n\nexport interface WorkflowBindingLike {\n  create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike>;\n  get(id: string): Promise<WorkflowInstanceLike>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Every binding the journey engine needs (names match the wrangler config). */\nexport interface JourneyEnv {\n  /**\n   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:\n   * a Worker on another JourneyStore (Postgres, say) does not declare it.\n   */\n  WORKFLOW_KV?: KVNamespaceLike;\n  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */\n  DB?: D1DatabaseLike;\n  /** JourneyRunner's workflow binding (creating instances and waking them). */\n  JOURNEY: WorkflowBindingLike;\n  /** Optional message-delivery webhook (defaults to the console logging sender). */\n  MESSAGE_WEBHOOK_URL?: string;\n  /**\n   * Bearer token required on every mutating HTTP endpoint (`Authorization:\n   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in\n   * particular rewrites the whole routing table, so production must set this.\n   */\n  API_TOKEN?: string;\n  /**\n   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'\n   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.\n   */\n  WORKFLOW_ORIGIN?: string;\n  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */\n  ENVIRONMENT?: string;\n  /** Cloudflare Email Sending, when the config has `emails`. */\n  EMAIL?: EmailBindingLike;\n  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */\n  APNS_PRIVATE_KEY_BASE64?: string;\n  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */\n  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;\n  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */\n  VAPID_PUBLIC_KEY?: string;\n  VAPID_PRIVATE_KEY?: string;\n  /**\n   * Cloudflare's version metadata binding (wrangler `\"version_metadata\": { \"binding\":\n   * \"CF_VERSION_METADATA\" }`). With it, and a store that records the live version (Postgres),\n   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler\n   * deploy` is the whole deploy.\n   */\n  CF_VERSION_METADATA?: { id: string; tag?: string; timestamp: string };\n  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */\n  APNS_RELAY_ORIGIN?: string;\n}\n\n/** The event type the router uses to wake waiting instances (sendEvent's `type`). */\nexport const WAKE_EVENT_TYPE = 'wake';\n\n/** Journey instance parameters, passed by the ingest router when it creates one. */\nexport interface JourneyParams {\n  workflowId: string;\n  /** The IR version pinned at entry. */\n  contentHash: string;\n  userId: string;\n  trigger: { event: string; payload: Record<string, unknown> };\n  [key: string]: unknown;\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. The\n * adapter used to read them all as timeouts, which made an infrastructure\n * fault indistinguishable from \"the user never did it\": the journey took its\n * onTimeout branch, early and silently. Only the clock can tell them apart.\n */\nexport function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean {\n  return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);\n}\n"],"mappings":";;AAqHA,MAAa,kBAAkB;;;;;;AAiB/B,MAAa,4BAA4B;;;;;;;;;;AAWzC,SAAgB,YAAY,WAAmB,WAAmB,KAAsB;CACtF,OAAO,MAAM,aAAa,KAAK,IAAI,GAAG,YAAY,yBAAyB;AAC7E"}

package/dist/cloudflare/index.cjs

@@ -26,6 +26,7 @@ exports.LogMessageSender = require_cloudflare_senders.LogMessageSender;
 exports.PostgresJourneyStore = require_store_postgres.PostgresJourneyStore;
 exports.PostgresReporting = require_store_postgres_reporting.PostgresReporting;
 exports.SchemaMismatchError = require_store_index.SchemaMismatchError;
+exports.UnversionedStoreError = require_cloudflare_router.UnversionedStoreError;
 exports.WAKE_EVENT_TYPE = require_cloudflare_bindings.WAKE_EVENT_TYPE;
 exports.WAKE_TIMEOUT_TOLERANCE_MS = require_cloudflare_bindings.WAKE_TIMEOUT_TOLERANCE_MS;
 exports.WebhookMessageSender = require_cloudflare_senders.WebhookMessageSender;

package/dist/cloudflare/index.d.cts

@@ -6,9 +6,9 @@ import { JourneyFactSource } from "../store/facts.cjs";
 import { SqlClientLike } from "../store/sql.cjs";
 import { PostgresJourneyStore, PostgresJourneyStoreOptions } from "../store/postgres.cjs";
 import { PostgresReporting } from "../store/postgres-reporting.cjs";
-import { Engagement, EntryInput, EntryOutcome, EventInput, JourneyReporting, JourneyStore, MessageRecord, ProfileProps, SchemaMismatchError, SegmentTriggerRoute, StoreLease, TriggerRoute } from "../store/index.cjs";
+import { BundleVersion, Engagement, EntryInput, EntryOutcome, EventInput, JourneyReporting, JourneyStore, MessageRecord, ProfileProps, SchemaMismatchError, SegmentTriggerRoute, StoreLease, TriggerRoute } from "../store/index.cjs";
 import { d1Store } from "./d1-env.cjs";
-import { BundleIntegrityError, DeployResult, DeviceRegistration, IdentifyResult, IngestInput, IngestResult, SweepResult, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.cjs";
+import { BundleIntegrityError, DeployResult, DeviceRegistration, IdentifyResult, IngestInput, IngestResult, SweepResult, UnversionedStoreError, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.cjs";
 import { JourneyRunner } from "./runner.cjs";
 import { CfEmailOptions, CfEmailSender, EmailRenderer, LogMessageSender, WebhookMessageSender, routeByChannel, routeByPlatform, trackEmail } from "./senders.cjs";
 import { ChannelsConfig, channelsFromConfig, journeyMode, runtimeFromConfig } from "./channels.cjs";
@@ -16,4 +16,4 @@ import { reportingObserver } from "../reporting/observer.cjs";
 import { TrackingOptions, handleTracking, recordPushOpen } from "../reporting/tracking.cjs";
 import { BURST_WINDOW_MS, ClassifyOptions, ClickFacts, DEFAULT_QUICK_MS, RequestFacts, Verdict, classifyClick, classifyOpen } from "../reporting/classify.cjs";
 import { EnvValidationError, ExecutionContextLike, JourneyWorker, JourneyWorkerOptions, journeyWorker } from "./worker.cjs";
-export { BURST_WINDOW_MS, BundleIntegrityError, type CfEmailOptions, CfEmailSender, type ChannelsConfig, type ClassifyOptions, type ClickFacts, type D1DatabaseLike, D1JourneyStore, DEFAULT_QUICK_MS, type DeployResult, type DeviceRegistration, type EmailAddress, type EmailBindingLike, type EmailRenderer, type Engagement, type EntryInput, type EntryOutcome, EnvValidationError, type EventInput, type ExecutionContextLike, type IdentifyResult, type IngestInput, type IngestResult, type JourneyEnv, JourneyFactSource, type JourneyObserver, type JourneyParams, type JourneyReporting, JourneyRunner, type JourneyStore, type JourneyWorker, type JourneyWorkerOptions, type KVNamespaceLike, LogMessageSender, type MessageRecord, type MessageTracking, type OutboundMessage, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type ProfileProps, type PushDevice, type RequestFacts, SchemaMismatchError, type SegmentTriggerRoute, type SendResult, type SqlClientLike, type StoreLease, type SweepResult, type TrackingOptions, type TriggerRoute, type Verdict, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, type WorkflowBindingLike, type WorkflowInstanceLike, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };
+export { BURST_WINDOW_MS, BundleIntegrityError, type BundleVersion, type CfEmailOptions, CfEmailSender, type ChannelsConfig, type ClassifyOptions, type ClickFacts, type D1DatabaseLike, D1JourneyStore, DEFAULT_QUICK_MS, type DeployResult, type DeviceRegistration, type EmailAddress, type EmailBindingLike, type EmailRenderer, type Engagement, type EntryInput, type EntryOutcome, EnvValidationError, type EventInput, type ExecutionContextLike, type IdentifyResult, type IngestInput, type IngestResult, type JourneyEnv, JourneyFactSource, type JourneyObserver, type JourneyParams, type JourneyReporting, JourneyRunner, type JourneyStore, type JourneyWorker, type JourneyWorkerOptions, type KVNamespaceLike, LogMessageSender, type MessageRecord, type MessageTracking, type OutboundMessage, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type ProfileProps, type PushDevice, type RequestFacts, SchemaMismatchError, type SegmentTriggerRoute, type SendResult, type SqlClientLike, type StoreLease, type SweepResult, type TrackingOptions, type TriggerRoute, UnversionedStoreError, type Verdict, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, type WorkflowBindingLike, type WorkflowInstanceLike, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };

package/dist/cloudflare/index.d.mts

@@ -6,9 +6,9 @@ import { JourneyFactSource } from "../store/facts.mjs";
 import { SqlClientLike } from "../store/sql.mjs";
 import { PostgresJourneyStore, PostgresJourneyStoreOptions } from "../store/postgres.mjs";
 import { PostgresReporting } from "../store/postgres-reporting.mjs";
-import { Engagement, EntryInput, EntryOutcome, EventInput, JourneyReporting, JourneyStore, MessageRecord, ProfileProps, SchemaMismatchError, SegmentTriggerRoute, StoreLease, TriggerRoute } from "../store/index.mjs";
+import { BundleVersion, Engagement, EntryInput, EntryOutcome, EventInput, JourneyReporting, JourneyStore, MessageRecord, ProfileProps, SchemaMismatchError, SegmentTriggerRoute, StoreLease, TriggerRoute } from "../store/index.mjs";
 import { d1Store } from "./d1-env.mjs";
-import { BundleIntegrityError, DeployResult, DeviceRegistration, IdentifyResult, IngestInput, IngestResult, SweepResult, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.mjs";
+import { BundleIntegrityError, DeployResult, DeviceRegistration, IdentifyResult, IngestInput, IngestResult, SweepResult, UnversionedStoreError, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.mjs";
 import { JourneyRunner } from "./runner.mjs";
 import { CfEmailOptions, CfEmailSender, EmailRenderer, LogMessageSender, WebhookMessageSender, routeByChannel, routeByPlatform, trackEmail } from "./senders.mjs";
 import { ChannelsConfig, channelsFromConfig, journeyMode, runtimeFromConfig } from "./channels.mjs";
@@ -16,4 +16,4 @@ import { reportingObserver } from "../reporting/observer.mjs";
 import { TrackingOptions, handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
 import { BURST_WINDOW_MS, ClassifyOptions, ClickFacts, DEFAULT_QUICK_MS, RequestFacts, Verdict, classifyClick, classifyOpen } from "../reporting/classify.mjs";
 import { EnvValidationError, ExecutionContextLike, JourneyWorker, JourneyWorkerOptions, journeyWorker } from "./worker.mjs";
-export { BURST_WINDOW_MS, BundleIntegrityError, type CfEmailOptions, CfEmailSender, type ChannelsConfig, type ClassifyOptions, type ClickFacts, type D1DatabaseLike, D1JourneyStore, DEFAULT_QUICK_MS, type DeployResult, type DeviceRegistration, type EmailAddress, type EmailBindingLike, type EmailRenderer, type Engagement, type EntryInput, type EntryOutcome, EnvValidationError, type EventInput, type ExecutionContextLike, type IdentifyResult, type IngestInput, type IngestResult, type JourneyEnv, JourneyFactSource, type JourneyObserver, type JourneyParams, type JourneyReporting, JourneyRunner, type JourneyStore, type JourneyWorker, type JourneyWorkerOptions, type KVNamespaceLike, LogMessageSender, type MessageRecord, type MessageTracking, type OutboundMessage, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type ProfileProps, type PushDevice, type RequestFacts, SchemaMismatchError, type SegmentTriggerRoute, type SendResult, type SqlClientLike, type StoreLease, type SweepResult, type TrackingOptions, type TriggerRoute, type Verdict, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, type WorkflowBindingLike, type WorkflowInstanceLike, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };
+export { BURST_WINDOW_MS, BundleIntegrityError, type BundleVersion, type CfEmailOptions, CfEmailSender, type ChannelsConfig, type ClassifyOptions, type ClickFacts, type D1DatabaseLike, D1JourneyStore, DEFAULT_QUICK_MS, type DeployResult, type DeviceRegistration, type EmailAddress, type EmailBindingLike, type EmailRenderer, type Engagement, type EntryInput, type EntryOutcome, EnvValidationError, type EventInput, type ExecutionContextLike, type IdentifyResult, type IngestInput, type IngestResult, type JourneyEnv, JourneyFactSource, type JourneyObserver, type JourneyParams, type JourneyReporting, JourneyRunner, type JourneyStore, type JourneyWorker, type JourneyWorkerOptions, type KVNamespaceLike, LogMessageSender, type MessageRecord, type MessageTracking, type OutboundMessage, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type ProfileProps, type PushDevice, type RequestFacts, SchemaMismatchError, type SegmentTriggerRoute, type SendResult, type SqlClientLike, type StoreLease, type SweepResult, type TrackingOptions, type TriggerRoute, UnversionedStoreError, type Verdict, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, type WorkflowBindingLike, type WorkflowInstanceLike, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };

package/dist/cloudflare/index.mjs

@@ -7,10 +7,10 @@ import { JourneyFactSource } from "../store/facts.mjs";
 import { D1JourneyStore } from "../store/d1.mjs";
 import { SchemaMismatchError } from "../store/index.mjs";
 import { d1Store } from "./d1-env.mjs";
-import { BundleIntegrityError, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.mjs";
+import { BundleIntegrityError, UnversionedStoreError, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, registerDevice, removeDevice, sweepSegments, unbindDevice } from "./router.mjs";
 import { CfEmailSender, LogMessageSender, WebhookMessageSender, routeByChannel, routeByPlatform, trackEmail } from "./senders.mjs";
 import { channelsFromConfig, journeyMode, runtimeFromConfig } from "./channels.mjs";
 import { JourneyRunner } from "./runner.mjs";
 import { reportingObserver } from "../reporting/observer.mjs";
 import { EnvValidationError, journeyWorker } from "./worker.mjs";
-export { BURST_WINDOW_MS, BundleIntegrityError, CfEmailSender, D1JourneyStore, DEFAULT_QUICK_MS, EnvValidationError, JourneyFactSource, JourneyRunner, LogMessageSender, PostgresJourneyStore, PostgresReporting, SchemaMismatchError, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };
+export { BURST_WINDOW_MS, BundleIntegrityError, CfEmailSender, D1JourneyStore, DEFAULT_QUICK_MS, EnvValidationError, JourneyFactSource, JourneyRunner, LogMessageSender, PostgresJourneyStore, PostgresReporting, SchemaMismatchError, UnversionedStoreError, WAKE_EVENT_TYPE, WAKE_TIMEOUT_TOLERANCE_MS, WebhookMessageSender, channelsFromConfig, classifyClick, classifyOpen, d1Store, deployBundle, forgetUser, handleRequest, handleTracking, identifyUser, ingestEvent, journeyMode, journeyWorker, recordPushOpen, registerDevice, removeDevice, reportingObserver, routeByChannel, routeByPlatform, runtimeFromConfig, sweepSegments, trackEmail, unbindDevice, wakeExpired };

package/dist/cloudflare/router.cjs

@@ -331,6 +331,13 @@ async function removeDevice(env, token, store = require_cloudflare_d1_env.d1Stor
 		woke: owner === void 0 ? 0 : await wakeSubscribers(env, store, owner, require_engine_condition.DEVICES_UPDATED_EVENT)
 	};
 }
+/** A versioned deploy on a store that cannot tell which version is live (D1). */
+var UnversionedStoreError = class extends Error {
+	name = "UnversionedStoreError";
+	constructor() {
+		super("this store does not record which version is live: deploy with POST /bundle/deploy");
+	}
+};
 /** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */
 var BundleIntegrityError = class extends Error {
 	constructor(message) {
@@ -359,21 +366,30 @@ function verifyBundleHashes(parsed) {
 	for (const segment of parsed.segments) if (require_hash.semanticHash(segment.condition) !== segment.contentHash) mismatched.push(`segment '${segment.id}'`);
 	if (mismatched.length > 0) throw new BundleIntegrityError(`contentHash does not match content for ${mismatched.join(", ")} — recompile the bundle instead of editing it by hand`);
 }
-/** Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed deploy leaves only harmless orphans), then the routing swap. */
-async function deployBundle(env, bundle, store = require_cloudflare_d1_env.d1Store(env)) {
+/**
+* Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed
+* deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens
+* only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle
+* compiled into it; without one it is forced, whatever is live.
+*/
+async function deployBundle(env, bundle, store = require_cloudflare_d1_env.d1Store(env), version) {
+	if (version !== void 0 && store.replaceRoutesIfNewer === void 0) throw new UnversionedStoreError();
 	const parsed = require_ir.BundleIR.parse(bundle);
 	verifyBundleHashes(parsed);
 	const problems = await store.checkSchema?.() ?? [];
 	if (problems.length > 0) throw new require_store_index.SchemaMismatchError(problems);
 	for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);
-	await store.replaceRoutes(parsed);
+	let applied = true;
+	if (version === void 0) await store.replaceRoutes(parsed);
+	else applied = await store.replaceRoutesIfNewer?.(parsed, version) ?? false;
 	const unrouted = parsed.workflows.filter((workflow) => workflow.trigger.type === "date" || workflow.trigger.type === "webhook").map((workflow) => ({
 		workflow: workflow.id,
 		trigger: workflow.trigger.type
 	}));
 	return {
 		workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),
-		unrouted
+		unrouted,
+		applied
 	};
 }
 /**
@@ -502,6 +518,7 @@ async function handleRequest(request, env, store = require_cloudflare_d1_env.d1S
 }
 //#endregion
 exports.BundleIntegrityError = BundleIntegrityError;
+exports.UnversionedStoreError = UnversionedStoreError;
 exports.deployBundle = deployBundle;
 exports.forgetUser = forgetUser;
 exports.handleRequest = handleRequest;

package/dist/cloudflare/router.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs","names":["d1Store","WAKE_EVENT_TYPE","matchesWhere","JourneyFactSource","evaluateCondition","murmur3","PROFILE_UPDATED_EVENT","DEVICES_UPDATED_EVENT","semanticHash","BundleIR","SchemaMismatchError","checkEvent","recordPushOpen","z"],"sources":["../../src/cloudflare/router.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport { murmur3 } from '../engine/bucket';\nimport {\n  DEVICES_UPDATED_EVENT,\n  PROFILE_UPDATED_EVENT,\n  evaluateCondition,\n  matchesWhere,\n} from '../engine/condition';\nimport { semanticHash } from '../hash';\nimport { BundleIR, type ConditionIR, type TriggerIR } from '../ir';\nimport { recordPushOpen } from '../reporting/tracking';\nimport { JourneyFactSource } from '../store/facts';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  type SegmentTriggerRoute,\n} from '../store/index';\nimport {\n  type JourneyEnv,\n  type JourneyParams,\n  WAKE_EVENT_TYPE,\n  type WorkflowInstanceLike,\n} from './bindings';\nimport { d1Store } from './d1-env';\n\n/**\n * Ingest router. An incoming event does four things: it is stored, it wakes\n * waiting instances, it is matched against event triggers, and it re-evaluates\n * segment-trigger membership. Plus /deploy (persist a bundle) and /identify\n * (merge a profile — which wakes property-condition waits via\n * PROFILE_UPDATED_EVENT and re-evaluates segment triggers too).\n *\n * Storage goes through a JourneyStore; the `store` argument defaults to the\n * D1 + KV store built from the env's bindings, so a Worker that only has those\n * calls these functions exactly as before.\n */\n\nexport interface IngestInput {\n  userId: string;\n  event: string;\n  payload?: Record<string, unknown>;\n  ts?: number;\n  /**\n   * This occurrence's identity, and with it the idempotency of sending it.\n   *\n   * Only the sender can know whether two deliveries describe one occurrence or\n   * two, so the engine does not decide: an id it has already stored makes the\n   * second delivery a no-op. That matters because ingest is reachable from two\n   * retrying callers — an HTTP client retrying a 500, and the interpreter's\n   * send_event step being retried after it already committed its row — and a\n   * second copy of an event silently changes every count- and window-based\n   * condition that reads the log.\n   *\n   * Callers that retry should send an id they can reproduce. Omitting it gets\n   * a fresh one, which records the event as its own occurrence.\n   */\n  id?: string;\n}\n\nexport interface IngestResult {\n  /** The occurrence's identity: the caller's `id`, or the one minted for it. */\n  id: string;\n  /** False when that id was already in the log: nothing was written this time. */\n  stored: boolean;\n  woke: number;\n  started: string[];\n}\n\nexport async function ingestEvent(\n  env: JourneyEnv,\n  input: IngestInput,\n  store: JourneyStore = d1Store(env)\n): Promise<IngestResult> {\n  if (input.event.startsWith('$')) {\n    throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);\n  }\n  const ts = input.ts ?? Date.now();\n  const payload = input.payload ?? {};\n  // No id means the sender is not claiming this is a repeat of anything, which\n  // a fresh one states truthfully — unlike a key derived from the contents,\n  // which would silently collapse two identical events a second apart.\n  const id = input.id ?? crypto.randomUUID();\n\n  const stored = await store.insertEvent({\n    id,\n    userId: input.userId,\n    event: input.event,\n    ts,\n    payload,\n  });\n\n  /*\n   * The rest runs even for a duplicate. A retry arrives precisely because the\n   * first attempt did not finish — it committed the row and then failed — so\n   * returning early would strand the journeys the retry exists to start. Both\n   * halves are independently idempotent: waking an instance that already moved\n   * on is a no-op, and the entry ledger refuses a second entry.\n   */\n  const woke = await wakeSubscribers(env, store, input.userId, input.event);\n  const started = await startTriggeredJourneys(env, store, { ...input, payload }, ts);\n  started.push(...(await refreshSegmentTriggers(env, store, input.userId, ts)));\n  return { id, stored, woke, started };\n}\n\nasync function wakeSubscribers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  event: string\n): Promise<number> {\n  let woke = 0;\n  for (const handle of await store.findWakeHandles(userId, event)) {\n    let instance: WorkflowInstanceLike;\n    try {\n      instance = await env.JOURNEY.get(handle);\n    } catch {\n      // Unknown instance (errored out without cleanup): drop the dangling subscription\n      await store.unsubscribe(handle);\n      continue;\n    }\n    try {\n      await instance.sendEvent({ type: WAKE_EVENT_TYPE, payload: { event } });\n      woke++;\n    } catch {\n      // Transient send failure (or an instance finishing right now): keep the\n      // subscription — a later event retries it, and the wait's own timeout\n      // bounds the damage. Deleting here would silence all future wake-ups.\n    }\n  }\n  return woke;\n}\n\nasync function startTriggeredJourneys(\n  env: JourneyEnv,\n  store: JourneyStore,\n  input: IngestInput & { payload: Record<string, unknown> },\n  ts: number\n): Promise<string[]> {\n  const started: string[] = [];\n  for (const route of await store.findTriggers(input.event)) {\n    // where: the payload gate — evaluated against the incoming event first\n    if (route.where !== null && !matchesWhere(input.payload, route.where)) continue;\n\n    // filter: the profile gate\n    if (route.filter !== null) {\n      const facts = new JourneyFactSource(store, input.userId);\n      if (!(await evaluateCondition(route.filter, facts, ts))) continue;\n    }\n\n    const instanceId = await startJourney(\n      env,\n      store,\n      route.workflow,\n      route.hash,\n      input.userId,\n      ts,\n      {\n        event: input.event,\n        payload: input.payload,\n      }\n    );\n    if (instanceId !== null) started.push(instanceId);\n  }\n  return started;\n}\n\n/**\n * Segment-entry triggers, maintained lazily: on each ingest/identify for a\n * user, re-evaluate every trigger-routed segment for that user and act on the\n * membership transition (enter → start journeys, leave → drop membership so a\n * later re-entry is observable). Purely time-driven drift (an inactivity\n * segment turning true by clock alone) has no event to ride on: the scheduled\n * sweep catches it (`sweepSegments`).\n */\nexport async function refreshSegmentTriggers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number\n): Promise<string[]> {\n  return refreshSegments(env, store, userId, ts, await store.listSegmentTriggers());\n}\n\n/**\n * Re-evaluate segments for one user — the routed ones only, or with `segments` every one named —\n * and act on each membership transition: entering records the membership and starts the\n * segment's routed workflows, leaving drops it. A segment trigger therefore starts journeys for\n * users who enter after it is deployed; a user already a member is not entered again.\n */\nasync function refreshSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number,\n  routes: readonly SegmentTriggerRoute[],\n  segments: readonly string[] = [],\n  // A sweep loads each definition once for all its users, not once per user\n  definitions = new Map<string, ConditionIR | undefined>()\n): Promise<string[]> {\n  const bySegment = new Map<string, { workflow: string; hash: string }[]>(\n    segments.map((name) => [name, []])\n  );\n  for (const route of routes) {\n    const list = bySegment.get(route.segment) ?? [];\n    list.push({ workflow: route.workflow, hash: route.hash });\n    bySegment.set(route.segment, list);\n  }\n  if (bySegment.size === 0) return [];\n\n  const facts = new JourneyFactSource(store, userId);\n  const started: string[] = [];\n  const failures: unknown[] = [];\n  for (const [segmentId, segmentRoutes] of bySegment) {\n    if (!definitions.has(segmentId)) {\n      definitions.set(segmentId, await store.getSegmentCondition(segmentId));\n    }\n    const definition = definitions.get(segmentId);\n    if (definition === undefined) continue; // route without a definition: broken deploy, skip\n\n    const matches = await evaluateCondition(definition, facts, ts);\n    const member = await store.isSegmentMember(segmentId, userId);\n\n    if (matches && !member) {\n      // Entry transition: the membership and the starts it owes, recorded together\n      await store.addSegmentMember(\n        segmentId,\n        userId,\n        ts,\n        segmentRoutes.map((route) => route.workflow)\n      );\n    } else if (!matches && member) {\n      await store.removeSegmentMember(segmentId, userId);\n      continue;\n    }\n    if (!matches) continue;\n\n    // Every start the entry still owes — a fresh entry's, or one an earlier evaluation failed on.\n    // Each is crossed off once its instance exists, so one workflow failing neither blocks the\n    // others nor gets lost: the next evaluation (the sweep, the user's next event) retries it.\n    const pending = new Set(await store.pendingSegmentStarts(segmentId, userId));\n    for (const route of segmentRoutes) {\n      if (!pending.has(route.workflow)) continue;\n      try {\n        const instanceId = await startJourney(env, store, route.workflow, route.hash, userId, ts, {\n          event: '$segment_entry',\n          payload: { segment: segmentId },\n        });\n        if (instanceId !== null) started.push(instanceId);\n        await store.completeSegmentStart(segmentId, userId, route.workflow);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n  }\n  // Surface a failure to the caller (an ingest answers 500) once every start had its chance\n  if (failures.length > 0) throw failures[0];\n  return started;\n}\n\nexport interface SweepResult {\n  users: number;\n  /** Journeys the segments' entries started. */\n  started: string[];\n  /** Each deployed segment's size after the sweep (empty when the store keeps no reporting). */\n  sizes: { segment: string; size: number }[];\n}\n\n/**\n * The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a\n * journey's conditions run on, so a member is exactly who a journey would see in it. Membership\n * follows (joiners keep the time they joined, leavers are removed), segment triggers start the\n * journeys of whoever entered by the clock alone, and the store records each segment's size.\n * It walks users one by one: fine for thousands, a large audience wants SQL-side evaluation.\n */\nexport async function sweepSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<SweepResult> {\n  // Erasures left unfinished (an instance would not stop) first: their users are not evaluated\n  const erasing = new Set<string>();\n  for (const userId of await store.pendingErasures()) {\n    try {\n      const { erased } = await eraseUser(env, userId, store);\n      if (!erased) erasing.add(userId);\n    } catch (error) {\n      // Still pending: the next sweep tries again, and the rest of this one goes on\n      erasing.add(userId);\n      console.error(`[workflow] erasure of ${userId} failed`, error);\n    }\n  }\n  const segments = (await store.listSegments()).map((segment) => segment.id);\n  const routes = await store.listSegmentTriggers();\n  const users = (await store.listUserIds()).filter((userId) => !erasing.has(userId));\n  const started: string[] = [];\n  const definitions = new Map<string, ConditionIR | undefined>();\n  for (const userId of users) {\n    try {\n      started.push(\n        ...(await refreshSegments(env, store, userId, now, routes, segments, definitions))\n      );\n    } catch (error) {\n      // One user's failed start is kept for the next sweep; it must not stop everyone else's\n      console.error(`[workflow] segment refresh for ${userId} failed`, error);\n    }\n  }\n  const sizes = (await store.reporting?.snapshotSegments(now)) ?? [];\n  return { users: users.length, started, sizes };\n}\n\n/**\n * Create one journey instance behind the entry ledger. Returns null when the\n * once-policy blocks the entry (the store's attempt is atomic, so concurrent\n * ingests cannot double-enter). A pair whose previous instance is recorded as\n * 'failed' is reclaimed rather than barred forever over one outage.\n */\nasync function startJourney(\n  env: JourneyEnv,\n  store: JourneyStore,\n  workflow: string,\n  hash: string,\n  userId: string,\n  ts: number,\n  trigger: { event: string; payload: Record<string, unknown> }\n): Promise<string | null> {\n  const instanceId = buildInstanceId(workflow, hash, userId, ts);\n  const params: JourneyParams = { workflowId: workflow, contentHash: hash, userId, trigger };\n\n  const outcome = await store.enterJourney({ workflow, userId, instanceId, hash, ts });\n  if (outcome === null) return null; // already entered, and still alive\n\n  try {\n    await env.JOURNEY.create({ id: instanceId, params });\n  } catch (error) {\n    if (outcome === 'reclaimed') {\n      // Put the corpse back rather than deleting it: the entry is still a\n      // failure, and dropping the row would erase that from the ledger.\n      await store.setEntryStatus(instanceId, 'failed');\n    } else {\n      // Roll the ledger back so a retried ingest can enter — otherwise the\n      // once-policy would permanently record an entry that never ran.\n      await store.removeEntry(instanceId);\n    }\n    throw error;\n  }\n  return instanceId;\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * Instance id: addressable (the router gets it directly to wake it), ≤100\n * chars, legal charset. The murmur3 fingerprint keeps ids distinct when the\n * sanitized/truncated userId alone would collide.\n */\nfunction buildInstanceId(workflow: string, hash: string, userId: string, ts: number): string {\n  const uid = userId.replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 24);\n  const fingerprint = murmur3(utf8.encode(userId)).toString(36);\n  return `${workflow.slice(0, 32)}-${hash.slice(0, 8)}-${uid}-${fingerprint}-${ts.toString(36)}`;\n}\n\n/* --------------------------------- identify --------------------------------- */\n\nexport interface IdentifyResult {\n  ok: true;\n  props: ProfileProps;\n  woke: number;\n  started: string[];\n}\n\n/**\n * Merge-patch profile properties (a null removes one), then wake property waits\n * and re-evaluate segment triggers. The merge is one statement in the store, so\n * two identifies landing together cannot lose each other's fields.\n */\nexport async function identifyUser(\n  env: JourneyEnv,\n  userId: string,\n  props: ProfileProps,\n  store: JourneyStore = d1Store(env)\n): Promise<IdentifyResult> {\n  const ts = Date.now();\n  const merged = await store.mergeProfile(userId, props);\n  // Property-condition waits subscribe to this reserved event (see relevantEvents)\n  const woke = await wakeSubscribers(env, store, userId, PROFILE_UPDATED_EVENT);\n  // A profile change can move the user into (or out of) a trigger-routed segment\n  const started = await refreshSegmentTriggers(env, store, userId, ts);\n  return { ok: true, props: merged, woke, started };\n}\n\nexport interface DeviceRegistration {\n  userId: string;\n  token: string;\n  platform: string;\n  ts?: number;\n}\n\n/**\n * A push token registered for the user (or moved to them from another account: a token belongs\n * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside\n * `waitUntil`), for the new owner and the previous one.\n */\nexport async function registerDevice(\n  env: JourneyEnv,\n  device: DeviceRegistration,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const previous = await store.removeDevice(device.token);\n  await store.upsertDevice({ ...device, ts: device.ts ?? Date.now() });\n  let woke = await wakeSubscribers(env, store, device.userId, DEVICES_UPDATED_EVENT);\n  if (previous !== undefined && previous !== device.userId) {\n    woke += await wakeSubscribers(env, store, previous, DEVICES_UPDATED_EVENT);\n  }\n  return { ok: true, woke };\n}\n\n/**\n * A deleted account: everything the engine keeps about the user is erased and the journeys still\n * running for them are terminated, so nothing more is sent. Idempotent.\n */\n/** Workflow instance states that will never run another step. */\nconst STOPPED_STATUSES = new Set(['complete', 'errored', 'terminated']);\n\n/**\n * Stop one instance for good; true once it is known not to run again. An instance the platform\n * no longer knows, or one already finished (terminate refuses those), counts as stopped. Any other\n * failure is not taken for \"already gone\": it answers false, and the erasure waits for a retry.\n */\nasync function stopInstance(env: JourneyEnv, instanceId: string): Promise<boolean> {\n  let instance: WorkflowInstanceLike;\n  try {\n    instance = await env.JOURNEY.get(instanceId);\n  } catch (error) {\n    if (/not[_ ]found/i.test(String(error))) return true;\n    console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);\n    return false;\n  }\n  if (instance.terminate === undefined) return false;\n  try {\n    await instance.terminate();\n    return true;\n  } catch (error) {\n    const status = await instance.status?.().catch(() => undefined);\n    if (status !== undefined && STOPPED_STATUSES.has(status.status)) return true;\n    console.warn(`[workflow] terminating ${instanceId} failed`, error);\n    return false;\n  }\n}\n\n/**\n * Carry out a recorded erasure: stop every running instance of the user, and only once all have\n * stopped erase their data (the request with it). Stopping first means no step can write rows\n * back after the erase; erasing nothing until then keeps the entries that name the instances\n * still to stop, so a retry can finish the job.\n */\nasync function eraseUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore\n): Promise<{ erased: boolean; pending: string[] }> {\n  const pending: string[] = [];\n  for (const instanceId of await store.runningInstances(userId)) {\n    if (!(await stopInstance(env, instanceId))) pending.push(instanceId);\n  }\n  if (pending.length > 0) return { erased: false, pending };\n  await store.forgetUser(userId);\n  return { erased: true, pending };\n}\n\n/**\n * Forget a user (a deleted account): the request is recorded first, then carried out. An\n * instance that will not stop leaves it pending — nothing erased yet — and the scheduled sweep\n * retries it; `erased: false` says so.\n */\nexport async function forgetUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore = d1Store(env),\n  now = Date.now()\n): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n  await store.requestErasure(userId, now);\n  return { ok: true, ...(await eraseUser(env, userId, store)) };\n}\n\n/**\n * The user signed out on the device: the token stays registered, bound to nobody, so the next\n * sign-in only has to bind it again. Wakes the former owner's device waits (`reachable('push')`\n * may no longer hold).\n */\nexport async function unbindDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.unbindDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT);\n  return { ok: true, woke };\n}\n\n/** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */\nexport async function removeDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.removeDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT);\n  return { ok: true, woke };\n}\n\n/* ---------------------------------- deploy ---------------------------------- */\n\nexport interface DeployResult {\n  workflows: string[];\n  /**\n   * Workflows whose trigger type has no runtime routing yet — they deploy (the\n   * IR is stored and versioned) but will never start until the routing lands.\n   * Currently: date (TODO — needs cron + Queues, instance creation is\n   * rate-limited and a date trigger fans out to the whole audience at once)\n   * and webhook (TODO — needs endpoint allocation).\n   */\n  unrouted: { workflow: string; trigger: TriggerIR['type'] }[];\n}\n\n/** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */\nexport class BundleIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'BundleIntegrityError';\n  }\n}\n\n/**\n * Recompute every declared contentHash and refuse the bundle if one disagrees.\n *\n * The contentHash is the address an in-flight journey reads its IR from, so\n * a hash that does not describe its own content is a way to change what a\n * pinned instance executes: submit an edited flow under the old hash and the\n * next replay picks it up. The compiler always computes the hash it ships, so\n * a mismatch means a hand-rolled payload or a stale client — neither should be\n * able to overwrite a version that journeys are running.\n *\n * Each hash is recomputed exactly the way its compiler produced it: a workflow\n * hashes its whole IR (contentHash strips itself), a segment hashes only its\n * condition. Mirroring them is load-bearing — recomputing a segment over the\n * whole record would reject every honest deploy.\n */\nfunction verifyBundleHashes(parsed: BundleIR): void {\n  const mismatched: string[] = [];\n  for (const workflow of parsed.workflows) {\n    if (semanticHash(workflow) !== workflow.contentHash) {\n      mismatched.push(`workflow '${workflow.id}'`);\n    }\n  }\n  for (const segment of parsed.segments) {\n    if (semanticHash(segment.condition) !== segment.contentHash) {\n      mismatched.push(`segment '${segment.id}'`);\n    }\n  }\n  if (mismatched.length > 0) {\n    throw new BundleIntegrityError(\n      `contentHash does not match content for ${mismatched.join(', ')} — recompile the bundle instead of editing it by hand`\n    );\n  }\n}\n\n/** Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed deploy leaves only harmless orphans), then the routing swap. */\nexport async function deployBundle(\n  env: JourneyEnv,\n  bundle: unknown,\n  store: JourneyStore = d1Store(env)\n): Promise<DeployResult> {\n  const parsed = BundleIR.parse(bundle);\n  // Before any write: a bad hash must not reach the store, where it would address content it does not describe\n  verifyBundleHashes(parsed);\n  // Nor a bundle the database cannot hold: the host migrates, the engine only checks\n  const problems = (await store.checkSchema?.()) ?? [];\n  if (problems.length > 0) throw new SchemaMismatchError(problems);\n\n  for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);\n  await store.replaceRoutes(parsed);\n\n  const unrouted = parsed.workflows\n    .filter((workflow) => workflow.trigger.type === 'date' || workflow.trigger.type === 'webhook')\n    .map((workflow) => ({ workflow: workflow.id, trigger: workflow.trigger.type }));\n\n  return {\n    workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),\n    unrouted,\n  };\n}\n\n/* ----------------------------------- http ----------------------------------- */\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body: unknown = await request.json();\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\nexport async function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore = d1Store(env),\n  validation: IngestValidation = {}\n): Promise<Response> {\n  const url = new URL(request.url);\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n  const { contract } = validation;\n  const enforce = validation.mode !== 'report';\n  /** The contract's verdict: the value to use, or the response refusing the request. */\n  const checked = <T>(\n    result: ContractResult<T>,\n    original: T,\n    what: string\n  ): { value: T } | { refused: Response } => {\n    if (result.ok) return { value: result.data };\n    const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n    if (!enforce) {\n      console.warn(`[workflow router] contract would refuse ${what}: ${issues.join('; ')}`);\n      return { value: original };\n    }\n    return {\n      refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n    };\n  };\n\n  if (request.method === 'GET' && url.pathname === '/health') {\n    return json({ ok: true });\n  }\n\n  // Bearer auth on everything mutating. An unset token means an open dev\n  // instance (see JourneyEnv.API_TOKEN) — production must configure it.\n  if (env.API_TOKEN !== undefined) {\n    if (request.headers.get('authorization') !== `Bearer ${env.API_TOKEN}`) {\n      return json({ error: 'unauthorized' }, 401);\n    }\n  }\n\n  try {\n    if (request.method === 'POST' && url.pathname === '/events') {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && typeof ts !== 'number') {\n        return json({ error: 'ts must be a number' }, 400);\n      }\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (contract !== undefined) {\n        const verdict = checked(\n          checkEvent(contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/identify') {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      let patch = props as ProfileProps;\n      if (contract !== undefined) {\n        const verdict = checked(contract.parseProfilePatch(props), patch, 'identify');\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices') {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && typeof ts !== 'number')\n        return json({ error: 'ts must be a number' }, 400);\n      return json(\n        await registerDevice(\n          env,\n          { userId, token, platform, ...(ts === undefined ? {} : { ts }) },\n          store\n        )\n      );\n    }\n\n    if (request.method === 'POST' && url.pathname === '/messages/opened') {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded =\n        store.reporting !== undefined && (await recordPushOpen(store.reporting, userId, messageId));\n      return json({ ok: true, recorded });\n    }\n\n    if (request.method === 'POST' && url.pathname === '/users/forget') {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices/unbind') {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices/remove') {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/deploy') {\n      return json(await deployBundle(env, await request.json(), store));\n    }\n\n    return json({ error: 'not found' }, 404);\n  } catch (error) {\n    // Validation problems are the caller's to fix; anything else stays out of\n    // the response body (internals are logged, not leaked).\n    if (error instanceof z.core.$ZodError) {\n      return json({ error: `invalid payload: ${error.message}` }, 400);\n    }\n    // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n    if (error instanceof BundleIntegrityError) {\n      return json({ error: error.message }, 400);\n    }\n    // The operator's to fix (run the migrations), so the response says what is missing\n    if (error instanceof SchemaMismatchError) {\n      return json({ error: error.message, problems: error.problems }, 503);\n    }\n    console.error('[workflow router]', error);\n    return json({ error: 'internal error' }, 500);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAsEA,eAAsB,YACpB,KACA,OACA,QAAsBA,0BAAAA,QAAQ,GAAG,GACV;CACvB,IAAI,MAAM,MAAM,WAAW,GAAG,GAC5B,MAAM,IAAI,MAAM,eAAe,MAAM,MAAM,uCAAuC;CAEpF,MAAM,KAAK,MAAM,MAAM,KAAK,IAAI;CAChC,MAAM,UAAU,MAAM,WAAW,CAAC;CAIlC,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW;CAEzC,MAAM,SAAS,MAAM,MAAM,YAAY;EACrC;EACA,QAAQ,MAAM;EACd,OAAO,MAAM;EACb;EACA;CACF,CAAC;CASD,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,MAAM,KAAK;CACxE,MAAM,UAAU,MAAM,uBAAuB,KAAK,OAAO;EAAE,GAAG;EAAO;CAAQ,GAAG,EAAE;CAClF,QAAQ,KAAK,GAAI,MAAM,uBAAuB,KAAK,OAAO,MAAM,QAAQ,EAAE,CAAE;CAC5E,OAAO;EAAE;EAAI;EAAQ;EAAM;CAAQ;AACrC;AAEA,eAAe,gBACb,KACA,OACA,QACA,OACiB;CACjB,IAAI,OAAO;CACX,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,QAAQ,KAAK,GAAG;EAC/D,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,IAAI,QAAQ,IAAI,MAAM;EACzC,QAAQ;GAEN,MAAM,MAAM,YAAY,MAAM;GAC9B;EACF;EACA,IAAI;GACF,MAAM,SAAS,UAAU;IAAE,MAAMC,4BAAAA;IAAiB,SAAS,EAAE,MAAM;GAAE,CAAC;GACtE;EACF,QAAQ,CAIR;CACF;CACA,OAAO;AACT;AAEA,eAAe,uBACb,KACA,OACA,OACA,IACmB;CACnB,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,MAAM,MAAM,aAAa,MAAM,KAAK,GAAG;EAEzD,IAAI,MAAM,UAAU,QAAQ,CAACC,yBAAAA,aAAa,MAAM,SAAS,MAAM,KAAK,GAAG;EAGvE,IAAI,MAAM,WAAW,MAAM;GACzB,MAAM,QAAQ,IAAIC,oBAAAA,kBAAkB,OAAO,MAAM,MAAM;GACvD,IAAI,CAAE,MAAMC,yBAAAA,kBAAkB,MAAM,QAAQ,OAAO,EAAE,GAAI;EAC3D;EAEA,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,MAAM,QACN,IACA;GACE,OAAO,MAAM;GACb,SAAS,MAAM;EACjB,CACF;EACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;CAClD;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,uBACpB,KACA,OACA,QACA,IACmB;CACnB,OAAO,gBAAgB,KAAK,OAAO,QAAQ,IAAI,MAAM,MAAM,oBAAoB,CAAC;AAClF;;;;;;;AAQA,eAAe,gBACb,KACA,OACA,QACA,IACA,QACA,WAA8B,CAAC,GAE/B,8BAAc,IAAI,IAAqC,GACpC;CACnB,MAAM,YAAY,IAAI,IACpB,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CACnC;CACA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OAAO,UAAU,IAAI,MAAM,OAAO,KAAK,CAAC;EAC9C,KAAK,KAAK;GAAE,UAAU,MAAM;GAAU,MAAM,MAAM;EAAK,CAAC;EACxD,UAAU,IAAI,MAAM,SAAS,IAAI;CACnC;CACA,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,IAAID,oBAAAA,kBAAkB,OAAO,MAAM;CACjD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,WAAW,kBAAkB,WAAW;EAClD,IAAI,CAAC,YAAY,IAAI,SAAS,GAC5B,YAAY,IAAI,WAAW,MAAM,MAAM,oBAAoB,SAAS,CAAC;EAEvE,MAAM,aAAa,YAAY,IAAI,SAAS;EAC5C,IAAI,eAAe,KAAA,GAAW;EAE9B,MAAM,UAAU,MAAMC,yBAAAA,kBAAkB,YAAY,OAAO,EAAE;EAC7D,MAAM,SAAS,MAAM,MAAM,gBAAgB,WAAW,MAAM;EAE5D,IAAI,WAAW,CAAC,QAEd,MAAM,MAAM,iBACV,WACA,QACA,IACA,cAAc,KAAK,UAAU,MAAM,QAAQ,CAC7C;OACK,IAAI,CAAC,WAAW,QAAQ;GAC7B,MAAM,MAAM,oBAAoB,WAAW,MAAM;GACjD;EACF;EACA,IAAI,CAAC,SAAS;EAKd,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,qBAAqB,WAAW,MAAM,CAAC;EAC3E,KAAK,MAAM,SAAS,eAAe;GACjC,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG;GAClC,IAAI;IACF,MAAM,aAAa,MAAM,aAAa,KAAK,OAAO,MAAM,UAAU,MAAM,MAAM,QAAQ,IAAI;KACxF,OAAO;KACP,SAAS,EAAE,SAAS,UAAU;IAChC,CAAC;IACD,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;IAChD,MAAM,MAAM,qBAAqB,WAAW,QAAQ,MAAM,QAAQ;GACpE,SAAS,OAAO;IACd,SAAS,KAAK,KAAK;GACrB;EACF;CACF;CAEA,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CACxC,OAAO;AACT;;;;;;;;AAiBA,eAAsB,cACpB,KACA,OACA,MAAM,KAAK,IAAI,GACO;CAEtB,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,GAC/C,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,UAAU,KAAK,QAAQ,KAAK;EACrD,IAAI,CAAC,QAAQ,QAAQ,IAAI,MAAM;CACjC,SAAS,OAAO;EAEd,QAAQ,IAAI,MAAM;EAClB,QAAQ,MAAM,yBAAyB,OAAO,UAAU,KAAK;CAC/D;CAEF,MAAM,YAAY,MAAM,MAAM,aAAa,EAAA,CAAG,KAAK,YAAY,QAAQ,EAAE;CACzE,MAAM,SAAS,MAAM,MAAM,oBAAoB;CAC/C,MAAM,SAAS,MAAM,MAAM,YAAY,EAAA,CAAG,QAAQ,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC;CACjF,MAAM,UAAoB,CAAC;CAC3B,MAAM,8BAAc,IAAI,IAAqC;CAC7D,KAAK,MAAM,UAAU,OACnB,IAAI;EACF,QAAQ,KACN,GAAI,MAAM,gBAAgB,KAAK,OAAO,QAAQ,KAAK,QAAQ,UAAU,WAAW,CAClF;CACF,SAAS,OAAO;EAEd,QAAQ,MAAM,kCAAkC,OAAO,UAAU,KAAK;CACxE;CAEF,MAAM,QAAS,MAAM,MAAM,WAAW,iBAAiB,GAAG,KAAM,CAAC;CACjE,OAAO;EAAE,OAAO,MAAM;EAAQ;EAAS;CAAM;AAC/C;;;;;;;AAQA,eAAe,aACb,KACA,OACA,UACA,MACA,QACA,IACA,SACwB;CACxB,MAAM,aAAa,gBAAgB,UAAU,MAAM,QAAQ,EAAE;CAC7D,MAAM,SAAwB;EAAE,YAAY;EAAU,aAAa;EAAM;EAAQ;CAAQ;CAEzF,MAAM,UAAU,MAAM,MAAM,aAAa;EAAE;EAAU;EAAQ;EAAY;EAAM;CAAG,CAAC;CACnF,IAAI,YAAY,MAAM,OAAO;CAE7B,IAAI;EACF,MAAM,IAAI,QAAQ,OAAO;GAAE,IAAI;GAAY;EAAO,CAAC;CACrD,SAAS,OAAO;EACd,IAAI,YAAY,aAGd,MAAM,MAAM,eAAe,YAAY,QAAQ;OAI/C,MAAM,MAAM,YAAY,UAAU;EAEpC,MAAM;CACR;CACA,OAAO;AACT;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAS,gBAAgB,UAAkB,MAAc,QAAgB,IAAoB;CAC3F,MAAM,MAAM,OAAO,QAAQ,mBAAmB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAC9D,MAAM,cAAcC,sBAAAA,QAAQ,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE;CAC5D,OAAO,GAAG,SAAS,MAAM,GAAG,EAAE,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,YAAY,GAAG,GAAG,SAAS,EAAE;AAC7F;;;;;;AAgBA,eAAsB,aACpB,KACA,QACA,OACA,QAAsBL,0BAAAA,QAAQ,GAAG,GACR;CACzB,MAAM,KAAK,KAAK,IAAI;CAMpB,OAAO;EAAE,IAAI;EAAM,OAAO,MALL,MAAM,aAAa,QAAQ,KAAK;EAKnB,MAAA,MAHf,gBAAgB,KAAK,OAAO,QAAQM,yBAAAA,qBAAqB;EAGpC,SAAA,MADlB,uBAAuB,KAAK,OAAO,QAAQ,EAAE;CACnB;AAClD;;;;;;AAcA,eAAsB,eACpB,KACA,QACA,QAAsBN,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,WAAW,MAAM,MAAM,aAAa,OAAO,KAAK;CACtD,MAAM,MAAM,aAAa;EAAE,GAAG;EAAQ,IAAI,OAAO,MAAM,KAAK,IAAI;CAAE,CAAC;CACnE,IAAI,OAAO,MAAM,gBAAgB,KAAK,OAAO,OAAO,QAAQO,yBAAAA,qBAAqB;CACjF,IAAI,aAAa,KAAA,KAAa,aAAa,OAAO,QAChD,QAAQ,MAAM,gBAAgB,KAAK,OAAO,UAAUA,yBAAAA,qBAAqB;CAE3E,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;;;;;AAOA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAY;CAAW;AAAY,CAAC;;;;;;AAOtE,eAAe,aAAa,KAAiB,YAAsC;CACjF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,IAAI,QAAQ,IAAI,UAAU;CAC7C,SAAS,OAAO;EACd,IAAI,gBAAgB,KAAK,OAAO,KAAK,CAAC,GAAG,OAAO;EAChD,QAAQ,KAAK,yBAAyB,WAAW,qBAAqB,KAAK;EAC3E,OAAO;CACT;CACA,IAAI,SAAS,cAAc,KAAA,GAAW,OAAO;CAC7C,IAAI;EACF,MAAM,SAAS,UAAU;EACzB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9D,IAAI,WAAW,KAAA,KAAa,iBAAiB,IAAI,OAAO,MAAM,GAAG,OAAO;EACxE,QAAQ,KAAK,0BAA0B,WAAW,UAAU,KAAK;EACjE,OAAO;CACT;AACF;;;;;;;AAQA,eAAe,UACb,KACA,QACA,OACiD;CACjD,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,cAAc,MAAM,MAAM,iBAAiB,MAAM,GAC1D,IAAI,CAAE,MAAM,aAAa,KAAK,UAAU,GAAI,QAAQ,KAAK,UAAU;CAErE,IAAI,QAAQ,SAAS,GAAG,OAAO;EAAE,QAAQ;EAAO;CAAQ;CACxD,MAAM,MAAM,WAAW,MAAM;CAC7B,OAAO;EAAE,QAAQ;EAAM;CAAQ;AACjC;;;;;;AAOA,eAAsB,WACpB,KACA,QACA,QAAsBP,0BAAAA,QAAQ,GAAG,GACjC,MAAM,KAAK,IAAI,GAC4C;CAC3D,MAAM,MAAM,eAAe,QAAQ,GAAG;CACtC,OAAO;EAAE,IAAI;EAAM,GAAI,MAAM,UAAU,KAAK,QAAQ,KAAK;CAAG;AAC9D;;;;;;AAOA,eAAsB,aACpB,KACA,OACA,QAAsBA,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAOO,yBAAAA,qBAAqB;CAClE;AAC1B;;AAGA,eAAsB,aACpB,KACA,OACA,QAAsBP,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAOO,yBAAAA,qBAAqB;CAClE;AAC1B;;AAiBA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,mBAAmB,QAAwB;CAClD,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,YAAY,OAAO,WAC5B,IAAIC,aAAAA,aAAa,QAAQ,MAAM,SAAS,aACtC,WAAW,KAAK,aAAa,SAAS,GAAG,EAAE;CAG/C,KAAK,MAAM,WAAW,OAAO,UAC3B,IAAIA,aAAAA,aAAa,QAAQ,SAAS,MAAM,QAAQ,aAC9C,WAAW,KAAK,YAAY,QAAQ,GAAG,EAAE;CAG7C,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,qBACR,0CAA0C,WAAW,KAAK,IAAI,EAAE,sDAClE;AAEJ;;AAGA,eAAsB,aACpB,KACA,QACA,QAAsBR,0BAAAA,QAAQ,GAAG,GACV;CACvB,MAAM,SAASS,WAAAA,SAAS,MAAM,MAAM;CAEpC,mBAAmB,MAAM;CAEzB,MAAM,WAAY,MAAM,MAAM,cAAc,KAAM,CAAC;CACnD,IAAI,SAAS,SAAS,GAAG,MAAM,IAAIC,oBAAAA,oBAAoB,QAAQ;CAE/D,KAAK,MAAM,YAAY,OAAO,WAAW,MAAM,MAAM,cAAc,QAAQ;CAC3E,MAAM,MAAM,cAAc,MAAM;CAEhC,MAAM,WAAW,OAAO,UACrB,QAAQ,aAAa,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ,SAAS,SAAS,CAAC,CAC7F,KAAK,cAAc;EAAE,UAAU,SAAS;EAAI,SAAS,SAAS,QAAQ;CAAK,EAAE;CAEhF,OAAO;EACL,WAAW,OAAO,UAAU,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,GAAG;EAC7E;CACF;AACF;;;;;;AASA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAgB,MAAM,QAAQ,KAAK;CACzC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAaA,eAAsB,cACpB,SACA,KACA,QAAsBV,0BAAAA,QAAQ,GAAG,GACjC,aAA+B,CAAC,GACb;CACnB,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CACH,MAAM,EAAE,aAAa;CACrB,MAAM,UAAU,WAAW,SAAS;;CAEpC,MAAM,WACJ,QACA,UACA,SACyC;EACzC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;EAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;EAC7E,IAAI,CAAC,SAAS;GACZ,QAAQ,KAAK,2CAA2C,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;GACpF,OAAO,EAAE,OAAO,SAAS;EAC3B;EACA,OAAO,EACL,SAAS,KAAK;GAAE,OAAO,GAAG,KAAK;GAA2B,QAAQ,OAAO;EAAO,GAAG,GAAG,EACxF;CACF;CAEA,IAAI,QAAQ,WAAW,SAAS,IAAI,aAAa,WAC/C,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC;CAK1B,IAAI,IAAI,cAAc,KAAA,GAChB;MAAA,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI,aACzD,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CAAA;CAI9C,IAAI;EACF,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,WAAW;GAC3D,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,OAAO,OAAO,UACpC,OAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GAEnD,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,UAAU,QACdW,iBAAAA,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACzC,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAM,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,aAAa;GAC7D,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAChF,IAAI,QAAQ;GACZ,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,GAAG,OAAO,UAAU;IAC5E,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAM,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,YAAY;GAC5D,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,OAAO,OAAO,UACpC,OAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GACnD,OAAO,KACL,MAAM,eACJ,KACA;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG,GAC/D,KACF,CACF;EACF;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,oBAAoB;GACpE,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAGlF,OAAO,KAAK;IAAE,IAAI;IAAM,UADtB,MAAM,cAAc,KAAA,KAAc,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GAC1D,CAAC;EACpC;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,iBAAiB;GACjE,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAM,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,mBAAmB;GACnE,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,mBAAmB;GACnE,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,WAChD,OAAO,KAAK,MAAM,aAAa,KAAK,MAAM,QAAQ,KAAK,GAAG,KAAK,CAAC;EAGlE,OAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;CACzC,SAAS,OAAO;EAGd,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;EAGjE,IAAI,iBAAiB,sBACnB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;EAG3C,IAAI,iBAAiBH,oBAAAA,qBACnB,OAAO,KAAK;GAAE,OAAO,MAAM;GAAS,UAAU,MAAM;EAAS,GAAG,GAAG;EAErE,QAAQ,MAAM,qBAAqB,KAAK;EACxC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAC9C;AACF"}
+{"version":3,"file":"router.cjs","names":["d1Store","WAKE_EVENT_TYPE","matchesWhere","JourneyFactSource","evaluateCondition","murmur3","PROFILE_UPDATED_EVENT","DEVICES_UPDATED_EVENT","semanticHash","BundleIR","SchemaMismatchError","checkEvent","recordPushOpen","z"],"sources":["../../src/cloudflare/router.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport { murmur3 } from '../engine/bucket';\nimport {\n  DEVICES_UPDATED_EVENT,\n  PROFILE_UPDATED_EVENT,\n  evaluateCondition,\n  matchesWhere,\n} from '../engine/condition';\nimport { semanticHash } from '../hash';\nimport { BundleIR, type ConditionIR, type TriggerIR } from '../ir';\nimport { recordPushOpen } from '../reporting/tracking';\nimport { JourneyFactSource } from '../store/facts';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  type SegmentTriggerRoute,\n} from '../store/index';\nimport {\n  type JourneyEnv,\n  type JourneyParams,\n  WAKE_EVENT_TYPE,\n  type WorkflowInstanceLike,\n} from './bindings';\nimport { d1Store } from './d1-env';\n\n/**\n * Ingest router. An incoming event does four things: it is stored, it wakes\n * waiting instances, it is matched against event triggers, and it re-evaluates\n * segment-trigger membership. Plus /deploy (persist a bundle) and /identify\n * (merge a profile — which wakes property-condition waits via\n * PROFILE_UPDATED_EVENT and re-evaluates segment triggers too).\n *\n * Storage goes through a JourneyStore; the `store` argument defaults to the\n * D1 + KV store built from the env's bindings, so a Worker that only has those\n * calls these functions exactly as before.\n */\n\nexport interface IngestInput {\n  userId: string;\n  event: string;\n  payload?: Record<string, unknown>;\n  ts?: number;\n  /**\n   * This occurrence's identity, and with it the idempotency of sending it.\n   *\n   * Only the sender can know whether two deliveries describe one occurrence or\n   * two, so the engine does not decide: an id it has already stored makes the\n   * second delivery a no-op. That matters because ingest is reachable from two\n   * retrying callers — an HTTP client retrying a 500, and the interpreter's\n   * send_event step being retried after it already committed its row — and a\n   * second copy of an event silently changes every count- and window-based\n   * condition that reads the log.\n   *\n   * Callers that retry should send an id they can reproduce. Omitting it gets\n   * a fresh one, which records the event as its own occurrence.\n   */\n  id?: string;\n}\n\nexport interface IngestResult {\n  /** The occurrence's identity: the caller's `id`, or the one minted for it. */\n  id: string;\n  /** False when that id was already in the log: nothing was written this time. */\n  stored: boolean;\n  woke: number;\n  started: string[];\n}\n\nexport async function ingestEvent(\n  env: JourneyEnv,\n  input: IngestInput,\n  store: JourneyStore = d1Store(env)\n): Promise<IngestResult> {\n  if (input.event.startsWith('$')) {\n    throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);\n  }\n  const ts = input.ts ?? Date.now();\n  const payload = input.payload ?? {};\n  // No id means the sender is not claiming this is a repeat of anything, which\n  // a fresh one states truthfully — unlike a key derived from the contents,\n  // which would silently collapse two identical events a second apart.\n  const id = input.id ?? crypto.randomUUID();\n\n  const stored = await store.insertEvent({\n    id,\n    userId: input.userId,\n    event: input.event,\n    ts,\n    payload,\n  });\n\n  /*\n   * The rest runs even for a duplicate. A retry arrives precisely because the\n   * first attempt did not finish — it committed the row and then failed — so\n   * returning early would strand the journeys the retry exists to start. Both\n   * halves are independently idempotent: waking an instance that already moved\n   * on is a no-op, and the entry ledger refuses a second entry.\n   */\n  const woke = await wakeSubscribers(env, store, input.userId, input.event);\n  const started = await startTriggeredJourneys(env, store, { ...input, payload }, ts);\n  started.push(...(await refreshSegmentTriggers(env, store, input.userId, ts)));\n  return { id, stored, woke, started };\n}\n\nasync function wakeSubscribers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  event: string\n): Promise<number> {\n  let woke = 0;\n  for (const handle of await store.findWakeHandles(userId, event)) {\n    let instance: WorkflowInstanceLike;\n    try {\n      instance = await env.JOURNEY.get(handle);\n    } catch {\n      // Unknown instance (errored out without cleanup): drop the dangling subscription\n      await store.unsubscribe(handle);\n      continue;\n    }\n    try {\n      await instance.sendEvent({ type: WAKE_EVENT_TYPE, payload: { event } });\n      woke++;\n    } catch {\n      // Transient send failure (or an instance finishing right now): keep the\n      // subscription — a later event retries it, and the wait's own timeout\n      // bounds the damage. Deleting here would silence all future wake-ups.\n    }\n  }\n  return woke;\n}\n\nasync function startTriggeredJourneys(\n  env: JourneyEnv,\n  store: JourneyStore,\n  input: IngestInput & { payload: Record<string, unknown> },\n  ts: number\n): Promise<string[]> {\n  const started: string[] = [];\n  for (const route of await store.findTriggers(input.event)) {\n    // where: the payload gate — evaluated against the incoming event first\n    if (route.where !== null && !matchesWhere(input.payload, route.where)) continue;\n\n    // filter: the profile gate\n    if (route.filter !== null) {\n      const facts = new JourneyFactSource(store, input.userId);\n      if (!(await evaluateCondition(route.filter, facts, ts))) continue;\n    }\n\n    const instanceId = await startJourney(\n      env,\n      store,\n      route.workflow,\n      route.hash,\n      input.userId,\n      ts,\n      {\n        event: input.event,\n        payload: input.payload,\n      }\n    );\n    if (instanceId !== null) started.push(instanceId);\n  }\n  return started;\n}\n\n/**\n * Segment-entry triggers, maintained lazily: on each ingest/identify for a\n * user, re-evaluate every trigger-routed segment for that user and act on the\n * membership transition (enter → start journeys, leave → drop membership so a\n * later re-entry is observable). Purely time-driven drift (an inactivity\n * segment turning true by clock alone) has no event to ride on: the scheduled\n * sweep catches it (`sweepSegments`).\n */\nexport async function refreshSegmentTriggers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number\n): Promise<string[]> {\n  return refreshSegments(env, store, userId, ts, await store.listSegmentTriggers());\n}\n\n/**\n * Re-evaluate segments for one user — the routed ones only, or with `segments` every one named —\n * and act on each membership transition: entering records the membership and starts the\n * segment's routed workflows, leaving drops it. A segment trigger therefore starts journeys for\n * users who enter after it is deployed; a user already a member is not entered again.\n */\nasync function refreshSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number,\n  routes: readonly SegmentTriggerRoute[],\n  segments: readonly string[] = [],\n  // A sweep loads each definition once for all its users, not once per user\n  definitions = new Map<string, ConditionIR | undefined>()\n): Promise<string[]> {\n  const bySegment = new Map<string, { workflow: string; hash: string }[]>(\n    segments.map((name) => [name, []])\n  );\n  for (const route of routes) {\n    const list = bySegment.get(route.segment) ?? [];\n    list.push({ workflow: route.workflow, hash: route.hash });\n    bySegment.set(route.segment, list);\n  }\n  if (bySegment.size === 0) return [];\n\n  const facts = new JourneyFactSource(store, userId);\n  const started: string[] = [];\n  const failures: unknown[] = [];\n  for (const [segmentId, segmentRoutes] of bySegment) {\n    if (!definitions.has(segmentId)) {\n      definitions.set(segmentId, await store.getSegmentCondition(segmentId));\n    }\n    const definition = definitions.get(segmentId);\n    if (definition === undefined) continue; // route without a definition: broken deploy, skip\n\n    const matches = await evaluateCondition(definition, facts, ts);\n    const member = await store.isSegmentMember(segmentId, userId);\n\n    if (matches && !member) {\n      // Entry transition: the membership and the starts it owes, recorded together\n      await store.addSegmentMember(\n        segmentId,\n        userId,\n        ts,\n        segmentRoutes.map((route) => route.workflow)\n      );\n    } else if (!matches && member) {\n      await store.removeSegmentMember(segmentId, userId);\n      continue;\n    }\n    if (!matches) continue;\n\n    // Every start the entry still owes — a fresh entry's, or one an earlier evaluation failed on.\n    // Each is crossed off once its instance exists, so one workflow failing neither blocks the\n    // others nor gets lost: the next evaluation (the sweep, the user's next event) retries it.\n    const pending = new Set(await store.pendingSegmentStarts(segmentId, userId));\n    for (const route of segmentRoutes) {\n      if (!pending.has(route.workflow)) continue;\n      try {\n        const instanceId = await startJourney(env, store, route.workflow, route.hash, userId, ts, {\n          event: '$segment_entry',\n          payload: { segment: segmentId },\n        });\n        if (instanceId !== null) started.push(instanceId);\n        await store.completeSegmentStart(segmentId, userId, route.workflow);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n  }\n  // Surface a failure to the caller (an ingest answers 500) once every start had its chance\n  if (failures.length > 0) throw failures[0];\n  return started;\n}\n\nexport interface SweepResult {\n  users: number;\n  /** Journeys the segments' entries started. */\n  started: string[];\n  /** Each deployed segment's size after the sweep (empty when the store keeps no reporting). */\n  sizes: { segment: string; size: number }[];\n}\n\n/**\n * The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a\n * journey's conditions run on, so a member is exactly who a journey would see in it. Membership\n * follows (joiners keep the time they joined, leavers are removed), segment triggers start the\n * journeys of whoever entered by the clock alone, and the store records each segment's size.\n * It walks users one by one: fine for thousands, a large audience wants SQL-side evaluation.\n */\nexport async function sweepSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<SweepResult> {\n  // Erasures left unfinished (an instance would not stop) first: their users are not evaluated\n  const erasing = new Set<string>();\n  for (const userId of await store.pendingErasures()) {\n    try {\n      const { erased } = await eraseUser(env, userId, store);\n      if (!erased) erasing.add(userId);\n    } catch (error) {\n      // Still pending: the next sweep tries again, and the rest of this one goes on\n      erasing.add(userId);\n      console.error(`[workflow] erasure of ${userId} failed`, error);\n    }\n  }\n  const segments = (await store.listSegments()).map((segment) => segment.id);\n  const routes = await store.listSegmentTriggers();\n  const users = (await store.listUserIds()).filter((userId) => !erasing.has(userId));\n  const started: string[] = [];\n  const definitions = new Map<string, ConditionIR | undefined>();\n  for (const userId of users) {\n    try {\n      started.push(\n        ...(await refreshSegments(env, store, userId, now, routes, segments, definitions))\n      );\n    } catch (error) {\n      // One user's failed start is kept for the next sweep; it must not stop everyone else's\n      console.error(`[workflow] segment refresh for ${userId} failed`, error);\n    }\n  }\n  const sizes = (await store.reporting?.snapshotSegments(now)) ?? [];\n  return { users: users.length, started, sizes };\n}\n\n/**\n * Create one journey instance behind the entry ledger. Returns null when the\n * once-policy blocks the entry (the store's attempt is atomic, so concurrent\n * ingests cannot double-enter). A pair whose previous instance is recorded as\n * 'failed' is reclaimed rather than barred forever over one outage.\n */\nasync function startJourney(\n  env: JourneyEnv,\n  store: JourneyStore,\n  workflow: string,\n  hash: string,\n  userId: string,\n  ts: number,\n  trigger: { event: string; payload: Record<string, unknown> }\n): Promise<string | null> {\n  const instanceId = buildInstanceId(workflow, hash, userId, ts);\n  const params: JourneyParams = { workflowId: workflow, contentHash: hash, userId, trigger };\n\n  const outcome = await store.enterJourney({ workflow, userId, instanceId, hash, ts });\n  if (outcome === null) return null; // already entered, and still alive\n\n  try {\n    await env.JOURNEY.create({ id: instanceId, params });\n  } catch (error) {\n    if (outcome === 'reclaimed') {\n      // Put the corpse back rather than deleting it: the entry is still a\n      // failure, and dropping the row would erase that from the ledger.\n      await store.setEntryStatus(instanceId, 'failed');\n    } else {\n      // Roll the ledger back so a retried ingest can enter — otherwise the\n      // once-policy would permanently record an entry that never ran.\n      await store.removeEntry(instanceId);\n    }\n    throw error;\n  }\n  return instanceId;\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * Instance id: addressable (the router gets it directly to wake it), ≤100\n * chars, legal charset. The murmur3 fingerprint keeps ids distinct when the\n * sanitized/truncated userId alone would collide.\n */\nfunction buildInstanceId(workflow: string, hash: string, userId: string, ts: number): string {\n  const uid = userId.replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 24);\n  const fingerprint = murmur3(utf8.encode(userId)).toString(36);\n  return `${workflow.slice(0, 32)}-${hash.slice(0, 8)}-${uid}-${fingerprint}-${ts.toString(36)}`;\n}\n\n/* --------------------------------- identify --------------------------------- */\n\nexport interface IdentifyResult {\n  ok: true;\n  props: ProfileProps;\n  woke: number;\n  started: string[];\n}\n\n/**\n * Merge-patch profile properties (a null removes one), then wake property waits\n * and re-evaluate segment triggers. The merge is one statement in the store, so\n * two identifies landing together cannot lose each other's fields.\n */\nexport async function identifyUser(\n  env: JourneyEnv,\n  userId: string,\n  props: ProfileProps,\n  store: JourneyStore = d1Store(env)\n): Promise<IdentifyResult> {\n  const ts = Date.now();\n  const merged = await store.mergeProfile(userId, props);\n  // Property-condition waits subscribe to this reserved event (see relevantEvents)\n  const woke = await wakeSubscribers(env, store, userId, PROFILE_UPDATED_EVENT);\n  // A profile change can move the user into (or out of) a trigger-routed segment\n  const started = await refreshSegmentTriggers(env, store, userId, ts);\n  return { ok: true, props: merged, woke, started };\n}\n\nexport interface DeviceRegistration {\n  userId: string;\n  token: string;\n  platform: string;\n  ts?: number;\n}\n\n/**\n * A push token registered for the user (or moved to them from another account: a token belongs\n * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside\n * `waitUntil`), for the new owner and the previous one.\n */\nexport async function registerDevice(\n  env: JourneyEnv,\n  device: DeviceRegistration,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const previous = await store.removeDevice(device.token);\n  await store.upsertDevice({ ...device, ts: device.ts ?? Date.now() });\n  let woke = await wakeSubscribers(env, store, device.userId, DEVICES_UPDATED_EVENT);\n  if (previous !== undefined && previous !== device.userId) {\n    woke += await wakeSubscribers(env, store, previous, DEVICES_UPDATED_EVENT);\n  }\n  return { ok: true, woke };\n}\n\n/**\n * A deleted account: everything the engine keeps about the user is erased and the journeys still\n * running for them are terminated, so nothing more is sent. Idempotent.\n */\n/** Workflow instance states that will never run another step. */\nconst STOPPED_STATUSES = new Set(['complete', 'errored', 'terminated']);\n\n/**\n * Stop one instance for good; true once it is known not to run again. An instance the platform\n * no longer knows, or one already finished (terminate refuses those), counts as stopped. Any other\n * failure is not taken for \"already gone\": it answers false, and the erasure waits for a retry.\n */\nasync function stopInstance(env: JourneyEnv, instanceId: string): Promise<boolean> {\n  let instance: WorkflowInstanceLike;\n  try {\n    instance = await env.JOURNEY.get(instanceId);\n  } catch (error) {\n    if (/not[_ ]found/i.test(String(error))) return true;\n    console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);\n    return false;\n  }\n  if (instance.terminate === undefined) return false;\n  try {\n    await instance.terminate();\n    return true;\n  } catch (error) {\n    const status = await instance.status?.().catch(() => undefined);\n    if (status !== undefined && STOPPED_STATUSES.has(status.status)) return true;\n    console.warn(`[workflow] terminating ${instanceId} failed`, error);\n    return false;\n  }\n}\n\n/**\n * Carry out a recorded erasure: stop every running instance of the user, and only once all have\n * stopped erase their data (the request with it). Stopping first means no step can write rows\n * back after the erase; erasing nothing until then keeps the entries that name the instances\n * still to stop, so a retry can finish the job.\n */\nasync function eraseUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore\n): Promise<{ erased: boolean; pending: string[] }> {\n  const pending: string[] = [];\n  for (const instanceId of await store.runningInstances(userId)) {\n    if (!(await stopInstance(env, instanceId))) pending.push(instanceId);\n  }\n  if (pending.length > 0) return { erased: false, pending };\n  await store.forgetUser(userId);\n  return { erased: true, pending };\n}\n\n/**\n * Forget a user (a deleted account): the request is recorded first, then carried out. An\n * instance that will not stop leaves it pending — nothing erased yet — and the scheduled sweep\n * retries it; `erased: false` says so.\n */\nexport async function forgetUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore = d1Store(env),\n  now = Date.now()\n): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n  await store.requestErasure(userId, now);\n  return { ok: true, ...(await eraseUser(env, userId, store)) };\n}\n\n/**\n * The user signed out on the device: the token stays registered, bound to nobody, so the next\n * sign-in only has to bind it again. Wakes the former owner's device waits (`reachable('push')`\n * may no longer hold).\n */\nexport async function unbindDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.unbindDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT);\n  return { ok: true, woke };\n}\n\n/** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */\nexport async function removeDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.removeDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT);\n  return { ok: true, woke };\n}\n\n/* ---------------------------------- deploy ---------------------------------- */\n\nexport interface DeployResult {\n  workflows: string[];\n  /**\n   * Workflows whose trigger type has no runtime routing yet — they deploy (the\n   * IR is stored and versioned) but will never start until the routing lands.\n   * Currently: date (TODO — needs cron + Queues, instance creation is\n   * rate-limited and a date trigger fans out to the whole audience at once)\n   * and webhook (TODO — needs endpoint allocation).\n   */\n  unrouted: { workflow: string; trigger: TriggerIR['type'] }[];\n  /**\n   * Whether the routes now point at this bundle: always for a forced deploy, false for a\n   * versioned one when a version as new or newer is already live (nothing was swapped).\n   */\n  applied: boolean;\n}\n\n/** A versioned deploy on a store that cannot tell which version is live (D1). */\nexport class UnversionedStoreError extends Error {\n  override readonly name = 'UnversionedStoreError';\n  constructor() {\n    super('this store does not record which version is live: deploy with POST /bundle/deploy');\n  }\n}\n\n/** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */\nexport class BundleIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'BundleIntegrityError';\n  }\n}\n\n/**\n * Recompute every declared contentHash and refuse the bundle if one disagrees.\n *\n * The contentHash is the address an in-flight journey reads its IR from, so\n * a hash that does not describe its own content is a way to change what a\n * pinned instance executes: submit an edited flow under the old hash and the\n * next replay picks it up. The compiler always computes the hash it ships, so\n * a mismatch means a hand-rolled payload or a stale client — neither should be\n * able to overwrite a version that journeys are running.\n *\n * Each hash is recomputed exactly the way its compiler produced it: a workflow\n * hashes its whole IR (contentHash strips itself), a segment hashes only its\n * condition. Mirroring them is load-bearing — recomputing a segment over the\n * whole record would reject every honest deploy.\n */\nfunction verifyBundleHashes(parsed: BundleIR): void {\n  const mismatched: string[] = [];\n  for (const workflow of parsed.workflows) {\n    if (semanticHash(workflow) !== workflow.contentHash) {\n      mismatched.push(`workflow '${workflow.id}'`);\n    }\n  }\n  for (const segment of parsed.segments) {\n    if (semanticHash(segment.condition) !== segment.contentHash) {\n      mismatched.push(`segment '${segment.id}'`);\n    }\n  }\n  if (mismatched.length > 0) {\n    throw new BundleIntegrityError(\n      `contentHash does not match content for ${mismatched.join(', ')} — recompile the bundle instead of editing it by hand`\n    );\n  }\n}\n\n/**\n * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed\n * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens\n * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle\n * compiled into it; without one it is forced, whatever is live.\n */\nexport async function deployBundle(\n  env: JourneyEnv,\n  bundle: unknown,\n  store: JourneyStore = d1Store(env),\n  version?: BundleVersion\n): Promise<DeployResult> {\n  if (version !== undefined && store.replaceRoutesIfNewer === undefined) {\n    throw new UnversionedStoreError();\n  }\n  const parsed = BundleIR.parse(bundle);\n  // Before any write: a bad hash must not reach the store, where it would address content it does not describe\n  verifyBundleHashes(parsed);\n  // Nor a bundle the database cannot hold: the host migrates, the engine only checks\n  const problems = (await store.checkSchema?.()) ?? [];\n  if (problems.length > 0) throw new SchemaMismatchError(problems);\n\n  for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);\n  let applied = true;\n  if (version === undefined) await store.replaceRoutes(parsed);\n  else applied = (await store.replaceRoutesIfNewer?.(parsed, version)) ?? false;\n\n  const unrouted = parsed.workflows\n    .filter((workflow) => workflow.trigger.type === 'date' || workflow.trigger.type === 'webhook')\n    .map((workflow) => ({ workflow: workflow.id, trigger: workflow.trigger.type }));\n\n  return {\n    workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),\n    unrouted,\n    applied,\n  };\n}\n\n/* ----------------------------------- http ----------------------------------- */\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body: unknown = await request.json();\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\nexport async function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore = d1Store(env),\n  validation: IngestValidation = {}\n): Promise<Response> {\n  const url = new URL(request.url);\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n  const { contract } = validation;\n  const enforce = validation.mode !== 'report';\n  /** The contract's verdict: the value to use, or the response refusing the request. */\n  const checked = <T>(\n    result: ContractResult<T>,\n    original: T,\n    what: string\n  ): { value: T } | { refused: Response } => {\n    if (result.ok) return { value: result.data };\n    const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n    if (!enforce) {\n      console.warn(`[workflow router] contract would refuse ${what}: ${issues.join('; ')}`);\n      return { value: original };\n    }\n    return {\n      refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n    };\n  };\n\n  if (request.method === 'GET' && url.pathname === '/health') {\n    return json({ ok: true });\n  }\n\n  // Bearer auth on everything mutating. An unset token means an open dev\n  // instance (see JourneyEnv.API_TOKEN) — production must configure it.\n  if (env.API_TOKEN !== undefined) {\n    if (request.headers.get('authorization') !== `Bearer ${env.API_TOKEN}`) {\n      return json({ error: 'unauthorized' }, 401);\n    }\n  }\n\n  try {\n    if (request.method === 'POST' && url.pathname === '/events') {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && typeof ts !== 'number') {\n        return json({ error: 'ts must be a number' }, 400);\n      }\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (contract !== undefined) {\n        const verdict = checked(\n          checkEvent(contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/identify') {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      let patch = props as ProfileProps;\n      if (contract !== undefined) {\n        const verdict = checked(contract.parseProfilePatch(props), patch, 'identify');\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices') {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && typeof ts !== 'number')\n        return json({ error: 'ts must be a number' }, 400);\n      return json(\n        await registerDevice(\n          env,\n          { userId, token, platform, ...(ts === undefined ? {} : { ts }) },\n          store\n        )\n      );\n    }\n\n    if (request.method === 'POST' && url.pathname === '/messages/opened') {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded =\n        store.reporting !== undefined && (await recordPushOpen(store.reporting, userId, messageId));\n      return json({ ok: true, recorded });\n    }\n\n    if (request.method === 'POST' && url.pathname === '/users/forget') {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices/unbind') {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/devices/remove') {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    }\n\n    if (request.method === 'POST' && url.pathname === '/deploy') {\n      return json(await deployBundle(env, await request.json(), store));\n    }\n\n    return json({ error: 'not found' }, 404);\n  } catch (error) {\n    // Validation problems are the caller's to fix; anything else stays out of\n    // the response body (internals are logged, not leaked).\n    if (error instanceof z.core.$ZodError) {\n      return json({ error: `invalid payload: ${error.message}` }, 400);\n    }\n    // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n    if (error instanceof BundleIntegrityError) {\n      return json({ error: error.message }, 400);\n    }\n    // The operator's to fix (run the migrations), so the response says what is missing\n    if (error instanceof SchemaMismatchError) {\n      return json({ error: error.message, problems: error.problems }, 503);\n    }\n    console.error('[workflow router]', error);\n    return json({ error: 'internal error' }, 500);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuEA,eAAsB,YACpB,KACA,OACA,QAAsBA,0BAAAA,QAAQ,GAAG,GACV;CACvB,IAAI,MAAM,MAAM,WAAW,GAAG,GAC5B,MAAM,IAAI,MAAM,eAAe,MAAM,MAAM,uCAAuC;CAEpF,MAAM,KAAK,MAAM,MAAM,KAAK,IAAI;CAChC,MAAM,UAAU,MAAM,WAAW,CAAC;CAIlC,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW;CAEzC,MAAM,SAAS,MAAM,MAAM,YAAY;EACrC;EACA,QAAQ,MAAM;EACd,OAAO,MAAM;EACb;EACA;CACF,CAAC;CASD,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,MAAM,KAAK;CACxE,MAAM,UAAU,MAAM,uBAAuB,KAAK,OAAO;EAAE,GAAG;EAAO;CAAQ,GAAG,EAAE;CAClF,QAAQ,KAAK,GAAI,MAAM,uBAAuB,KAAK,OAAO,MAAM,QAAQ,EAAE,CAAE;CAC5E,OAAO;EAAE;EAAI;EAAQ;EAAM;CAAQ;AACrC;AAEA,eAAe,gBACb,KACA,OACA,QACA,OACiB;CACjB,IAAI,OAAO;CACX,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,QAAQ,KAAK,GAAG;EAC/D,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,IAAI,QAAQ,IAAI,MAAM;EACzC,QAAQ;GAEN,MAAM,MAAM,YAAY,MAAM;GAC9B;EACF;EACA,IAAI;GACF,MAAM,SAAS,UAAU;IAAE,MAAMC,4BAAAA;IAAiB,SAAS,EAAE,MAAM;GAAE,CAAC;GACtE;EACF,QAAQ,CAIR;CACF;CACA,OAAO;AACT;AAEA,eAAe,uBACb,KACA,OACA,OACA,IACmB;CACnB,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,MAAM,MAAM,aAAa,MAAM,KAAK,GAAG;EAEzD,IAAI,MAAM,UAAU,QAAQ,CAACC,yBAAAA,aAAa,MAAM,SAAS,MAAM,KAAK,GAAG;EAGvE,IAAI,MAAM,WAAW,MAAM;GACzB,MAAM,QAAQ,IAAIC,oBAAAA,kBAAkB,OAAO,MAAM,MAAM;GACvD,IAAI,CAAE,MAAMC,yBAAAA,kBAAkB,MAAM,QAAQ,OAAO,EAAE,GAAI;EAC3D;EAEA,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,MAAM,QACN,IACA;GACE,OAAO,MAAM;GACb,SAAS,MAAM;EACjB,CACF;EACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;CAClD;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,uBACpB,KACA,OACA,QACA,IACmB;CACnB,OAAO,gBAAgB,KAAK,OAAO,QAAQ,IAAI,MAAM,MAAM,oBAAoB,CAAC;AAClF;;;;;;;AAQA,eAAe,gBACb,KACA,OACA,QACA,IACA,QACA,WAA8B,CAAC,GAE/B,8BAAc,IAAI,IAAqC,GACpC;CACnB,MAAM,YAAY,IAAI,IACpB,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CACnC;CACA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OAAO,UAAU,IAAI,MAAM,OAAO,KAAK,CAAC;EAC9C,KAAK,KAAK;GAAE,UAAU,MAAM;GAAU,MAAM,MAAM;EAAK,CAAC;EACxD,UAAU,IAAI,MAAM,SAAS,IAAI;CACnC;CACA,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,IAAID,oBAAAA,kBAAkB,OAAO,MAAM;CACjD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,WAAW,kBAAkB,WAAW;EAClD,IAAI,CAAC,YAAY,IAAI,SAAS,GAC5B,YAAY,IAAI,WAAW,MAAM,MAAM,oBAAoB,SAAS,CAAC;EAEvE,MAAM,aAAa,YAAY,IAAI,SAAS;EAC5C,IAAI,eAAe,KAAA,GAAW;EAE9B,MAAM,UAAU,MAAMC,yBAAAA,kBAAkB,YAAY,OAAO,EAAE;EAC7D,MAAM,SAAS,MAAM,MAAM,gBAAgB,WAAW,MAAM;EAE5D,IAAI,WAAW,CAAC,QAEd,MAAM,MAAM,iBACV,WACA,QACA,IACA,cAAc,KAAK,UAAU,MAAM,QAAQ,CAC7C;OACK,IAAI,CAAC,WAAW,QAAQ;GAC7B,MAAM,MAAM,oBAAoB,WAAW,MAAM;GACjD;EACF;EACA,IAAI,CAAC,SAAS;EAKd,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,qBAAqB,WAAW,MAAM,CAAC;EAC3E,KAAK,MAAM,SAAS,eAAe;GACjC,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG;GAClC,IAAI;IACF,MAAM,aAAa,MAAM,aAAa,KAAK,OAAO,MAAM,UAAU,MAAM,MAAM,QAAQ,IAAI;KACxF,OAAO;KACP,SAAS,EAAE,SAAS,UAAU;IAChC,CAAC;IACD,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;IAChD,MAAM,MAAM,qBAAqB,WAAW,QAAQ,MAAM,QAAQ;GACpE,SAAS,OAAO;IACd,SAAS,KAAK,KAAK;GACrB;EACF;CACF;CAEA,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CACxC,OAAO;AACT;;;;;;;;AAiBA,eAAsB,cACpB,KACA,OACA,MAAM,KAAK,IAAI,GACO;CAEtB,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,GAC/C,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,UAAU,KAAK,QAAQ,KAAK;EACrD,IAAI,CAAC,QAAQ,QAAQ,IAAI,MAAM;CACjC,SAAS,OAAO;EAEd,QAAQ,IAAI,MAAM;EAClB,QAAQ,MAAM,yBAAyB,OAAO,UAAU,KAAK;CAC/D;CAEF,MAAM,YAAY,MAAM,MAAM,aAAa,EAAA,CAAG,KAAK,YAAY,QAAQ,EAAE;CACzE,MAAM,SAAS,MAAM,MAAM,oBAAoB;CAC/C,MAAM,SAAS,MAAM,MAAM,YAAY,EAAA,CAAG,QAAQ,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC;CACjF,MAAM,UAAoB,CAAC;CAC3B,MAAM,8BAAc,IAAI,IAAqC;CAC7D,KAAK,MAAM,UAAU,OACnB,IAAI;EACF,QAAQ,KACN,GAAI,MAAM,gBAAgB,KAAK,OAAO,QAAQ,KAAK,QAAQ,UAAU,WAAW,CAClF;CACF,SAAS,OAAO;EAEd,QAAQ,MAAM,kCAAkC,OAAO,UAAU,KAAK;CACxE;CAEF,MAAM,QAAS,MAAM,MAAM,WAAW,iBAAiB,GAAG,KAAM,CAAC;CACjE,OAAO;EAAE,OAAO,MAAM;EAAQ;EAAS;CAAM;AAC/C;;;;;;;AAQA,eAAe,aACb,KACA,OACA,UACA,MACA,QACA,IACA,SACwB;CACxB,MAAM,aAAa,gBAAgB,UAAU,MAAM,QAAQ,EAAE;CAC7D,MAAM,SAAwB;EAAE,YAAY;EAAU,aAAa;EAAM;EAAQ;CAAQ;CAEzF,MAAM,UAAU,MAAM,MAAM,aAAa;EAAE;EAAU;EAAQ;EAAY;EAAM;CAAG,CAAC;CACnF,IAAI,YAAY,MAAM,OAAO;CAE7B,IAAI;EACF,MAAM,IAAI,QAAQ,OAAO;GAAE,IAAI;GAAY;EAAO,CAAC;CACrD,SAAS,OAAO;EACd,IAAI,YAAY,aAGd,MAAM,MAAM,eAAe,YAAY,QAAQ;OAI/C,MAAM,MAAM,YAAY,UAAU;EAEpC,MAAM;CACR;CACA,OAAO;AACT;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAS,gBAAgB,UAAkB,MAAc,QAAgB,IAAoB;CAC3F,MAAM,MAAM,OAAO,QAAQ,mBAAmB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAC9D,MAAM,cAAcC,sBAAAA,QAAQ,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE;CAC5D,OAAO,GAAG,SAAS,MAAM,GAAG,EAAE,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,YAAY,GAAG,GAAG,SAAS,EAAE;AAC7F;;;;;;AAgBA,eAAsB,aACpB,KACA,QACA,OACA,QAAsBL,0BAAAA,QAAQ,GAAG,GACR;CACzB,MAAM,KAAK,KAAK,IAAI;CAMpB,OAAO;EAAE,IAAI;EAAM,OAAO,MALL,MAAM,aAAa,QAAQ,KAAK;EAKnB,MAAA,MAHf,gBAAgB,KAAK,OAAO,QAAQM,yBAAAA,qBAAqB;EAGpC,SAAA,MADlB,uBAAuB,KAAK,OAAO,QAAQ,EAAE;CACnB;AAClD;;;;;;AAcA,eAAsB,eACpB,KACA,QACA,QAAsBN,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,WAAW,MAAM,MAAM,aAAa,OAAO,KAAK;CACtD,MAAM,MAAM,aAAa;EAAE,GAAG;EAAQ,IAAI,OAAO,MAAM,KAAK,IAAI;CAAE,CAAC;CACnE,IAAI,OAAO,MAAM,gBAAgB,KAAK,OAAO,OAAO,QAAQO,yBAAAA,qBAAqB;CACjF,IAAI,aAAa,KAAA,KAAa,aAAa,OAAO,QAChD,QAAQ,MAAM,gBAAgB,KAAK,OAAO,UAAUA,yBAAAA,qBAAqB;CAE3E,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;;;;;AAOA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAY;CAAW;AAAY,CAAC;;;;;;AAOtE,eAAe,aAAa,KAAiB,YAAsC;CACjF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,IAAI,QAAQ,IAAI,UAAU;CAC7C,SAAS,OAAO;EACd,IAAI,gBAAgB,KAAK,OAAO,KAAK,CAAC,GAAG,OAAO;EAChD,QAAQ,KAAK,yBAAyB,WAAW,qBAAqB,KAAK;EAC3E,OAAO;CACT;CACA,IAAI,SAAS,cAAc,KAAA,GAAW,OAAO;CAC7C,IAAI;EACF,MAAM,SAAS,UAAU;EACzB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9D,IAAI,WAAW,KAAA,KAAa,iBAAiB,IAAI,OAAO,MAAM,GAAG,OAAO;EACxE,QAAQ,KAAK,0BAA0B,WAAW,UAAU,KAAK;EACjE,OAAO;CACT;AACF;;;;;;;AAQA,eAAe,UACb,KACA,QACA,OACiD;CACjD,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,cAAc,MAAM,MAAM,iBAAiB,MAAM,GAC1D,IAAI,CAAE,MAAM,aAAa,KAAK,UAAU,GAAI,QAAQ,KAAK,UAAU;CAErE,IAAI,QAAQ,SAAS,GAAG,OAAO;EAAE,QAAQ;EAAO;CAAQ;CACxD,MAAM,MAAM,WAAW,MAAM;CAC7B,OAAO;EAAE,QAAQ;EAAM;CAAQ;AACjC;;;;;;AAOA,eAAsB,WACpB,KACA,QACA,QAAsBP,0BAAAA,QAAQ,GAAG,GACjC,MAAM,KAAK,IAAI,GAC4C;CAC3D,MAAM,MAAM,eAAe,QAAQ,GAAG;CACtC,OAAO;EAAE,IAAI;EAAM,GAAI,MAAM,UAAU,KAAK,QAAQ,KAAK;CAAG;AAC9D;;;;;;AAOA,eAAsB,aACpB,KACA,OACA,QAAsBA,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAOO,yBAAAA,qBAAqB;CAClE;AAC1B;;AAGA,eAAsB,aACpB,KACA,OACA,QAAsBP,0BAAAA,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAOO,yBAAAA,qBAAqB;CAClE;AAC1B;;AAsBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,OAAyB;CACzB,cAAc;EACZ,MAAM,mFAAmF;CAC3F;AACF;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,mBAAmB,QAAwB;CAClD,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,YAAY,OAAO,WAC5B,IAAIC,aAAAA,aAAa,QAAQ,MAAM,SAAS,aACtC,WAAW,KAAK,aAAa,SAAS,GAAG,EAAE;CAG/C,KAAK,MAAM,WAAW,OAAO,UAC3B,IAAIA,aAAAA,aAAa,QAAQ,SAAS,MAAM,QAAQ,aAC9C,WAAW,KAAK,YAAY,QAAQ,GAAG,EAAE;CAG7C,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,qBACR,0CAA0C,WAAW,KAAK,IAAI,EAAE,sDAClE;AAEJ;;;;;;;AAQA,eAAsB,aACpB,KACA,QACA,QAAsBR,0BAAAA,QAAQ,GAAG,GACjC,SACuB;CACvB,IAAI,YAAY,KAAA,KAAa,MAAM,yBAAyB,KAAA,GAC1D,MAAM,IAAI,sBAAsB;CAElC,MAAM,SAASS,WAAAA,SAAS,MAAM,MAAM;CAEpC,mBAAmB,MAAM;CAEzB,MAAM,WAAY,MAAM,MAAM,cAAc,KAAM,CAAC;CACnD,IAAI,SAAS,SAAS,GAAG,MAAM,IAAIC,oBAAAA,oBAAoB,QAAQ;CAE/D,KAAK,MAAM,YAAY,OAAO,WAAW,MAAM,MAAM,cAAc,QAAQ;CAC3E,IAAI,UAAU;CACd,IAAI,YAAY,KAAA,GAAW,MAAM,MAAM,cAAc,MAAM;MACtD,UAAW,MAAM,MAAM,uBAAuB,QAAQ,OAAO,KAAM;CAExE,MAAM,WAAW,OAAO,UACrB,QAAQ,aAAa,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ,SAAS,SAAS,CAAC,CAC7F,KAAK,cAAc;EAAE,UAAU,SAAS;EAAI,SAAS,SAAS,QAAQ;CAAK,EAAE;CAEhF,OAAO;EACL,WAAW,OAAO,UAAU,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,GAAG;EAC7E;EACA;CACF;AACF;;;;;;AASA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAgB,MAAM,QAAQ,KAAK;CACzC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAaA,eAAsB,cACpB,SACA,KACA,QAAsBV,0BAAAA,QAAQ,GAAG,GACjC,aAA+B,CAAC,GACb;CACnB,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CACH,MAAM,EAAE,aAAa;CACrB,MAAM,UAAU,WAAW,SAAS;;CAEpC,MAAM,WACJ,QACA,UACA,SACyC;EACzC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;EAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;EAC7E,IAAI,CAAC,SAAS;GACZ,QAAQ,KAAK,2CAA2C,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;GACpF,OAAO,EAAE,OAAO,SAAS;EAC3B;EACA,OAAO,EACL,SAAS,KAAK;GAAE,OAAO,GAAG,KAAK;GAA2B,QAAQ,OAAO;EAAO,GAAG,GAAG,EACxF;CACF;CAEA,IAAI,QAAQ,WAAW,SAAS,IAAI,aAAa,WAC/C,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC;CAK1B,IAAI,IAAI,cAAc,KAAA,GAChB;MAAA,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI,aACzD,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CAAA;CAI9C,IAAI;EACF,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,WAAW;GAC3D,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,OAAO,OAAO,UACpC,OAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GAEnD,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,UAAU,QACdW,iBAAAA,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACzC,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAM,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,aAAa;GAC7D,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAChF,IAAI,QAAQ;GACZ,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,GAAG,OAAO,UAAU;IAC5E,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAM,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,YAAY;GAC5D,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,OAAO,OAAO,UACpC,OAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GACnD,OAAO,KACL,MAAM,eACJ,KACA;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG,GAC/D,KACF,CACF;EACF;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,oBAAoB;GACpE,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAGlF,OAAO,KAAK;IAAE,IAAI;IAAM,UADtB,MAAM,cAAc,KAAA,KAAc,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GAC1D,CAAC;EACpC;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,iBAAiB;GACjE,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAM,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,mBAAmB;GACnE,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,mBAAmB;GACnE,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;EAEA,IAAI,QAAQ,WAAW,UAAU,IAAI,aAAa,WAChD,OAAO,KAAK,MAAM,aAAa,KAAK,MAAM,QAAQ,KAAK,GAAG,KAAK,CAAC;EAGlE,OAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;CACzC,SAAS,OAAO;EAGd,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;EAGjE,IAAI,iBAAiB,sBACnB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;EAG3C,IAAI,iBAAiBH,oBAAAA,qBACnB,OAAO,KAAK;GAAE,OAAO,MAAM;GAAS,UAAU,MAAM;EAAS,GAAG,GAAG;EAErE,QAAQ,MAAM,qBAAqB,KAAK;EACxC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAC9C;AACF"}

package/dist/cloudflare/router.d.cts

@@ -1,7 +1,7 @@
 import { TriggerIR } from "../ir.cjs";
 import { Contract } from "../contract.cjs";
 import { JourneyEnv } from "./bindings.cjs";
-import { JourneyStore, ProfileProps } from "../store/index.cjs";
+import { BundleVersion, JourneyStore, ProfileProps } from "../store/index.cjs";
 //#region src/cloudflare/router.d.ts
 /**
  * Ingest router. An incoming event does four things: it is stored, it wakes
@@ -135,13 +135,28 @@ export interface DeployResult {
     workflow: string;
     trigger: TriggerIR['type'];
   }[];
+  /**
+   * Whether the routes now point at this bundle: always for a forced deploy, false for a
+   * versioned one when a version as new or newer is already live (nothing was swapped).
+   */
+  applied: boolean;
+}
+/** A versioned deploy on a store that cannot tell which version is live (D1). */
+export declare class UnversionedStoreError extends Error {
+  readonly name = "UnversionedStoreError";
+  constructor();
 }
 /** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */
 export declare class BundleIntegrityError extends Error {
   constructor(message: string);
 }
-/** Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed deploy leaves only harmless orphans), then the routing swap. */
-export declare function deployBundle(env: JourneyEnv, bundle: unknown, store?: JourneyStore): Promise<DeployResult>;
+/**
+ * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed
+ * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens
+ * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle
+ * compiled into it; without one it is forced, whatever is live.
+ */
+export declare function deployBundle(env: JourneyEnv, bundle: unknown, store?: JourneyStore, version?: BundleVersion): Promise<DeployResult>;
 /**
  * How the ingest API applies a contract: 'enforce' refuses an invalid event or
  * patch with a 400 before anything is stored, woken or started; 'report' logs

package/dist/cloudflare/router.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.cts","names":[],"sources":["../../src/cloudflare/router.ts"],"mappings":";;;;;;;;;;;;;;;;iBAuCiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,QAAO,eACN,QAAQ;;;;;;;;;wBAsGW,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBAgFc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;;;;;;;wBAUN,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAqFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,QAAO,eACN,QAAQ;iBAUM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,QAAO,eACN;EAAU;EAAU;;;;;;;wBAoED,WACpB,KAAK,YACL,gBACA,QAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;qBAI5B,6BAA6B;EACxC,YAAY;;;wBAyCQ,aACpB,KAAK,YACL,iBACA,QAAO,eACN,QAAQ;;;;;;;iBA+CM;EACf,WAAW;EACX;;wBAGoB,cACpB,SAAS,SACT,KAAK,YACL,QAAO,cACP,aAAY,mBACX,QAAQ"}
+{"version":3,"file":"router.d.cts","names":[],"sources":["../../src/cloudflare/router.ts"],"mappings":";;;;;;;;;;;;;;;;iBAwCiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,QAAO,eACN,QAAQ;;;;;;;;;wBAsGW,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBAgFc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;;;;;;;wBAUN,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAqFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,QAAO,eACN,QAAQ;iBAUM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,QAAO,eACN;EAAU;EAAU;;;;;;;wBAoED,WACpB,KAAK,YACL,gBACA,QAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,8BAA8B;WACvB;EAClB;;;qBAMW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,QAAO,cACP,UAAU,gBACT,QAAQ;;;;;;;iBAqDM;EACf,WAAW;EACX;;wBAGoB,cACpB,SAAS,SACT,KAAK,YACL,QAAO,cACP,aAAY,mBACX,QAAQ"}

package/dist/cloudflare/router.d.mts

@@ -1,7 +1,7 @@
 import { TriggerIR } from "../ir.mjs";
 import { Contract } from "../contract.mjs";
 import { JourneyEnv } from "./bindings.mjs";
-import { JourneyStore, ProfileProps } from "../store/index.mjs";
+import { BundleVersion, JourneyStore, ProfileProps } from "../store/index.mjs";
 //#region src/cloudflare/router.d.ts
 /**
  * Ingest router. An incoming event does four things: it is stored, it wakes
@@ -135,13 +135,28 @@ export interface DeployResult {
     workflow: string;
     trigger: TriggerIR['type'];
   }[];
+  /**
+   * Whether the routes now point at this bundle: always for a forced deploy, false for a
+   * versioned one when a version as new or newer is already live (nothing was swapped).
+   */
+  applied: boolean;
+}
+/** A versioned deploy on a store that cannot tell which version is live (D1). */
+export declare class UnversionedStoreError extends Error {
+  readonly name = "UnversionedStoreError";
+  constructor();
 }
 /** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */
 export declare class BundleIntegrityError extends Error {
   constructor(message: string);
 }
-/** Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed deploy leaves only harmless orphans), then the routing swap. */
-export declare function deployBundle(env: JourneyEnv, bundle: unknown, store?: JourneyStore): Promise<DeployResult>;
+/**
+ * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed
+ * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens
+ * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle
+ * compiled into it; without one it is forced, whatever is live.
+ */
+export declare function deployBundle(env: JourneyEnv, bundle: unknown, store?: JourneyStore, version?: BundleVersion): Promise<DeployResult>;
 /**
  * How the ingest API applies a contract: 'enforce' refuses an invalid event or
  * patch with a 400 before anything is stored, woken or started; 'report' logs

package/dist/cloudflare/router.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.mts","names":[],"sources":["../../src/cloudflare/router.ts"],"mappings":";;;;;;;;;;;;;;;;iBAuCiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,QAAO,eACN,QAAQ;;;;;;;;;wBAsGW,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBAgFc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;;;;;;;wBAUN,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAqFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,QAAO,eACN,QAAQ;iBAUM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,QAAO,eACN;EAAU;EAAU;;;;;;;wBAoED,WACpB,KAAK,YACL,gBACA,QAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;qBAI5B,6BAA6B;EACxC,YAAY;;;wBAyCQ,aACpB,KAAK,YACL,iBACA,QAAO,eACN,QAAQ;;;;;;;iBA+CM;EACf,WAAW;EACX;;wBAGoB,cACpB,SAAS,SACT,KAAK,YACL,QAAO,cACP,aAAY,mBACX,QAAQ"}
+{"version":3,"file":"router.d.mts","names":[],"sources":["../../src/cloudflare/router.ts"],"mappings":";;;;;;;;;;;;;;;;iBAwCiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,QAAO,eACN,QAAQ;;;;;;;;;wBAsGW,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBAgFc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;;;;;;;wBAUN,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAqFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,QAAO,eACN,QAAQ;iBAUM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,QAAO,eACN;EAAU;EAAU;;;;;;;wBAoED,WACpB,KAAK,YACL,gBACA,QAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,QAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,8BAA8B;WACvB;EAClB;;;qBAMW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,QAAO,cACP,UAAU,gBACT,QAAQ;;;;;;;iBAqDM;EACf,WAAW;EACX;;wBAGoB,cACpB,SAAS,SACT,KAAK,YACL,QAAO,cACP,aAAY,mBACX,QAAQ"}