@shware/workflow 1.0.0 → 2.0.1

package/dist/cloudflare/worker.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"worker.mjs","names":[],"sources":["../../src/cloudflare/worker.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport { type JourneyConfig, compileConfig } from '../config';\nimport { type Contract, ContractValidationError, checkEvent } from '../contract';\nimport type { RegisteredAction } from '../engine/actions';\nimport type { JourneyObserver, MessageSender, MessageValidator } from '../engine/ports';\nimport { scaleSegmentWindows } from '../engine/time-scale';\nimport type { ScalarIR } from '../ir';\nimport { registryRenderer } from '../react-email';\nimport { reportingObserver } from '../reporting/observer';\nimport { handleTracking } from '../reporting/tracking';\nimport type { JourneyRuntimeOptions } from '../runtime';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  SchemaMismatchError,\n  type StoreLease,\n} from '../store/index';\nimport { DEFAULT_SCHEMA } from '../store/tables';\nimport { TemplateValidationError, registryValidator } from '../templates';\nimport type { JourneyEnv, JourneyParams } from './bindings';\nimport { channelsFromConfig, runtimeFromConfig } from './channels';\nimport { d1Store } from './d1-env';\nimport {\n  type SweepResult,\n  deployBundle,\n  handleRequest,\n  ingestEvent,\n  sweepSegments,\n} from './router';\nimport { JourneyRunner } from './runner';\n\n/** The fetch handler's execution context (the subset used). */\nexport interface ExecutionContextLike {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport interface JourneyWorkerOptions<Env extends JourneyEnv> {\n  /**\n   * The project's `workflow.config.ts` (`defineConfig`): what the Worker\n   * deploys (`GET /bundle`, `POST /bundle/deploy` serve `compileConfig`), the\n   * template registries the senders, the validator and `/preview` render from,\n   * the contract every `/events` and `/identify` is checked against, the email\n   * envelope, actions, and the runtime / APNs / FCM settings. Secrets come\n   * from the env under the names `JourneyEnv` documents.\n   */\n  config: JourneyConfig;\n  /**\n   * The data plane, opened per request and per workflow run. Return a\n   * `StoreLease` when the client must be released afterwards (a Postgres\n   * connection); defaults to D1 + KV from the env's bindings. `database` is\n   * the config's (`schema` defaulting to `workflow`), for a Postgres store:\n   *\n   *   store: (env, database) => postgresJsStore(env.HYPERDRIVE.connectionString, database)\n   */\n  store?: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /**\n   * Reporting hooks: node arrivals, every copy sent (with the tracking it should carry — click\n   * links and an open pixel for email, payload data for a push), and how each instance ended.\n   * By default a store that keeps reporting (Postgres) records them itself, and the Worker\n   * serves the email tracking routes (`/t/...`, on `WORKFLOW_ORIGIN`); override to report\n   * elsewhere.\n   */\n  observer?: (env: Env, store: JourneyStore) => JourneyObserver;\n  /** Message outlet override (tests, a custom gateway); by default the channels the config describes. */\n  messages?: (env: Env, store: JourneyStore) => MessageSender;\n  /** Per-instance runtime options override (a tester in fast-forward); by default `config.runtime` for `ENVIRONMENT`. */\n  runtime?: (env: Env, params: JourneyParams) => JourneyRuntimeOptions;\n  /**\n   * The host's environment, as a zod schema over its vars and secrets (bindings pass through\n   * untouched): checked the first time the Worker runs, so a missing or malformed variable fails\n   * there — every problem listed — not at the send that needs it. Webhook templates read their\n   * URL from the parsed values: `webhook: (env: Env) => env.WEBHOOK_DISCORD_ALERTS`.\n   */\n  env?: core.$ZodType<object>;\n  /** 'enforce' (default) answers an event or patch the contract refuses with a 400; 'report' only logs it. */\n  contractMode?: 'enforce' | 'report';\n}\n\nexport interface JourneyWorker<Env extends JourneyEnv> {\n  /** Export this under the `class_name` of the wrangler `workflows` binding. */\n  Runner: new (...args: never[]) => JourneyRunner;\n  /** The Worker's fetch handler: `/health`, `/events`, `/identify`, `/devices`, `/messages/opened`, `/segments/sweep`, `/t/*` (email tracking), `/deploy`, `/bundle`, `/bundle/deploy` and `/preview/*`. */\n  fetch: (request: Request, env: Env, ctx?: ExecutionContextLike) => Promise<Response>;\n  /**\n   * The segment sweep (`sweepSegments`): membership of every deployed segment for every known\n   * user, the journeys of segments entered by the clock alone (`not(performed(e.login, { within:\n   * '7 days' }))` has no event to ride on), and each segment's size. Also served as\n   * `POST /segments/sweep`.\n   */\n  sweep: (env: Env) => Promise<SweepResult>;\n  /** The cron trigger's handler: runs the sweep. Export it beside `fetch` with a `triggers.crons` entry. */\n  scheduled: (controller: unknown, env: Env, ctx: ExecutionContextLike) => Promise<void>;\n}\n\n/**\n * A complete journey host in one call: the runner class with the app's store,\n * outlets and runtime plugged in, and the fetch handler that serves the ingest\n * API around them.\n *\n *   const journeys = journeyWorker<Env>({\n *     config,   // workflow.config.ts (defineConfig)\n *     store: (env, database) => postgresJsStore(env.HYPERDRIVE.connectionString, database),\n *   });\n *   export const MyRunner = journeys.Runner;\n *   export default { fetch: journeys.fetch };\n */\n/** The Worker's environment failed its schema (`journeyWorker({ env })`). */\nexport class EnvValidationError extends Error {\n  override readonly name = 'EnvValidationError';\n  constructor(readonly issues: readonly string[]) {\n    super(`the Worker's environment is invalid:\\n  ${issues.join('\\n  ')}`);\n  }\n}\n\nexport function journeyWorker<Env extends JourneyEnv>(\n  options: JourneyWorkerOptions<Env>\n): JourneyWorker<Env> {\n  const { config } = options;\n  // Parsed once per env object: the runtime hands the same one to every request of an isolate\n  const checked = new WeakMap<object, Env>();\n  const checkEnv = (env: Env): Env => {\n    if (options.env === undefined) return env;\n    const cached = checked.get(env);\n    if (cached !== undefined) return cached;\n    const result = z.safeParse(options.env, env);\n    if (!result.success) {\n      // Names and reasons only: the values are secrets\n      throw new EnvValidationError(\n        result.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)\n      );\n    }\n    const merged: Env = { ...env, ...result.data };\n    checked.set(env, merged);\n    return merged;\n  };\n  const bundle = () => compileConfig(config);\n  const emails = config.templates?.email;\n  const database = { schema: config.database?.schema ?? DEFAULT_SCHEMA };\n  // In fast-forward, segment windows scale with the journeys reading them (time-scale.ts)\n  const lease = (env: Env): Required<StoreLease> => {\n    const opened = options.store === undefined ? d1Store(env) : options.store(env, database);\n    const noop = async () => {};\n    const factor = runtimeFromConfig(config, env).timeScale;\n    return 'store' in opened\n      ? { store: scaleSegmentWindows(opened.store, factor), close: opened.close ?? noop }\n      : { store: scaleSegmentWindows(opened, factor), close: noop };\n  };\n\n  class Runner extends JourneyRunner {\n    private readonly leases = new WeakMap<JourneyStore, () => Promise<void>>();\n    private current: JourneyStore | undefined;\n\n    protected override createStore(): JourneyStore {\n      // A run fails at its start on an invalid environment, not at the send that needs it\n      const { store, close } = lease(checkEnv(this.env as Env));\n      this.leases.set(store, close);\n      this.current = store;\n      return store;\n    }\n\n    protected override async closeStore(store: JourneyStore): Promise<void> {\n      await this.leases.get(store)?.();\n    }\n\n    protected override contract(): Contract | undefined {\n      return config.contract;\n    }\n\n    protected override createMessageValidator(): MessageValidator {\n      return registryValidator(config.templates ?? {});\n    }\n\n    protected override createMessageSender(): MessageSender {\n      if (this.current === undefined) return super.createMessageSender();\n      if (options.messages !== undefined) {\n        return options.messages(checkEnv(this.env as Env), this.current);\n      }\n      return channelsFromConfig(config, checkEnv(this.env as Env), { store: this.current });\n    }\n\n    protected override createObserver(store: JourneyStore): JourneyObserver | undefined {\n      if (options.observer !== undefined) return options.observer(checkEnv(this.env as Env), store);\n      return store.reporting === undefined\n        ? undefined\n        : reportingObserver(store.reporting, checkEnv(this.env as Env).WORKFLOW_ORIGIN);\n    }\n\n    protected override runtime(params: JourneyParams): JourneyRuntimeOptions {\n      const env = checkEnv(this.env as Env);\n      if (options.runtime !== undefined) return options.runtime(env, params);\n      return runtimeFromConfig(config, env);\n    }\n\n    protected override actions(): readonly RegisteredAction[] {\n      // An action ref is a registered action structurally: the same object carries name, code and hash\n      return config.actions ?? [];\n    }\n  }\n\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n\n  const authorized = (request: Request, env: Env): boolean =>\n    env.API_TOKEN === undefined ||\n    request.headers.get('authorization') === `Bearer ${env.API_TOKEN}`;\n\n  const preview = emails === undefined ? undefined : registryRenderer(emails);\n\n  // The bundle compiled into this version goes live on its own, once per isolate: the first\n  // request or cron run reads which version's bundle is live (one row) and applies this one only\n  // over an older version, so one still serving during a rollout can never put its routes back.\n  // A failure (say the migrations have not run) is logged and retried a minute later. Only the\n  // request that starts the check gets its promise back: a request context cannot wait on\n  // another's I/O.\n  let applying: Promise<void> | undefined;\n  let retryAt = 0;\n  const applyOwnBundle = (env: Env): Promise<void> | undefined => {\n    const metadata = env.CF_VERSION_METADATA;\n    if (metadata === undefined || metadata.id === '') return undefined;\n    const version: BundleVersion = { id: metadata.id, createdAt: Date.parse(metadata.timestamp) };\n    if (Number.isNaN(version.createdAt)) return undefined;\n    if (applying !== undefined || Date.now() < retryAt) return undefined;\n    applying = (async () => {\n      const { store, close } = lease(env);\n      try {\n        if (store.liveBundleVersion === undefined) return; // D1: POST /bundle/deploy\n        const live = await store.liveBundleVersion();\n        if (live !== undefined && (live.id === version.id || live.createdAt >= version.createdAt))\n          return;\n        const result = await deployBundle(env, bundle(), store, version);\n        if (result.applied) console.log(`[workflow] version ${version.id} is live`);\n      } finally {\n        await close();\n      }\n    })().catch((error: unknown) => {\n      applying = undefined;\n      retryAt = Date.now() + 60_000;\n      console.error(`[workflow] could not make version ${version.id} live`, error);\n    });\n    return applying;\n  };\n\n  const fetch = async (request: Request, rawEnv: Env, ctx?: ExecutionContextLike) => {\n    // Everything below reads the validated environment (the schema's defaults applied)\n    let env: Env;\n    try {\n      env = checkEnv(rawEnv);\n    } catch (error) {\n      if (!(error instanceof EnvValidationError)) throw error;\n      console.error(`[workflow] ${error.message}`);\n      return json({ error: error.message }, 500);\n    }\n    const pending = applyOwnBundle(env);\n    // In the background where the runtime has waitUntil; inline otherwise (tests)\n    if (pending !== undefined) {\n      if (ctx === undefined) await pending;\n      else ctx.waitUntil(pending);\n    }\n    const url = new URL(request.url);\n    const { store, close } = lease(env);\n    try {\n      // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n      if (url.pathname.startsWith('/t/') && store.reporting !== undefined) {\n        const openedEvent = config.webPush?.openedEvent;\n        const tracked = await handleTracking(request, store.reporting, {\n          unsubscribe: config.emails?.unsubscribe,\n          product: config.title,\n          quickMs: config.emails?.tracking?.quickClickMs,\n          pushOpened:\n            openedEvent === undefined\n              ? undefined\n              : async ({ messageId, userId, at }) => {\n                  const payload: Record<string, unknown> = { message_id: messageId };\n                  const contract = config.contract;\n                  const verdict =\n                    contract === undefined ? undefined : checkEvent(contract, openedEvent, payload);\n                  if (verdict !== undefined && !verdict.ok) {\n                    throw new ContractValidationError(openedEvent, verdict.issues);\n                  }\n                  // Keyed by the copy: a second tap of the same notification is the same event\n                  await ingestEvent(\n                    env,\n                    {\n                      id: `${openedEvent}:${messageId}`,\n                      userId,\n                      event: openedEvent,\n                      payload: verdict?.data ?? payload,\n                      ts: at,\n                    },\n                    store\n                  );\n                },\n        });\n        if (tracked !== undefined) return tracked;\n      }\n      if (url.pathname === '/segments/sweep') {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n        return json(await sweepSegments(env, store));\n      }\n      if (url.pathname === '/bundle') {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n        return json(bundle());\n      }\n      if (url.pathname === '/bundle/deploy') {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n        try {\n          return json(await deployBundle(env, bundle(), store));\n        } catch (error) {\n          if (!(error instanceof SchemaMismatchError)) throw error;\n          return json({ error: error.message, problems: error.problems }, 503);\n        }\n      }\n      if (emails !== undefined && preview !== undefined && url.pathname.startsWith('/preview/')) {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n        const key = url.pathname.slice('/preview/'.length);\n        if (!Object.hasOwn(emails, key))\n          return json({ error: `unknown email template: ${key}` }, 404);\n        // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n        let props: unknown = {};\n        try {\n          props = JSON.parse(url.searchParams.get('props') ?? '{}');\n        } catch {\n          return json({ error: 'props must be a JSON object' }, 400);\n        }\n        if (typeof props !== 'object' || props === null || Array.isArray(props)) {\n          return json({ error: 'props must be a JSON object' }, 400);\n        }\n        try {\n          const { subject, html } = await preview(key, props as Record<string, ScalarIR>);\n          return new Response(html, {\n            headers: { 'content-type': 'text/html; charset=utf-8', 'x-subject': subject },\n          });\n        } catch (error) {\n          // The query string is the props: a refusal is the caller's to fix, with the field paths\n          if (error instanceof TemplateValidationError) {\n            return json({ error: error.message, issues: error.issues }, 400);\n          }\n          throw error;\n        }\n      }\n      return await handleRequest(request, env, store, {\n        contract: config.contract,\n        mode: options.contractMode,\n      });\n    } finally {\n      // After the response when the runtime offers waitUntil, inline otherwise (tests).\n      if (ctx === undefined) await close();\n      else ctx.waitUntil(close());\n    }\n  };\n\n  const sweep = async (rawEnv: Env) => {\n    const env = checkEnv(rawEnv);\n    const { store, close } = lease(env);\n    try {\n      return await sweepSegments(env, store);\n    } finally {\n      await close();\n    }\n  };\n\n  const scheduled = async (_controller: unknown, env: Env, ctx: ExecutionContextLike) => {\n    // A version with no traffic yet goes live here; the sweep then reads its segments\n    ctx.waitUntil(\n      (async () => {\n        await applyOwnBundle(checkEnv(env));\n        await sweep(env);\n      })()\n    );\n  };\n\n  return { Runner, fetch, sweep, scheduled };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4GA,IAAa,qBAAb,cAAwC,MAAM;CAEvB;CADrB,OAAyB;CACzB,YAAY,QAAoC;EAC9C,MAAM,2CAA2C,OAAO,KAAK,MAAM,GAAG;EADnD,KAAA,SAAA;CAErB;AACF;AAEA,SAAgB,cACd,SACoB;CACpB,MAAM,EAAE,WAAW;CAEnB,MAAM,0BAAU,IAAI,QAAqB;CACzC,MAAM,YAAY,QAAkB;EAClC,IAAI,QAAQ,QAAQ,KAAA,GAAW,OAAO;EACtC,MAAM,SAAS,QAAQ,IAAI,GAAG;EAC9B,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,SAAS,EAAE,UAAU,QAAQ,KAAK,GAAG;EAC3C,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,mBACR,OAAO,MAAM,OAAO,KAAK,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,SAAS,IAAI,MAAM,SAAS,CAC5F;EAEF,MAAM,SAAc;GAAE,GAAG;GAAK,GAAG,OAAO;EAAK;EAC7C,QAAQ,IAAI,KAAK,MAAM;EACvB,OAAO;CACT;CACA,MAAM,eAAe,cAAc,MAAM;CACzC,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,WAAW,EAAE,QAAQ,OAAO,UAAU,UAAA,WAAyB;CAErE,MAAM,SAAS,QAAmC;EAChD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,QAAQ,GAAG,IAAI,QAAQ,MAAM,KAAK,QAAQ;EACvF,MAAM,OAAO,YAAY,CAAC;EAC1B,MAAM,SAAS,kBAAkB,QAAQ,GAAG,CAAC,CAAC;EAC9C,OAAO,WAAW,SACd;GAAE,OAAO,oBAAoB,OAAO,OAAO,MAAM;GAAG,OAAO,OAAO,SAAS;EAAK,IAChF;GAAE,OAAO,oBAAoB,QAAQ,MAAM;GAAG,OAAO;EAAK;CAChE;CAEA,MAAM,eAAe,cAAc;EACjC,yBAA0B,IAAI,QAA2C;EACzE;EAEA,cAA+C;GAE7C,MAAM,EAAE,OAAO,UAAU,MAAM,SAAS,KAAK,GAAU,CAAC;GACxD,KAAK,OAAO,IAAI,OAAO,KAAK;GAC5B,KAAK,UAAU;GACf,OAAO;EACT;EAEA,MAAyB,WAAW,OAAoC;GACtE,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG;EACjC;EAEA,WAAoD;GAClD,OAAO,OAAO;EAChB;EAEA,yBAA8D;GAC5D,OAAO,kBAAkB,OAAO,aAAa,CAAC,CAAC;EACjD;EAEA,sBAAwD;GACtD,IAAI,KAAK,YAAY,KAAA,GAAW,OAAO,MAAM,oBAAoB;GACjE,IAAI,QAAQ,aAAa,KAAA,GACvB,OAAO,QAAQ,SAAS,SAAS,KAAK,GAAU,GAAG,KAAK,OAAO;GAEjE,OAAO,mBAAmB,QAAQ,SAAS,KAAK,GAAU,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC;EACtF;EAEA,eAAkC,OAAkD;GAClF,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,SAAS,KAAK,GAAU,GAAG,KAAK;GAC5F,OAAO,MAAM,cAAc,KAAA,IACvB,KAAA,IACA,kBAAkB,MAAM,WAAW,SAAS,KAAK,GAAU,CAAC,CAAC,eAAe;EAClF;EAEA,QAA2B,QAA8C;GACvE,MAAM,MAAM,SAAS,KAAK,GAAU;GACpC,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,QAAQ,QAAQ,KAAK,MAAM;GACrE,OAAO,kBAAkB,QAAQ,GAAG;EACtC;EAEA,UAA0D;GAExD,OAAO,OAAO,WAAW,CAAC;EAC5B;CACF;CAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CAEH,MAAM,cAAc,SAAkB,QACpC,IAAI,cAAc,KAAA,KAClB,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI;CAEzD,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,iBAAiB,MAAM;CAQ1E,IAAI;CACJ,IAAI,UAAU;CACd,MAAM,kBAAkB,QAAwC;EAC9D,MAAM,WAAW,IAAI;EACrB,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,IAAI,OAAO,KAAA;EACzD,MAAM,UAAyB;GAAE,IAAI,SAAS;GAAI,WAAW,KAAK,MAAM,SAAS,SAAS;EAAE;EAC5F,IAAI,OAAO,MAAM,QAAQ,SAAS,GAAG,OAAO,KAAA;EAC5C,IAAI,aAAa,KAAA,KAAa,KAAK,IAAI,IAAI,SAAS,OAAO,KAAA;EAC3D,YAAY,YAAY;GACtB,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;GAClC,IAAI;IACF,IAAI,MAAM,sBAAsB,KAAA,GAAW;IAC3C,MAAM,OAAO,MAAM,MAAM,kBAAkB;IAC3C,IAAI,SAAS,KAAA,MAAc,KAAK,OAAO,QAAQ,MAAM,KAAK,aAAa,QAAQ,YAC7E;IAEF,KAAI,MADiB,aAAa,KAAK,OAAO,GAAG,OAAO,OAAO,EAAA,CACpD,SAAS,QAAQ,IAAI,sBAAsB,QAAQ,GAAG,SAAS;GAC5E,UAAU;IACR,MAAM,MAAM;GACd;EACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;GAC7B,WAAW,KAAA;GACX,UAAU,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,qCAAqC,QAAQ,GAAG,QAAQ,KAAK;EAC7E,CAAC;EACD,OAAO;CACT;CAEA,MAAM,QAAQ,OAAO,SAAkB,QAAa,QAA+B;EAEjF,IAAI;EACJ,IAAI;GACF,MAAM,SAAS,MAAM;EACvB,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,qBAAqB,MAAM;GAClD,QAAQ,MAAM,cAAc,MAAM,SAAS;GAC3C,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;EAC3C;EACA,MAAM,UAAU,eAAe,GAAG;EAElC,IAAI,YAAY,KAAA,GAAW;GACzB,IAAI,QAAQ,KAAA,GAAW,MAAM;QACxB,IAAI,UAAU,OAAO;EAC5B;EACA,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GAEF,IAAI,IAAI,SAAS,WAAW,KAAK,KAAK,MAAM,cAAc,KAAA,GAAW;IACnE,MAAM,cAAc,OAAO,SAAS;IACpC,MAAM,UAAU,MAAM,eAAe,SAAS,MAAM,WAAW;KAC7D,aAAa,OAAO,QAAQ;KAC5B,SAAS,OAAO;KAChB,SAAS,OAAO,QAAQ,UAAU;KAClC,YACE,gBAAgB,KAAA,IACZ,KAAA,IACA,OAAO,EAAE,WAAW,QAAQ,SAAS;MACnC,MAAM,UAAmC,EAAE,YAAY,UAAU;MACjE,MAAM,WAAW,OAAO;MACxB,MAAM,UACJ,aAAa,KAAA,IAAY,KAAA,IAAY,WAAW,UAAU,aAAa,OAAO;MAChF,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,IACpC,MAAM,IAAI,wBAAwB,aAAa,QAAQ,MAAM;MAG/D,MAAM,YACJ,KACA;OACE,IAAI,GAAG,YAAY,GAAG;OACtB;OACA,OAAO;OACP,SAAS,SAAS,QAAQ;OAC1B,IAAI;MACN,GACA,KACF;KACF;IACR,CAAC;IACD,IAAI,YAAY,KAAA,GAAW,OAAO;GACpC;GACA,IAAI,IAAI,aAAa,mBAAmB;IACtC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC/E,OAAO,KAAK,MAAM,cAAc,KAAK,KAAK,CAAC;GAC7C;GACA,IAAI,IAAI,aAAa,WAAW;IAC9B,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC9E,OAAO,KAAK,OAAO,CAAC;GACtB;GACA,IAAI,IAAI,aAAa,kBAAkB;IACrC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC/E,IAAI;KACF,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,GAAG,KAAK,CAAC;IACtD,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,sBAAsB,MAAM;KACnD,OAAO,KAAK;MAAE,OAAO,MAAM;MAAS,UAAU,MAAM;KAAS,GAAG,GAAG;IACrE;GACF;GACA,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,KAAa,IAAI,SAAS,WAAW,WAAW,GAAG;IACzF,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC9E,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;IACjD,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG,GAC5B,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;IAE9D,IAAI,QAAiB,CAAC;IACtB,IAAI;KACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;IAC1D,QAAQ;KACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;IAC3D;IACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;IAE3D,IAAI;KACF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,KAAK,KAAiC;KAC9E,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;MAAE,gBAAgB;MAA4B,aAAa;KAAQ,EAC9E,CAAC;IACH,SAAS,OAAO;KAEd,IAAI,iBAAiB,yBACnB,OAAO,KAAK;MAAE,OAAO,MAAM;MAAS,QAAQ,MAAM;KAAO,GAAG,GAAG;KAEjE,MAAM;IACR;GACF;GACA,OAAO,MAAM,cAAc,SAAS,KAAK,OAAO;IAC9C,UAAU,OAAO;IACjB,MAAM,QAAQ;GAChB,CAAC;EACH,UAAU;GAER,IAAI,QAAQ,KAAA,GAAW,MAAM,MAAM;QAC9B,IAAI,UAAU,MAAM,CAAC;EAC5B;CACF;CAEA,MAAM,QAAQ,OAAO,WAAgB;EACnC,MAAM,MAAM,SAAS,MAAM;EAC3B,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GACF,OAAO,MAAM,cAAc,KAAK,KAAK;EACvC,UAAU;GACR,MAAM,MAAM;EACd;CACF;CAEA,MAAM,YAAY,OAAO,aAAsB,KAAU,QAA8B;EAErF,IAAI,WACD,YAAY;GACX,MAAM,eAAe,SAAS,GAAG,CAAC;GAClC,MAAM,MAAM,GAAG;EACjB,EAAA,CAAG,CACL;CACF;CAEA,OAAO;EAAE;EAAQ;EAAO;EAAO;CAAU;AAC3C"}
+{"version":3,"file":"worker.mjs","names":[],"sources":["../../src/cloudflare/worker.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport { type JourneyConfig, compileConfig } from '../config';\nimport { type Contract, ContractValidationError, checkEvent } from '../contract';\nimport { assertEmailConfig } from '../email';\nimport type { RegisteredAction } from '../engine/actions';\nimport type { JourneyObserver, MessageSender, MessageValidator } from '../engine/ports';\nimport { scaleSegmentWindows } from '../engine/time-scale';\nimport type { ScalarIR } from '../ir';\nimport { registryRenderer } from '../react-email';\nimport { reportingObserver } from '../reporting/observer';\nimport { handleTracking } from '../reporting/tracking';\nimport type { JourneyRuntimeOptions } from '../runtime';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  SchemaMismatchError,\n  type StoreLease,\n} from '../store/index';\nimport { DEFAULT_SCHEMA } from '../store/tables';\nimport { TemplateValidationError, indexTemplates, registryValidator } from '../templates';\nimport type { JourneyEnv, JourneyParams } from './bindings';\nimport { channelsFromConfig, runtimeFromConfig } from './channels';\nimport { d1Store } from './d1-env';\nimport {\n  type SweepResult,\n  deployBundle,\n  handleRequest,\n  ingestEvent,\n  sweepSegments,\n} from './router';\nimport { JourneyRunner } from './runner';\n\n/** The fetch handler's execution context (the subset used). */\nexport interface ExecutionContextLike {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport interface JourneyWorkerOptions<Env extends JourneyEnv> {\n  /**\n   * The project's `workflow.config.ts` (`defineConfig`): what the Worker\n   * deploys (`GET /bundle`, `POST /bundle/deploy` serve `compileConfig`), the\n   * template registries the senders, the validator and `/preview` render from,\n   * the contract every `/events` and `/identify` is checked against, the email\n   * envelope, actions, and the runtime / APNs / FCM settings. Secrets come\n   * from the env under the names `JourneyEnv` documents.\n   */\n  config: JourneyConfig;\n  /**\n   * The data plane, opened per request and per workflow run. Return a\n   * `StoreLease` when the client must be released afterwards (a Postgres\n   * connection); defaults to D1 + KV from the env's bindings. `database` is\n   * the config's (`schema` defaulting to `workflow`), for a Postgres store:\n   *\n   *   store: (env, database) => postgresJsStore(env.HYPERDRIVE.connectionString, database)\n   */\n  store?: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /**\n   * Reporting hooks: node arrivals, every copy sent (with the tracking it should carry — click\n   * links and an open pixel for email, payload data for a push), and how each instance ended.\n   * By default a store that keeps reporting (Postgres) records them itself, and the Worker\n   * serves the email tracking routes (`/t/...`, on `WORKFLOW_ORIGIN`); override to report\n   * elsewhere.\n   */\n  observer?: (env: Env, store: JourneyStore) => JourneyObserver;\n  /** Message outlet override (tests, a custom gateway); by default the channels the config describes. */\n  messages?: (env: Env, store: JourneyStore) => MessageSender;\n  /** Per-instance runtime options override (a tester in fast-forward); by default `config.runtime` for `ENVIRONMENT`. */\n  runtime?: (env: Env, params: JourneyParams) => JourneyRuntimeOptions;\n  /**\n   * The host's environment, as a zod schema over its vars and secrets (bindings pass through\n   * untouched): checked the first time the Worker runs, so a missing or malformed variable fails\n   * there — every problem listed — not at the send that needs it. Webhook templates read their\n   * URL from the parsed values: `webhook: (env: Env) => env.WEBHOOK_DISCORD_ALERTS`.\n   */\n  env?: core.$ZodType<object>;\n  /** 'enforce' (default) answers an event or patch the contract refuses with a 400; 'report' only logs it. */\n  contractMode?: 'enforce' | 'report';\n}\n\nexport interface JourneyWorker<Env extends JourneyEnv> {\n  /** Export this under the `class_name` of the wrangler `workflows` binding. */\n  Runner: new (...args: never[]) => JourneyRunner;\n  /** The Worker's fetch handler: `/health`, `/events`, `/identify`, `/devices`, `/messages/opened`, `/segments/sweep`, `/t/*` (email tracking), `/deploy`, `/bundle`, `/bundle/deploy` and `/preview/*`. */\n  fetch: (request: Request, env: Env, ctx?: ExecutionContextLike) => Promise<Response>;\n  /**\n   * The segment sweep (`sweepSegments`): membership of every deployed segment for every known\n   * user, the journeys of segments entered by the clock alone (`not(performed(e.login, { within:\n   * '7 days' }))` has no event to ride on), and each segment's size. Also served as\n   * `POST /segments/sweep`.\n   */\n  sweep: (env: Env) => Promise<SweepResult>;\n  /** The cron trigger's handler: runs the sweep. Export it beside `fetch` with a `triggers.crons` entry. */\n  scheduled: (controller: unknown, env: Env, ctx: ExecutionContextLike) => Promise<void>;\n}\n\n/**\n * A complete journey host in one call: the runner class with the app's store,\n * outlets and runtime plugged in, and the fetch handler that serves the ingest\n * API around them.\n *\n *   const journeys = journeyWorker<Env>({\n *     config,   // workflow.config.ts (defineConfig)\n *     store: (env, database) => postgresJsStore(env.HYPERDRIVE.connectionString, database),\n *   });\n *   export const MyRunner = journeys.Runner;\n *   export default { fetch: journeys.fetch };\n */\n/** The Worker's environment failed its schema (`journeyWorker({ env })`). */\nexport class EnvValidationError extends Error {\n  override readonly name = 'EnvValidationError';\n  constructor(readonly issues: readonly string[]) {\n    super(`the Worker's environment is invalid:\\n  ${issues.join('\\n  ')}`);\n  }\n}\n\nexport function journeyWorker<Env extends JourneyEnv>(\n  options: JourneyWorkerOptions<Env>\n): JourneyWorker<Env> {\n  const { config } = options;\n  const emailIds = indexTemplates('email', config.templates?.email);\n  // A config still on `emails` (its sender would be silently dropped) fails here, not at a send\n  assertEmailConfig(config, emailIds.values());\n  // Parsed once per env object: the runtime hands the same one to every request of an isolate\n  const checked = new WeakMap<object, Env>();\n  const checkEnv = (env: Env): Env => {\n    if (options.env === undefined) return env;\n    const cached = checked.get(env);\n    if (cached !== undefined) return cached;\n    const result = z.safeParse(options.env, env);\n    if (!result.success) {\n      // Names and reasons only: the values are secrets\n      throw new EnvValidationError(\n        result.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)\n      );\n    }\n    const merged: Env = { ...env, ...result.data };\n    checked.set(env, merged);\n    return merged;\n  };\n  const bundle = () => compileConfig(config);\n  const emails = config.templates?.email;\n  const database = { schema: config.database?.schema ?? DEFAULT_SCHEMA };\n  // In fast-forward, segment windows scale with the journeys reading them (time-scale.ts)\n  const lease = (env: Env): Required<StoreLease> => {\n    const opened = options.store === undefined ? d1Store(env) : options.store(env, database);\n    const noop = async () => {};\n    const factor = runtimeFromConfig(config, env).timeScale;\n    return 'store' in opened\n      ? { store: scaleSegmentWindows(opened.store, factor), close: opened.close ?? noop }\n      : { store: scaleSegmentWindows(opened, factor), close: noop };\n  };\n\n  class Runner extends JourneyRunner {\n    private readonly leases = new WeakMap<JourneyStore, () => Promise<void>>();\n    private current: JourneyStore | undefined;\n\n    protected override createStore(): JourneyStore {\n      // A run fails at its start on an invalid environment, not at the send that needs it\n      const { store, close } = lease(checkEnv(this.env as Env));\n      this.leases.set(store, close);\n      this.current = store;\n      return store;\n    }\n\n    protected override async closeStore(store: JourneyStore): Promise<void> {\n      await this.leases.get(store)?.();\n    }\n\n    protected override contract(): Contract | undefined {\n      return config.contract;\n    }\n\n    protected override createMessageValidator(): MessageValidator {\n      return registryValidator(config.templates ?? {});\n    }\n\n    protected override createMessageSender(): MessageSender {\n      if (this.current === undefined) return super.createMessageSender();\n      if (options.messages !== undefined) {\n        return options.messages(checkEnv(this.env as Env), this.current);\n      }\n      return channelsFromConfig(config, checkEnv(this.env as Env), { store: this.current });\n    }\n\n    protected override createObserver(store: JourneyStore): JourneyObserver | undefined {\n      if (options.observer !== undefined) return options.observer(checkEnv(this.env as Env), store);\n      return store.reporting === undefined\n        ? undefined\n        : reportingObserver(store.reporting, checkEnv(this.env as Env).WORKFLOW_ORIGIN);\n    }\n\n    protected override runtime(params: JourneyParams): JourneyRuntimeOptions {\n      const env = checkEnv(this.env as Env);\n      if (options.runtime !== undefined) return options.runtime(env, params);\n      return runtimeFromConfig(config, env);\n    }\n\n    protected override actions(): readonly RegisteredAction[] {\n      // An action ref is a registered action structurally: the same object carries name, code and hash\n      return config.actions ?? [];\n    }\n  }\n\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n\n  const authorized = (request: Request, env: Env): boolean =>\n    env.API_TOKEN === undefined ||\n    request.headers.get('authorization') === `Bearer ${env.API_TOKEN}`;\n\n  const preview = emails === undefined ? undefined : registryRenderer(emails, config.email);\n\n  // The bundle compiled into this version goes live on its own, once per isolate: the first\n  // request or cron run reads which version's bundle is live (one row) and applies this one only\n  // over an older version, so one still serving during a rollout can never put its routes back.\n  // A failure (say the migrations have not run) is logged and retried a minute later. Only the\n  // request that starts the check gets its promise back: a request context cannot wait on\n  // another's I/O.\n  let applying: Promise<void> | undefined;\n  let retryAt = 0;\n  const applyOwnBundle = (env: Env): Promise<void> | undefined => {\n    const metadata = env.CF_VERSION_METADATA;\n    if (metadata === undefined || metadata.id === '') return undefined;\n    const version: BundleVersion = { id: metadata.id, createdAt: Date.parse(metadata.timestamp) };\n    if (Number.isNaN(version.createdAt)) return undefined;\n    if (applying !== undefined || Date.now() < retryAt) return undefined;\n    applying = (async () => {\n      const { store, close } = lease(env);\n      try {\n        if (store.liveBundleVersion === undefined) return; // D1: POST /bundle/deploy\n        const live = await store.liveBundleVersion();\n        if (live !== undefined && (live.id === version.id || live.createdAt >= version.createdAt))\n          return;\n        const result = await deployBundle(env, bundle(), store, version);\n        if (result.applied) console.log(`[workflow] version ${version.id} is live`);\n      } finally {\n        await close();\n      }\n    })().catch((error: unknown) => {\n      applying = undefined;\n      retryAt = Date.now() + 60_000;\n      console.error(`[workflow] could not make version ${version.id} live`, error);\n    });\n    return applying;\n  };\n\n  const fetch = async (request: Request, rawEnv: Env, ctx?: ExecutionContextLike) => {\n    // Everything below reads the validated environment (the schema's defaults applied)\n    let env: Env;\n    try {\n      env = checkEnv(rawEnv);\n    } catch (error) {\n      if (!(error instanceof EnvValidationError)) throw error;\n      console.error(`[workflow] ${error.message}`);\n      return json({ error: error.message }, 500);\n    }\n    const pending = applyOwnBundle(env);\n    // In the background where the runtime has waitUntil; inline otherwise (tests)\n    if (pending !== undefined) {\n      if (ctx === undefined) await pending;\n      else ctx.waitUntil(pending);\n    }\n    const url = new URL(request.url);\n    const { store, close } = lease(env);\n    try {\n      // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n      if (url.pathname.startsWith('/t/') && store.reporting !== undefined) {\n        const openedEvent = config.webPush?.openedEvent;\n        const tracked = await handleTracking(request, store.reporting, {\n          legacyUnsubscribeUrl: config.email?.unsubscribeUrl,\n          product: config.title,\n          quickMs: config.email?.tracking?.quickClickMs,\n          pushOpened:\n            openedEvent === undefined\n              ? undefined\n              : async ({ messageId, userId, at }) => {\n                  const payload: Record<string, unknown> = { message_id: messageId };\n                  const contract = config.contract;\n                  const verdict =\n                    contract === undefined ? undefined : checkEvent(contract, openedEvent, payload);\n                  if (verdict !== undefined && !verdict.ok) {\n                    throw new ContractValidationError(openedEvent, verdict.issues);\n                  }\n                  // Keyed by the copy: a second tap of the same notification is the same event\n                  await ingestEvent(\n                    env,\n                    {\n                      id: `${openedEvent}:${messageId}`,\n                      userId,\n                      event: openedEvent,\n                      payload: verdict?.data ?? payload,\n                      ts: at,\n                    },\n                    store\n                  );\n                },\n        });\n        if (tracked !== undefined) return tracked;\n      }\n      if (url.pathname === '/segments/sweep') {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n        return json(await sweepSegments(env, store));\n      }\n      if (url.pathname === '/bundle') {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n        return json(bundle());\n      }\n      if (url.pathname === '/bundle/deploy') {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n        try {\n          return json(await deployBundle(env, bundle(), store));\n        } catch (error) {\n          if (!(error instanceof SchemaMismatchError)) throw error;\n          return json({ error: error.message, problems: error.problems }, 503);\n        }\n      }\n      if (emails !== undefined && preview !== undefined && url.pathname.startsWith('/preview/')) {\n        if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n        if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n        const key = url.pathname.slice('/preview/'.length);\n        if (!emailIds.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n        // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n        let props: unknown = {};\n        try {\n          props = JSON.parse(url.searchParams.get('props') ?? '{}');\n        } catch {\n          return json({ error: 'props must be a JSON object' }, 400);\n        }\n        if (typeof props !== 'object' || props === null || Array.isArray(props)) {\n          return json({ error: 'props must be a JSON object' }, 400);\n        }\n        try {\n          const { subject, html } = await preview(key, props as Record<string, ScalarIR>);\n          return new Response(html, {\n            headers: { 'content-type': 'text/html; charset=utf-8', 'x-subject': subject },\n          });\n        } catch (error) {\n          // The query string is the props: a refusal is the caller's to fix, with the field paths\n          if (error instanceof TemplateValidationError) {\n            return json({ error: error.message, issues: error.issues }, 400);\n          }\n          throw error;\n        }\n      }\n      return await handleRequest(request, env, store, {\n        contract: config.contract,\n        mode: options.contractMode,\n      });\n    } finally {\n      // After the response when the runtime offers waitUntil, inline otherwise (tests).\n      if (ctx === undefined) await close();\n      else ctx.waitUntil(close());\n    }\n  };\n\n  const sweep = async (rawEnv: Env) => {\n    const env = checkEnv(rawEnv);\n    const { store, close } = lease(env);\n    try {\n      return await sweepSegments(env, store);\n    } finally {\n      await close();\n    }\n  };\n\n  const scheduled = async (_controller: unknown, env: Env, ctx: ExecutionContextLike) => {\n    // A version with no traffic yet goes live here; the sweep then reads its segments\n    ctx.waitUntil(\n      (async () => {\n        await applyOwnBundle(checkEnv(env));\n        await sweep(env);\n      })()\n    );\n  };\n\n  return { Runner, fetch, sweep, scheduled };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6GA,IAAa,qBAAb,cAAwC,MAAM;CAEvB;CADrB,OAAyB;CACzB,YAAY,QAAoC;EAC9C,MAAM,2CAA2C,OAAO,KAAK,MAAM,GAAG;EADnD,KAAA,SAAA;CAErB;AACF;AAEA,SAAgB,cACd,SACoB;CACpB,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,eAAe,SAAS,OAAO,WAAW,KAAK;CAEhE,kBAAkB,QAAQ,SAAS,OAAO,CAAC;CAE3C,MAAM,0BAAU,IAAI,QAAqB;CACzC,MAAM,YAAY,QAAkB;EAClC,IAAI,QAAQ,QAAQ,KAAA,GAAW,OAAO;EACtC,MAAM,SAAS,QAAQ,IAAI,GAAG;EAC9B,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,SAAS,EAAE,UAAU,QAAQ,KAAK,GAAG;EAC3C,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,mBACR,OAAO,MAAM,OAAO,KAAK,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,SAAS,IAAI,MAAM,SAAS,CAC5F;EAEF,MAAM,SAAc;GAAE,GAAG;GAAK,GAAG,OAAO;EAAK;EAC7C,QAAQ,IAAI,KAAK,MAAM;EACvB,OAAO;CACT;CACA,MAAM,eAAe,cAAc,MAAM;CACzC,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,WAAW,EAAE,QAAQ,OAAO,UAAU,UAAA,WAAyB;CAErE,MAAM,SAAS,QAAmC;EAChD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,QAAQ,GAAG,IAAI,QAAQ,MAAM,KAAK,QAAQ;EACvF,MAAM,OAAO,YAAY,CAAC;EAC1B,MAAM,SAAS,kBAAkB,QAAQ,GAAG,CAAC,CAAC;EAC9C,OAAO,WAAW,SACd;GAAE,OAAO,oBAAoB,OAAO,OAAO,MAAM;GAAG,OAAO,OAAO,SAAS;EAAK,IAChF;GAAE,OAAO,oBAAoB,QAAQ,MAAM;GAAG,OAAO;EAAK;CAChE;CAEA,MAAM,eAAe,cAAc;EACjC,yBAA0B,IAAI,QAA2C;EACzE;EAEA,cAA+C;GAE7C,MAAM,EAAE,OAAO,UAAU,MAAM,SAAS,KAAK,GAAU,CAAC;GACxD,KAAK,OAAO,IAAI,OAAO,KAAK;GAC5B,KAAK,UAAU;GACf,OAAO;EACT;EAEA,MAAyB,WAAW,OAAoC;GACtE,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG;EACjC;EAEA,WAAoD;GAClD,OAAO,OAAO;EAChB;EAEA,yBAA8D;GAC5D,OAAO,kBAAkB,OAAO,aAAa,CAAC,CAAC;EACjD;EAEA,sBAAwD;GACtD,IAAI,KAAK,YAAY,KAAA,GAAW,OAAO,MAAM,oBAAoB;GACjE,IAAI,QAAQ,aAAa,KAAA,GACvB,OAAO,QAAQ,SAAS,SAAS,KAAK,GAAU,GAAG,KAAK,OAAO;GAEjE,OAAO,mBAAmB,QAAQ,SAAS,KAAK,GAAU,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC;EACtF;EAEA,eAAkC,OAAkD;GAClF,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,SAAS,KAAK,GAAU,GAAG,KAAK;GAC5F,OAAO,MAAM,cAAc,KAAA,IACvB,KAAA,IACA,kBAAkB,MAAM,WAAW,SAAS,KAAK,GAAU,CAAC,CAAC,eAAe;EAClF;EAEA,QAA2B,QAA8C;GACvE,MAAM,MAAM,SAAS,KAAK,GAAU;GACpC,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,QAAQ,QAAQ,KAAK,MAAM;GACrE,OAAO,kBAAkB,QAAQ,GAAG;EACtC;EAEA,UAA0D;GAExD,OAAO,OAAO,WAAW,CAAC;EAC5B;CACF;CAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CAEH,MAAM,cAAc,SAAkB,QACpC,IAAI,cAAc,KAAA,KAClB,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI;CAEzD,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,iBAAiB,QAAQ,OAAO,KAAK;CAQxF,IAAI;CACJ,IAAI,UAAU;CACd,MAAM,kBAAkB,QAAwC;EAC9D,MAAM,WAAW,IAAI;EACrB,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,IAAI,OAAO,KAAA;EACzD,MAAM,UAAyB;GAAE,IAAI,SAAS;GAAI,WAAW,KAAK,MAAM,SAAS,SAAS;EAAE;EAC5F,IAAI,OAAO,MAAM,QAAQ,SAAS,GAAG,OAAO,KAAA;EAC5C,IAAI,aAAa,KAAA,KAAa,KAAK,IAAI,IAAI,SAAS,OAAO,KAAA;EAC3D,YAAY,YAAY;GACtB,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;GAClC,IAAI;IACF,IAAI,MAAM,sBAAsB,KAAA,GAAW;IAC3C,MAAM,OAAO,MAAM,MAAM,kBAAkB;IAC3C,IAAI,SAAS,KAAA,MAAc,KAAK,OAAO,QAAQ,MAAM,KAAK,aAAa,QAAQ,YAC7E;IAEF,KAAI,MADiB,aAAa,KAAK,OAAO,GAAG,OAAO,OAAO,EAAA,CACpD,SAAS,QAAQ,IAAI,sBAAsB,QAAQ,GAAG,SAAS;GAC5E,UAAU;IACR,MAAM,MAAM;GACd;EACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;GAC7B,WAAW,KAAA;GACX,UAAU,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,qCAAqC,QAAQ,GAAG,QAAQ,KAAK;EAC7E,CAAC;EACD,OAAO;CACT;CAEA,MAAM,QAAQ,OAAO,SAAkB,QAAa,QAA+B;EAEjF,IAAI;EACJ,IAAI;GACF,MAAM,SAAS,MAAM;EACvB,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,qBAAqB,MAAM;GAClD,QAAQ,MAAM,cAAc,MAAM,SAAS;GAC3C,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;EAC3C;EACA,MAAM,UAAU,eAAe,GAAG;EAElC,IAAI,YAAY,KAAA,GAAW;GACzB,IAAI,QAAQ,KAAA,GAAW,MAAM;QACxB,IAAI,UAAU,OAAO;EAC5B;EACA,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GAEF,IAAI,IAAI,SAAS,WAAW,KAAK,KAAK,MAAM,cAAc,KAAA,GAAW;IACnE,MAAM,cAAc,OAAO,SAAS;IACpC,MAAM,UAAU,MAAM,eAAe,SAAS,MAAM,WAAW;KAC7D,sBAAsB,OAAO,OAAO;KACpC,SAAS,OAAO;KAChB,SAAS,OAAO,OAAO,UAAU;KACjC,YACE,gBAAgB,KAAA,IACZ,KAAA,IACA,OAAO,EAAE,WAAW,QAAQ,SAAS;MACnC,MAAM,UAAmC,EAAE,YAAY,UAAU;MACjE,MAAM,WAAW,OAAO;MACxB,MAAM,UACJ,aAAa,KAAA,IAAY,KAAA,IAAY,WAAW,UAAU,aAAa,OAAO;MAChF,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,IACpC,MAAM,IAAI,wBAAwB,aAAa,QAAQ,MAAM;MAG/D,MAAM,YACJ,KACA;OACE,IAAI,GAAG,YAAY,GAAG;OACtB;OACA,OAAO;OACP,SAAS,SAAS,QAAQ;OAC1B,IAAI;MACN,GACA,KACF;KACF;IACR,CAAC;IACD,IAAI,YAAY,KAAA,GAAW,OAAO;GACpC;GACA,IAAI,IAAI,aAAa,mBAAmB;IACtC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC/E,OAAO,KAAK,MAAM,cAAc,KAAK,KAAK,CAAC;GAC7C;GACA,IAAI,IAAI,aAAa,WAAW;IAC9B,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC9E,OAAO,KAAK,OAAO,CAAC;GACtB;GACA,IAAI,IAAI,aAAa,kBAAkB;IACrC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC/E,IAAI;KACF,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,GAAG,KAAK,CAAC;IACtD,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,sBAAsB,MAAM;KACnD,OAAO,KAAK;MAAE,OAAO,MAAM;MAAS,UAAU,MAAM;KAAS,GAAG,GAAG;IACrE;GACF;GACA,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,KAAa,IAAI,SAAS,WAAW,WAAW,GAAG;IACzF,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAC9E,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;IACjD,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;IAEpF,IAAI,QAAiB,CAAC;IACtB,IAAI;KACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;IAC1D,QAAQ;KACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;IAC3D;IACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;IAE3D,IAAI;KACF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,KAAK,KAAiC;KAC9E,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;MAAE,gBAAgB;MAA4B,aAAa;KAAQ,EAC9E,CAAC;IACH,SAAS,OAAO;KAEd,IAAI,iBAAiB,yBACnB,OAAO,KAAK;MAAE,OAAO,MAAM;MAAS,QAAQ,MAAM;KAAO,GAAG,GAAG;KAEjE,MAAM;IACR;GACF;GACA,OAAO,MAAM,cAAc,SAAS,KAAK,OAAO;IAC9C,UAAU,OAAO;IACjB,MAAM,QAAQ;GAChB,CAAC;EACH,UAAU;GAER,IAAI,QAAQ,KAAA,GAAW,MAAM,MAAM;QAC9B,IAAI,UAAU,MAAM,CAAC;EAC5B;CACF;CAEA,MAAM,QAAQ,OAAO,WAAgB;EACnC,MAAM,MAAM,SAAS,MAAM;EAC3B,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GACF,OAAO,MAAM,cAAc,KAAK,KAAK;EACvC,UAAU;GACR,MAAM,MAAM;EACd;CACF;CAEA,MAAM,YAAY,OAAO,aAAsB,KAAU,QAA8B;EAErF,IAAI,WACD,YAAY;GACX,MAAM,eAAe,SAAS,GAAG,CAAC;GAClC,MAAM,MAAM,GAAG;EACjB,EAAA,CAAG,CACL;CACF;CAEA,OAAO;EAAE;EAAQ;EAAO;EAAO;CAAU;AAC3C"}

package/dist/config.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
+const require_email = require("./email.cjs");
 const require_templates = require("./templates.cjs");
 const require_dsl_flow = require("./dsl/flow.cjs");
 const require_dsl_bundle = require("./dsl/bundle.cjs");
@@ -7,11 +8,6 @@ require("./dsl/index.cjs");
 let zod_mini = require("zod/mini");
 zod_mini = require_runtime.__toESM(zod_mini, 1);
 //#region src/config.ts
-/** `Name <email>`, or the bare address. */
-function formatEmailAddress(address) {
-	if (typeof address === "string") return address;
-	return address.name === void 0 ? address.email : `${address.name} <${address.email}>`;
-}
 function defineConfig(definition) {
 	return {
 		kind: "journey-config",
@@ -33,8 +29,10 @@ var ConfigCompileError = class extends Error {
 * Compile the config: the bundle `compileBundle` would produce, with the
 * template manifest generated from the registry (every registered template,
 * by id, not a hand-kept list). The registry is checked first, used or not:
-* every entry is a template of its channel with an id, and an id is registered
-* once per channel. Then every message node is checked against it — an
+* every entry is a template of its channel with an id, an id is registered
+* once per channel, and every email template's metadata is valid, as is the
+* config's `email` (which replaced `emails`: a config still carrying it fails).
+* Then every message node is checked against it — an
 * unregistered or cross-channel template fails with the workflow, node and
 * channel named, and so does a literal prop the template's schema refuses (a
 * missing required prop, an undeclared one, a wrong literal) — and every
@@ -46,8 +44,10 @@ var ConfigCompileError = class extends Error {
 function compileConfig(config) {
 	let index;
 	try {
+		const email = require_templates.indexTemplates("email", config.templates?.email);
+		require_email.assertEmailConfig(config, email.values());
 		index = {
-			email: require_templates.indexTemplates("email", config.templates?.email),
+			email,
 			push: require_templates.indexTemplates("push", config.templates?.push),
 			discord: require_templates.indexTemplates("discord", config.templates?.discord),
 			slack: require_templates.indexTemplates("slack", config.templates?.slack)
@@ -134,7 +134,7 @@ function checkMessage(workflow, node, index, config) {
 			problems.push(`'${field}' is not a prop of the template`);
 			continue;
 		}
-		if (typeof value === "object" && value !== null && "type" in value) {
+		if (typeof value === "object" && "type" in value) {
 			const profile = config.contract?.schemas.profile._zod.def;
 			if (profile !== void 0 && value.path !== "userId" && !Object.hasOwn(profile.shape, value.path)) problems.push(`'${field}' reads u.${value.path}, which the contract's profile does not declare`);
 			continue;
@@ -158,7 +158,7 @@ function checkEmit(workflow, node, config) {
 	const shape = contract.schemas.events[node.event]._zod.def.shape;
 	const problems = [];
 	for (const [field, value] of Object.entries(node.payload)) {
-		if (typeof value === "object" && value !== null && "type" in value) continue;
+		if (typeof value === "object" && "type" in value) continue;
 		if (!Object.hasOwn(shape, field)) continue;
 		if (!zod_mini.safeParse(shape[field], value).success) problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);
 	}
@@ -170,7 +170,6 @@ exports.ConfigCompileError = ConfigCompileError;
 exports.apnsEnvironment = apnsEnvironment;
 exports.compileConfig = compileConfig;
 exports.defineConfig = defineConfig;
-exports.formatEmailAddress = formatEmailAddress;
 exports.isConfig = isConfig;
 
 //# sourceMappingURL=config.cjs.map

package/dist/config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.cjs","names":["indexTemplates","compileBundle","templateUses","CHANNEL_OF","z"],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, the email envelope, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     emails: { from: { email: 'noreply@acme.test', name: 'Acme' } },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** An address as the transports take it: bare, or with a display name. */\nexport type EmailAddress = string | { email: string; name?: string };\n\n/** `Name <email>`, or the bare address. */\nexport function formatEmailAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  return address.name === undefined ? address.email : `${address.name} <${address.email}>`;\n}\n\n/** The envelope every journey email goes out with (and the studio shows). */\nexport interface EmailConfig {\n  from: EmailAddress;\n  replyTo?: EmailAddress;\n  /**\n   * The unsubscribe link the templates' footer carries. Tracked like every link, but following\n   * it shows a confirmation page, and only the confirmation (a POST no link scanner sends) is\n   * recorded as the message's unsubscribe.\n   */\n  unsubscribe?: string;\n  /** How the Worker tells a person's opens and clicks from a machine's (see the reporting classifier). */\n  tracking?: {\n    /**\n     * An open or click this many milliseconds after delivery is a weak machine signal — machine\n     * only together with another (a second link within seconds); 1000 by default. A person\n     * tapping a mail notification can click within a few seconds, so keep it short.\n     */\n    quickClickMs?: number;\n  };\n}\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: Contract;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef<object>[];\n  /** The template definitions, per channel; each is identified by its own `id`. */\n  templates?: TemplateRegistry;\n  emails?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** Where a Postgres store keeps the engine's tables (the D1 store ignores it). */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig(definition: JourneyConfigDefinition): JourneyConfig {\n  return { kind: 'journey-config', ...definition };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, and an id is registered\n * once per channel. Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    index = {\n      email: indexTemplates('email', config.templates?.email),\n      push: indexTemplates('push', config.templates?.push),\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && value !== null && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, and no\n * required field is missing. Values read from the profile are checked when the\n * event is emitted, by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && value !== null && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) continue; // a loose payload may carry extra fields\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;;;;AA6CA,SAAgB,mBAAmB,SAA+B;CAChE,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,OAAO,QAAQ,SAAS,KAAA,IAAY,QAAQ,QAAQ,GAAG,QAAQ,KAAK,IAAI,QAAQ,MAAM;AACxF;AAgGA,SAAgB,aAAa,YAAoD;CAC/E,OAAO;EAAE,MAAM;EAAkB,GAAG;CAAW;AACjD;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;AAgBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,QAAQ;GACN,OAAOA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;GACtD,MAAMA,kBAAAA,eAAe,QAAQ,OAAO,WAAW,IAAI;GACnD,SAASA,kBAAAA,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAOA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAASC,mBAAAA,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;AAM9D,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAASC,iBAAAA,aAAa,OAAO,GAAG;EACrD,MAAM,UAAUC,kBAAAA,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,OAAO;GAElE,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADWC,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;;AAQA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAGF,MAAM,QADS,SAAS,QAAQ,OAAO,KAAK,MACvB,CAAC,KAAK,IAA2B;CACtD,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,OAAO;EACpE,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;EAElC,IAAI,CADWA,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}
+{"version":3,"file":"config.cjs","names":["indexTemplates","compileBundle","templateUses","CHANNEL_OF","z"],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport { type EmailConfig, assertEmailConfig } from './email';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, what the email templates share, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: Contract;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef[];\n  /** The template definitions, per channel; each is identified by its own `id`. */\n  templates?: TemplateRegistry;\n  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */\n  email?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** Where a Postgres store keeps the engine's tables (the D1 store ignores it). */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig(definition: JourneyConfigDefinition): JourneyConfig {\n  return { kind: 'journey-config', ...definition };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, an id is registered\n * once per channel, and every email template's metadata is valid, as is the\n * config's `email` (which replaced `emails`: a config still carrying it fails).\n * Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    const email = indexTemplates('email', config.templates?.email);\n    assertEmailConfig(config, email.values());\n    index = {\n      email,\n      push: indexTemplates('push', config.templates?.push),\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, and no\n * required field is missing. Values read from the profile are checked when the\n * event is emitted, by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) continue; // a loose payload may carry extra fields\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;;;;AAoHA,SAAgB,aAAa,YAAoD;CAC/E,OAAO;EAAE,MAAM;EAAkB,GAAG;CAAW;AACjD;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,MAAM,QAAQA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EAC7D,cAAA,kBAAkB,QAAQ,MAAM,OAAO,CAAC;EACxC,QAAQ;GACN;GACA,MAAMA,kBAAAA,eAAe,QAAQ,OAAO,WAAW,IAAI;GACnD,SAASA,kBAAAA,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAOA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAASC,mBAAAA,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;AAM9D,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAASC,iBAAAA,aAAa,OAAO,GAAG;EACrD,MAAM,UAAUC,kBAAAA,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;GAEhD,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADWC,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;;AAQA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAGF,MAAM,QADS,SAAS,QAAQ,OAAO,KAAK,MACvB,CAAC,KAAK,IAA2B;CACtD,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;EAClD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;EAElC,IAAI,CADWA,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}

package/dist/config.d.cts

@@ -1,4 +1,5 @@
 import { BundleIR } from "./ir.cjs";
+import { EmailConfig } from "./email.cjs";
 import { TemplateRegistry } from "./templates.cjs";
 import { ActionRef } from "./dsl/action.cjs";
 import { SegmentRef } from "./dsl/condition.cjs";
@@ -11,7 +12,7 @@ import { JourneyMode, JourneyRuntimeConfig } from "./runtime.cjs";
  * `workflow.config.ts` — the project's journey configuration, typed, flat and
  * committed with the code: what it deploys (workflows, segments, actions),
  * the template registries behind them, the contract every inbound event is
- * checked against, the email envelope, and how the engine runs per
+ * checked against, what the email templates share, and how the engine runs per
  * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the
  * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this
  * one object, so everything is registered exactly once:
@@ -21,7 +22,7 @@ import { JourneyMode, JourneyRuntimeConfig } from "./runtime.cjs";
  *     contract,
  *     workflows, // [onboarding, notificationTest]
  *     templates, // { email, push }: the definitions the workflows send
- *     emails: { from: { email: 'noreply@acme.test', name: 'Acme' } },
+ *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },
  *     runtime: { development: { timeScale: 600, logMessages: true } },
  *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },
  *   });
@@ -32,33 +33,6 @@ import { JourneyMode, JourneyRuntimeConfig } from "./runtime.cjs";
  * config is a source object (schemas, components, functions); only its
  * compiled bundle and preview-safe template data may cross to a browser.
  */
-/** An address as the transports take it: bare, or with a display name. */
-export type EmailAddress = string | {
-  email: string;
-  name?: string;
-};
-/** `Name <email>`, or the bare address. */
-export declare function formatEmailAddress(address: EmailAddress): string;
-/** The envelope every journey email goes out with (and the studio shows). */
-export interface EmailConfig {
-  from: EmailAddress;
-  replyTo?: EmailAddress;
-  /**
-   * The unsubscribe link the templates' footer carries. Tracked like every link, but following
-   * it shows a confirmation page, and only the confirmation (a POST no link scanner sends) is
-   * recorded as the message's unsubscribe.
-   */
-  unsubscribe?: string;
-  /** How the Worker tells a person's opens and clicks from a machine's (see the reporting classifier). */
-  tracking?: {
-    /**
-     * An open or click this many milliseconds after delivery is a weak machine signal — machine
-     * only together with another (a second link within seconds); 1000 by default. A person
-     * tapping a mail notification can click within a few seconds, so keep it short.
-     */
-    quickClickMs?: number;
-  };
-}
 /** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */
 export interface ApnsConfig {
   /** The app's bundle id (`apns-topic`). */
@@ -111,10 +85,11 @@ export interface JourneyConfigDefinition {
   contract?: Contract;
   workflows: readonly WorkflowBuilder[];
   segments?: readonly SegmentRef[];
-  actions?: readonly ActionRef<object>[];
+  actions?: readonly ActionRef[];
   /** The template definitions, per channel; each is identified by its own `id`. */
   templates?: TemplateRegistry;
-  emails?: EmailConfig;
+  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */
+  email?: EmailConfig;
   /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */
   runtime?: JourneyRuntimeConfig;
   apns?: ApnsConfig;
@@ -138,8 +113,10 @@ export declare class ConfigCompileError extends Error {
  * Compile the config: the bundle `compileBundle` would produce, with the
  * template manifest generated from the registry (every registered template,
  * by id, not a hand-kept list). The registry is checked first, used or not:
- * every entry is a template of its channel with an id, and an id is registered
- * once per channel. Then every message node is checked against it — an
+ * every entry is a template of its channel with an id, an id is registered
+ * once per channel, and every email template's metadata is valid, as is the
+ * config's `email` (which replaced `emails`: a config still carrying it fails).
+ * Then every message node is checked against it — an
  * unregistered or cross-channel template fails with the workflow, node and
  * channel named, and so does a literal prop the template's schema refuses (a
  * missing required prop, an undeclared one, a wrong literal) — and every

package/dist/config.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.cts","names":[],"sources":["../src/config.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA0CY;EAA0B;EAAe;;;wBAGrC,mBAAmB,SAAS;;iBAM3B;EACf,MAAM;EACN,UAAU;;;;;;EAMV;;EAEA;;;;;;IAME;;;;iBAKa;;EAEf;;EAEA;;EAEA;;;;;;;EAOA,cAAc,QAAQ,OAAO;;;;;;iBAOd;;EAEf;;;;;;;EAOA;;;iBAIe;;EAEf;;;;;;;iBAQe;;EAEf;;iBAGe;;EAEf;;EAEA,WAAW;EACX,oBAAoB;EACpB,oBAAoB;EACpB,mBAAmB;;EAEnB,YAAY;EACZ,SAAS;;EAET,UAAU;EACV,OAAO;EACP,MAAM;EACN,UAAU;;EAEV,WAAW;;iBAGI,sBAAsB;WAC5B;;wBAGK,aAAa,YAAY,0BAA0B;wBAInD,SAAS,iBAAiB,SAAS;;wBASnC,gBAAgB,QAAQ,YAAY,MAAM;;qBAK7C,2BAA2B;WACpB;;;;;;;;;;;;;;;;wBAiBJ,cAAc,QAAQ,gBAAgB"}
+{"version":3,"file":"config.d.cts","names":[],"sources":["../src/config.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CiB;;EAEf;;EAEA;;EAEA;;;;;;;EAOA,cAAc,QAAQ,OAAO;;;;;;iBAOd;;EAEf;;;;;;;EAOA;;;iBAIe;;EAEf;;;;;;;iBAQe;;EAEf;;iBAGe;;EAEf;;EAEA,WAAW;EACX,oBAAoB;EACpB,oBAAoB;EACpB,mBAAmB;;EAEnB,YAAY;;EAEZ,QAAQ;;EAER,UAAU;EACV,OAAO;EACP,MAAM;EACN,UAAU;;EAEV,WAAW;;iBAGI,sBAAsB;WAC5B;;wBAGK,aAAa,YAAY,0BAA0B;wBAInD,SAAS,iBAAiB,SAAS;;wBASnC,gBAAgB,QAAQ,YAAY,MAAM;;qBAK7C,2BAA2B;WACpB;;;;;;;;;;;;;;;;;;wBAmBJ,cAAc,QAAQ,gBAAgB"}

package/dist/config.d.mts

@@ -1,4 +1,5 @@
 import { BundleIR } from "./ir.mjs";
+import { EmailConfig } from "./email.mjs";
 import { TemplateRegistry } from "./templates.mjs";
 import { ActionRef } from "./dsl/action.mjs";
 import { SegmentRef } from "./dsl/condition.mjs";
@@ -11,7 +12,7 @@ import { JourneyMode, JourneyRuntimeConfig } from "./runtime.mjs";
  * `workflow.config.ts` — the project's journey configuration, typed, flat and
  * committed with the code: what it deploys (workflows, segments, actions),
  * the template registries behind them, the contract every inbound event is
- * checked against, the email envelope, and how the engine runs per
+ * checked against, what the email templates share, and how the engine runs per
  * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the
  * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this
  * one object, so everything is registered exactly once:
@@ -21,7 +22,7 @@ import { JourneyMode, JourneyRuntimeConfig } from "./runtime.mjs";
  *     contract,
  *     workflows, // [onboarding, notificationTest]
  *     templates, // { email, push }: the definitions the workflows send
- *     emails: { from: { email: 'noreply@acme.test', name: 'Acme' } },
+ *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },
  *     runtime: { development: { timeScale: 600, logMessages: true } },
  *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },
  *   });
@@ -32,33 +33,6 @@ import { JourneyMode, JourneyRuntimeConfig } from "./runtime.mjs";
  * config is a source object (schemas, components, functions); only its
  * compiled bundle and preview-safe template data may cross to a browser.
  */
-/** An address as the transports take it: bare, or with a display name. */
-export type EmailAddress = string | {
-  email: string;
-  name?: string;
-};
-/** `Name <email>`, or the bare address. */
-export declare function formatEmailAddress(address: EmailAddress): string;
-/** The envelope every journey email goes out with (and the studio shows). */
-export interface EmailConfig {
-  from: EmailAddress;
-  replyTo?: EmailAddress;
-  /**
-   * The unsubscribe link the templates' footer carries. Tracked like every link, but following
-   * it shows a confirmation page, and only the confirmation (a POST no link scanner sends) is
-   * recorded as the message's unsubscribe.
-   */
-  unsubscribe?: string;
-  /** How the Worker tells a person's opens and clicks from a machine's (see the reporting classifier). */
-  tracking?: {
-    /**
-     * An open or click this many milliseconds after delivery is a weak machine signal — machine
-     * only together with another (a second link within seconds); 1000 by default. A person
-     * tapping a mail notification can click within a few seconds, so keep it short.
-     */
-    quickClickMs?: number;
-  };
-}
 /** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */
 export interface ApnsConfig {
   /** The app's bundle id (`apns-topic`). */
@@ -111,10 +85,11 @@ export interface JourneyConfigDefinition {
   contract?: Contract;
   workflows: readonly WorkflowBuilder[];
   segments?: readonly SegmentRef[];
-  actions?: readonly ActionRef<object>[];
+  actions?: readonly ActionRef[];
   /** The template definitions, per channel; each is identified by its own `id`. */
   templates?: TemplateRegistry;
-  emails?: EmailConfig;
+  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */
+  email?: EmailConfig;
   /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */
   runtime?: JourneyRuntimeConfig;
   apns?: ApnsConfig;
@@ -138,8 +113,10 @@ export declare class ConfigCompileError extends Error {
  * Compile the config: the bundle `compileBundle` would produce, with the
  * template manifest generated from the registry (every registered template,
  * by id, not a hand-kept list). The registry is checked first, used or not:
- * every entry is a template of its channel with an id, and an id is registered
- * once per channel. Then every message node is checked against it — an
+ * every entry is a template of its channel with an id, an id is registered
+ * once per channel, and every email template's metadata is valid, as is the
+ * config's `email` (which replaced `emails`: a config still carrying it fails).
+ * Then every message node is checked against it — an
  * unregistered or cross-channel template fails with the workflow, node and
  * channel named, and so does a literal prop the template's schema refuses (a
  * missing required prop, an undeclared one, a wrong literal) — and every

package/dist/config.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","names":[],"sources":["../src/config.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA0CY;EAA0B;EAAe;;;wBAGrC,mBAAmB,SAAS;;iBAM3B;EACf,MAAM;EACN,UAAU;;;;;;EAMV;;EAEA;;;;;;IAME;;;;iBAKa;;EAEf;;EAEA;;EAEA;;;;;;;EAOA,cAAc,QAAQ,OAAO;;;;;;iBAOd;;EAEf;;;;;;;EAOA;;;iBAIe;;EAEf;;;;;;;iBAQe;;EAEf;;iBAGe;;EAEf;;EAEA,WAAW;EACX,oBAAoB;EACpB,oBAAoB;EACpB,mBAAmB;;EAEnB,YAAY;EACZ,SAAS;;EAET,UAAU;EACV,OAAO;EACP,MAAM;EACN,UAAU;;EAEV,WAAW;;iBAGI,sBAAsB;WAC5B;;wBAGK,aAAa,YAAY,0BAA0B;wBAInD,SAAS,iBAAiB,SAAS;;wBASnC,gBAAgB,QAAQ,YAAY,MAAM;;qBAK7C,2BAA2B;WACpB;;;;;;;;;;;;;;;;wBAiBJ,cAAc,QAAQ,gBAAgB"}
+{"version":3,"file":"config.d.mts","names":[],"sources":["../src/config.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CiB;;EAEf;;EAEA;;EAEA;;;;;;;EAOA,cAAc,QAAQ,OAAO;;;;;;iBAOd;;EAEf;;;;;;;EAOA;;;iBAIe;;EAEf;;;;;;;iBAQe;;EAEf;;iBAGe;;EAEf;;EAEA,WAAW;EACX,oBAAoB;EACpB,oBAAoB;EACpB,mBAAmB;;EAEnB,YAAY;;EAEZ,QAAQ;;EAER,UAAU;EACV,OAAO;EACP,MAAM;EACN,UAAU;;EAEV,WAAW;;iBAGI,sBAAsB;WAC5B;;wBAGK,aAAa,YAAY,0BAA0B;wBAInD,SAAS,iBAAiB,SAAS;;wBASnC,gBAAgB,QAAQ,YAAY,MAAM;;qBAK7C,2BAA2B;WACpB;;;;;;;;;;;;;;;;;;wBAmBJ,cAAc,QAAQ,gBAAgB"}

package/dist/config.mjs

@@ -1,14 +1,10 @@
+import { assertEmailConfig } from "./email.mjs";
 import { CHANNEL_OF, indexTemplates } from "./templates.mjs";
 import { templateUses } from "./dsl/flow.mjs";
 import { compileBundle } from "./dsl/bundle.mjs";
 import "./dsl/index.mjs";
 import * as z from "zod/mini";
 //#region src/config.ts
-/** `Name <email>`, or the bare address. */
-function formatEmailAddress(address) {
-	if (typeof address === "string") return address;
-	return address.name === void 0 ? address.email : `${address.name} <${address.email}>`;
-}
 function defineConfig(definition) {
 	return {
 		kind: "journey-config",
@@ -30,8 +26,10 @@ var ConfigCompileError = class extends Error {
 * Compile the config: the bundle `compileBundle` would produce, with the
 * template manifest generated from the registry (every registered template,
 * by id, not a hand-kept list). The registry is checked first, used or not:
-* every entry is a template of its channel with an id, and an id is registered
-* once per channel. Then every message node is checked against it — an
+* every entry is a template of its channel with an id, an id is registered
+* once per channel, and every email template's metadata is valid, as is the
+* config's `email` (which replaced `emails`: a config still carrying it fails).
+* Then every message node is checked against it — an
 * unregistered or cross-channel template fails with the workflow, node and
 * channel named, and so does a literal prop the template's schema refuses (a
 * missing required prop, an undeclared one, a wrong literal) — and every
@@ -43,8 +41,10 @@ var ConfigCompileError = class extends Error {
 function compileConfig(config) {
 	let index;
 	try {
+		const email = indexTemplates("email", config.templates?.email);
+		assertEmailConfig(config, email.values());
 		index = {
-			email: indexTemplates("email", config.templates?.email),
+			email,
 			push: indexTemplates("push", config.templates?.push),
 			discord: indexTemplates("discord", config.templates?.discord),
 			slack: indexTemplates("slack", config.templates?.slack)
@@ -131,7 +131,7 @@ function checkMessage(workflow, node, index, config) {
 			problems.push(`'${field}' is not a prop of the template`);
 			continue;
 		}
-		if (typeof value === "object" && value !== null && "type" in value) {
+		if (typeof value === "object" && "type" in value) {
 			const profile = config.contract?.schemas.profile._zod.def;
 			if (profile !== void 0 && value.path !== "userId" && !Object.hasOwn(profile.shape, value.path)) problems.push(`'${field}' reads u.${value.path}, which the contract's profile does not declare`);
 			continue;
@@ -155,7 +155,7 @@ function checkEmit(workflow, node, config) {
 	const shape = contract.schemas.events[node.event]._zod.def.shape;
 	const problems = [];
 	for (const [field, value] of Object.entries(node.payload)) {
-		if (typeof value === "object" && value !== null && "type" in value) continue;
+		if (typeof value === "object" && "type" in value) continue;
 		if (!Object.hasOwn(shape, field)) continue;
 		if (!z.safeParse(shape[field], value).success) problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);
 	}
@@ -163,6 +163,6 @@ function checkEmit(workflow, node, config) {
 	if (problems.length > 0) throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join("; ")}`);
 }
 //#endregion
-export { ConfigCompileError, apnsEnvironment, compileConfig, defineConfig, formatEmailAddress, isConfig };
+export { ConfigCompileError, apnsEnvironment, compileConfig, defineConfig, isConfig };
 
 //# sourceMappingURL=config.mjs.map