@shware/workflow 2.0.0 → 2.0.1

package/dist/config.cjs

@@ -134,7 +134,7 @@ function checkMessage(workflow, node, index, config) {
 			problems.push(`'${field}' is not a prop of the template`);
 			continue;
 		}
-		if (typeof value === "object" && value !== null && "type" in value) {
+		if (typeof value === "object" && "type" in value) {
 			const profile = config.contract?.schemas.profile._zod.def;
 			if (profile !== void 0 && value.path !== "userId" && !Object.hasOwn(profile.shape, value.path)) problems.push(`'${field}' reads u.${value.path}, which the contract's profile does not declare`);
 			continue;
@@ -158,7 +158,7 @@ function checkEmit(workflow, node, config) {
 	const shape = contract.schemas.events[node.event]._zod.def.shape;
 	const problems = [];
 	for (const [field, value] of Object.entries(node.payload)) {
-		if (typeof value === "object" && value !== null && "type" in value) continue;
+		if (typeof value === "object" && "type" in value) continue;
 		if (!Object.hasOwn(shape, field)) continue;
 		if (!zod_mini.safeParse(shape[field], value).success) problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);
 	}

package/dist/config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.cjs","names":["indexTemplates","compileBundle","templateUses","CHANNEL_OF","z"],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport { type EmailConfig, assertEmailConfig } from './email';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, what the email templates share, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: Contract;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef<object>[];\n  /** The template definitions, per channel; each is identified by its own `id`. */\n  templates?: TemplateRegistry;\n  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */\n  email?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** Where a Postgres store keeps the engine's tables (the D1 store ignores it). */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig(definition: JourneyConfigDefinition): JourneyConfig {\n  return { kind: 'journey-config', ...definition };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, an id is registered\n * once per channel, and every email template's metadata is valid, as is the\n * config's `email` (which replaced `emails`: a config still carrying it fails).\n * Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    const email = indexTemplates('email', config.templates?.email);\n    assertEmailConfig(config, email.values());\n    index = {\n      email,\n      push: indexTemplates('push', config.templates?.push),\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && value !== null && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, and no\n * required field is missing. Values read from the profile are checked when the\n * event is emitted, by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && value !== null && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) continue; // a loose payload may carry extra fields\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;;;;AAoHA,SAAgB,aAAa,YAAoD;CAC/E,OAAO;EAAE,MAAM;EAAkB,GAAG;CAAW;AACjD;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,MAAM,QAAQA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EAC7D,cAAA,kBAAkB,QAAQ,MAAM,OAAO,CAAC;EACxC,QAAQ;GACN;GACA,MAAMA,kBAAAA,eAAe,QAAQ,OAAO,WAAW,IAAI;GACnD,SAASA,kBAAAA,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAOA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAASC,mBAAAA,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;AAM9D,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAASC,iBAAAA,aAAa,OAAO,GAAG;EACrD,MAAM,UAAUC,kBAAAA,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,OAAO;GAElE,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADWC,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;;AAQA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAGF,MAAM,QADS,SAAS,QAAQ,OAAO,KAAK,MACvB,CAAC,KAAK,IAA2B;CACtD,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,OAAO;EACpE,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;EAElC,IAAI,CADWA,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}
+{"version":3,"file":"config.cjs","names":["indexTemplates","compileBundle","templateUses","CHANNEL_OF","z"],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport { type EmailConfig, assertEmailConfig } from './email';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, what the email templates share, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: Contract;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef[];\n  /** The template definitions, per channel; each is identified by its own `id`. */\n  templates?: TemplateRegistry;\n  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */\n  email?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** Where a Postgres store keeps the engine's tables (the D1 store ignores it). */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig(definition: JourneyConfigDefinition): JourneyConfig {\n  return { kind: 'journey-config', ...definition };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, an id is registered\n * once per channel, and every email template's metadata is valid, as is the\n * config's `email` (which replaced `emails`: a config still carrying it fails).\n * Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    const email = indexTemplates('email', config.templates?.email);\n    assertEmailConfig(config, email.values());\n    index = {\n      email,\n      push: indexTemplates('push', config.templates?.push),\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, and no\n * required field is missing. Values read from the profile are checked when the\n * event is emitted, by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) continue; // a loose payload may carry extra fields\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;;;;AAoHA,SAAgB,aAAa,YAAoD;CAC/E,OAAO;EAAE,MAAM;EAAkB,GAAG;CAAW;AACjD;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,MAAM,QAAQA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EAC7D,cAAA,kBAAkB,QAAQ,MAAM,OAAO,CAAC;EACxC,QAAQ;GACN;GACA,MAAMA,kBAAAA,eAAe,QAAQ,OAAO,WAAW,IAAI;GACnD,SAASA,kBAAAA,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAOA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAASC,mBAAAA,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;AAM9D,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAASC,iBAAAA,aAAa,OAAO,GAAG;EACrD,MAAM,UAAUC,kBAAAA,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;GAEhD,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADWC,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;;AAQA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAGF,MAAM,QADS,SAAS,QAAQ,OAAO,KAAK,MACvB,CAAC,KAAK,IAA2B;CACtD,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;EAClD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;EAElC,IAAI,CADWA,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}

package/dist/config.d.cts

@@ -85,7 +85,7 @@ export interface JourneyConfigDefinition {
   contract?: Contract;
   workflows: readonly WorkflowBuilder[];
   segments?: readonly SegmentRef[];
-  actions?: readonly ActionRef<object>[];
+  actions?: readonly ActionRef[];
   /** The template definitions, per channel; each is identified by its own `id`. */
   templates?: TemplateRegistry;
   /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */

package/dist/config.d.mts

@@ -85,7 +85,7 @@ export interface JourneyConfigDefinition {
   contract?: Contract;
   workflows: readonly WorkflowBuilder[];
   segments?: readonly SegmentRef[];
-  actions?: readonly ActionRef<object>[];
+  actions?: readonly ActionRef[];
   /** The template definitions, per channel; each is identified by its own `id`. */
   templates?: TemplateRegistry;
   /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */

package/dist/config.mjs

@@ -131,7 +131,7 @@ function checkMessage(workflow, node, index, config) {
 			problems.push(`'${field}' is not a prop of the template`);
 			continue;
 		}
-		if (typeof value === "object" && value !== null && "type" in value) {
+		if (typeof value === "object" && "type" in value) {
 			const profile = config.contract?.schemas.profile._zod.def;
 			if (profile !== void 0 && value.path !== "userId" && !Object.hasOwn(profile.shape, value.path)) problems.push(`'${field}' reads u.${value.path}, which the contract's profile does not declare`);
 			continue;
@@ -155,7 +155,7 @@ function checkEmit(workflow, node, config) {
 	const shape = contract.schemas.events[node.event]._zod.def.shape;
 	const problems = [];
 	for (const [field, value] of Object.entries(node.payload)) {
-		if (typeof value === "object" && value !== null && "type" in value) continue;
+		if (typeof value === "object" && "type" in value) continue;
 		if (!Object.hasOwn(shape, field)) continue;
 		if (!z.safeParse(shape[field], value).success) problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);
 	}

package/dist/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport { type EmailConfig, assertEmailConfig } from './email';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, what the email templates share, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: Contract;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef<object>[];\n  /** The template definitions, per channel; each is identified by its own `id`. */\n  templates?: TemplateRegistry;\n  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */\n  email?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** Where a Postgres store keeps the engine's tables (the D1 store ignores it). */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig(definition: JourneyConfigDefinition): JourneyConfig {\n  return { kind: 'journey-config', ...definition };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, an id is registered\n * once per channel, and every email template's metadata is valid, as is the\n * config's `email` (which replaced `emails`: a config still carrying it fails).\n * Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    const email = indexTemplates('email', config.templates?.email);\n    assertEmailConfig(config, email.values());\n    index = {\n      email,\n      push: indexTemplates('push', config.templates?.push),\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && value !== null && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, and no\n * required field is missing. Values read from the profile are checked when the\n * event is emitted, by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && value !== null && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) continue; // a loose payload may carry extra fields\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;AAoHA,SAAgB,aAAa,YAAoD;CAC/E,OAAO;EAAE,MAAM;EAAkB,GAAG;CAAW;AACjD;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,MAAM,QAAQ,eAAe,SAAS,OAAO,WAAW,KAAK;EAC7D,kBAAkB,QAAQ,MAAM,OAAO,CAAC;EACxC,QAAQ;GACN;GACA,MAAM,eAAe,QAAQ,OAAO,WAAW,IAAI;GACnD,SAAS,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAO,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAAS,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;AAM9D,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAAS,aAAa,OAAO,GAAG;EACrD,MAAM,UAAU,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,OAAO;GAElE,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADW,EAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;;AAQA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAGF,MAAM,QADS,SAAS,QAAQ,OAAO,KAAK,MACvB,CAAC,KAAK,IAA2B;CACtD,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,OAAO;EACpE,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;EAElC,IAAI,CADW,EAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}
+{"version":3,"file":"config.mjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport { type EmailConfig, assertEmailConfig } from './email';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, what the email templates share, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: Contract;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef[];\n  /** The template definitions, per channel; each is identified by its own `id`. */\n  templates?: TemplateRegistry;\n  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */\n  email?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** Where a Postgres store keeps the engine's tables (the D1 store ignores it). */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig(definition: JourneyConfigDefinition): JourneyConfig {\n  return { kind: 'journey-config', ...definition };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, an id is registered\n * once per channel, and every email template's metadata is valid, as is the\n * config's `email` (which replaced `emails`: a config still carrying it fails).\n * Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    const email = indexTemplates('email', config.templates?.email);\n    assertEmailConfig(config, email.values());\n    index = {\n      email,\n      push: indexTemplates('push', config.templates?.push),\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, and no\n * required field is missing. Values read from the profile are checked when the\n * event is emitted, by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) continue; // a loose payload may carry extra fields\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;AAoHA,SAAgB,aAAa,YAAoD;CAC/E,OAAO;EAAE,MAAM;EAAkB,GAAG;CAAW;AACjD;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,MAAM,QAAQ,eAAe,SAAS,OAAO,WAAW,KAAK;EAC7D,kBAAkB,QAAQ,MAAM,OAAO,CAAC;EACxC,QAAQ;GACN;GACA,MAAM,eAAe,QAAQ,OAAO,WAAW,IAAI;GACnD,SAAS,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAO,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAAS,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;AAM9D,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAAS,aAAa,OAAO,GAAG;EACrD,MAAM,UAAU,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;GAEhD,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADW,EAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;;AAQA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAGF,MAAM,QADS,SAAS,QAAQ,OAAO,KAAK,MACvB,CAAC,KAAK,IAA2B;CACtD,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;EAClD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;EAElC,IAAI,CADW,EAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}

package/dist/contract.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"contract.cjs","names":["event","user","z"],"sources":["../src/contract.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport { type EventRefs, type UserRefs, event, user } from './dsl';\n\n/**\n * `defineContract({ events, profile })` — the producer/engine contract as Zod\n * schemas, written once in a package both sides import. From it:\n *\n * - `contract.events` / `contract.user` are the DSL's typed reference tables\n *   (what `event<E>()` / `user<U>()` used to be, now derived from the schemas);\n * - `JourneyClient({ contract })` types `track` / `identify` by event name and\n *   checks payloads before sending;\n * - `journeyWorker({ contract })` re-validates every inbound `/events` and\n *   `/identify` — never trusting the caller used the SDK — and refuses a bad\n *   one with a 4xx before anything is stored, woken or started.\n *\n * Supported schemas (v1), synchronous and JSON-shaped: event payloads are\n * object schemas (`z.looseObject` keeps a producer's extra analytics fields,\n * `z.strictObject` refuses them) and may nest objects and arrays; the profile\n * is a flat object of string / number / boolean / enum / literal fields. Input\n * and output must mean the same thing, so defaults, transforms, coercion,\n * custom refinements and async checks are refused when the contract is\n * defined. The Zod instances stay in the host; nothing here changes the IR.\n */\n\ntype ObjectSchema = core.$ZodObject;\n\n/** The declared fields of an object schema — without a loose object's `[key: string]: unknown`, so the DSL only offers fields that were written down. */\nexport type DeclaredOutput<S> =\n  S extends core.$ZodObject<infer Shape>\n    ? core.$InferObjectOutput<Shape, Record<never, never>>\n    : never;\n\nexport interface ContractDefinition<\n  E extends Record<string, ObjectSchema>,\n  P extends ObjectSchema,\n> {\n  events: E;\n  profile: P;\n}\n\n/** One rejected field, with the dotted path the producer can fix. */\nexport interface ContractIssue {\n  path: string;\n  message: string;\n}\n\nexport type ContractResult<T> = { ok: true; data: T } | { ok: false; issues: ContractIssue[] };\n\nexport interface Contract<\n  E extends Record<string, ObjectSchema> = Record<string, ObjectSchema>,\n  P extends ObjectSchema = ObjectSchema,\n> {\n  readonly kind: 'journey-contract';\n  /** The DSL's event reference table: `e.purchase` — payload refs from the declared fields only. */\n  readonly events: EventRefs<{ [K in keyof E]: DeclaredOutput<E[K]> }>;\n  /** The DSL's user-property reference table: `u.name`, plus the system `u.userId`. */\n  readonly user: UserRefs<DeclaredOutput<P> & { userId: string }>;\n  /** The raw schemas, for hosts that need them (validation, docs). */\n  readonly schemas: { readonly events: E; readonly profile: P };\n  /** Every event name the contract declares — what a producer forwards. */\n  readonly eventNames: readonly (keyof E & string)[];\n  isEvent(name: string): name is keyof E & string;\n  /** Validate one event's payload; the parsed value is what may be stored. */\n  parseEvent<K extends keyof E & string>(\n    name: K,\n    payload: unknown\n  ): ContractResult<core.output<E[K]>>;\n  /**\n   * Validate an `/identify` merge patch: omitted fields stay as they are,\n   * `null` removes a field, every provided value is checked against its field\n   * schema, and an undeclared field is refused — a patch, never a full parse\n   * that would fill defaults over fields the caller did not send.\n   */\n  parseProfilePatch(patch: unknown): ContractResult<ProfilePatch<P>>;\n}\n\n/** An `/identify` patch over the profile: any subset of fields, `null` to remove one. */\nexport type ProfilePatch<P> = { [K in keyof DeclaredOutput<P>]?: DeclaredOutput<P>[K] | null };\n\n/** Payload type of one event, for producers: `EventPayload<typeof contract, 'purchase'>`. */\nexport type EventPayload<C, K extends string> =\n  C extends Contract<infer E> ? (K extends keyof E ? core.input<E[K]> : never) : never;\n\nexport function defineContract<E extends Record<string, ObjectSchema>, P extends ObjectSchema>(\n  definition: ContractDefinition<E, P>\n): Contract<E, P> {\n  for (const [name, schema] of Object.entries(definition.events)) {\n    if (name.startsWith('$')) {\n      throw new TypeError(`contract event '${name}': names starting with $ are reserved`);\n    }\n    assertJsonSchema(schema, `event '${name}'`, true);\n  }\n  assertJsonSchema(definition.profile, 'profile', true);\n  const profileShape = (definition.profile._zod.def as core.$ZodObjectDef).shape;\n  for (const [field, schema] of Object.entries(profileShape)) {\n    assertFlatScalar(schema, `profile.${field}`);\n  }\n  const strictProfile = definition.profile._zod.def.catchall?._zod.def.type === 'never';\n\n  const names = Object.keys(definition.events) as (keyof E & string)[];\n  return {\n    kind: 'journey-contract',\n    events: event() as never,\n    user: user() as never,\n    schemas: { events: definition.events, profile: definition.profile },\n    eventNames: names,\n    isEvent: (name): name is keyof E & string => Object.hasOwn(definition.events, name),\n    parseEvent(name, payload) {\n      if (!Object.hasOwn(definition.events, name)) {\n        return { ok: false, issues: [{ path: '', message: `unknown event '${name}'` }] };\n      }\n      return toResult(z.safeParse(definition.events[name], payload));\n    },\n    parseProfilePatch(patch) {\n      if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {\n        return { ok: false, issues: [{ path: '', message: 'props must be an object' }] };\n      }\n      const issues: ContractIssue[] = [];\n      const data: Record<string, unknown> = {};\n      for (const [field, value] of Object.entries(patch)) {\n        if (!Object.hasOwn(profileShape, field)) {\n          // userId is the request's identity, not a profile field\n          if (strictProfile || field === 'userId') {\n            issues.push({ path: field, message: 'not a declared profile field' });\n          } else {\n            data[field] = value;\n          }\n          continue;\n        }\n        if (value === null) {\n          data[field] = null;\n          continue;\n        }\n        const result = z.safeParse(profileShape[field], value);\n        if (result.success) data[field] = result.data;\n        else issues.push(...prefixed(field, result.error));\n      }\n      return issues.length > 0 ? { ok: false, issues } : { ok: true, data: data as never };\n    },\n  };\n}\n\n/**\n * An event the contract refuses — raised for events a journey emits itself\n * (`.sendEvent()`), which never pass the HTTP ingest: they go through the same\n * check, and a refusal is deterministic, so it is not retried.\n */\nexport class ContractValidationError extends Error {\n  override readonly name = 'ContractValidationError';\n  constructor(\n    readonly event: string,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `event '${event}' refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n  }\n}\n\n/** The one check every event passes, from HTTP or from a journey: declared, and its payload parses. */\nexport function checkEvent(\n  contract: Contract,\n  name: string,\n  payload: unknown\n): ContractResult<Record<string, unknown>> {\n  if (!contract.isEvent(name)) {\n    return {\n      ok: false,\n      issues: [{ path: '', message: `'${String(name)}' is not in the contract` }],\n    };\n  }\n  return contract.parseEvent(name, payload);\n}\n\nexport function isContract(value: unknown): value is Contract {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-contract'\n  );\n}\n\nfunction toResult<T>(result: core.util.SafeParseResult<T>): ContractResult<T> {\n  return result.success\n    ? { ok: true, data: result.data }\n    : { ok: false, issues: prefixed('', result.error) };\n}\n\nfunction prefixed(prefix: string, error: core.$ZodError): ContractIssue[] {\n  return error.issues.map((issue) => ({\n    path: [prefix, ...issue.path.map(String)].filter((p) => p !== '').join('.'),\n    message: issue.message,\n  }));\n}\n\n/* ---------------------------- supported schemas ---------------------------- */\n\n/**\n * The schema types a contract may use — JSON shapes that parse synchronously\n * and mean the same before and after parsing. Anything not listed (default,\n * transform, pipe, lazy, promise, custom, date, bigint, …) is refused, and\n * every container is walked so nothing unsupported hides inside one.\n */\nconst ALLOWED = new Set([\n  'object',\n  'array',\n  'tuple',\n  'union',\n  'intersection',\n  'record',\n  'optional',\n  'nullable',\n  'readonly',\n  'nonoptional',\n  'string',\n  'number',\n  'boolean',\n  'null',\n  'enum',\n  'literal',\n  'unknown',\n  'any',\n  'never',\n]);\n\n/** Checks that change the value (`overwrite`: `.trim()`, `.toLowerCase()`, …) or run arbitrary code (`custom`: `.refine()`, async or not). */\nconst REFUSED_CHECKS = new Set(['custom', 'overwrite']);\n\nfunction assertJsonSchema(schema: unknown, where: string, top = false): void {\n  const def = (schema as core.$ZodType | undefined)?._zod?.def;\n  if (def === undefined) throw new TypeError(`contract ${where}: not a Zod schema`);\n  if (top && def.type !== 'object') {\n    throw new TypeError(\n      `contract ${where}: must be an object schema (z.looseObject / z.strictObject)`\n    );\n  }\n  if (!ALLOWED.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: ${def.type} schemas are not supported (input and output must mean the same JSON, parsed synchronously)`\n    );\n  }\n  if ((def as { coerce?: boolean }).coerce === true) {\n    throw new TypeError(`contract ${where}: coercion (z.coerce) is not supported`);\n  }\n  for (const check of def.checks ?? []) {\n    if (REFUSED_CHECKS.has(check._zod.def.check)) {\n      throw new TypeError(\n        `contract ${where}: ${check._zod.def.check === 'overwrite' ? 'value-changing checks (.overwrite, .trim, …)' : 'custom refinements'} are not supported`\n      );\n    }\n  }\n  const children: [string, unknown][] = [];\n  switch (def.type) {\n    case 'object': {\n      const object = def as core.$ZodObjectDef;\n      for (const [k, v] of Object.entries(object.shape)) children.push([`${where}.${k}`, v]);\n      if (object.catchall !== undefined) children.push([`${where}.*`, object.catchall]);\n      break;\n    }\n    case 'optional':\n    case 'nullable':\n    case 'readonly':\n    case 'nonoptional':\n      children.push([where, (def as unknown as { innerType: unknown }).innerType]);\n      break;\n    case 'array':\n      children.push([`${where}[]`, (def as core.$ZodArrayDef).element]);\n      break;\n    case 'tuple': {\n      const tuple = def as core.$ZodTupleDef;\n      tuple.items.forEach((item, index) => children.push([`${where}[${index}]`, item]));\n      if (tuple.rest !== null) children.push([`${where}[…]`, tuple.rest]);\n      break;\n    }\n    case 'union':\n      for (const option of (def as core.$ZodUnionDef).options) children.push([where, option]);\n      break;\n    case 'intersection': {\n      const intersection = def as core.$ZodIntersectionDef;\n      children.push([where, intersection.left], [where, intersection.right]);\n      break;\n    }\n    case 'record': {\n      const record = def as core.$ZodRecordDef;\n      children.push([`${where}{key}`, record.keyType], [`${where}{}`, record.valueType]);\n      break;\n    }\n    default:\n      break;\n  }\n  for (const [path, child] of children) assertJsonSchema(child, path);\n}\n\nconst SCALARS = new Set(['string', 'number', 'boolean', 'enum', 'literal']);\n\nfunction assertFlatScalar(schema: unknown, where: string): void {\n  let def = (schema as core.$ZodType)._zod.def;\n  if (def.type === 'optional') def = (def as core.$ZodOptionalDef).innerType._zod.def;\n  if (!SCALARS.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: profile fields must be flat scalars (string, number, boolean, enum, literal), got ${def.type}`\n    );\n  }\n}\n"],"mappings":";;;;;;;AAoFA,SAAgB,eACd,YACgB;CAChB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,WAAW,MAAM,GAAG;EAC9D,IAAI,KAAK,WAAW,GAAG,GACrB,MAAM,IAAI,UAAU,mBAAmB,KAAK,sCAAsC;EAEpF,iBAAiB,QAAQ,UAAU,KAAK,IAAI,IAAI;CAClD;CACA,iBAAiB,WAAW,SAAS,WAAW,IAAI;CACpD,MAAM,eAAgB,WAAW,QAAQ,KAAK,IAA2B;CACzE,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,YAAY,GACvD,iBAAiB,QAAQ,WAAW,OAAO;CAE7C,MAAM,gBAAgB,WAAW,QAAQ,KAAK,IAAI,UAAU,KAAK,IAAI,SAAS;CAE9E,MAAM,QAAQ,OAAO,KAAK,WAAW,MAAM;CAC3C,OAAO;EACL,MAAM;EACN,QAAQA,iBAAAA,MAAM;EACd,MAAMC,iBAAAA,KAAK;EACX,SAAS;GAAE,QAAQ,WAAW;GAAQ,SAAS,WAAW;EAAQ;EAClE,YAAY;EACZ,UAAU,SAAmC,OAAO,OAAO,WAAW,QAAQ,IAAI;EAClF,WAAW,MAAM,SAAS;GACxB,IAAI,CAAC,OAAO,OAAO,WAAW,QAAQ,IAAI,GACxC,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS,kBAAkB,KAAK;IAAG,CAAC;GAAE;GAEjF,OAAO,SAASC,SAAE,UAAU,WAAW,OAAO,OAAO,OAAO,CAAC;EAC/D;EACA,kBAAkB,OAAO;GACvB,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS;IAA0B,CAAC;GAAE;GAEjF,MAAM,SAA0B,CAAC;GACjC,MAAM,OAAgC,CAAC;GACvC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG;IAClD,IAAI,CAAC,OAAO,OAAO,cAAc,KAAK,GAAG;KAEvC,IAAI,iBAAiB,UAAU,UAC7B,OAAO,KAAK;MAAE,MAAM;MAAO,SAAS;KAA+B,CAAC;UAEpE,KAAK,SAAS;KAEhB;IACF;IACA,IAAI,UAAU,MAAM;KAClB,KAAK,SAAS;KACd;IACF;IACA,MAAM,SAASA,SAAE,UAAU,aAAa,QAAQ,KAAK;IACrD,IAAI,OAAO,SAAS,KAAK,SAAS,OAAO;SACpC,OAAO,KAAK,GAAG,SAAS,OAAO,OAAO,KAAK,CAAC;GACnD;GACA,OAAO,OAAO,SAAS,IAAI;IAAE,IAAI;IAAO;GAAO,IAAI;IAAE,IAAI;IAAY;GAAc;EACrF;CACF;AACF;;;;;;AAOA,IAAa,0BAAb,cAA6C,MAAM;CAGtC;CACA;CAHX,OAAyB;CACzB,YACE,OACA,QACA;EACA,MACE,UAAU,MAAM,6BAA6B,OAC1C,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EAPS,KAAA,QAAA;EACA,KAAA,SAAA;CAOX;AACF;;AAGA,SAAgB,WACd,UACA,MACA,SACyC;CACzC,IAAI,CAAC,SAAS,QAAQ,IAAI,GACxB,OAAO;EACL,IAAI;EACJ,QAAQ,CAAC;GAAE,MAAM;GAAI,SAAS,IAAI,OAAO,IAAI,EAAE;EAA0B,CAAC;CAC5E;CAEF,OAAO,SAAS,WAAW,MAAM,OAAO;AAC1C;AAEA,SAAgB,WAAW,OAAmC;CAC5D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;AAEA,SAAS,SAAY,QAAyD;CAC5E,OAAO,OAAO,UACV;EAAE,IAAI;EAAM,MAAM,OAAO;CAAK,IAC9B;EAAE,IAAI;EAAO,QAAQ,SAAS,IAAI,OAAO,KAAK;CAAE;AACtD;AAEA,SAAS,SAAS,QAAgB,OAAwC;CACxE,OAAO,MAAM,OAAO,KAAK,WAAW;EAClC,MAAM,CAAC,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG;EAC1E,SAAS,MAAM;CACjB,EAAE;AACJ;;;;;;;AAUA,MAAM,0BAAU,IAAI,IAAI;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,iCAAiB,IAAI,IAAI,CAAC,UAAU,WAAW,CAAC;AAEtD,SAAS,iBAAiB,QAAiB,OAAe,MAAM,OAAa;CAC3E,MAAM,MAAO,QAAsC,MAAM;CACzD,IAAI,QAAQ,KAAA,GAAW,MAAM,IAAI,UAAU,YAAY,MAAM,mBAAmB;CAChF,IAAI,OAAO,IAAI,SAAS,UACtB,MAAM,IAAI,UACR,YAAY,MAAM,4DACpB;CAEF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,IAAI,KAAK,4FACjC;CAEF,IAAK,IAA6B,WAAW,MAC3C,MAAM,IAAI,UAAU,YAAY,MAAM,uCAAuC;CAE/E,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,GACjC,IAAI,eAAe,IAAI,MAAM,KAAK,IAAI,KAAK,GACzC,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,MAAM,KAAK,IAAI,UAAU,cAAc,iDAAiD,qBAAqB,mBACrI;CAGJ,MAAM,WAAgC,CAAC;CACvC,QAAQ,IAAI,MAAZ;EACE,KAAK,UAAU;GACb,MAAM,SAAS;GACf,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,GAAG,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;GACrF,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,KAAK,CAAC,GAAG,MAAM,KAAK,OAAO,QAAQ,CAAC;GAChF;EACF;EACA,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACH,SAAS,KAAK,CAAC,OAAQ,IAA0C,SAAS,CAAC;GAC3E;EACF,KAAK;GACH,SAAS,KAAK,CAAC,GAAG,MAAM,KAAM,IAA0B,OAAO,CAAC;GAChE;EACF,KAAK,SAAS;GACZ,MAAM,QAAQ;GACd,MAAM,MAAM,SAAS,MAAM,UAAU,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC;GAChF,IAAI,MAAM,SAAS,MAAM,SAAS,KAAK,CAAC,GAAG,MAAM,MAAM,MAAM,IAAI,CAAC;GAClE;EACF;EACA,KAAK;GACH,KAAK,MAAM,UAAW,IAA0B,SAAS,SAAS,KAAK,CAAC,OAAO,MAAM,CAAC;GACtF;EACF,KAAK,gBAAgB;GACnB,MAAM,eAAe;GACrB,SAAS,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,CAAC,OAAO,aAAa,KAAK,CAAC;GACrE;EACF;EACA,KAAK,UAAU;GACb,MAAM,SAAS;GACf,SAAS,KAAK,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,GAAG,CAAC,GAAG,MAAM,KAAK,OAAO,SAAS,CAAC;GACjF;EACF;CAGF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,UAAU,iBAAiB,OAAO,IAAI;AACpE;AAEA,MAAM,0BAAU,IAAI,IAAI;CAAC;CAAU;CAAU;CAAW;CAAQ;AAAS,CAAC;AAE1E,SAAS,iBAAiB,QAAiB,OAAqB;CAC9D,IAAI,MAAO,OAAyB,KAAK;CACzC,IAAI,IAAI,SAAS,YAAY,MAAO,IAA6B,UAAU,KAAK;CAChF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,sFAAsF,IAAI,MAC9G;AAEJ"}
+{"version":3,"file":"contract.cjs","names":["event","user","z"],"sources":["../src/contract.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport { type EventRefs, type UserRefs, event, user } from './dsl';\n\n/**\n * `defineContract({ events, profile })` — the producer/engine contract as Zod\n * schemas, written once in a package both sides import. From it:\n *\n * - `contract.events` / `contract.user` are the DSL's typed reference tables\n *   (what `event<E>()` / `user<U>()` used to be, now derived from the schemas);\n * - `JourneyClient({ contract })` types `track` / `identify` by event name and\n *   checks payloads before sending;\n * - `journeyWorker({ contract })` re-validates every inbound `/events` and\n *   `/identify` — never trusting the caller used the SDK — and refuses a bad\n *   one with a 4xx before anything is stored, woken or started.\n *\n * Supported schemas (v1), synchronous and JSON-shaped: event payloads are\n * object schemas (`z.looseObject` keeps a producer's extra analytics fields,\n * `z.strictObject` refuses them) and may nest objects and arrays; the profile\n * is a flat object of string / number / boolean / enum / literal fields. Input\n * and output must mean the same thing, so defaults, transforms, coercion,\n * custom refinements and async checks are refused when the contract is\n * defined. The Zod instances stay in the host; nothing here changes the IR.\n */\n\ntype ObjectSchema = core.$ZodObject;\n\n/** The declared fields of an object schema — without a loose object's `[key: string]: unknown`, so the DSL only offers fields that were written down. */\nexport type DeclaredOutput<S> =\n  S extends core.$ZodObject<infer Shape>\n    ? core.$InferObjectOutput<Shape, core.$strict['out']>\n    : never;\n\nexport interface ContractDefinition<\n  E extends Record<string, ObjectSchema>,\n  P extends ObjectSchema,\n> {\n  events: E;\n  profile: P;\n}\n\n/** One rejected field, with the dotted path the producer can fix. */\nexport interface ContractIssue {\n  path: string;\n  message: string;\n}\n\nexport type ContractResult<T> = { ok: true; data: T } | { ok: false; issues: ContractIssue[] };\n\nexport interface Contract<\n  E extends Record<string, ObjectSchema> = Record<string, ObjectSchema>,\n  P extends ObjectSchema = ObjectSchema,\n> {\n  readonly kind: 'journey-contract';\n  /** The DSL's event reference table: `e.purchase` — payload refs from the declared fields only. */\n  readonly events: EventRefs<{ [K in keyof E]: DeclaredOutput<E[K]> }>;\n  /** The DSL's user-property reference table: `u.name`, plus the system `u.userId`. */\n  readonly user: UserRefs<DeclaredOutput<P> & { userId: string }>;\n  /** The raw schemas, for hosts that need them (validation, docs). */\n  readonly schemas: { readonly events: E; readonly profile: P };\n  /** Every event name the contract declares — what a producer forwards. */\n  readonly eventNames: readonly (keyof E & string)[];\n  isEvent(name: string): name is keyof E & string;\n  /** Validate one event's payload; the parsed value is what may be stored. */\n  parseEvent<K extends keyof E & string>(\n    name: K,\n    payload: unknown\n  ): ContractResult<core.output<E[K]>>;\n  /**\n   * Validate an `/identify` merge patch: omitted fields stay as they are,\n   * `null` removes a field, every provided value is checked against its field\n   * schema, and an undeclared field is refused — a patch, never a full parse\n   * that would fill defaults over fields the caller did not send.\n   */\n  parseProfilePatch(patch: unknown): ContractResult<ProfilePatch<P>>;\n}\n\n/** An `/identify` patch over the profile: any subset of fields, `null` to remove one. */\nexport type ProfilePatch<P> = { [K in keyof DeclaredOutput<P>]?: DeclaredOutput<P>[K] | null };\n\n/** Payload type of one event, for producers: `EventPayload<typeof contract, 'purchase'>`. */\nexport type EventPayload<C, K extends string> =\n  C extends Contract<infer E> ? (K extends keyof E ? core.input<E[K]> : never) : never;\n\nexport function defineContract<E extends Record<string, ObjectSchema>, P extends ObjectSchema>(\n  definition: ContractDefinition<E, P>\n): Contract<E, P> {\n  for (const [name, schema] of Object.entries(definition.events)) {\n    if (name.startsWith('$')) {\n      throw new TypeError(`contract event '${name}': names starting with $ are reserved`);\n    }\n    assertJsonSchema(schema, `event '${name}'`, true);\n  }\n  assertJsonSchema(definition.profile, 'profile', true);\n  const profileShape = (definition.profile._zod.def as core.$ZodObjectDef).shape;\n  for (const [field, schema] of Object.entries(profileShape)) {\n    assertFlatScalar(schema, `profile.${field}`);\n  }\n  const strictProfile = definition.profile._zod.def.catchall?._zod.def.type === 'never';\n\n  const names = Object.keys(definition.events) as (keyof E & string)[];\n  return {\n    kind: 'journey-contract',\n    events: event() as never,\n    user: user() as never,\n    schemas: { events: definition.events, profile: definition.profile },\n    eventNames: names,\n    isEvent: (name): name is keyof E & string => Object.hasOwn(definition.events, name),\n    parseEvent(name, payload) {\n      if (!Object.hasOwn(definition.events, name)) {\n        return { ok: false, issues: [{ path: '', message: `unknown event '${name}'` }] };\n      }\n      return toResult(z.safeParse(definition.events[name], payload));\n    },\n    parseProfilePatch(patch) {\n      if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {\n        return { ok: false, issues: [{ path: '', message: 'props must be an object' }] };\n      }\n      const issues: ContractIssue[] = [];\n      const data: Record<string, unknown> = {};\n      for (const [field, value] of Object.entries(patch)) {\n        if (!Object.hasOwn(profileShape, field)) {\n          // userId is the request's identity, not a profile field\n          if (strictProfile || field === 'userId') {\n            issues.push({ path: field, message: 'not a declared profile field' });\n          } else {\n            data[field] = value;\n          }\n          continue;\n        }\n        if (value === null) {\n          data[field] = null;\n          continue;\n        }\n        const result = z.safeParse(profileShape[field], value);\n        if (result.success) data[field] = result.data;\n        else issues.push(...prefixed(field, result.error));\n      }\n      return issues.length > 0 ? { ok: false, issues } : { ok: true, data: data as never };\n    },\n  };\n}\n\n/**\n * An event the contract refuses — raised for events a journey emits itself\n * (`.sendEvent()`), which never pass the HTTP ingest: they go through the same\n * check, and a refusal is deterministic, so it is not retried.\n */\nexport class ContractValidationError extends Error {\n  override readonly name = 'ContractValidationError';\n  constructor(\n    readonly event: string,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `event '${event}' refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n  }\n}\n\n/** The one check every event passes, from HTTP or from a journey: declared, and its payload parses. */\nexport function checkEvent(\n  contract: Contract,\n  name: string,\n  payload: unknown\n): ContractResult<Record<string, unknown>> {\n  if (!contract.isEvent(name)) {\n    return {\n      ok: false,\n      issues: [{ path: '', message: `'${String(name)}' is not in the contract` }],\n    };\n  }\n  return contract.parseEvent(name, payload);\n}\n\nexport function isContract(value: unknown): value is Contract {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-contract'\n  );\n}\n\nfunction toResult<T>(result: core.util.SafeParseResult<T>): ContractResult<T> {\n  return result.success\n    ? { ok: true, data: result.data }\n    : { ok: false, issues: prefixed('', result.error) };\n}\n\nfunction prefixed(prefix: string, error: core.$ZodError): ContractIssue[] {\n  return error.issues.map((issue) => ({\n    path: [prefix, ...issue.path.map(String)].filter((p) => p !== '').join('.'),\n    message: issue.message,\n  }));\n}\n\n/* ---------------------------- supported schemas ---------------------------- */\n\n/**\n * The schema types a contract may use — JSON shapes that parse synchronously\n * and mean the same before and after parsing. Anything not listed (default,\n * transform, pipe, lazy, promise, custom, date, bigint, …) is refused, and\n * every container is walked so nothing unsupported hides inside one.\n */\nconst ALLOWED = new Set([\n  'object',\n  'array',\n  'tuple',\n  'union',\n  'intersection',\n  'record',\n  'optional',\n  'nullable',\n  'readonly',\n  'nonoptional',\n  'string',\n  'number',\n  'boolean',\n  'null',\n  'enum',\n  'literal',\n  'unknown',\n  'any',\n  'never',\n]);\n\n/** Checks that change the value (`overwrite`: `.trim()`, `.toLowerCase()`, …) or run arbitrary code (`custom`: `.refine()`, async or not). */\nconst REFUSED_CHECKS = new Set(['custom', 'overwrite']);\n\nfunction assertJsonSchema(schema: unknown, where: string, top = false): void {\n  const def = (schema as { _zod?: { def?: core.$ZodTypeDef } } | null | undefined)?._zod?.def;\n  if (def === undefined) throw new TypeError(`contract ${where}: not a Zod schema`);\n  if (top && def.type !== 'object') {\n    throw new TypeError(\n      `contract ${where}: must be an object schema (z.looseObject / z.strictObject)`\n    );\n  }\n  if (!ALLOWED.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: ${def.type} schemas are not supported (input and output must mean the same JSON, parsed synchronously)`\n    );\n  }\n  if ((def as { coerce?: boolean }).coerce === true) {\n    throw new TypeError(`contract ${where}: coercion (z.coerce) is not supported`);\n  }\n  for (const check of def.checks ?? []) {\n    if (REFUSED_CHECKS.has(check._zod.def.check)) {\n      throw new TypeError(\n        `contract ${where}: ${check._zod.def.check === 'overwrite' ? 'value-changing checks (.overwrite, .trim, …)' : 'custom refinements'} are not supported`\n      );\n    }\n  }\n  const children: [string, unknown][] = [];\n  switch (def.type) {\n    case 'object': {\n      const object = def as core.$ZodObjectDef;\n      for (const [k, v] of Object.entries(object.shape)) children.push([`${where}.${k}`, v]);\n      if (object.catchall !== undefined) children.push([`${where}.*`, object.catchall]);\n      break;\n    }\n    case 'optional':\n    case 'nullable':\n    case 'readonly':\n    case 'nonoptional':\n      children.push([where, (def as unknown as { innerType: unknown }).innerType]);\n      break;\n    case 'array':\n      children.push([`${where}[]`, (def as core.$ZodArrayDef).element]);\n      break;\n    case 'tuple': {\n      const tuple = def as core.$ZodTupleDef;\n      tuple.items.forEach((item, index) => children.push([`${where}[${index}]`, item]));\n      if (tuple.rest !== null) children.push([`${where}[…]`, tuple.rest]);\n      break;\n    }\n    case 'union':\n      for (const option of (def as core.$ZodUnionDef).options) children.push([where, option]);\n      break;\n    case 'intersection': {\n      const intersection = def as core.$ZodIntersectionDef;\n      children.push([where, intersection.left], [where, intersection.right]);\n      break;\n    }\n    case 'record': {\n      const record = def as core.$ZodRecordDef;\n      children.push([`${where}{key}`, record.keyType], [`${where}{}`, record.valueType]);\n      break;\n    }\n    default:\n      break;\n  }\n  for (const [path, child] of children) assertJsonSchema(child, path);\n}\n\nconst SCALARS = new Set(['string', 'number', 'boolean', 'enum', 'literal']);\n\nfunction assertFlatScalar(schema: unknown, where: string): void {\n  let def = (schema as core.$ZodType)._zod.def;\n  if (def.type === 'optional') def = (def as core.$ZodOptionalDef).innerType._zod.def;\n  if (!SCALARS.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: profile fields must be flat scalars (string, number, boolean, enum, literal), got ${def.type}`\n    );\n  }\n}\n"],"mappings":";;;;;;;AAoFA,SAAgB,eACd,YACgB;CAChB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,WAAW,MAAM,GAAG;EAC9D,IAAI,KAAK,WAAW,GAAG,GACrB,MAAM,IAAI,UAAU,mBAAmB,KAAK,sCAAsC;EAEpF,iBAAiB,QAAQ,UAAU,KAAK,IAAI,IAAI;CAClD;CACA,iBAAiB,WAAW,SAAS,WAAW,IAAI;CACpD,MAAM,eAAgB,WAAW,QAAQ,KAAK,IAA2B;CACzE,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,YAAY,GACvD,iBAAiB,QAAQ,WAAW,OAAO;CAE7C,MAAM,gBAAgB,WAAW,QAAQ,KAAK,IAAI,UAAU,KAAK,IAAI,SAAS;CAE9E,MAAM,QAAQ,OAAO,KAAK,WAAW,MAAM;CAC3C,OAAO;EACL,MAAM;EACN,QAAQA,iBAAAA,MAAM;EACd,MAAMC,iBAAAA,KAAK;EACX,SAAS;GAAE,QAAQ,WAAW;GAAQ,SAAS,WAAW;EAAQ;EAClE,YAAY;EACZ,UAAU,SAAmC,OAAO,OAAO,WAAW,QAAQ,IAAI;EAClF,WAAW,MAAM,SAAS;GACxB,IAAI,CAAC,OAAO,OAAO,WAAW,QAAQ,IAAI,GACxC,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS,kBAAkB,KAAK;IAAG,CAAC;GAAE;GAEjF,OAAO,SAASC,SAAE,UAAU,WAAW,OAAO,OAAO,OAAO,CAAC;EAC/D;EACA,kBAAkB,OAAO;GACvB,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS;IAA0B,CAAC;GAAE;GAEjF,MAAM,SAA0B,CAAC;GACjC,MAAM,OAAgC,CAAC;GACvC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG;IAClD,IAAI,CAAC,OAAO,OAAO,cAAc,KAAK,GAAG;KAEvC,IAAI,iBAAiB,UAAU,UAC7B,OAAO,KAAK;MAAE,MAAM;MAAO,SAAS;KAA+B,CAAC;UAEpE,KAAK,SAAS;KAEhB;IACF;IACA,IAAI,UAAU,MAAM;KAClB,KAAK,SAAS;KACd;IACF;IACA,MAAM,SAASA,SAAE,UAAU,aAAa,QAAQ,KAAK;IACrD,IAAI,OAAO,SAAS,KAAK,SAAS,OAAO;SACpC,OAAO,KAAK,GAAG,SAAS,OAAO,OAAO,KAAK,CAAC;GACnD;GACA,OAAO,OAAO,SAAS,IAAI;IAAE,IAAI;IAAO;GAAO,IAAI;IAAE,IAAI;IAAY;GAAc;EACrF;CACF;AACF;;;;;;AAOA,IAAa,0BAAb,cAA6C,MAAM;CAGtC;CACA;CAHX,OAAyB;CACzB,YACE,OACA,QACA;EACA,MACE,UAAU,MAAM,6BAA6B,OAC1C,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EAPS,KAAA,QAAA;EACA,KAAA,SAAA;CAOX;AACF;;AAGA,SAAgB,WACd,UACA,MACA,SACyC;CACzC,IAAI,CAAC,SAAS,QAAQ,IAAI,GACxB,OAAO;EACL,IAAI;EACJ,QAAQ,CAAC;GAAE,MAAM;GAAI,SAAS,IAAI,OAAO,IAAI,EAAE;EAA0B,CAAC;CAC5E;CAEF,OAAO,SAAS,WAAW,MAAM,OAAO;AAC1C;AAEA,SAAgB,WAAW,OAAmC;CAC5D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;AAEA,SAAS,SAAY,QAAyD;CAC5E,OAAO,OAAO,UACV;EAAE,IAAI;EAAM,MAAM,OAAO;CAAK,IAC9B;EAAE,IAAI;EAAO,QAAQ,SAAS,IAAI,OAAO,KAAK;CAAE;AACtD;AAEA,SAAS,SAAS,QAAgB,OAAwC;CACxE,OAAO,MAAM,OAAO,KAAK,WAAW;EAClC,MAAM,CAAC,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG;EAC1E,SAAS,MAAM;CACjB,EAAE;AACJ;;;;;;;AAUA,MAAM,0BAAU,IAAI,IAAI;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,iCAAiB,IAAI,IAAI,CAAC,UAAU,WAAW,CAAC;AAEtD,SAAS,iBAAiB,QAAiB,OAAe,MAAM,OAAa;CAC3E,MAAM,MAAO,QAAqE,MAAM;CACxF,IAAI,QAAQ,KAAA,GAAW,MAAM,IAAI,UAAU,YAAY,MAAM,mBAAmB;CAChF,IAAI,OAAO,IAAI,SAAS,UACtB,MAAM,IAAI,UACR,YAAY,MAAM,4DACpB;CAEF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,IAAI,KAAK,4FACjC;CAEF,IAAK,IAA6B,WAAW,MAC3C,MAAM,IAAI,UAAU,YAAY,MAAM,uCAAuC;CAE/E,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,GACjC,IAAI,eAAe,IAAI,MAAM,KAAK,IAAI,KAAK,GACzC,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,MAAM,KAAK,IAAI,UAAU,cAAc,iDAAiD,qBAAqB,mBACrI;CAGJ,MAAM,WAAgC,CAAC;CACvC,QAAQ,IAAI,MAAZ;EACE,KAAK,UAAU;GACb,MAAM,SAAS;GACf,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,GAAG,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;GACrF,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,KAAK,CAAC,GAAG,MAAM,KAAK,OAAO,QAAQ,CAAC;GAChF;EACF;EACA,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACH,SAAS,KAAK,CAAC,OAAQ,IAA0C,SAAS,CAAC;GAC3E;EACF,KAAK;GACH,SAAS,KAAK,CAAC,GAAG,MAAM,KAAM,IAA0B,OAAO,CAAC;GAChE;EACF,KAAK,SAAS;GACZ,MAAM,QAAQ;GACd,MAAM,MAAM,SAAS,MAAM,UAAU,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC;GAChF,IAAI,MAAM,SAAS,MAAM,SAAS,KAAK,CAAC,GAAG,MAAM,MAAM,MAAM,IAAI,CAAC;GAClE;EACF;EACA,KAAK;GACH,KAAK,MAAM,UAAW,IAA0B,SAAS,SAAS,KAAK,CAAC,OAAO,MAAM,CAAC;GACtF;EACF,KAAK,gBAAgB;GACnB,MAAM,eAAe;GACrB,SAAS,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,CAAC,OAAO,aAAa,KAAK,CAAC;GACrE;EACF;EACA,KAAK,UAAU;GACb,MAAM,SAAS;GACf,SAAS,KAAK,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,GAAG,CAAC,GAAG,MAAM,KAAK,OAAO,SAAS,CAAC;GACjF;EACF;CAGF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,UAAU,iBAAiB,OAAO,IAAI;AACpE;AAEA,MAAM,0BAAU,IAAI,IAAI;CAAC;CAAU;CAAU;CAAW;CAAQ;AAAS,CAAC;AAE1E,SAAS,iBAAiB,QAAiB,OAAqB;CAC9D,IAAI,MAAO,OAAyB,KAAK;CACzC,IAAI,IAAI,SAAS,YAAY,MAAO,IAA6B,UAAU,KAAK;CAChF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,sFAAsF,IAAI,MAC9G;AAEJ"}

package/dist/contract.d.cts

@@ -24,7 +24,7 @@ import * as core from "zod/v4/core";
  */
 type ObjectSchema = core.$ZodObject;
 /** The declared fields of an object schema — without a loose object's `[key: string]: unknown`, so the DSL only offers fields that were written down. */
-export type DeclaredOutput<S> = S extends core.$ZodObject<infer Shape> ? core.$InferObjectOutput<Shape, Record<never, never>> : never;
+export type DeclaredOutput<S> = S extends core.$ZodObject<infer Shape> ? core.$InferObjectOutput<Shape, core.$strict['out']> : never;
 export interface ContractDefinition<E extends Record<string, ObjectSchema>, P extends ObjectSchema> {
   events: E;
   profile: P;

package/dist/contract.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.cts","names":[],"sources":["../src/contract.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;KAyBK,eAAe,KAAK;;YAGb,eAAe,KACzB,UAAU,KAAK,iBAAiB,SAC5B,KAAK,mBAAmB,OAAO;iBAGpB,mBACf,UAAU,eAAe,eACzB,UAAU;EAEV,QAAQ;EACR,SAAS;;;iBAIM;EACf;EACA;;YAGU,eAAe;EAAO;EAAU,MAAM;;EAAQ;EAAW,QAAQ;;iBAE5D,SACf,UAAU,eAAe,gBAAgB,eAAe,eACxD,UAAU,eAAe;WAEhB;;WAEA,QAAQ,aAAa,WAAW,IAAI,eAAe,EAAE;;WAErD,MAAM,SAAS,eAAe;IAAO;;;WAErC;aAAoB,QAAQ;aAAY,SAAS;;;WAEjD,4BAA4B;EACrC,QAAQ,eAAe,cAAc;;EAErC,WAAW,gBAAgB,YACzB,MAAM,GACN,mBACC,eAAe,KAAK,OAAO,EAAE;;;;;;;EAOhC,kBAAkB,iBAAiB,eAAe,aAAa;;;YAIrD,aAAa,QAAQ,WAAW,eAAe,MAAM,eAAe,GAAG;;YAGvE,aAAa,GAAG,oBAC1B,UAAU,eAAe,MAAM,gBAAgB,IAAI,KAAK,MAAM,EAAE;wBAElD,eAAe,UAAU,eAAe,eAAe,UAAU,cAC/E,YAAY,mBAAmB,GAAG,KACjC,SAAS,GAAG;;;;;;qBA8DF,gCAAgC;WAGhC;WACA,QAAQ;WAHD;EAClB,YACW,eACA,QAAQ;;;wBAWL,WACd,UAAU,UACV,cACA,mBACC,eAAe;wBAUF,WAAW,iBAAiB,SAAS"}
+{"version":3,"file":"contract.d.cts","names":[],"sources":["../src/contract.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;KAyBK,eAAe,KAAK;;YAGb,eAAe,KACzB,UAAU,KAAK,iBAAiB,SAC5B,KAAK,mBAAmB,OAAO,KAAK;iBAGzB,mBACf,UAAU,eAAe,eACzB,UAAU;EAEV,QAAQ;EACR,SAAS;;;iBAIM;EACf;EACA;;YAGU,eAAe;EAAO;EAAU,MAAM;;EAAQ;EAAW,QAAQ;;iBAE5D,SACf,UAAU,eAAe,gBAAgB,eAAe,eACxD,UAAU,eAAe;WAEhB;;WAEA,QAAQ,aAAa,WAAW,IAAI,eAAe,EAAE;;WAErD,MAAM,SAAS,eAAe;IAAO;;;WAErC;aAAoB,QAAQ;aAAY,SAAS;;;WAEjD,4BAA4B;EACrC,QAAQ,eAAe,cAAc;;EAErC,WAAW,gBAAgB,YACzB,MAAM,GACN,mBACC,eAAe,KAAK,OAAO,EAAE;;;;;;;EAOhC,kBAAkB,iBAAiB,eAAe,aAAa;;;YAIrD,aAAa,QAAQ,WAAW,eAAe,MAAM,eAAe,GAAG;;YAGvE,aAAa,GAAG,oBAC1B,UAAU,eAAe,MAAM,gBAAgB,IAAI,KAAK,MAAM,EAAE;wBAElD,eAAe,UAAU,eAAe,eAAe,UAAU,cAC/E,YAAY,mBAAmB,GAAG,KACjC,SAAS,GAAG;;;;;;qBA8DF,gCAAgC;WAGhC;WACA,QAAQ;WAHD;EAClB,YACW,eACA,QAAQ;;;wBAWL,WACd,UAAU,UACV,cACA,mBACC,eAAe;wBAUF,WAAW,iBAAiB,SAAS"}

package/dist/contract.d.mts

@@ -24,7 +24,7 @@ import * as core from "zod/v4/core";
  */
 type ObjectSchema = core.$ZodObject;
 /** The declared fields of an object schema — without a loose object's `[key: string]: unknown`, so the DSL only offers fields that were written down. */
-export type DeclaredOutput<S> = S extends core.$ZodObject<infer Shape> ? core.$InferObjectOutput<Shape, Record<never, never>> : never;
+export type DeclaredOutput<S> = S extends core.$ZodObject<infer Shape> ? core.$InferObjectOutput<Shape, core.$strict['out']> : never;
 export interface ContractDefinition<E extends Record<string, ObjectSchema>, P extends ObjectSchema> {
   events: E;
   profile: P;

package/dist/contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.mts","names":[],"sources":["../src/contract.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;KAyBK,eAAe,KAAK;;YAGb,eAAe,KACzB,UAAU,KAAK,iBAAiB,SAC5B,KAAK,mBAAmB,OAAO;iBAGpB,mBACf,UAAU,eAAe,eACzB,UAAU;EAEV,QAAQ;EACR,SAAS;;;iBAIM;EACf;EACA;;YAGU,eAAe;EAAO;EAAU,MAAM;;EAAQ;EAAW,QAAQ;;iBAE5D,SACf,UAAU,eAAe,gBAAgB,eAAe,eACxD,UAAU,eAAe;WAEhB;;WAEA,QAAQ,aAAa,WAAW,IAAI,eAAe,EAAE;;WAErD,MAAM,SAAS,eAAe;IAAO;;;WAErC;aAAoB,QAAQ;aAAY,SAAS;;;WAEjD,4BAA4B;EACrC,QAAQ,eAAe,cAAc;;EAErC,WAAW,gBAAgB,YACzB,MAAM,GACN,mBACC,eAAe,KAAK,OAAO,EAAE;;;;;;;EAOhC,kBAAkB,iBAAiB,eAAe,aAAa;;;YAIrD,aAAa,QAAQ,WAAW,eAAe,MAAM,eAAe,GAAG;;YAGvE,aAAa,GAAG,oBAC1B,UAAU,eAAe,MAAM,gBAAgB,IAAI,KAAK,MAAM,EAAE;wBAElD,eAAe,UAAU,eAAe,eAAe,UAAU,cAC/E,YAAY,mBAAmB,GAAG,KACjC,SAAS,GAAG;;;;;;qBA8DF,gCAAgC;WAGhC;WACA,QAAQ;WAHD;EAClB,YACW,eACA,QAAQ;;;wBAWL,WACd,UAAU,UACV,cACA,mBACC,eAAe;wBAUF,WAAW,iBAAiB,SAAS"}
+{"version":3,"file":"contract.d.mts","names":[],"sources":["../src/contract.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;KAyBK,eAAe,KAAK;;YAGb,eAAe,KACzB,UAAU,KAAK,iBAAiB,SAC5B,KAAK,mBAAmB,OAAO,KAAK;iBAGzB,mBACf,UAAU,eAAe,eACzB,UAAU;EAEV,QAAQ;EACR,SAAS;;;iBAIM;EACf;EACA;;YAGU,eAAe;EAAO;EAAU,MAAM;;EAAQ;EAAW,QAAQ;;iBAE5D,SACf,UAAU,eAAe,gBAAgB,eAAe,eACxD,UAAU,eAAe;WAEhB;;WAEA,QAAQ,aAAa,WAAW,IAAI,eAAe,EAAE;;WAErD,MAAM,SAAS,eAAe;IAAO;;;WAErC;aAAoB,QAAQ;aAAY,SAAS;;;WAEjD,4BAA4B;EACrC,QAAQ,eAAe,cAAc;;EAErC,WAAW,gBAAgB,YACzB,MAAM,GACN,mBACC,eAAe,KAAK,OAAO,EAAE;;;;;;;EAOhC,kBAAkB,iBAAiB,eAAe,aAAa;;;YAIrD,aAAa,QAAQ,WAAW,eAAe,MAAM,eAAe,GAAG;;YAGvE,aAAa,GAAG,oBAC1B,UAAU,eAAe,MAAM,gBAAgB,IAAI,KAAK,MAAM,EAAE;wBAElD,eAAe,UAAU,eAAe,eAAe,UAAU,cAC/E,YAAY,mBAAmB,GAAG,KACjC,SAAS,GAAG;;;;;;qBA8DF,gCAAgC;WAGhC;WACA,QAAQ;WAHD;EAClB,YACW,eACA,QAAQ;;;wBAWL,WACd,UAAU,UACV,cACA,mBACC,eAAe;wBAUF,WAAW,iBAAiB,SAAS"}

package/dist/contract.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"contract.mjs","names":[],"sources":["../src/contract.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport { type EventRefs, type UserRefs, event, user } from './dsl';\n\n/**\n * `defineContract({ events, profile })` — the producer/engine contract as Zod\n * schemas, written once in a package both sides import. From it:\n *\n * - `contract.events` / `contract.user` are the DSL's typed reference tables\n *   (what `event<E>()` / `user<U>()` used to be, now derived from the schemas);\n * - `JourneyClient({ contract })` types `track` / `identify` by event name and\n *   checks payloads before sending;\n * - `journeyWorker({ contract })` re-validates every inbound `/events` and\n *   `/identify` — never trusting the caller used the SDK — and refuses a bad\n *   one with a 4xx before anything is stored, woken or started.\n *\n * Supported schemas (v1), synchronous and JSON-shaped: event payloads are\n * object schemas (`z.looseObject` keeps a producer's extra analytics fields,\n * `z.strictObject` refuses them) and may nest objects and arrays; the profile\n * is a flat object of string / number / boolean / enum / literal fields. Input\n * and output must mean the same thing, so defaults, transforms, coercion,\n * custom refinements and async checks are refused when the contract is\n * defined. The Zod instances stay in the host; nothing here changes the IR.\n */\n\ntype ObjectSchema = core.$ZodObject;\n\n/** The declared fields of an object schema — without a loose object's `[key: string]: unknown`, so the DSL only offers fields that were written down. */\nexport type DeclaredOutput<S> =\n  S extends core.$ZodObject<infer Shape>\n    ? core.$InferObjectOutput<Shape, Record<never, never>>\n    : never;\n\nexport interface ContractDefinition<\n  E extends Record<string, ObjectSchema>,\n  P extends ObjectSchema,\n> {\n  events: E;\n  profile: P;\n}\n\n/** One rejected field, with the dotted path the producer can fix. */\nexport interface ContractIssue {\n  path: string;\n  message: string;\n}\n\nexport type ContractResult<T> = { ok: true; data: T } | { ok: false; issues: ContractIssue[] };\n\nexport interface Contract<\n  E extends Record<string, ObjectSchema> = Record<string, ObjectSchema>,\n  P extends ObjectSchema = ObjectSchema,\n> {\n  readonly kind: 'journey-contract';\n  /** The DSL's event reference table: `e.purchase` — payload refs from the declared fields only. */\n  readonly events: EventRefs<{ [K in keyof E]: DeclaredOutput<E[K]> }>;\n  /** The DSL's user-property reference table: `u.name`, plus the system `u.userId`. */\n  readonly user: UserRefs<DeclaredOutput<P> & { userId: string }>;\n  /** The raw schemas, for hosts that need them (validation, docs). */\n  readonly schemas: { readonly events: E; readonly profile: P };\n  /** Every event name the contract declares — what a producer forwards. */\n  readonly eventNames: readonly (keyof E & string)[];\n  isEvent(name: string): name is keyof E & string;\n  /** Validate one event's payload; the parsed value is what may be stored. */\n  parseEvent<K extends keyof E & string>(\n    name: K,\n    payload: unknown\n  ): ContractResult<core.output<E[K]>>;\n  /**\n   * Validate an `/identify` merge patch: omitted fields stay as they are,\n   * `null` removes a field, every provided value is checked against its field\n   * schema, and an undeclared field is refused — a patch, never a full parse\n   * that would fill defaults over fields the caller did not send.\n   */\n  parseProfilePatch(patch: unknown): ContractResult<ProfilePatch<P>>;\n}\n\n/** An `/identify` patch over the profile: any subset of fields, `null` to remove one. */\nexport type ProfilePatch<P> = { [K in keyof DeclaredOutput<P>]?: DeclaredOutput<P>[K] | null };\n\n/** Payload type of one event, for producers: `EventPayload<typeof contract, 'purchase'>`. */\nexport type EventPayload<C, K extends string> =\n  C extends Contract<infer E> ? (K extends keyof E ? core.input<E[K]> : never) : never;\n\nexport function defineContract<E extends Record<string, ObjectSchema>, P extends ObjectSchema>(\n  definition: ContractDefinition<E, P>\n): Contract<E, P> {\n  for (const [name, schema] of Object.entries(definition.events)) {\n    if (name.startsWith('$')) {\n      throw new TypeError(`contract event '${name}': names starting with $ are reserved`);\n    }\n    assertJsonSchema(schema, `event '${name}'`, true);\n  }\n  assertJsonSchema(definition.profile, 'profile', true);\n  const profileShape = (definition.profile._zod.def as core.$ZodObjectDef).shape;\n  for (const [field, schema] of Object.entries(profileShape)) {\n    assertFlatScalar(schema, `profile.${field}`);\n  }\n  const strictProfile = definition.profile._zod.def.catchall?._zod.def.type === 'never';\n\n  const names = Object.keys(definition.events) as (keyof E & string)[];\n  return {\n    kind: 'journey-contract',\n    events: event() as never,\n    user: user() as never,\n    schemas: { events: definition.events, profile: definition.profile },\n    eventNames: names,\n    isEvent: (name): name is keyof E & string => Object.hasOwn(definition.events, name),\n    parseEvent(name, payload) {\n      if (!Object.hasOwn(definition.events, name)) {\n        return { ok: false, issues: [{ path: '', message: `unknown event '${name}'` }] };\n      }\n      return toResult(z.safeParse(definition.events[name], payload));\n    },\n    parseProfilePatch(patch) {\n      if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {\n        return { ok: false, issues: [{ path: '', message: 'props must be an object' }] };\n      }\n      const issues: ContractIssue[] = [];\n      const data: Record<string, unknown> = {};\n      for (const [field, value] of Object.entries(patch)) {\n        if (!Object.hasOwn(profileShape, field)) {\n          // userId is the request's identity, not a profile field\n          if (strictProfile || field === 'userId') {\n            issues.push({ path: field, message: 'not a declared profile field' });\n          } else {\n            data[field] = value;\n          }\n          continue;\n        }\n        if (value === null) {\n          data[field] = null;\n          continue;\n        }\n        const result = z.safeParse(profileShape[field], value);\n        if (result.success) data[field] = result.data;\n        else issues.push(...prefixed(field, result.error));\n      }\n      return issues.length > 0 ? { ok: false, issues } : { ok: true, data: data as never };\n    },\n  };\n}\n\n/**\n * An event the contract refuses — raised for events a journey emits itself\n * (`.sendEvent()`), which never pass the HTTP ingest: they go through the same\n * check, and a refusal is deterministic, so it is not retried.\n */\nexport class ContractValidationError extends Error {\n  override readonly name = 'ContractValidationError';\n  constructor(\n    readonly event: string,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `event '${event}' refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n  }\n}\n\n/** The one check every event passes, from HTTP or from a journey: declared, and its payload parses. */\nexport function checkEvent(\n  contract: Contract,\n  name: string,\n  payload: unknown\n): ContractResult<Record<string, unknown>> {\n  if (!contract.isEvent(name)) {\n    return {\n      ok: false,\n      issues: [{ path: '', message: `'${String(name)}' is not in the contract` }],\n    };\n  }\n  return contract.parseEvent(name, payload);\n}\n\nexport function isContract(value: unknown): value is Contract {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-contract'\n  );\n}\n\nfunction toResult<T>(result: core.util.SafeParseResult<T>): ContractResult<T> {\n  return result.success\n    ? { ok: true, data: result.data }\n    : { ok: false, issues: prefixed('', result.error) };\n}\n\nfunction prefixed(prefix: string, error: core.$ZodError): ContractIssue[] {\n  return error.issues.map((issue) => ({\n    path: [prefix, ...issue.path.map(String)].filter((p) => p !== '').join('.'),\n    message: issue.message,\n  }));\n}\n\n/* ---------------------------- supported schemas ---------------------------- */\n\n/**\n * The schema types a contract may use — JSON shapes that parse synchronously\n * and mean the same before and after parsing. Anything not listed (default,\n * transform, pipe, lazy, promise, custom, date, bigint, …) is refused, and\n * every container is walked so nothing unsupported hides inside one.\n */\nconst ALLOWED = new Set([\n  'object',\n  'array',\n  'tuple',\n  'union',\n  'intersection',\n  'record',\n  'optional',\n  'nullable',\n  'readonly',\n  'nonoptional',\n  'string',\n  'number',\n  'boolean',\n  'null',\n  'enum',\n  'literal',\n  'unknown',\n  'any',\n  'never',\n]);\n\n/** Checks that change the value (`overwrite`: `.trim()`, `.toLowerCase()`, …) or run arbitrary code (`custom`: `.refine()`, async or not). */\nconst REFUSED_CHECKS = new Set(['custom', 'overwrite']);\n\nfunction assertJsonSchema(schema: unknown, where: string, top = false): void {\n  const def = (schema as core.$ZodType | undefined)?._zod?.def;\n  if (def === undefined) throw new TypeError(`contract ${where}: not a Zod schema`);\n  if (top && def.type !== 'object') {\n    throw new TypeError(\n      `contract ${where}: must be an object schema (z.looseObject / z.strictObject)`\n    );\n  }\n  if (!ALLOWED.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: ${def.type} schemas are not supported (input and output must mean the same JSON, parsed synchronously)`\n    );\n  }\n  if ((def as { coerce?: boolean }).coerce === true) {\n    throw new TypeError(`contract ${where}: coercion (z.coerce) is not supported`);\n  }\n  for (const check of def.checks ?? []) {\n    if (REFUSED_CHECKS.has(check._zod.def.check)) {\n      throw new TypeError(\n        `contract ${where}: ${check._zod.def.check === 'overwrite' ? 'value-changing checks (.overwrite, .trim, …)' : 'custom refinements'} are not supported`\n      );\n    }\n  }\n  const children: [string, unknown][] = [];\n  switch (def.type) {\n    case 'object': {\n      const object = def as core.$ZodObjectDef;\n      for (const [k, v] of Object.entries(object.shape)) children.push([`${where}.${k}`, v]);\n      if (object.catchall !== undefined) children.push([`${where}.*`, object.catchall]);\n      break;\n    }\n    case 'optional':\n    case 'nullable':\n    case 'readonly':\n    case 'nonoptional':\n      children.push([where, (def as unknown as { innerType: unknown }).innerType]);\n      break;\n    case 'array':\n      children.push([`${where}[]`, (def as core.$ZodArrayDef).element]);\n      break;\n    case 'tuple': {\n      const tuple = def as core.$ZodTupleDef;\n      tuple.items.forEach((item, index) => children.push([`${where}[${index}]`, item]));\n      if (tuple.rest !== null) children.push([`${where}[…]`, tuple.rest]);\n      break;\n    }\n    case 'union':\n      for (const option of (def as core.$ZodUnionDef).options) children.push([where, option]);\n      break;\n    case 'intersection': {\n      const intersection = def as core.$ZodIntersectionDef;\n      children.push([where, intersection.left], [where, intersection.right]);\n      break;\n    }\n    case 'record': {\n      const record = def as core.$ZodRecordDef;\n      children.push([`${where}{key}`, record.keyType], [`${where}{}`, record.valueType]);\n      break;\n    }\n    default:\n      break;\n  }\n  for (const [path, child] of children) assertJsonSchema(child, path);\n}\n\nconst SCALARS = new Set(['string', 'number', 'boolean', 'enum', 'literal']);\n\nfunction assertFlatScalar(schema: unknown, where: string): void {\n  let def = (schema as core.$ZodType)._zod.def;\n  if (def.type === 'optional') def = (def as core.$ZodOptionalDef).innerType._zod.def;\n  if (!SCALARS.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: profile fields must be flat scalars (string, number, boolean, enum, literal), got ${def.type}`\n    );\n  }\n}\n"],"mappings":";;;;AAoFA,SAAgB,eACd,YACgB;CAChB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,WAAW,MAAM,GAAG;EAC9D,IAAI,KAAK,WAAW,GAAG,GACrB,MAAM,IAAI,UAAU,mBAAmB,KAAK,sCAAsC;EAEpF,iBAAiB,QAAQ,UAAU,KAAK,IAAI,IAAI;CAClD;CACA,iBAAiB,WAAW,SAAS,WAAW,IAAI;CACpD,MAAM,eAAgB,WAAW,QAAQ,KAAK,IAA2B;CACzE,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,YAAY,GACvD,iBAAiB,QAAQ,WAAW,OAAO;CAE7C,MAAM,gBAAgB,WAAW,QAAQ,KAAK,IAAI,UAAU,KAAK,IAAI,SAAS;CAE9E,MAAM,QAAQ,OAAO,KAAK,WAAW,MAAM;CAC3C,OAAO;EACL,MAAM;EACN,QAAQ,MAAM;EACd,MAAM,KAAK;EACX,SAAS;GAAE,QAAQ,WAAW;GAAQ,SAAS,WAAW;EAAQ;EAClE,YAAY;EACZ,UAAU,SAAmC,OAAO,OAAO,WAAW,QAAQ,IAAI;EAClF,WAAW,MAAM,SAAS;GACxB,IAAI,CAAC,OAAO,OAAO,WAAW,QAAQ,IAAI,GACxC,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS,kBAAkB,KAAK;IAAG,CAAC;GAAE;GAEjF,OAAO,SAAS,EAAE,UAAU,WAAW,OAAO,OAAO,OAAO,CAAC;EAC/D;EACA,kBAAkB,OAAO;GACvB,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS;IAA0B,CAAC;GAAE;GAEjF,MAAM,SAA0B,CAAC;GACjC,MAAM,OAAgC,CAAC;GACvC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG;IAClD,IAAI,CAAC,OAAO,OAAO,cAAc,KAAK,GAAG;KAEvC,IAAI,iBAAiB,UAAU,UAC7B,OAAO,KAAK;MAAE,MAAM;MAAO,SAAS;KAA+B,CAAC;UAEpE,KAAK,SAAS;KAEhB;IACF;IACA,IAAI,UAAU,MAAM;KAClB,KAAK,SAAS;KACd;IACF;IACA,MAAM,SAAS,EAAE,UAAU,aAAa,QAAQ,KAAK;IACrD,IAAI,OAAO,SAAS,KAAK,SAAS,OAAO;SACpC,OAAO,KAAK,GAAG,SAAS,OAAO,OAAO,KAAK,CAAC;GACnD;GACA,OAAO,OAAO,SAAS,IAAI;IAAE,IAAI;IAAO;GAAO,IAAI;IAAE,IAAI;IAAY;GAAc;EACrF;CACF;AACF;;;;;;AAOA,IAAa,0BAAb,cAA6C,MAAM;CAGtC;CACA;CAHX,OAAyB;CACzB,YACE,OACA,QACA;EACA,MACE,UAAU,MAAM,6BAA6B,OAC1C,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EAPS,KAAA,QAAA;EACA,KAAA,SAAA;CAOX;AACF;;AAGA,SAAgB,WACd,UACA,MACA,SACyC;CACzC,IAAI,CAAC,SAAS,QAAQ,IAAI,GACxB,OAAO;EACL,IAAI;EACJ,QAAQ,CAAC;GAAE,MAAM;GAAI,SAAS,IAAI,OAAO,IAAI,EAAE;EAA0B,CAAC;CAC5E;CAEF,OAAO,SAAS,WAAW,MAAM,OAAO;AAC1C;AAEA,SAAgB,WAAW,OAAmC;CAC5D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;AAEA,SAAS,SAAY,QAAyD;CAC5E,OAAO,OAAO,UACV;EAAE,IAAI;EAAM,MAAM,OAAO;CAAK,IAC9B;EAAE,IAAI;EAAO,QAAQ,SAAS,IAAI,OAAO,KAAK;CAAE;AACtD;AAEA,SAAS,SAAS,QAAgB,OAAwC;CACxE,OAAO,MAAM,OAAO,KAAK,WAAW;EAClC,MAAM,CAAC,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG;EAC1E,SAAS,MAAM;CACjB,EAAE;AACJ;;;;;;;AAUA,MAAM,0BAAU,IAAI,IAAI;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,iCAAiB,IAAI,IAAI,CAAC,UAAU,WAAW,CAAC;AAEtD,SAAS,iBAAiB,QAAiB,OAAe,MAAM,OAAa;CAC3E,MAAM,MAAO,QAAsC,MAAM;CACzD,IAAI,QAAQ,KAAA,GAAW,MAAM,IAAI,UAAU,YAAY,MAAM,mBAAmB;CAChF,IAAI,OAAO,IAAI,SAAS,UACtB,MAAM,IAAI,UACR,YAAY,MAAM,4DACpB;CAEF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,IAAI,KAAK,4FACjC;CAEF,IAAK,IAA6B,WAAW,MAC3C,MAAM,IAAI,UAAU,YAAY,MAAM,uCAAuC;CAE/E,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,GACjC,IAAI,eAAe,IAAI,MAAM,KAAK,IAAI,KAAK,GACzC,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,MAAM,KAAK,IAAI,UAAU,cAAc,iDAAiD,qBAAqB,mBACrI;CAGJ,MAAM,WAAgC,CAAC;CACvC,QAAQ,IAAI,MAAZ;EACE,KAAK,UAAU;GACb,MAAM,SAAS;GACf,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,GAAG,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;GACrF,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,KAAK,CAAC,GAAG,MAAM,KAAK,OAAO,QAAQ,CAAC;GAChF;EACF;EACA,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACH,SAAS,KAAK,CAAC,OAAQ,IAA0C,SAAS,CAAC;GAC3E;EACF,KAAK;GACH,SAAS,KAAK,CAAC,GAAG,MAAM,KAAM,IAA0B,OAAO,CAAC;GAChE;EACF,KAAK,SAAS;GACZ,MAAM,QAAQ;GACd,MAAM,MAAM,SAAS,MAAM,UAAU,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC;GAChF,IAAI,MAAM,SAAS,MAAM,SAAS,KAAK,CAAC,GAAG,MAAM,MAAM,MAAM,IAAI,CAAC;GAClE;EACF;EACA,KAAK;GACH,KAAK,MAAM,UAAW,IAA0B,SAAS,SAAS,KAAK,CAAC,OAAO,MAAM,CAAC;GACtF;EACF,KAAK,gBAAgB;GACnB,MAAM,eAAe;GACrB,SAAS,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,CAAC,OAAO,aAAa,KAAK,CAAC;GACrE;EACF;EACA,KAAK,UAAU;GACb,MAAM,SAAS;GACf,SAAS,KAAK,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,GAAG,CAAC,GAAG,MAAM,KAAK,OAAO,SAAS,CAAC;GACjF;EACF;CAGF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,UAAU,iBAAiB,OAAO,IAAI;AACpE;AAEA,MAAM,0BAAU,IAAI,IAAI;CAAC;CAAU;CAAU;CAAW;CAAQ;AAAS,CAAC;AAE1E,SAAS,iBAAiB,QAAiB,OAAqB;CAC9D,IAAI,MAAO,OAAyB,KAAK;CACzC,IAAI,IAAI,SAAS,YAAY,MAAO,IAA6B,UAAU,KAAK;CAChF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,sFAAsF,IAAI,MAC9G;AAEJ"}
+{"version":3,"file":"contract.mjs","names":[],"sources":["../src/contract.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport { type EventRefs, type UserRefs, event, user } from './dsl';\n\n/**\n * `defineContract({ events, profile })` — the producer/engine contract as Zod\n * schemas, written once in a package both sides import. From it:\n *\n * - `contract.events` / `contract.user` are the DSL's typed reference tables\n *   (what `event<E>()` / `user<U>()` used to be, now derived from the schemas);\n * - `JourneyClient({ contract })` types `track` / `identify` by event name and\n *   checks payloads before sending;\n * - `journeyWorker({ contract })` re-validates every inbound `/events` and\n *   `/identify` — never trusting the caller used the SDK — and refuses a bad\n *   one with a 4xx before anything is stored, woken or started.\n *\n * Supported schemas (v1), synchronous and JSON-shaped: event payloads are\n * object schemas (`z.looseObject` keeps a producer's extra analytics fields,\n * `z.strictObject` refuses them) and may nest objects and arrays; the profile\n * is a flat object of string / number / boolean / enum / literal fields. Input\n * and output must mean the same thing, so defaults, transforms, coercion,\n * custom refinements and async checks are refused when the contract is\n * defined. The Zod instances stay in the host; nothing here changes the IR.\n */\n\ntype ObjectSchema = core.$ZodObject;\n\n/** The declared fields of an object schema — without a loose object's `[key: string]: unknown`, so the DSL only offers fields that were written down. */\nexport type DeclaredOutput<S> =\n  S extends core.$ZodObject<infer Shape>\n    ? core.$InferObjectOutput<Shape, core.$strict['out']>\n    : never;\n\nexport interface ContractDefinition<\n  E extends Record<string, ObjectSchema>,\n  P extends ObjectSchema,\n> {\n  events: E;\n  profile: P;\n}\n\n/** One rejected field, with the dotted path the producer can fix. */\nexport interface ContractIssue {\n  path: string;\n  message: string;\n}\n\nexport type ContractResult<T> = { ok: true; data: T } | { ok: false; issues: ContractIssue[] };\n\nexport interface Contract<\n  E extends Record<string, ObjectSchema> = Record<string, ObjectSchema>,\n  P extends ObjectSchema = ObjectSchema,\n> {\n  readonly kind: 'journey-contract';\n  /** The DSL's event reference table: `e.purchase` — payload refs from the declared fields only. */\n  readonly events: EventRefs<{ [K in keyof E]: DeclaredOutput<E[K]> }>;\n  /** The DSL's user-property reference table: `u.name`, plus the system `u.userId`. */\n  readonly user: UserRefs<DeclaredOutput<P> & { userId: string }>;\n  /** The raw schemas, for hosts that need them (validation, docs). */\n  readonly schemas: { readonly events: E; readonly profile: P };\n  /** Every event name the contract declares — what a producer forwards. */\n  readonly eventNames: readonly (keyof E & string)[];\n  isEvent(name: string): name is keyof E & string;\n  /** Validate one event's payload; the parsed value is what may be stored. */\n  parseEvent<K extends keyof E & string>(\n    name: K,\n    payload: unknown\n  ): ContractResult<core.output<E[K]>>;\n  /**\n   * Validate an `/identify` merge patch: omitted fields stay as they are,\n   * `null` removes a field, every provided value is checked against its field\n   * schema, and an undeclared field is refused — a patch, never a full parse\n   * that would fill defaults over fields the caller did not send.\n   */\n  parseProfilePatch(patch: unknown): ContractResult<ProfilePatch<P>>;\n}\n\n/** An `/identify` patch over the profile: any subset of fields, `null` to remove one. */\nexport type ProfilePatch<P> = { [K in keyof DeclaredOutput<P>]?: DeclaredOutput<P>[K] | null };\n\n/** Payload type of one event, for producers: `EventPayload<typeof contract, 'purchase'>`. */\nexport type EventPayload<C, K extends string> =\n  C extends Contract<infer E> ? (K extends keyof E ? core.input<E[K]> : never) : never;\n\nexport function defineContract<E extends Record<string, ObjectSchema>, P extends ObjectSchema>(\n  definition: ContractDefinition<E, P>\n): Contract<E, P> {\n  for (const [name, schema] of Object.entries(definition.events)) {\n    if (name.startsWith('$')) {\n      throw new TypeError(`contract event '${name}': names starting with $ are reserved`);\n    }\n    assertJsonSchema(schema, `event '${name}'`, true);\n  }\n  assertJsonSchema(definition.profile, 'profile', true);\n  const profileShape = (definition.profile._zod.def as core.$ZodObjectDef).shape;\n  for (const [field, schema] of Object.entries(profileShape)) {\n    assertFlatScalar(schema, `profile.${field}`);\n  }\n  const strictProfile = definition.profile._zod.def.catchall?._zod.def.type === 'never';\n\n  const names = Object.keys(definition.events) as (keyof E & string)[];\n  return {\n    kind: 'journey-contract',\n    events: event() as never,\n    user: user() as never,\n    schemas: { events: definition.events, profile: definition.profile },\n    eventNames: names,\n    isEvent: (name): name is keyof E & string => Object.hasOwn(definition.events, name),\n    parseEvent(name, payload) {\n      if (!Object.hasOwn(definition.events, name)) {\n        return { ok: false, issues: [{ path: '', message: `unknown event '${name}'` }] };\n      }\n      return toResult(z.safeParse(definition.events[name], payload));\n    },\n    parseProfilePatch(patch) {\n      if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {\n        return { ok: false, issues: [{ path: '', message: 'props must be an object' }] };\n      }\n      const issues: ContractIssue[] = [];\n      const data: Record<string, unknown> = {};\n      for (const [field, value] of Object.entries(patch)) {\n        if (!Object.hasOwn(profileShape, field)) {\n          // userId is the request's identity, not a profile field\n          if (strictProfile || field === 'userId') {\n            issues.push({ path: field, message: 'not a declared profile field' });\n          } else {\n            data[field] = value;\n          }\n          continue;\n        }\n        if (value === null) {\n          data[field] = null;\n          continue;\n        }\n        const result = z.safeParse(profileShape[field], value);\n        if (result.success) data[field] = result.data;\n        else issues.push(...prefixed(field, result.error));\n      }\n      return issues.length > 0 ? { ok: false, issues } : { ok: true, data: data as never };\n    },\n  };\n}\n\n/**\n * An event the contract refuses — raised for events a journey emits itself\n * (`.sendEvent()`), which never pass the HTTP ingest: they go through the same\n * check, and a refusal is deterministic, so it is not retried.\n */\nexport class ContractValidationError extends Error {\n  override readonly name = 'ContractValidationError';\n  constructor(\n    readonly event: string,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `event '${event}' refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n  }\n}\n\n/** The one check every event passes, from HTTP or from a journey: declared, and its payload parses. */\nexport function checkEvent(\n  contract: Contract,\n  name: string,\n  payload: unknown\n): ContractResult<Record<string, unknown>> {\n  if (!contract.isEvent(name)) {\n    return {\n      ok: false,\n      issues: [{ path: '', message: `'${String(name)}' is not in the contract` }],\n    };\n  }\n  return contract.parseEvent(name, payload);\n}\n\nexport function isContract(value: unknown): value is Contract {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-contract'\n  );\n}\n\nfunction toResult<T>(result: core.util.SafeParseResult<T>): ContractResult<T> {\n  return result.success\n    ? { ok: true, data: result.data }\n    : { ok: false, issues: prefixed('', result.error) };\n}\n\nfunction prefixed(prefix: string, error: core.$ZodError): ContractIssue[] {\n  return error.issues.map((issue) => ({\n    path: [prefix, ...issue.path.map(String)].filter((p) => p !== '').join('.'),\n    message: issue.message,\n  }));\n}\n\n/* ---------------------------- supported schemas ---------------------------- */\n\n/**\n * The schema types a contract may use — JSON shapes that parse synchronously\n * and mean the same before and after parsing. Anything not listed (default,\n * transform, pipe, lazy, promise, custom, date, bigint, …) is refused, and\n * every container is walked so nothing unsupported hides inside one.\n */\nconst ALLOWED = new Set([\n  'object',\n  'array',\n  'tuple',\n  'union',\n  'intersection',\n  'record',\n  'optional',\n  'nullable',\n  'readonly',\n  'nonoptional',\n  'string',\n  'number',\n  'boolean',\n  'null',\n  'enum',\n  'literal',\n  'unknown',\n  'any',\n  'never',\n]);\n\n/** Checks that change the value (`overwrite`: `.trim()`, `.toLowerCase()`, …) or run arbitrary code (`custom`: `.refine()`, async or not). */\nconst REFUSED_CHECKS = new Set(['custom', 'overwrite']);\n\nfunction assertJsonSchema(schema: unknown, where: string, top = false): void {\n  const def = (schema as { _zod?: { def?: core.$ZodTypeDef } } | null | undefined)?._zod?.def;\n  if (def === undefined) throw new TypeError(`contract ${where}: not a Zod schema`);\n  if (top && def.type !== 'object') {\n    throw new TypeError(\n      `contract ${where}: must be an object schema (z.looseObject / z.strictObject)`\n    );\n  }\n  if (!ALLOWED.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: ${def.type} schemas are not supported (input and output must mean the same JSON, parsed synchronously)`\n    );\n  }\n  if ((def as { coerce?: boolean }).coerce === true) {\n    throw new TypeError(`contract ${where}: coercion (z.coerce) is not supported`);\n  }\n  for (const check of def.checks ?? []) {\n    if (REFUSED_CHECKS.has(check._zod.def.check)) {\n      throw new TypeError(\n        `contract ${where}: ${check._zod.def.check === 'overwrite' ? 'value-changing checks (.overwrite, .trim, …)' : 'custom refinements'} are not supported`\n      );\n    }\n  }\n  const children: [string, unknown][] = [];\n  switch (def.type) {\n    case 'object': {\n      const object = def as core.$ZodObjectDef;\n      for (const [k, v] of Object.entries(object.shape)) children.push([`${where}.${k}`, v]);\n      if (object.catchall !== undefined) children.push([`${where}.*`, object.catchall]);\n      break;\n    }\n    case 'optional':\n    case 'nullable':\n    case 'readonly':\n    case 'nonoptional':\n      children.push([where, (def as unknown as { innerType: unknown }).innerType]);\n      break;\n    case 'array':\n      children.push([`${where}[]`, (def as core.$ZodArrayDef).element]);\n      break;\n    case 'tuple': {\n      const tuple = def as core.$ZodTupleDef;\n      tuple.items.forEach((item, index) => children.push([`${where}[${index}]`, item]));\n      if (tuple.rest !== null) children.push([`${where}[…]`, tuple.rest]);\n      break;\n    }\n    case 'union':\n      for (const option of (def as core.$ZodUnionDef).options) children.push([where, option]);\n      break;\n    case 'intersection': {\n      const intersection = def as core.$ZodIntersectionDef;\n      children.push([where, intersection.left], [where, intersection.right]);\n      break;\n    }\n    case 'record': {\n      const record = def as core.$ZodRecordDef;\n      children.push([`${where}{key}`, record.keyType], [`${where}{}`, record.valueType]);\n      break;\n    }\n    default:\n      break;\n  }\n  for (const [path, child] of children) assertJsonSchema(child, path);\n}\n\nconst SCALARS = new Set(['string', 'number', 'boolean', 'enum', 'literal']);\n\nfunction assertFlatScalar(schema: unknown, where: string): void {\n  let def = (schema as core.$ZodType)._zod.def;\n  if (def.type === 'optional') def = (def as core.$ZodOptionalDef).innerType._zod.def;\n  if (!SCALARS.has(def.type)) {\n    throw new TypeError(\n      `contract ${where}: profile fields must be flat scalars (string, number, boolean, enum, literal), got ${def.type}`\n    );\n  }\n}\n"],"mappings":";;;;AAoFA,SAAgB,eACd,YACgB;CAChB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,WAAW,MAAM,GAAG;EAC9D,IAAI,KAAK,WAAW,GAAG,GACrB,MAAM,IAAI,UAAU,mBAAmB,KAAK,sCAAsC;EAEpF,iBAAiB,QAAQ,UAAU,KAAK,IAAI,IAAI;CAClD;CACA,iBAAiB,WAAW,SAAS,WAAW,IAAI;CACpD,MAAM,eAAgB,WAAW,QAAQ,KAAK,IAA2B;CACzE,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,YAAY,GACvD,iBAAiB,QAAQ,WAAW,OAAO;CAE7C,MAAM,gBAAgB,WAAW,QAAQ,KAAK,IAAI,UAAU,KAAK,IAAI,SAAS;CAE9E,MAAM,QAAQ,OAAO,KAAK,WAAW,MAAM;CAC3C,OAAO;EACL,MAAM;EACN,QAAQ,MAAM;EACd,MAAM,KAAK;EACX,SAAS;GAAE,QAAQ,WAAW;GAAQ,SAAS,WAAW;EAAQ;EAClE,YAAY;EACZ,UAAU,SAAmC,OAAO,OAAO,WAAW,QAAQ,IAAI;EAClF,WAAW,MAAM,SAAS;GACxB,IAAI,CAAC,OAAO,OAAO,WAAW,QAAQ,IAAI,GACxC,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS,kBAAkB,KAAK;IAAG,CAAC;GAAE;GAEjF,OAAO,SAAS,EAAE,UAAU,WAAW,OAAO,OAAO,OAAO,CAAC;EAC/D;EACA,kBAAkB,OAAO;GACvB,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO;IAAE,IAAI;IAAO,QAAQ,CAAC;KAAE,MAAM;KAAI,SAAS;IAA0B,CAAC;GAAE;GAEjF,MAAM,SAA0B,CAAC;GACjC,MAAM,OAAgC,CAAC;GACvC,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG;IAClD,IAAI,CAAC,OAAO,OAAO,cAAc,KAAK,GAAG;KAEvC,IAAI,iBAAiB,UAAU,UAC7B,OAAO,KAAK;MAAE,MAAM;MAAO,SAAS;KAA+B,CAAC;UAEpE,KAAK,SAAS;KAEhB;IACF;IACA,IAAI,UAAU,MAAM;KAClB,KAAK,SAAS;KACd;IACF;IACA,MAAM,SAAS,EAAE,UAAU,aAAa,QAAQ,KAAK;IACrD,IAAI,OAAO,SAAS,KAAK,SAAS,OAAO;SACpC,OAAO,KAAK,GAAG,SAAS,OAAO,OAAO,KAAK,CAAC;GACnD;GACA,OAAO,OAAO,SAAS,IAAI;IAAE,IAAI;IAAO;GAAO,IAAI;IAAE,IAAI;IAAY;GAAc;EACrF;CACF;AACF;;;;;;AAOA,IAAa,0BAAb,cAA6C,MAAM;CAGtC;CACA;CAHX,OAAyB;CACzB,YACE,OACA,QACA;EACA,MACE,UAAU,MAAM,6BAA6B,OAC1C,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EAPS,KAAA,QAAA;EACA,KAAA,SAAA;CAOX;AACF;;AAGA,SAAgB,WACd,UACA,MACA,SACyC;CACzC,IAAI,CAAC,SAAS,QAAQ,IAAI,GACxB,OAAO;EACL,IAAI;EACJ,QAAQ,CAAC;GAAE,MAAM;GAAI,SAAS,IAAI,OAAO,IAAI,EAAE;EAA0B,CAAC;CAC5E;CAEF,OAAO,SAAS,WAAW,MAAM,OAAO;AAC1C;AAEA,SAAgB,WAAW,OAAmC;CAC5D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;AAEA,SAAS,SAAY,QAAyD;CAC5E,OAAO,OAAO,UACV;EAAE,IAAI;EAAM,MAAM,OAAO;CAAK,IAC9B;EAAE,IAAI;EAAO,QAAQ,SAAS,IAAI,OAAO,KAAK;CAAE;AACtD;AAEA,SAAS,SAAS,QAAgB,OAAwC;CACxE,OAAO,MAAM,OAAO,KAAK,WAAW;EAClC,MAAM,CAAC,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG;EAC1E,SAAS,MAAM;CACjB,EAAE;AACJ;;;;;;;AAUA,MAAM,0BAAU,IAAI,IAAI;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,iCAAiB,IAAI,IAAI,CAAC,UAAU,WAAW,CAAC;AAEtD,SAAS,iBAAiB,QAAiB,OAAe,MAAM,OAAa;CAC3E,MAAM,MAAO,QAAqE,MAAM;CACxF,IAAI,QAAQ,KAAA,GAAW,MAAM,IAAI,UAAU,YAAY,MAAM,mBAAmB;CAChF,IAAI,OAAO,IAAI,SAAS,UACtB,MAAM,IAAI,UACR,YAAY,MAAM,4DACpB;CAEF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,IAAI,KAAK,4FACjC;CAEF,IAAK,IAA6B,WAAW,MAC3C,MAAM,IAAI,UAAU,YAAY,MAAM,uCAAuC;CAE/E,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,GACjC,IAAI,eAAe,IAAI,MAAM,KAAK,IAAI,KAAK,GACzC,MAAM,IAAI,UACR,YAAY,MAAM,IAAI,MAAM,KAAK,IAAI,UAAU,cAAc,iDAAiD,qBAAqB,mBACrI;CAGJ,MAAM,WAAgC,CAAC;CACvC,QAAQ,IAAI,MAAZ;EACE,KAAK,UAAU;GACb,MAAM,SAAS;GACf,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,KAAK,GAAG,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;GACrF,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,KAAK,CAAC,GAAG,MAAM,KAAK,OAAO,QAAQ,CAAC;GAChF;EACF;EACA,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;GACH,SAAS,KAAK,CAAC,OAAQ,IAA0C,SAAS,CAAC;GAC3E;EACF,KAAK;GACH,SAAS,KAAK,CAAC,GAAG,MAAM,KAAM,IAA0B,OAAO,CAAC;GAChE;EACF,KAAK,SAAS;GACZ,MAAM,QAAQ;GACd,MAAM,MAAM,SAAS,MAAM,UAAU,SAAS,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC;GAChF,IAAI,MAAM,SAAS,MAAM,SAAS,KAAK,CAAC,GAAG,MAAM,MAAM,MAAM,IAAI,CAAC;GAClE;EACF;EACA,KAAK;GACH,KAAK,MAAM,UAAW,IAA0B,SAAS,SAAS,KAAK,CAAC,OAAO,MAAM,CAAC;GACtF;EACF,KAAK,gBAAgB;GACnB,MAAM,eAAe;GACrB,SAAS,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,CAAC,OAAO,aAAa,KAAK,CAAC;GACrE;EACF;EACA,KAAK,UAAU;GACb,MAAM,SAAS;GACf,SAAS,KAAK,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,GAAG,CAAC,GAAG,MAAM,KAAK,OAAO,SAAS,CAAC;GACjF;EACF;CAGF;CACA,KAAK,MAAM,CAAC,MAAM,UAAU,UAAU,iBAAiB,OAAO,IAAI;AACpE;AAEA,MAAM,0BAAU,IAAI,IAAI;CAAC;CAAU;CAAU;CAAW;CAAQ;AAAS,CAAC;AAE1E,SAAS,iBAAiB,QAAiB,OAAqB;CAC9D,IAAI,MAAO,OAAyB,KAAK;CACzC,IAAI,IAAI,SAAS,YAAY,MAAO,IAA6B,UAAU,KAAK;CAChF,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,GACvB,MAAM,IAAI,UACR,YAAY,MAAM,sFAAsF,IAAI,MAC9G;AAEJ"}

package/dist/dsl/action.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"action.cjs","names":["sha256Hex"],"sources":["../../src/dsl/action.ts"],"sourcesContent":["import { sha256Hex } from '../hash';\n\n/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.\n * The runtime resolves the name against a registry (see engine/actions.ts) and\n * compares codeHash to detect version skew between a pinned IR and the\n * currently deployed implementation.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * implementation for the runtime registry and the codeHash for the IR pin.\n */\nexport interface ActionRef<A extends object = Record<never, never>> {\n  readonly name: string;\n  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */\n  readonly codeHash: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * codeHash comes from `handler.toString()`, so it changes when the code\n * changes and stays put when it does not. Different build pipelines can print\n * the same function differently (minification), which is why the default\n * runtime policy on mismatch is warn, not fail.\n */\nexport function action<A extends object = Record<never, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, codeHash: sha256Hex(handler.toString()).slice(0, 32), handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM,UAAUA,aAAAA,UAAU,QAAQ,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAAG;CAAQ;AAC/E"}
+{"version":3,"file":"action.cjs","names":["sha256Hex"],"sources":["../../src/dsl/action.ts"],"sourcesContent":["import { sha256Hex } from '../hash';\n\n/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.\n * The runtime resolves the name against a registry (see engine/actions.ts) and\n * compares codeHash to detect version skew between a pinned IR and the\n * currently deployed implementation.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * implementation for the runtime registry and the codeHash for the IR pin.\n */\nexport interface ActionRef<A extends object = object> {\n  readonly name: string;\n  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */\n  readonly codeHash: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * codeHash comes from `handler.toString()`, so it changes when the code\n * changes and stays put when it does not. Different build pipelines can print\n * the same function differently (minification), which is why the default\n * runtime policy on mismatch is warn, not fail.\n */\nexport function action<A extends object = Record<string, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, codeHash: sha256Hex(handler.toString()).slice(0, 32), handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM,UAAUA,aAAAA,UAAU,QAAQ,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAAG;CAAQ;AAC/E"}

package/dist/dsl/action.d.cts

@@ -37,7 +37,7 @@ export type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => P
  * A registered custom action: the named asset `.run()` refers to. Carries the
  * implementation for the runtime registry and the codeHash for the IR pin.
  */
-export interface ActionRef<A extends object = Record<never, never>> {
+export interface ActionRef<A extends object = object> {
   readonly name: string;
   /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */
   readonly codeHash: string;
@@ -59,6 +59,6 @@ export interface ActionRef<A extends object = Record<never, never>> {
  * the same function differently (minification), which is why the default
  * runtime policy on mismatch is warn, not fail.
  */
-export declare function action<A extends object = Record<never, never>>(name: string, handler: ActionHandler<A>): ActionRef<A>;
+export declare function action<A extends object = Record<string, never>>(name: string, handler: ActionHandler<A>): ActionRef<A>;
 //#endregion
 //# sourceMappingURL=action.d.cts.map

package/dist/dsl/action.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.cts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;iBAoBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU,mBAAmB;WACnC;;WAEA;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;;wBAkBxB,OAAO,mBAAmB,sBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}
+{"version":3,"file":"action.d.cts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;iBAoBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU;WAChB;;WAEA;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;;wBAkBxB,OAAO,mBAAmB,uBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}

package/dist/dsl/action.d.mts

@@ -37,7 +37,7 @@ export type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => P
  * A registered custom action: the named asset `.run()` refers to. Carries the
  * implementation for the runtime registry and the codeHash for the IR pin.
  */
-export interface ActionRef<A extends object = Record<never, never>> {
+export interface ActionRef<A extends object = object> {
   readonly name: string;
   /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */
   readonly codeHash: string;
@@ -59,6 +59,6 @@ export interface ActionRef<A extends object = Record<never, never>> {
  * the same function differently (minification), which is why the default
  * runtime policy on mismatch is warn, not fail.
  */
-export declare function action<A extends object = Record<never, never>>(name: string, handler: ActionHandler<A>): ActionRef<A>;
+export declare function action<A extends object = Record<string, never>>(name: string, handler: ActionHandler<A>): ActionRef<A>;
 //#endregion
 //# sourceMappingURL=action.d.mts.map

package/dist/dsl/action.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.mts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;iBAoBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU,mBAAmB;WACnC;;WAEA;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;;wBAkBxB,OAAO,mBAAmB,sBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}
+{"version":3,"file":"action.d.mts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;iBAoBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU;WAChB;;WAEA;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;;wBAkBxB,OAAO,mBAAmB,uBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}

package/dist/dsl/action.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"action.mjs","names":[],"sources":["../../src/dsl/action.ts"],"sourcesContent":["import { sha256Hex } from '../hash';\n\n/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.\n * The runtime resolves the name against a registry (see engine/actions.ts) and\n * compares codeHash to detect version skew between a pinned IR and the\n * currently deployed implementation.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * implementation for the runtime registry and the codeHash for the IR pin.\n */\nexport interface ActionRef<A extends object = Record<never, never>> {\n  readonly name: string;\n  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */\n  readonly codeHash: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * codeHash comes from `handler.toString()`, so it changes when the code\n * changes and stays put when it does not. Different build pipelines can print\n * the same function differently (minification), which is why the default\n * runtime policy on mismatch is warn, not fail.\n */\nexport function action<A extends object = Record<never, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, codeHash: sha256Hex(handler.toString()).slice(0, 32), handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM,UAAU,UAAU,QAAQ,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAAG;CAAQ;AAC/E"}
+{"version":3,"file":"action.mjs","names":[],"sources":["../../src/dsl/action.ts"],"sourcesContent":["import { sha256Hex } from '../hash';\n\n/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.\n * The runtime resolves the name against a registry (see engine/actions.ts) and\n * compares codeHash to detect version skew between a pinned IR and the\n * currently deployed implementation.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * implementation for the runtime registry and the codeHash for the IR pin.\n */\nexport interface ActionRef<A extends object = object> {\n  readonly name: string;\n  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */\n  readonly codeHash: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * codeHash comes from `handler.toString()`, so it changes when the code\n * changes and stays put when it does not. Different build pipelines can print\n * the same function differently (minification), which is why the default\n * runtime policy on mismatch is warn, not fail.\n */\nexport function action<A extends object = Record<string, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, codeHash: sha256Hex(handler.toString()).slice(0, 32), handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM,UAAU,UAAU,QAAQ,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAAG;CAAQ;AAC/E"}