@shware/workflow 3.1.0 → 3.3.0

package/dist/cloudflare/runner.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_runtime = require("../runtime.cjs");
+const require_engine_retry = require("../engine/retry.cjs");
 const require_cloudflare_bindings = require("./bindings.cjs");
 const require_cloudflare_d1_env = require("./d1-env.cjs");
 const require_host_execute = require("../host/execute.cjs");
@@ -15,8 +16,6 @@ let cloudflare_workflows = require("cloudflare:workflows");
 * waitForEvent, which signals a timeout by throwing — and so does every other
 * failure in there, so only the clock can tell them apart (see wakeExpired).
 */
-/** Refusals a retry would only repeat: a template's props, an emitted event's payload. */
-const NON_RETRYABLE = /* @__PURE__ */ new Set(["TemplateValidationError", "ContractValidationError"]);
 var CfEngineStep = class {
 	step;
 	store;
@@ -29,8 +28,8 @@ var CfEngineStep = class {
 		this.instanceId = instanceId;
 	}
 	/**
-	* A template refusing its props, or the contract refusing an emitted event,
-	* is deterministic — a retry hits the same refusal — so it ends the step at
+	* A failure a retry would only repeat (`isRetryable`: a template refusing its props, the
+	* contract refusing an emitted event, a provider rejecting the request) ends the step at
 	* once instead of burning the retry budget.
 	*/
 	do(name, fn) {
@@ -38,7 +37,7 @@ var CfEngineStep = class {
 			try {
 				return await fn();
 			} catch (error) {
-				if (error instanceof Error && NON_RETRYABLE.has(error.name)) throw new cloudflare_workflows.NonRetryableError(error.message, error.name);
+				if (error instanceof Error && !require_engine_retry.isRetryable(error)) throw new cloudflare_workflows.NonRetryableError(error.message, error.name);
 				throw error;
 			}
 		});

package/dist/cloudflare/runner.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"runner.cjs","names":["NonRetryableError","WAKE_EVENT_TYPE","wakeExpired","WorkflowEntrypoint","d1Store","resolveRuntime","WebhookMessageSender","LogMessageSender","RegistryActionInvoker","executeJourney"],"sources":["../../src/cloudflare/runner.ts"],"sourcesContent":["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';\nimport { NonRetryableError } from 'cloudflare:workflows';\nimport type { Contract } from '../contract';\nimport { type RegisteredAction, RegistryActionInvoker } from '../engine/actions';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { type JourneyRunParts, executeJourney } from '../host/execute';\nimport { LogMessageSender, WebhookMessageSender } from '../host/senders';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport { type JourneyEnv, type JourneyParams, WAKE_EVENT_TYPE, wakeExpired } from './bindings';\nimport { d1Store } from './d1-env';\n\n/**\n * Adapts CF's WorkflowStep to EngineStep.\n * subscribe/unsubscribe write the subscription table inside durable steps (the\n * router wakes instances from that table); waitForWake parks on CF's\n * waitForEvent, which signals a timeout by throwing — and so does every other\n * failure in there, so only the clock can tell them apart (see wakeExpired).\n */\n/** Refusals a retry would only repeat: a template's props, an emitted event's payload. */\nconst NON_RETRYABLE = new Set(['TemplateValidationError', 'ContractValidationError']);\n\nclass CfEngineStep implements EngineStep {\n  constructor(\n    private readonly step: WorkflowStep,\n    private readonly store: JourneyStore,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  /**\n   * A template refusing its props, or the contract refusing an emitted event,\n   * is deterministic — a retry hits the same refusal — so it ends the step at\n   * once instead of burning the retry budget.\n   */\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.step.do(name, async () => {\n      try {\n        return await fn();\n      } catch (error) {\n        if (error instanceof Error && NON_RETRYABLE.has(error.name)) {\n          throw new NonRetryableError(error.message, error.name);\n        }\n        throw error;\n      }\n    });\n  }\n\n  sleep(name: string, ms: number): Promise<void> {\n    return this.step.sleep(name, ms);\n  }\n\n  sleepUntil(name: string, timestampMs: number): Promise<void> {\n    return this.step.sleepUntil(name, timestampMs);\n  }\n\n  subscribe(name: string, events: readonly string[]): Promise<void> {\n    // Idempotent in the store: the interpreter re-subscribes on every wait\n    // attempt (one-shot-callback contract) and registrations persist here.\n    return this.step.do(name, () =>\n      this.store.subscribe(this.instanceId, this.userId, events, Date.now())\n    );\n  }\n\n  unsubscribe(name: string): Promise<void> {\n    return this.step.do(name, () => this.store.unsubscribe(this.instanceId));\n  }\n\n  async waitForWake(name: string, timeoutMs: number): Promise<'event' | 'timeout'> {\n    const startedAt = Date.now();\n    try {\n      await this.step.waitForEvent(name, { type: WAKE_EVENT_TYPE, timeout: timeoutMs });\n      return 'event';\n    } catch (error) {\n      /*\n       * Only the deadline can tell a real timeout from a failure (see\n       * wakeExpired). `startedAt` is not replay-stable, but it is read only\n       * inside the step body below, and a step body runs on the live attempt\n       * alone — a replay returns the persisted verdict without touching the\n       * clock.\n       */\n      const timedOut = await this.step.do(`${name}:timed-out`, async () =>\n        wakeExpired(startedAt, timeoutMs, Date.now())\n      );\n      if (timedOut) return 'timeout';\n      throw error;\n    }\n  }\n}\n\n/**\n * The generic journey executor: one class runs every workflow, because IR is\n * data. It is loaded from the store by the contentHash pinned at entry —\n * content addressing makes it immutable, so reading it outside a step is\n * replay-safe.\n */\nexport class JourneyRunner extends WorkflowEntrypoint<JourneyEnv, JourneyParams> {\n  /**\n   * The data plane. D1 + KV from the env by default; an app on Postgres\n   * overrides this (and `closeStore` if its client needs closing):\n   *\n   *   protected override createStore() { return new PostgresJourneyStore(client(this.env)); }\n   */\n  protected createStore(): JourneyStore {\n    return d1Store(this.env);\n  }\n\n  /** Called once `run` is over, success or not — release whatever `createStore` opened. */\n  protected async closeStore(_store: JourneyStore): Promise<void> {}\n\n  /**\n   * Runtime options for this instance — typed configuration, resolved by the app (typically\n   * `resolveRuntime(config.runtime, mode)` over its workflow.config.ts, with the mode coming from\n   * an ENVIRONMENT var). The instance params are passed so the decision can also be per user:\n   * a tester account in production can run in fast-forward while everyone else runs in real\n   * time. Defaults: real time, quiet.\n   *\n   *   protected override runtime({ userId }) {\n   *     return resolveRuntime(workflowConfig.runtime, isTester(userId) ? 'test' : this.env.ENVIRONMENT);\n   *   }\n   */\n  protected runtime(_params: JourneyParams): JourneyRuntimeOptions {\n    return resolveRuntime(undefined, 'production');\n  }\n\n  /**\n   * Message outlet; an app overrides this to plug in real channels (say\n   * an EmailSender over a transport with a react-email renderer). By default it picks the webhook\n   * or logging sender based on the environment.\n   */\n  protected createMessageSender(): MessageSender {\n    return this.env.MESSAGE_WEBHOOK_URL\n      ? new WebhookMessageSender(this.env.MESSAGE_WEBHOOK_URL)\n      : new LogMessageSender();\n  }\n\n  /**\n   * Custom-action registry; an app overrides this returning the same\n   * `action(...)` objects its workflows reference (an ActionRef is a\n   * RegisteredAction structurally) — the code plane of the dual-plane model:\n   *\n   *   protected override actions() { return [syncCrm, issueCoupon]; }\n   */\n  protected actions(): readonly RegisteredAction[] {\n    return [];\n  }\n\n  /**\n   * The contract events this journey emits (`.sendEvent()`) are checked\n   * against, exactly like ingest; journeyWorker passes its config's.\n   */\n  protected contract(): Contract | undefined {\n    return undefined;\n  }\n\n  /**\n   * Template props check before every send; an app overrides this with\n   * `registryValidator({ emails, pushes })` (journeyWorker does it from its\n   * registries). By default props go out as resolved.\n   */\n  protected createMessageValidator(): MessageValidator | undefined {\n    return undefined;\n  }\n\n  /**\n   * Reporting hooks: node arrivals, every copy sent, how each instance ended. The host stores\n   * what it needs for its dashboards; by default nothing is reported.\n   */\n  protected createObserver(_store: JourneyStore): JourneyObserver | undefined {\n    return undefined;\n  }\n\n  /** Override for a different version policy ('warn' by default) or a fully custom invoker (e.g. webhook degradation for hosted tenants). */\n  protected createActionInvoker(): ActionInvoker {\n    return new RegistryActionInvoker(this.actions());\n  }\n\n  /**\n   * Everything one run is wired to. By default it is composed from the methods above; a host\n   * that assembles the whole set itself (journeyWorker) overrides this one instead.\n   */\n  protected createRunParts(store: JourneyStore, params: JourneyParams): JourneyRunParts {\n    return {\n      store,\n      env: this.env,\n      runtime: this.runtime(params),\n      messages: this.createMessageSender(),\n      actions: this.createActionInvoker(),\n      contract: this.contract(),\n      validator: this.createMessageValidator(),\n      observer: this.createObserver(store),\n    };\n  }\n\n  async run(event: WorkflowEvent<JourneyParams>, step: WorkflowStep): Promise<JourneyOutcome> {\n    const store = this.createStore();\n    try {\n      const { userId } = event.payload;\n      return await executeJourney(\n        {\n          instanceId: event.instanceId,\n          params: event.payload,\n          // Trigger-event creation time: replay-stable, unlike Date.now() here\n          enteredAtMs: event.timestamp.getTime(),\n          step: new CfEngineStep(step, store, userId, event.instanceId),\n        },\n        this.createRunParts(store, event.payload)\n      );\n    } finally {\n      await this.closeStore(store);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2BA,MAAM,gCAAgB,IAAI,IAAI,CAAC,2BAA2B,yBAAyB,CAAC;AAEpF,IAAM,eAAN,MAAyC;CAEpB;CACA;CACA;CACA;CAJnB,YACE,MACA,OACA,QACA,YACA;EAJiB,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;;;;;;CAOH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,KAAK,GAAG,MAAM,YAAY;GACpC,IAAI;IACF,OAAO,MAAM,GAAG;GAClB,SAAS,OAAO;IACd,IAAI,iBAAiB,SAAS,cAAc,IAAI,MAAM,IAAI,GACxD,MAAM,IAAIA,qBAAAA,kBAAkB,MAAM,SAAS,MAAM,IAAI;IAEvD,MAAM;GACR;EACF,CAAC;CACH;CAEA,MAAM,MAAc,IAA2B;EAC7C,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE;CACjC;CAEA,WAAW,MAAc,aAAoC;EAC3D,OAAO,KAAK,KAAK,WAAW,MAAM,WAAW;CAC/C;CAEA,UAAU,MAAc,QAA0C;EAGhE,OAAO,KAAK,KAAK,GAAG,YAClB,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC,CACvE;CACF;CAEA,YAAY,MAA6B;EACvC,OAAO,KAAK,KAAK,GAAG,YAAY,KAAK,MAAM,YAAY,KAAK,UAAU,CAAC;CACzE;CAEA,MAAM,YAAY,MAAc,WAAiD;EAC/E,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI;GACF,MAAM,KAAK,KAAK,aAAa,MAAM;IAAE,MAAMC,4BAAAA;IAAiB,SAAS;GAAU,CAAC;GAChF,OAAO;EACT,SAAS,OAAO;GAWd,IAAI,MAHmB,KAAK,KAAK,GAAG,GAAG,KAAK,aAAa,YACvDC,4BAAAA,YAAY,WAAW,WAAW,KAAK,IAAI,CAAC,CAC9C,GACc,OAAO;GACrB,MAAM;EACR;CACF;AACF;;;;;;;AAQA,IAAa,gBAAb,cAAmCC,mBAAAA,mBAA8C;;;;;;;CAO/E,cAAsC;EACpC,OAAOC,0BAAAA,QAAQ,KAAK,GAAG;CACzB;;CAGA,MAAgB,WAAW,QAAqC,CAAC;;;;;;;;;;;;CAajE,QAAkB,SAA+C;EAC/D,OAAOC,gBAAAA,eAAe,KAAA,GAAW,YAAY;CAC/C;;;;;;CAOA,sBAA+C;EAC7C,OAAO,KAAK,IAAI,sBACZ,IAAIC,qBAAAA,qBAAqB,KAAK,IAAI,mBAAmB,IACrD,IAAIC,qBAAAA,iBAAiB;CAC3B;;;;;;;;CASA,UAAiD;EAC/C,OAAO,CAAC;CACV;;;;;CAMA,WAA2C,CAE3C;;;;;;CAOA,yBAAiE,CAEjE;;;;;CAMA,eAAyB,QAAmD,CAE5E;;CAGA,sBAA+C;EAC7C,OAAO,IAAIC,uBAAAA,sBAAsB,KAAK,QAAQ,CAAC;CACjD;;;;;CAMA,eAAyB,OAAqB,QAAwC;EACpF,OAAO;GACL;GACA,KAAK,KAAK;GACV,SAAS,KAAK,QAAQ,MAAM;GAC5B,UAAU,KAAK,oBAAoB;GACnC,SAAS,KAAK,oBAAoB;GAClC,UAAU,KAAK,SAAS;GACxB,WAAW,KAAK,uBAAuB;GACvC,UAAU,KAAK,eAAe,KAAK;EACrC;CACF;CAEA,MAAM,IAAI,OAAqC,MAA6C;EAC1F,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI;GACF,MAAM,EAAE,WAAW,MAAM;GACzB,OAAO,MAAMC,qBAAAA,eACX;IACE,YAAY,MAAM;IAClB,QAAQ,MAAM;IAEd,aAAa,MAAM,UAAU,QAAQ;IACrC,MAAM,IAAI,aAAa,MAAM,OAAO,QAAQ,MAAM,UAAU;GAC9D,GACA,KAAK,eAAe,OAAO,MAAM,OAAO,CAC1C;EACF,UAAU;GACR,MAAM,KAAK,WAAW,KAAK;EAC7B;CACF;AACF"}
+{"version":3,"file":"runner.cjs","names":["isRetryable","NonRetryableError","WAKE_EVENT_TYPE","wakeExpired","WorkflowEntrypoint","d1Store","resolveRuntime","WebhookMessageSender","LogMessageSender","RegistryActionInvoker","executeJourney"],"sources":["../../src/cloudflare/runner.ts"],"sourcesContent":["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';\nimport { NonRetryableError } from 'cloudflare:workflows';\nimport type { Contract } from '../contract';\nimport { type RegisteredAction, RegistryActionInvoker } from '../engine/actions';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { isRetryable } from '../engine/retry';\nimport { type JourneyRunParts, executeJourney } from '../host/execute';\nimport { LogMessageSender, WebhookMessageSender } from '../host/senders';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport { type JourneyEnv, type JourneyParams, WAKE_EVENT_TYPE, wakeExpired } from './bindings';\nimport { d1Store } from './d1-env';\n\n/**\n * Adapts CF's WorkflowStep to EngineStep.\n * subscribe/unsubscribe write the subscription table inside durable steps (the\n * router wakes instances from that table); waitForWake parks on CF's\n * waitForEvent, which signals a timeout by throwing — and so does every other\n * failure in there, so only the clock can tell them apart (see wakeExpired).\n */\nclass CfEngineStep implements EngineStep {\n  constructor(\n    private readonly step: WorkflowStep,\n    private readonly store: JourneyStore,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  /**\n   * A failure a retry would only repeat (`isRetryable`: a template refusing its props, the\n   * contract refusing an emitted event, a provider rejecting the request) ends the step at\n   * once instead of burning the retry budget.\n   */\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.step.do(name, async () => {\n      try {\n        return await fn();\n      } catch (error) {\n        if (error instanceof Error && !isRetryable(error)) {\n          throw new NonRetryableError(error.message, error.name);\n        }\n        throw error;\n      }\n    });\n  }\n\n  sleep(name: string, ms: number): Promise<void> {\n    return this.step.sleep(name, ms);\n  }\n\n  sleepUntil(name: string, timestampMs: number): Promise<void> {\n    return this.step.sleepUntil(name, timestampMs);\n  }\n\n  subscribe(name: string, events: readonly string[]): Promise<void> {\n    // Idempotent in the store: the interpreter re-subscribes on every wait\n    // attempt (one-shot-callback contract) and registrations persist here.\n    return this.step.do(name, () =>\n      this.store.subscribe(this.instanceId, this.userId, events, Date.now())\n    );\n  }\n\n  unsubscribe(name: string): Promise<void> {\n    return this.step.do(name, () => this.store.unsubscribe(this.instanceId));\n  }\n\n  async waitForWake(name: string, timeoutMs: number): Promise<'event' | 'timeout'> {\n    const startedAt = Date.now();\n    try {\n      await this.step.waitForEvent(name, { type: WAKE_EVENT_TYPE, timeout: timeoutMs });\n      return 'event';\n    } catch (error) {\n      /*\n       * Only the deadline can tell a real timeout from a failure (see\n       * wakeExpired). `startedAt` is not replay-stable, but it is read only\n       * inside the step body below, and a step body runs on the live attempt\n       * alone — a replay returns the persisted verdict without touching the\n       * clock.\n       */\n      const timedOut = await this.step.do(`${name}:timed-out`, async () =>\n        wakeExpired(startedAt, timeoutMs, Date.now())\n      );\n      if (timedOut) return 'timeout';\n      throw error;\n    }\n  }\n}\n\n/**\n * The generic journey executor: one class runs every workflow, because IR is\n * data. It is loaded from the store by the contentHash pinned at entry —\n * content addressing makes it immutable, so reading it outside a step is\n * replay-safe.\n */\nexport class JourneyRunner extends WorkflowEntrypoint<JourneyEnv, JourneyParams> {\n  /**\n   * The data plane. D1 + KV from the env by default; an app on Postgres\n   * overrides this (and `closeStore` if its client needs closing):\n   *\n   *   protected override createStore() { return new PostgresJourneyStore(client(this.env)); }\n   */\n  protected createStore(): JourneyStore {\n    return d1Store(this.env);\n  }\n\n  /** Called once `run` is over, success or not — release whatever `createStore` opened. */\n  protected async closeStore(_store: JourneyStore): Promise<void> {}\n\n  /**\n   * Runtime options for this instance — typed configuration, resolved by the app (typically\n   * `resolveRuntime(config.runtime, mode)` over its workflow.config.ts, with the mode coming from\n   * an ENVIRONMENT var). The instance params are passed so the decision can also be per user:\n   * a tester account in production can run in fast-forward while everyone else runs in real\n   * time. Defaults: real time, quiet.\n   *\n   *   protected override runtime({ userId }) {\n   *     return resolveRuntime(workflowConfig.runtime, isTester(userId) ? 'test' : this.env.ENVIRONMENT);\n   *   }\n   */\n  protected runtime(_params: JourneyParams): JourneyRuntimeOptions {\n    return resolveRuntime(undefined, 'production');\n  }\n\n  /**\n   * Message outlet; an app overrides this to plug in real channels (say\n   * an EmailSender over a transport with a react-email renderer). By default it picks the webhook\n   * or logging sender based on the environment.\n   */\n  protected createMessageSender(): MessageSender {\n    return this.env.MESSAGE_WEBHOOK_URL\n      ? new WebhookMessageSender(this.env.MESSAGE_WEBHOOK_URL)\n      : new LogMessageSender();\n  }\n\n  /**\n   * Custom-action registry; an app overrides this returning the same\n   * `action(...)` objects its workflows reference (an ActionRef is a\n   * RegisteredAction structurally) — the code plane of the dual-plane model:\n   *\n   *   protected override actions() { return [syncCrm, issueCoupon]; }\n   */\n  protected actions(): readonly RegisteredAction[] {\n    return [];\n  }\n\n  /**\n   * The contract events this journey emits (`.sendEvent()`) are checked\n   * against, exactly like ingest; journeyWorker passes its config's.\n   */\n  protected contract(): Contract | undefined {\n    return undefined;\n  }\n\n  /**\n   * Template props check before every send; an app overrides this with\n   * `registryValidator({ emails, pushes })` (journeyWorker does it from its\n   * registries). By default props go out as resolved.\n   */\n  protected createMessageValidator(): MessageValidator | undefined {\n    return undefined;\n  }\n\n  /**\n   * Reporting hooks: node arrivals, every copy sent, how each instance ended. The host stores\n   * what it needs for its dashboards; by default nothing is reported.\n   */\n  protected createObserver(_store: JourneyStore): JourneyObserver | undefined {\n    return undefined;\n  }\n\n  /** Override for a different version policy ('warn' by default) or a fully custom invoker (e.g. webhook degradation for hosted tenants). */\n  protected createActionInvoker(): ActionInvoker {\n    return new RegistryActionInvoker(this.actions());\n  }\n\n  /**\n   * Everything one run is wired to. By default it is composed from the methods above; a host\n   * that assembles the whole set itself (journeyWorker) overrides this one instead.\n   */\n  protected createRunParts(store: JourneyStore, params: JourneyParams): JourneyRunParts {\n    return {\n      store,\n      env: this.env,\n      runtime: this.runtime(params),\n      messages: this.createMessageSender(),\n      actions: this.createActionInvoker(),\n      contract: this.contract(),\n      validator: this.createMessageValidator(),\n      observer: this.createObserver(store),\n    };\n  }\n\n  async run(event: WorkflowEvent<JourneyParams>, step: WorkflowStep): Promise<JourneyOutcome> {\n    const store = this.createStore();\n    try {\n      const { userId } = event.payload;\n      return await executeJourney(\n        {\n          instanceId: event.instanceId,\n          params: event.payload,\n          // Trigger-event creation time: replay-stable, unlike Date.now() here\n          enteredAtMs: event.timestamp.getTime(),\n          step: new CfEngineStep(step, store, userId, event.instanceId),\n        },\n        this.createRunParts(store, event.payload)\n      );\n    } finally {\n      await this.closeStore(store);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2BA,IAAM,eAAN,MAAyC;CAEpB;CACA;CACA;CACA;CAJnB,YACE,MACA,OACA,QACA,YACA;EAJiB,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;;;;;;CAOH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,KAAK,GAAG,MAAM,YAAY;GACpC,IAAI;IACF,OAAO,MAAM,GAAG;GAClB,SAAS,OAAO;IACd,IAAI,iBAAiB,SAAS,CAACA,qBAAAA,YAAY,KAAK,GAC9C,MAAM,IAAIC,qBAAAA,kBAAkB,MAAM,SAAS,MAAM,IAAI;IAEvD,MAAM;GACR;EACF,CAAC;CACH;CAEA,MAAM,MAAc,IAA2B;EAC7C,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE;CACjC;CAEA,WAAW,MAAc,aAAoC;EAC3D,OAAO,KAAK,KAAK,WAAW,MAAM,WAAW;CAC/C;CAEA,UAAU,MAAc,QAA0C;EAGhE,OAAO,KAAK,KAAK,GAAG,YAClB,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC,CACvE;CACF;CAEA,YAAY,MAA6B;EACvC,OAAO,KAAK,KAAK,GAAG,YAAY,KAAK,MAAM,YAAY,KAAK,UAAU,CAAC;CACzE;CAEA,MAAM,YAAY,MAAc,WAAiD;EAC/E,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI;GACF,MAAM,KAAK,KAAK,aAAa,MAAM;IAAE,MAAMC,4BAAAA;IAAiB,SAAS;GAAU,CAAC;GAChF,OAAO;EACT,SAAS,OAAO;GAWd,IAAI,MAHmB,KAAK,KAAK,GAAG,GAAG,KAAK,aAAa,YACvDC,4BAAAA,YAAY,WAAW,WAAW,KAAK,IAAI,CAAC,CAC9C,GACc,OAAO;GACrB,MAAM;EACR;CACF;AACF;;;;;;;AAQA,IAAa,gBAAb,cAAmCC,mBAAAA,mBAA8C;;;;;;;CAO/E,cAAsC;EACpC,OAAOC,0BAAAA,QAAQ,KAAK,GAAG;CACzB;;CAGA,MAAgB,WAAW,QAAqC,CAAC;;;;;;;;;;;;CAajE,QAAkB,SAA+C;EAC/D,OAAOC,gBAAAA,eAAe,KAAA,GAAW,YAAY;CAC/C;;;;;;CAOA,sBAA+C;EAC7C,OAAO,KAAK,IAAI,sBACZ,IAAIC,qBAAAA,qBAAqB,KAAK,IAAI,mBAAmB,IACrD,IAAIC,qBAAAA,iBAAiB;CAC3B;;;;;;;;CASA,UAAiD;EAC/C,OAAO,CAAC;CACV;;;;;CAMA,WAA2C,CAE3C;;;;;;CAOA,yBAAiE,CAEjE;;;;;CAMA,eAAyB,QAAmD,CAE5E;;CAGA,sBAA+C;EAC7C,OAAO,IAAIC,uBAAAA,sBAAsB,KAAK,QAAQ,CAAC;CACjD;;;;;CAMA,eAAyB,OAAqB,QAAwC;EACpF,OAAO;GACL;GACA,KAAK,KAAK;GACV,SAAS,KAAK,QAAQ,MAAM;GAC5B,UAAU,KAAK,oBAAoB;GACnC,SAAS,KAAK,oBAAoB;GAClC,UAAU,KAAK,SAAS;GACxB,WAAW,KAAK,uBAAuB;GACvC,UAAU,KAAK,eAAe,KAAK;EACrC;CACF;CAEA,MAAM,IAAI,OAAqC,MAA6C;EAC1F,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI;GACF,MAAM,EAAE,WAAW,MAAM;GACzB,OAAO,MAAMC,qBAAAA,eACX;IACE,YAAY,MAAM;IAClB,QAAQ,MAAM;IAEd,aAAa,MAAM,UAAU,QAAQ;IACrC,MAAM,IAAI,aAAa,MAAM,OAAO,QAAQ,MAAM,UAAU;GAC9D,GACA,KAAK,eAAe,OAAO,MAAM,OAAO,CAC1C;EACF,UAAU;GACR,MAAM,KAAK,WAAW,KAAK;EAC7B;CACF;AACF"}

package/dist/cloudflare/runner.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.cts","names":[],"sources":["../../src/cloudflare/runner.ts"],"mappings":";;;;;;;;;;;;;;;qBAuGa,sBAAsB,mBAAmB,YAAY;;;;;;;YAOtD,eAAe;;YAKT,WAAW,QAAQ,eAAe;;;;;;;;;;;;YAaxC,QAAQ,SAAS,gBAAgB;;;;;;YASjC,uBAAuB;;;;;;;;YAavB,oBAAoB;;;;;YAQpB,YAAY;;;;;;YASZ,0BAA0B;;;;;YAQ1B,eAAe,QAAQ,eAAe;;YAKtC,uBAAuB;;;;;YAQvB,eAAe,OAAO,cAAc,QAAQ,gBAAgB;EAahE,IAAI,OAAO,cAAc,gBAAgB,MAAM,eAAe,QAAQ"}
+{"version":3,"file":"runner.d.cts","names":[],"sources":["../../src/cloudflare/runner.ts"],"mappings":";;;;;;;;;;;;;;;qBAqGa,sBAAsB,mBAAmB,YAAY;;;;;;;YAOtD,eAAe;;YAKT,WAAW,QAAQ,eAAe;;;;;;;;;;;;YAaxC,QAAQ,SAAS,gBAAgB;;;;;;YASjC,uBAAuB;;;;;;;;YAavB,oBAAoB;;;;;YAQpB,YAAY;;;;;;YASZ,0BAA0B;;;;;YAQ1B,eAAe,QAAQ,eAAe;;YAKtC,uBAAuB;;;;;YAQvB,eAAe,OAAO,cAAc,QAAQ,gBAAgB;EAahE,IAAI,OAAO,cAAc,gBAAgB,MAAM,eAAe,QAAQ"}

package/dist/cloudflare/runner.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.mts","names":[],"sources":["../../src/cloudflare/runner.ts"],"mappings":";;;;;;;;;;;;;;;qBAuGa,sBAAsB,mBAAmB,YAAY;;;;;;;YAOtD,eAAe;;YAKT,WAAW,QAAQ,eAAe;;;;;;;;;;;;YAaxC,QAAQ,SAAS,gBAAgB;;;;;;YASjC,uBAAuB;;;;;;;;YAavB,oBAAoB;;;;;YAQpB,YAAY;;;;;;YASZ,0BAA0B;;;;;YAQ1B,eAAe,QAAQ,eAAe;;YAKtC,uBAAuB;;;;;YAQvB,eAAe,OAAO,cAAc,QAAQ,gBAAgB;EAahE,IAAI,OAAO,cAAc,gBAAgB,MAAM,eAAe,QAAQ"}
+{"version":3,"file":"runner.d.mts","names":[],"sources":["../../src/cloudflare/runner.ts"],"mappings":";;;;;;;;;;;;;;;qBAqGa,sBAAsB,mBAAmB,YAAY;;;;;;;YAOtD,eAAe;;YAKT,WAAW,QAAQ,eAAe;;;;;;;;;;;;YAaxC,QAAQ,SAAS,gBAAgB;;;;;;YASjC,uBAAuB;;;;;;;;YAavB,oBAAoB;;;;;YAQpB,YAAY;;;;;;YASZ,0BAA0B;;;;;YAQ1B,eAAe,QAAQ,eAAe;;YAKtC,uBAAuB;;;;;YAQvB,eAAe,OAAO,cAAc,QAAQ,gBAAgB;EAahE,IAAI,OAAO,cAAc,gBAAgB,MAAM,eAAe,QAAQ"}

package/dist/cloudflare/runner.mjs

@@ -1,4 +1,5 @@
 import { resolveRuntime } from "../runtime.mjs";
+import { isRetryable } from "../engine/retry.mjs";
 import { WAKE_EVENT_TYPE, wakeExpired } from "./bindings.mjs";
 import { d1Store } from "./d1-env.mjs";
 import { executeJourney } from "../host/execute.mjs";
@@ -14,8 +15,6 @@ import { NonRetryableError } from "cloudflare:workflows";
 * waitForEvent, which signals a timeout by throwing — and so does every other
 * failure in there, so only the clock can tell them apart (see wakeExpired).
 */
-/** Refusals a retry would only repeat: a template's props, an emitted event's payload. */
-const NON_RETRYABLE = /* @__PURE__ */ new Set(["TemplateValidationError", "ContractValidationError"]);
 var CfEngineStep = class {
 	step;
 	store;
@@ -28,8 +27,8 @@ var CfEngineStep = class {
 		this.instanceId = instanceId;
 	}
 	/**
-	* A template refusing its props, or the contract refusing an emitted event,
-	* is deterministic — a retry hits the same refusal — so it ends the step at
+	* A failure a retry would only repeat (`isRetryable`: a template refusing its props, the
+	* contract refusing an emitted event, a provider rejecting the request) ends the step at
 	* once instead of burning the retry budget.
 	*/
 	do(name, fn) {
@@ -37,7 +36,7 @@ var CfEngineStep = class {
 			try {
 				return await fn();
 			} catch (error) {
-				if (error instanceof Error && NON_RETRYABLE.has(error.name)) throw new NonRetryableError(error.message, error.name);
+				if (error instanceof Error && !isRetryable(error)) throw new NonRetryableError(error.message, error.name);
 				throw error;
 			}
 		});

package/dist/cloudflare/runner.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runner.mjs","names":[],"sources":["../../src/cloudflare/runner.ts"],"sourcesContent":["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';\nimport { NonRetryableError } from 'cloudflare:workflows';\nimport type { Contract } from '../contract';\nimport { type RegisteredAction, RegistryActionInvoker } from '../engine/actions';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { type JourneyRunParts, executeJourney } from '../host/execute';\nimport { LogMessageSender, WebhookMessageSender } from '../host/senders';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport { type JourneyEnv, type JourneyParams, WAKE_EVENT_TYPE, wakeExpired } from './bindings';\nimport { d1Store } from './d1-env';\n\n/**\n * Adapts CF's WorkflowStep to EngineStep.\n * subscribe/unsubscribe write the subscription table inside durable steps (the\n * router wakes instances from that table); waitForWake parks on CF's\n * waitForEvent, which signals a timeout by throwing — and so does every other\n * failure in there, so only the clock can tell them apart (see wakeExpired).\n */\n/** Refusals a retry would only repeat: a template's props, an emitted event's payload. */\nconst NON_RETRYABLE = new Set(['TemplateValidationError', 'ContractValidationError']);\n\nclass CfEngineStep implements EngineStep {\n  constructor(\n    private readonly step: WorkflowStep,\n    private readonly store: JourneyStore,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  /**\n   * A template refusing its props, or the contract refusing an emitted event,\n   * is deterministic — a retry hits the same refusal — so it ends the step at\n   * once instead of burning the retry budget.\n   */\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.step.do(name, async () => {\n      try {\n        return await fn();\n      } catch (error) {\n        if (error instanceof Error && NON_RETRYABLE.has(error.name)) {\n          throw new NonRetryableError(error.message, error.name);\n        }\n        throw error;\n      }\n    });\n  }\n\n  sleep(name: string, ms: number): Promise<void> {\n    return this.step.sleep(name, ms);\n  }\n\n  sleepUntil(name: string, timestampMs: number): Promise<void> {\n    return this.step.sleepUntil(name, timestampMs);\n  }\n\n  subscribe(name: string, events: readonly string[]): Promise<void> {\n    // Idempotent in the store: the interpreter re-subscribes on every wait\n    // attempt (one-shot-callback contract) and registrations persist here.\n    return this.step.do(name, () =>\n      this.store.subscribe(this.instanceId, this.userId, events, Date.now())\n    );\n  }\n\n  unsubscribe(name: string): Promise<void> {\n    return this.step.do(name, () => this.store.unsubscribe(this.instanceId));\n  }\n\n  async waitForWake(name: string, timeoutMs: number): Promise<'event' | 'timeout'> {\n    const startedAt = Date.now();\n    try {\n      await this.step.waitForEvent(name, { type: WAKE_EVENT_TYPE, timeout: timeoutMs });\n      return 'event';\n    } catch (error) {\n      /*\n       * Only the deadline can tell a real timeout from a failure (see\n       * wakeExpired). `startedAt` is not replay-stable, but it is read only\n       * inside the step body below, and a step body runs on the live attempt\n       * alone — a replay returns the persisted verdict without touching the\n       * clock.\n       */\n      const timedOut = await this.step.do(`${name}:timed-out`, async () =>\n        wakeExpired(startedAt, timeoutMs, Date.now())\n      );\n      if (timedOut) return 'timeout';\n      throw error;\n    }\n  }\n}\n\n/**\n * The generic journey executor: one class runs every workflow, because IR is\n * data. It is loaded from the store by the contentHash pinned at entry —\n * content addressing makes it immutable, so reading it outside a step is\n * replay-safe.\n */\nexport class JourneyRunner extends WorkflowEntrypoint<JourneyEnv, JourneyParams> {\n  /**\n   * The data plane. D1 + KV from the env by default; an app on Postgres\n   * overrides this (and `closeStore` if its client needs closing):\n   *\n   *   protected override createStore() { return new PostgresJourneyStore(client(this.env)); }\n   */\n  protected createStore(): JourneyStore {\n    return d1Store(this.env);\n  }\n\n  /** Called once `run` is over, success or not — release whatever `createStore` opened. */\n  protected async closeStore(_store: JourneyStore): Promise<void> {}\n\n  /**\n   * Runtime options for this instance — typed configuration, resolved by the app (typically\n   * `resolveRuntime(config.runtime, mode)` over its workflow.config.ts, with the mode coming from\n   * an ENVIRONMENT var). The instance params are passed so the decision can also be per user:\n   * a tester account in production can run in fast-forward while everyone else runs in real\n   * time. Defaults: real time, quiet.\n   *\n   *   protected override runtime({ userId }) {\n   *     return resolveRuntime(workflowConfig.runtime, isTester(userId) ? 'test' : this.env.ENVIRONMENT);\n   *   }\n   */\n  protected runtime(_params: JourneyParams): JourneyRuntimeOptions {\n    return resolveRuntime(undefined, 'production');\n  }\n\n  /**\n   * Message outlet; an app overrides this to plug in real channels (say\n   * an EmailSender over a transport with a react-email renderer). By default it picks the webhook\n   * or logging sender based on the environment.\n   */\n  protected createMessageSender(): MessageSender {\n    return this.env.MESSAGE_WEBHOOK_URL\n      ? new WebhookMessageSender(this.env.MESSAGE_WEBHOOK_URL)\n      : new LogMessageSender();\n  }\n\n  /**\n   * Custom-action registry; an app overrides this returning the same\n   * `action(...)` objects its workflows reference (an ActionRef is a\n   * RegisteredAction structurally) — the code plane of the dual-plane model:\n   *\n   *   protected override actions() { return [syncCrm, issueCoupon]; }\n   */\n  protected actions(): readonly RegisteredAction[] {\n    return [];\n  }\n\n  /**\n   * The contract events this journey emits (`.sendEvent()`) are checked\n   * against, exactly like ingest; journeyWorker passes its config's.\n   */\n  protected contract(): Contract | undefined {\n    return undefined;\n  }\n\n  /**\n   * Template props check before every send; an app overrides this with\n   * `registryValidator({ emails, pushes })` (journeyWorker does it from its\n   * registries). By default props go out as resolved.\n   */\n  protected createMessageValidator(): MessageValidator | undefined {\n    return undefined;\n  }\n\n  /**\n   * Reporting hooks: node arrivals, every copy sent, how each instance ended. The host stores\n   * what it needs for its dashboards; by default nothing is reported.\n   */\n  protected createObserver(_store: JourneyStore): JourneyObserver | undefined {\n    return undefined;\n  }\n\n  /** Override for a different version policy ('warn' by default) or a fully custom invoker (e.g. webhook degradation for hosted tenants). */\n  protected createActionInvoker(): ActionInvoker {\n    return new RegistryActionInvoker(this.actions());\n  }\n\n  /**\n   * Everything one run is wired to. By default it is composed from the methods above; a host\n   * that assembles the whole set itself (journeyWorker) overrides this one instead.\n   */\n  protected createRunParts(store: JourneyStore, params: JourneyParams): JourneyRunParts {\n    return {\n      store,\n      env: this.env,\n      runtime: this.runtime(params),\n      messages: this.createMessageSender(),\n      actions: this.createActionInvoker(),\n      contract: this.contract(),\n      validator: this.createMessageValidator(),\n      observer: this.createObserver(store),\n    };\n  }\n\n  async run(event: WorkflowEvent<JourneyParams>, step: WorkflowStep): Promise<JourneyOutcome> {\n    const store = this.createStore();\n    try {\n      const { userId } = event.payload;\n      return await executeJourney(\n        {\n          instanceId: event.instanceId,\n          params: event.payload,\n          // Trigger-event creation time: replay-stable, unlike Date.now() here\n          enteredAtMs: event.timestamp.getTime(),\n          step: new CfEngineStep(step, store, userId, event.instanceId),\n        },\n        this.createRunParts(store, event.payload)\n      );\n    } finally {\n      await this.closeStore(store);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,MAAM,gCAAgB,IAAI,IAAI,CAAC,2BAA2B,yBAAyB,CAAC;AAEpF,IAAM,eAAN,MAAyC;CAEpB;CACA;CACA;CACA;CAJnB,YACE,MACA,OACA,QACA,YACA;EAJiB,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;;;;;;CAOH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,KAAK,GAAG,MAAM,YAAY;GACpC,IAAI;IACF,OAAO,MAAM,GAAG;GAClB,SAAS,OAAO;IACd,IAAI,iBAAiB,SAAS,cAAc,IAAI,MAAM,IAAI,GACxD,MAAM,IAAI,kBAAkB,MAAM,SAAS,MAAM,IAAI;IAEvD,MAAM;GACR;EACF,CAAC;CACH;CAEA,MAAM,MAAc,IAA2B;EAC7C,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE;CACjC;CAEA,WAAW,MAAc,aAAoC;EAC3D,OAAO,KAAK,KAAK,WAAW,MAAM,WAAW;CAC/C;CAEA,UAAU,MAAc,QAA0C;EAGhE,OAAO,KAAK,KAAK,GAAG,YAClB,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC,CACvE;CACF;CAEA,YAAY,MAA6B;EACvC,OAAO,KAAK,KAAK,GAAG,YAAY,KAAK,MAAM,YAAY,KAAK,UAAU,CAAC;CACzE;CAEA,MAAM,YAAY,MAAc,WAAiD;EAC/E,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI;GACF,MAAM,KAAK,KAAK,aAAa,MAAM;IAAE,MAAM;IAAiB,SAAS;GAAU,CAAC;GAChF,OAAO;EACT,SAAS,OAAO;GAWd,IAAI,MAHmB,KAAK,KAAK,GAAG,GAAG,KAAK,aAAa,YACvD,YAAY,WAAW,WAAW,KAAK,IAAI,CAAC,CAC9C,GACc,OAAO;GACrB,MAAM;EACR;CACF;AACF;;;;;;;AAQA,IAAa,gBAAb,cAAmC,mBAA8C;;;;;;;CAO/E,cAAsC;EACpC,OAAO,QAAQ,KAAK,GAAG;CACzB;;CAGA,MAAgB,WAAW,QAAqC,CAAC;;;;;;;;;;;;CAajE,QAAkB,SAA+C;EAC/D,OAAO,eAAe,KAAA,GAAW,YAAY;CAC/C;;;;;;CAOA,sBAA+C;EAC7C,OAAO,KAAK,IAAI,sBACZ,IAAI,qBAAqB,KAAK,IAAI,mBAAmB,IACrD,IAAI,iBAAiB;CAC3B;;;;;;;;CASA,UAAiD;EAC/C,OAAO,CAAC;CACV;;;;;CAMA,WAA2C,CAE3C;;;;;;CAOA,yBAAiE,CAEjE;;;;;CAMA,eAAyB,QAAmD,CAE5E;;CAGA,sBAA+C;EAC7C,OAAO,IAAI,sBAAsB,KAAK,QAAQ,CAAC;CACjD;;;;;CAMA,eAAyB,OAAqB,QAAwC;EACpF,OAAO;GACL;GACA,KAAK,KAAK;GACV,SAAS,KAAK,QAAQ,MAAM;GAC5B,UAAU,KAAK,oBAAoB;GACnC,SAAS,KAAK,oBAAoB;GAClC,UAAU,KAAK,SAAS;GACxB,WAAW,KAAK,uBAAuB;GACvC,UAAU,KAAK,eAAe,KAAK;EACrC;CACF;CAEA,MAAM,IAAI,OAAqC,MAA6C;EAC1F,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI;GACF,MAAM,EAAE,WAAW,MAAM;GACzB,OAAO,MAAM,eACX;IACE,YAAY,MAAM;IAClB,QAAQ,MAAM;IAEd,aAAa,MAAM,UAAU,QAAQ;IACrC,MAAM,IAAI,aAAa,MAAM,OAAO,QAAQ,MAAM,UAAU;GAC9D,GACA,KAAK,eAAe,OAAO,MAAM,OAAO,CAC1C;EACF,UAAU;GACR,MAAM,KAAK,WAAW,KAAK;EAC7B;CACF;AACF"}
+{"version":3,"file":"runner.mjs","names":[],"sources":["../../src/cloudflare/runner.ts"],"sourcesContent":["import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';\nimport { NonRetryableError } from 'cloudflare:workflows';\nimport type { Contract } from '../contract';\nimport { type RegisteredAction, RegistryActionInvoker } from '../engine/actions';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { isRetryable } from '../engine/retry';\nimport { type JourneyRunParts, executeJourney } from '../host/execute';\nimport { LogMessageSender, WebhookMessageSender } from '../host/senders';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport { type JourneyEnv, type JourneyParams, WAKE_EVENT_TYPE, wakeExpired } from './bindings';\nimport { d1Store } from './d1-env';\n\n/**\n * Adapts CF's WorkflowStep to EngineStep.\n * subscribe/unsubscribe write the subscription table inside durable steps (the\n * router wakes instances from that table); waitForWake parks on CF's\n * waitForEvent, which signals a timeout by throwing — and so does every other\n * failure in there, so only the clock can tell them apart (see wakeExpired).\n */\nclass CfEngineStep implements EngineStep {\n  constructor(\n    private readonly step: WorkflowStep,\n    private readonly store: JourneyStore,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  /**\n   * A failure a retry would only repeat (`isRetryable`: a template refusing its props, the\n   * contract refusing an emitted event, a provider rejecting the request) ends the step at\n   * once instead of burning the retry budget.\n   */\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.step.do(name, async () => {\n      try {\n        return await fn();\n      } catch (error) {\n        if (error instanceof Error && !isRetryable(error)) {\n          throw new NonRetryableError(error.message, error.name);\n        }\n        throw error;\n      }\n    });\n  }\n\n  sleep(name: string, ms: number): Promise<void> {\n    return this.step.sleep(name, ms);\n  }\n\n  sleepUntil(name: string, timestampMs: number): Promise<void> {\n    return this.step.sleepUntil(name, timestampMs);\n  }\n\n  subscribe(name: string, events: readonly string[]): Promise<void> {\n    // Idempotent in the store: the interpreter re-subscribes on every wait\n    // attempt (one-shot-callback contract) and registrations persist here.\n    return this.step.do(name, () =>\n      this.store.subscribe(this.instanceId, this.userId, events, Date.now())\n    );\n  }\n\n  unsubscribe(name: string): Promise<void> {\n    return this.step.do(name, () => this.store.unsubscribe(this.instanceId));\n  }\n\n  async waitForWake(name: string, timeoutMs: number): Promise<'event' | 'timeout'> {\n    const startedAt = Date.now();\n    try {\n      await this.step.waitForEvent(name, { type: WAKE_EVENT_TYPE, timeout: timeoutMs });\n      return 'event';\n    } catch (error) {\n      /*\n       * Only the deadline can tell a real timeout from a failure (see\n       * wakeExpired). `startedAt` is not replay-stable, but it is read only\n       * inside the step body below, and a step body runs on the live attempt\n       * alone — a replay returns the persisted verdict without touching the\n       * clock.\n       */\n      const timedOut = await this.step.do(`${name}:timed-out`, async () =>\n        wakeExpired(startedAt, timeoutMs, Date.now())\n      );\n      if (timedOut) return 'timeout';\n      throw error;\n    }\n  }\n}\n\n/**\n * The generic journey executor: one class runs every workflow, because IR is\n * data. It is loaded from the store by the contentHash pinned at entry —\n * content addressing makes it immutable, so reading it outside a step is\n * replay-safe.\n */\nexport class JourneyRunner extends WorkflowEntrypoint<JourneyEnv, JourneyParams> {\n  /**\n   * The data plane. D1 + KV from the env by default; an app on Postgres\n   * overrides this (and `closeStore` if its client needs closing):\n   *\n   *   protected override createStore() { return new PostgresJourneyStore(client(this.env)); }\n   */\n  protected createStore(): JourneyStore {\n    return d1Store(this.env);\n  }\n\n  /** Called once `run` is over, success or not — release whatever `createStore` opened. */\n  protected async closeStore(_store: JourneyStore): Promise<void> {}\n\n  /**\n   * Runtime options for this instance — typed configuration, resolved by the app (typically\n   * `resolveRuntime(config.runtime, mode)` over its workflow.config.ts, with the mode coming from\n   * an ENVIRONMENT var). The instance params are passed so the decision can also be per user:\n   * a tester account in production can run in fast-forward while everyone else runs in real\n   * time. Defaults: real time, quiet.\n   *\n   *   protected override runtime({ userId }) {\n   *     return resolveRuntime(workflowConfig.runtime, isTester(userId) ? 'test' : this.env.ENVIRONMENT);\n   *   }\n   */\n  protected runtime(_params: JourneyParams): JourneyRuntimeOptions {\n    return resolveRuntime(undefined, 'production');\n  }\n\n  /**\n   * Message outlet; an app overrides this to plug in real channels (say\n   * an EmailSender over a transport with a react-email renderer). By default it picks the webhook\n   * or logging sender based on the environment.\n   */\n  protected createMessageSender(): MessageSender {\n    return this.env.MESSAGE_WEBHOOK_URL\n      ? new WebhookMessageSender(this.env.MESSAGE_WEBHOOK_URL)\n      : new LogMessageSender();\n  }\n\n  /**\n   * Custom-action registry; an app overrides this returning the same\n   * `action(...)` objects its workflows reference (an ActionRef is a\n   * RegisteredAction structurally) — the code plane of the dual-plane model:\n   *\n   *   protected override actions() { return [syncCrm, issueCoupon]; }\n   */\n  protected actions(): readonly RegisteredAction[] {\n    return [];\n  }\n\n  /**\n   * The contract events this journey emits (`.sendEvent()`) are checked\n   * against, exactly like ingest; journeyWorker passes its config's.\n   */\n  protected contract(): Contract | undefined {\n    return undefined;\n  }\n\n  /**\n   * Template props check before every send; an app overrides this with\n   * `registryValidator({ emails, pushes })` (journeyWorker does it from its\n   * registries). By default props go out as resolved.\n   */\n  protected createMessageValidator(): MessageValidator | undefined {\n    return undefined;\n  }\n\n  /**\n   * Reporting hooks: node arrivals, every copy sent, how each instance ended. The host stores\n   * what it needs for its dashboards; by default nothing is reported.\n   */\n  protected createObserver(_store: JourneyStore): JourneyObserver | undefined {\n    return undefined;\n  }\n\n  /** Override for a different version policy ('warn' by default) or a fully custom invoker (e.g. webhook degradation for hosted tenants). */\n  protected createActionInvoker(): ActionInvoker {\n    return new RegistryActionInvoker(this.actions());\n  }\n\n  /**\n   * Everything one run is wired to. By default it is composed from the methods above; a host\n   * that assembles the whole set itself (journeyWorker) overrides this one instead.\n   */\n  protected createRunParts(store: JourneyStore, params: JourneyParams): JourneyRunParts {\n    return {\n      store,\n      env: this.env,\n      runtime: this.runtime(params),\n      messages: this.createMessageSender(),\n      actions: this.createActionInvoker(),\n      contract: this.contract(),\n      validator: this.createMessageValidator(),\n      observer: this.createObserver(store),\n    };\n  }\n\n  async run(event: WorkflowEvent<JourneyParams>, step: WorkflowStep): Promise<JourneyOutcome> {\n    const store = this.createStore();\n    try {\n      const { userId } = event.payload;\n      return await executeJourney(\n        {\n          instanceId: event.instanceId,\n          params: event.payload,\n          // Trigger-event creation time: replay-stable, unlike Date.now() here\n          enteredAtMs: event.timestamp.getTime(),\n          step: new CfEngineStep(step, store, userId, event.instanceId),\n        },\n        this.createRunParts(store, event.payload)\n      );\n    } finally {\n      await this.closeStore(store);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,IAAM,eAAN,MAAyC;CAEpB;CACA;CACA;CACA;CAJnB,YACE,MACA,OACA,QACA,YACA;EAJiB,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;;;;;;CAOH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,KAAK,GAAG,MAAM,YAAY;GACpC,IAAI;IACF,OAAO,MAAM,GAAG;GAClB,SAAS,OAAO;IACd,IAAI,iBAAiB,SAAS,CAAC,YAAY,KAAK,GAC9C,MAAM,IAAI,kBAAkB,MAAM,SAAS,MAAM,IAAI;IAEvD,MAAM;GACR;EACF,CAAC;CACH;CAEA,MAAM,MAAc,IAA2B;EAC7C,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE;CACjC;CAEA,WAAW,MAAc,aAAoC;EAC3D,OAAO,KAAK,KAAK,WAAW,MAAM,WAAW;CAC/C;CAEA,UAAU,MAAc,QAA0C;EAGhE,OAAO,KAAK,KAAK,GAAG,YAClB,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC,CACvE;CACF;CAEA,YAAY,MAA6B;EACvC,OAAO,KAAK,KAAK,GAAG,YAAY,KAAK,MAAM,YAAY,KAAK,UAAU,CAAC;CACzE;CAEA,MAAM,YAAY,MAAc,WAAiD;EAC/E,MAAM,YAAY,KAAK,IAAI;EAC3B,IAAI;GACF,MAAM,KAAK,KAAK,aAAa,MAAM;IAAE,MAAM;IAAiB,SAAS;GAAU,CAAC;GAChF,OAAO;EACT,SAAS,OAAO;GAWd,IAAI,MAHmB,KAAK,KAAK,GAAG,GAAG,KAAK,aAAa,YACvD,YAAY,WAAW,WAAW,KAAK,IAAI,CAAC,CAC9C,GACc,OAAO;GACrB,MAAM;EACR;CACF;AACF;;;;;;;AAQA,IAAa,gBAAb,cAAmC,mBAA8C;;;;;;;CAO/E,cAAsC;EACpC,OAAO,QAAQ,KAAK,GAAG;CACzB;;CAGA,MAAgB,WAAW,QAAqC,CAAC;;;;;;;;;;;;CAajE,QAAkB,SAA+C;EAC/D,OAAO,eAAe,KAAA,GAAW,YAAY;CAC/C;;;;;;CAOA,sBAA+C;EAC7C,OAAO,KAAK,IAAI,sBACZ,IAAI,qBAAqB,KAAK,IAAI,mBAAmB,IACrD,IAAI,iBAAiB;CAC3B;;;;;;;;CASA,UAAiD;EAC/C,OAAO,CAAC;CACV;;;;;CAMA,WAA2C,CAE3C;;;;;;CAOA,yBAAiE,CAEjE;;;;;CAMA,eAAyB,QAAmD,CAE5E;;CAGA,sBAA+C;EAC7C,OAAO,IAAI,sBAAsB,KAAK,QAAQ,CAAC;CACjD;;;;;CAMA,eAAyB,OAAqB,QAAwC;EACpF,OAAO;GACL;GACA,KAAK,KAAK;GACV,SAAS,KAAK,QAAQ,MAAM;GAC5B,UAAU,KAAK,oBAAoB;GACnC,SAAS,KAAK,oBAAoB;GAClC,UAAU,KAAK,SAAS;GACxB,WAAW,KAAK,uBAAuB;GACvC,UAAU,KAAK,eAAe,KAAK;EACrC;CACF;CAEA,MAAM,IAAI,OAAqC,MAA6C;EAC1F,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI;GACF,MAAM,EAAE,WAAW,MAAM;GACzB,OAAO,MAAM,eACX;IACE,YAAY,MAAM;IAClB,QAAQ,MAAM;IAEd,aAAa,MAAM,UAAU,QAAQ;IACrC,MAAM,IAAI,aAAa,MAAM,OAAO,QAAQ,MAAM,UAAU;GAC9D,GACA,KAAK,eAAe,OAAO,MAAM,OAAO,CAC1C;EACF,UAAU;GACR,MAAM,KAAK,WAAW,KAAK;EAC7B;CACF;AACF"}

package/dist/email-sender.cjs

@@ -17,16 +17,39 @@ var EmailSender = class {
 		const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(message.template, message.props);
 		const tracked = message.tracking === void 0 ? html : trackEmail(html, message.tracking, unsubscribeUrl);
 		await message.tracking?.commit?.();
+		const headers = unsubscribeHeaders(unsubscribeUrl, message.tracking?.unsubscribe);
 		await this.options.transport.send({
 			from,
 			to: message.recipient,
 			...replyTo === void 0 ? {} : { replyTo },
 			subject,
 			html: tracked,
+			...headers === void 0 ? {} : { headers },
 			idempotencyKey: message.idempotencyKey
 		});
 	}
 };
+/**
+* The list-unsubscribe headers of an email with an unsubscribe link (RFC 2369, RFC 8058), so a
+* mail client's own unsubscribe button works — Gmail and Yahoo require one-click for bulk mail:
+*
+* - With a one-click endpoint (`MessageTracking.unsubscribe`, which reporting provides): the
+*   header names it, and `List-Unsubscribe-Post` says a POST there unsubscribes at once.
+* - Without one: the header names the email's own unsubscribe link, with no one-click claim —
+*   whether that page takes a POST is the app's.
+* - An email without an unsubscribe link (a receipt) gets neither.
+*
+* Only an https URL is named: mail clients and Cloudflare Email refuse any other.
+*/
+function unsubscribeHeaders(unsubscribeUrl, oneClick) {
+	if (unsubscribeUrl === void 0) return void 0;
+	const https = (url) => url?.startsWith("https://") === true;
+	if (https(oneClick)) return {
+		"List-Unsubscribe": `<${oneClick}>`,
+		"List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
+	};
+	if (https(unsubscribeUrl)) return { "List-Unsubscribe": `<${unsubscribeUrl}>` };
+}
 const LINK = /(<a\b[^>]*?\shref\s*=\s*)(["'])(https?:\/\/[^"']+)\2/gi;
 /**
 * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through
@@ -58,5 +81,6 @@ function escapeAttribute(value) {
 //#endregion
 exports.EmailSender = EmailSender;
 exports.trackEmail = trackEmail;
+exports.unsubscribeHeaders = unsubscribeHeaders;
 
 //# sourceMappingURL=email-sender.cjs.map

package/dist/email-sender.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-sender.cjs","names":["isUnsubscribeLink"],"sources":["../src/email-sender.ts"],"sourcesContent":["import { type EmailAddress, type ResolvedEmail, isUnsubscribeLink } from './email';\nimport type { MessageSender, MessageTracking, OutboundMessage } from './engine/ports';\nimport type { ScalarIR } from './ir';\n\n/**\n * The email channel, split where the runtime stops mattering: `EmailSender` renders a copy,\n * applies its tracking and commits the tracked links — the same on every host — and hands the\n * finished email to an `EmailTransport`, the only part that knows a provider (SES, Cloudflare\n * Email, ...). Nothing here imports a platform module, so a Worker and a Lambda share it.\n */\n\n/** A rendered email: the template's resolved metadata (`resolveEmail`), its subject and its HTML. */\nexport interface RenderedEmail extends ResolvedEmail {\n  subject: string;\n  html: string;\n}\n\n/**\n * Template renderer, injected by the app — this package's core stays free of\n * any react-email dependency (`@shware/workflow/react-email` ships one over a\n * registry). The subject comes back final: it is sent exactly as written, from\n * the template's own sender, and the unsubscribe link is the one the HTML was\n * rendered with.\n */\nexport type EmailRenderer = (\n  template: string,\n  props: Record<string, ScalarIR | undefined>\n) => Promise<RenderedEmail>;\n\n/** A finished email, as a transport takes it: rendered, tracked, addressed. */\nexport interface EmailMessage {\n  from: EmailAddress;\n  to: string;\n  replyTo?: EmailAddress;\n  subject: string;\n  html: string;\n  /**\n   * `${instanceId}:${nodeId}`: the copy's identity, stable across retries and replays. A provider\n   * that de-duplicates on a key receives it; one that cannot (SES) still sends at least once —\n   * the window between the provider accepting the email and the step's checkpoint stays open.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * One email provider. Throwing hands the retry to the durable step; resolving means the provider\n * accepted the email (not that it was delivered).\n */\nexport interface EmailTransport {\n  send(message: EmailMessage): Promise<{ providerMessageId?: string }>;\n}\n\nexport interface EmailSenderOptions {\n  transport: EmailTransport;\n  render: EmailRenderer;\n}\n\n/**\n * The email channel over any transport: render → tracking applied to the HTML → the tracked\n * links committed → the transport. The links resolve before the email exists anywhere a\n * scanner could follow them.\n */\nexport class EmailSender implements MessageSender {\n  constructor(private readonly options: EmailSenderOptions) {}\n\n  async send(message: OutboundMessage): Promise<void> {\n    if (message.channel !== 'email') {\n      throw new Error(`EmailSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`EmailSender: no recipient for user '${message.userId}'`);\n    }\n    const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(\n      message.template,\n      message.props\n    );\n    const tracked =\n      message.tracking === undefined ? html : trackEmail(html, message.tracking, unsubscribeUrl);\n    await message.tracking?.commit?.();\n    await this.options.transport.send({\n      from,\n      to: message.recipient,\n      ...(replyTo === undefined ? {} : { replyTo }),\n      subject,\n      html: tracked,\n      idempotencyKey: message.idempotencyKey,\n    });\n  }\n}\n\nconst LINK = /(<a\\b[^>]*?\\shref\\s*=\\s*)([\"'])(https?:\\/\\/[^\"']+)\\2/gi;\n\n/**\n * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through\n * `link` (the original URL decoded from its attribute escaping, the tracking URL escaped back) —\n * as the unsubscribe link when it is the one the email was rendered with, so what a click on it\n * means is fixed when the email is sent — and the open pixel appended before `</body>`, or at the\n * end when there is none.\n */\nexport function trackEmail(\n  html: string,\n  tracking: MessageTracking,\n  unsubscribeUrl?: string\n): string {\n  const { link, pixel } = tracking;\n  let out = html;\n  if (link !== undefined) {\n    out = out.replace(LINK, (_, start: string, quote: string, attribute: string) => {\n      const url = unescapeAttribute(attribute);\n      const purpose = isUnsubscribeLink(url, unsubscribeUrl) ? 'unsubscribe' : 'link';\n      return `${start}${quote}${escapeAttribute(link(url, purpose))}${quote}`;\n    });\n  }\n  if (pixel !== undefined) {\n    const image = `<img src=\"${escapeAttribute(pixel)}\" width=\"1\" height=\"1\" alt=\"\" style=\"display:block;border:0;width:1px;height:1px\" />`;\n    out = /<\\/body>/i.test(out) ? out.replace(/<\\/body>/i, `${image}</body>`) : `${out}${image}`;\n  }\n  return out;\n}\n\nfunction unescapeAttribute(value: string): string {\n  return value.replaceAll('&amp;', '&').replaceAll('&quot;', '\"').replaceAll('&#x27;', \"'\");\n}\n\nfunction escapeAttribute(value: string): string {\n  return value.replaceAll('&', '&amp;').replaceAll('\"', '&quot;');\n}\n"],"mappings":";;;;;;;;AA8DA,IAAa,cAAb,MAAkD;CACnB;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,KAAK,SAAyC;EAClD,IAAI,QAAQ,YAAY,SACtB,MAAM,IAAI,MAAM,qCAAqC,QAAQ,QAAQ,EAAE;EAEzE,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,OAAO,EAAE;EAE1E,MAAM,EAAE,SAAS,MAAM,MAAM,SAAS,mBAAmB,MAAM,KAAK,QAAQ,OAC1E,QAAQ,UACR,QAAQ,KACV;EACA,MAAM,UACJ,QAAQ,aAAa,KAAA,IAAY,OAAO,WAAW,MAAM,QAAQ,UAAU,cAAc;EAC3F,MAAM,QAAQ,UAAU,SAAS;EACjC,MAAM,KAAK,QAAQ,UAAU,KAAK;GAChC;GACA,IAAI,QAAQ;GACZ,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,MAAM;GACN,gBAAgB,QAAQ;EAC1B,CAAC;CACH;AACF;AAEA,MAAM,OAAO;;;;;;;;AASb,SAAgB,WACd,MACA,UACA,gBACQ;CACR,MAAM,EAAE,MAAM,UAAU;CACxB,IAAI,MAAM;CACV,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,QAAQ,OAAO,GAAG,OAAe,OAAe,cAAsB;EAC9E,MAAM,MAAM,kBAAkB,SAAS;EACvC,MAAM,UAAUA,cAAAA,kBAAkB,KAAK,cAAc,IAAI,gBAAgB;EACzE,OAAO,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,KAAK,OAAO,CAAC,IAAI;CAClE,CAAC;CAEH,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,aAAa,gBAAgB,KAAK,EAAE;EAClD,MAAM,YAAY,KAAK,GAAG,IAAI,IAAI,QAAQ,aAAa,GAAG,MAAM,QAAQ,IAAI,GAAG,MAAM;CACvF;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;CAChD,OAAO,MAAM,WAAW,SAAS,GAAG,CAAC,CAAC,WAAW,UAAU,IAAG,CAAC,CAAC,WAAW,UAAU,GAAG;AAC1F;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,MAAK,QAAQ;AAChE"}
+{"version":3,"file":"email-sender.cjs","names":["isUnsubscribeLink"],"sources":["../src/email-sender.ts"],"sourcesContent":["import { type EmailAddress, type ResolvedEmail, isUnsubscribeLink } from './email';\nimport type { MessageSender, MessageTracking, OutboundMessage } from './engine/ports';\nimport type { ScalarIR } from './ir';\n\n/**\n * The email channel, split where the runtime stops mattering: `EmailSender` renders a copy,\n * applies its tracking and commits the tracked links — the same on every host — and hands the\n * finished email to an `EmailTransport`, the only part that knows a provider (SES, Cloudflare\n * Email, ...). Nothing here imports a platform module, so a Worker and a Lambda share it.\n */\n\n/** A rendered email: the template's resolved metadata (`resolveEmail`), its subject and its HTML. */\nexport interface RenderedEmail extends ResolvedEmail {\n  subject: string;\n  html: string;\n}\n\n/**\n * Template renderer, injected by the app — this package's core stays free of\n * any react-email dependency (`@shware/workflow/react-email` ships one over a\n * registry). The subject comes back final: it is sent exactly as written, from\n * the template's own sender, and the unsubscribe link is the one the HTML was\n * rendered with.\n */\nexport type EmailRenderer = (\n  template: string,\n  props: Record<string, ScalarIR | undefined>\n) => Promise<RenderedEmail>;\n\n/** A finished email, as a transport takes it: rendered, tracked, addressed. */\nexport interface EmailMessage {\n  from: EmailAddress;\n  to: string;\n  replyTo?: EmailAddress;\n  subject: string;\n  html: string;\n  /**\n   * Extra headers, already formatted: `List-Unsubscribe` and `List-Unsubscribe-Post` for an\n   * email that has an unsubscribe link (see `unsubscribeHeaders`).\n   */\n  headers?: Readonly<Record<string, string>>;\n  /**\n   * `${instanceId}:${nodeId}`: the copy's identity, stable across retries and replays. A provider\n   * that de-duplicates on a key receives it; one that cannot (SES) still sends at least once —\n   * the window between the provider accepting the email and the step's checkpoint stays open.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * One email provider. Throwing hands the retry to the durable step; resolving means the provider\n * accepted the email (not that it was delivered).\n */\nexport interface EmailTransport {\n  send(message: EmailMessage): Promise<{ providerMessageId?: string }>;\n}\n\nexport interface EmailSenderOptions {\n  transport: EmailTransport;\n  render: EmailRenderer;\n}\n\n/**\n * The email channel over any transport: render → tracking applied to the HTML → the tracked\n * links committed → the transport. The links resolve before the email exists anywhere a\n * scanner could follow them.\n */\nexport class EmailSender implements MessageSender {\n  constructor(private readonly options: EmailSenderOptions) {}\n\n  async send(message: OutboundMessage): Promise<void> {\n    if (message.channel !== 'email') {\n      throw new Error(`EmailSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`EmailSender: no recipient for user '${message.userId}'`);\n    }\n    const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(\n      message.template,\n      message.props\n    );\n    const tracked =\n      message.tracking === undefined ? html : trackEmail(html, message.tracking, unsubscribeUrl);\n    await message.tracking?.commit?.();\n    const headers = unsubscribeHeaders(unsubscribeUrl, message.tracking?.unsubscribe);\n    await this.options.transport.send({\n      from,\n      to: message.recipient,\n      ...(replyTo === undefined ? {} : { replyTo }),\n      subject,\n      html: tracked,\n      ...(headers === undefined ? {} : { headers }),\n      idempotencyKey: message.idempotencyKey,\n    });\n  }\n}\n\n/**\n * The list-unsubscribe headers of an email with an unsubscribe link (RFC 2369, RFC 8058), so a\n * mail client's own unsubscribe button works — Gmail and Yahoo require one-click for bulk mail:\n *\n * - With a one-click endpoint (`MessageTracking.unsubscribe`, which reporting provides): the\n *   header names it, and `List-Unsubscribe-Post` says a POST there unsubscribes at once.\n * - Without one: the header names the email's own unsubscribe link, with no one-click claim —\n *   whether that page takes a POST is the app's.\n * - An email without an unsubscribe link (a receipt) gets neither.\n *\n * Only an https URL is named: mail clients and Cloudflare Email refuse any other.\n */\nexport function unsubscribeHeaders(\n  unsubscribeUrl: string | undefined,\n  oneClick: string | undefined\n): Record<string, string> | undefined {\n  if (unsubscribeUrl === undefined) return undefined;\n  const https = (url: string | undefined) => url?.startsWith('https://') === true;\n  if (https(oneClick)) {\n    return {\n      'List-Unsubscribe': `<${oneClick}>`,\n      'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click',\n    };\n  }\n  if (https(unsubscribeUrl)) return { 'List-Unsubscribe': `<${unsubscribeUrl}>` };\n  return undefined;\n}\n\nconst LINK = /(<a\\b[^>]*?\\shref\\s*=\\s*)([\"'])(https?:\\/\\/[^\"']+)\\2/gi;\n\n/**\n * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through\n * `link` (the original URL decoded from its attribute escaping, the tracking URL escaped back) —\n * as the unsubscribe link when it is the one the email was rendered with, so what a click on it\n * means is fixed when the email is sent — and the open pixel appended before `</body>`, or at the\n * end when there is none.\n */\nexport function trackEmail(\n  html: string,\n  tracking: MessageTracking,\n  unsubscribeUrl?: string\n): string {\n  const { link, pixel } = tracking;\n  let out = html;\n  if (link !== undefined) {\n    out = out.replace(LINK, (_, start: string, quote: string, attribute: string) => {\n      const url = unescapeAttribute(attribute);\n      const purpose = isUnsubscribeLink(url, unsubscribeUrl) ? 'unsubscribe' : 'link';\n      return `${start}${quote}${escapeAttribute(link(url, purpose))}${quote}`;\n    });\n  }\n  if (pixel !== undefined) {\n    const image = `<img src=\"${escapeAttribute(pixel)}\" width=\"1\" height=\"1\" alt=\"\" style=\"display:block;border:0;width:1px;height:1px\" />`;\n    out = /<\\/body>/i.test(out) ? out.replace(/<\\/body>/i, `${image}</body>`) : `${out}${image}`;\n  }\n  return out;\n}\n\nfunction unescapeAttribute(value: string): string {\n  return value.replaceAll('&amp;', '&').replaceAll('&quot;', '\"').replaceAll('&#x27;', \"'\");\n}\n\nfunction escapeAttribute(value: string): string {\n  return value.replaceAll('&', '&amp;').replaceAll('\"', '&quot;');\n}\n"],"mappings":";;;;;;;;AAmEA,IAAa,cAAb,MAAkD;CACnB;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,KAAK,SAAyC;EAClD,IAAI,QAAQ,YAAY,SACtB,MAAM,IAAI,MAAM,qCAAqC,QAAQ,QAAQ,EAAE;EAEzE,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,OAAO,EAAE;EAE1E,MAAM,EAAE,SAAS,MAAM,MAAM,SAAS,mBAAmB,MAAM,KAAK,QAAQ,OAC1E,QAAQ,UACR,QAAQ,KACV;EACA,MAAM,UACJ,QAAQ,aAAa,KAAA,IAAY,OAAO,WAAW,MAAM,QAAQ,UAAU,cAAc;EAC3F,MAAM,QAAQ,UAAU,SAAS;EACjC,MAAM,UAAU,mBAAmB,gBAAgB,QAAQ,UAAU,WAAW;EAChF,MAAM,KAAK,QAAQ,UAAU,KAAK;GAChC;GACA,IAAI,QAAQ;GACZ,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,MAAM;GACN,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C,gBAAgB,QAAQ;EAC1B,CAAC;CACH;AACF;;;;;;;;;;;;;AAcA,SAAgB,mBACd,gBACA,UACoC;CACpC,IAAI,mBAAmB,KAAA,GAAW,OAAO,KAAA;CACzC,MAAM,SAAS,QAA4B,KAAK,WAAW,UAAU,MAAM;CAC3E,IAAI,MAAM,QAAQ,GAChB,OAAO;EACL,oBAAoB,IAAI,SAAS;EACjC,yBAAyB;CAC3B;CAEF,IAAI,MAAM,cAAc,GAAG,OAAO,EAAE,oBAAoB,IAAI,eAAe,GAAG;AAEhF;AAEA,MAAM,OAAO;;;;;;;;AASb,SAAgB,WACd,MACA,UACA,gBACQ;CACR,MAAM,EAAE,MAAM,UAAU;CACxB,IAAI,MAAM;CACV,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,QAAQ,OAAO,GAAG,OAAe,OAAe,cAAsB;EAC9E,MAAM,MAAM,kBAAkB,SAAS;EACvC,MAAM,UAAUA,cAAAA,kBAAkB,KAAK,cAAc,IAAI,gBAAgB;EACzE,OAAO,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,KAAK,OAAO,CAAC,IAAI;CAClE,CAAC;CAEH,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,aAAa,gBAAgB,KAAK,EAAE;EAClD,MAAM,YAAY,KAAK,GAAG,IAAI,IAAI,QAAQ,aAAa,GAAG,MAAM,QAAQ,IAAI,GAAG,MAAM;CACvF;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;CAChD,OAAO,MAAM,WAAW,SAAS,GAAG,CAAC,CAAC,WAAW,UAAU,IAAG,CAAC,CAAC,WAAW,UAAU,GAAG;AAC1F;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,MAAK,QAAQ;AAChE"}

package/dist/email-sender.d.cts

@@ -28,6 +28,11 @@ export interface EmailMessage {
   replyTo?: EmailAddress;
   subject: string;
   html: string;
+  /**
+   * Extra headers, already formatted: `List-Unsubscribe` and `List-Unsubscribe-Post` for an
+   * email that has an unsubscribe link (see `unsubscribeHeaders`).
+   */
+  headers?: Readonly<Record<string, string>>;
   /**
    * `${instanceId}:${nodeId}`: the copy's identity, stable across retries and replays. A provider
    * that de-duplicates on a key receives it; one that cannot (SES) still sends at least once —
@@ -58,6 +63,19 @@ export declare class EmailSender implements MessageSender {
   constructor(options: EmailSenderOptions);
   send(message: OutboundMessage): Promise<void>;
 }
+/**
+ * The list-unsubscribe headers of an email with an unsubscribe link (RFC 2369, RFC 8058), so a
+ * mail client's own unsubscribe button works — Gmail and Yahoo require one-click for bulk mail:
+ *
+ * - With a one-click endpoint (`MessageTracking.unsubscribe`, which reporting provides): the
+ *   header names it, and `List-Unsubscribe-Post` says a POST there unsubscribes at once.
+ * - Without one: the header names the email's own unsubscribe link, with no one-click claim —
+ *   whether that page takes a POST is the app's.
+ * - An email without an unsubscribe link (a receipt) gets neither.
+ *
+ * Only an https URL is named: mail clients and Cloudflare Email refuse any other.
+ */
+export declare function unsubscribeHeaders(unsubscribeUrl: string | undefined, oneClick: string | undefined): Record<string, string> | undefined;
 /**
  * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through
  * `link` (the original URL decoded from its attribute escaping, the tracking URL escaped back) —

package/dist/email-sender.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"email-sender.d.cts","names":[],"sources":["../src/email-sender.ts"],"mappings":";;;;;;;;;;;iBAYiB,sBAAsB;EACrC;EACA;;;;;;;;;YAUU,iBACV,kBACA,OAAO,eAAe,0BACnB,QAAQ;;iBAGI;EACf,MAAM;EACN;EACA,UAAU;EACV;EACA;;;;;;EAMA;;;;;;iBAOe;EACf,KAAK,SAAS,eAAe;IAAU;;;iBAGxB;EACf,WAAW;EACX,QAAQ;;;;;;;qBAQG,uBAAuB;mBACL;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB;;;;;;;;;wBAkCxB,WACd,cACA,UAAU,iBACV"}
+{"version":3,"file":"email-sender.d.cts","names":[],"sources":["../src/email-sender.ts"],"mappings":";;;;;;;;;;;iBAYiB,sBAAsB;EACrC;EACA;;;;;;;;;YAUU,iBACV,kBACA,OAAO,eAAe,0BACnB,QAAQ;;iBAGI;EACf,MAAM;EACN;EACA,UAAU;EACV;EACA;;;;;EAKA,UAAU,SAAS;;;;;;EAMnB;;;;;;iBAOe;EACf,KAAK,SAAS,eAAe;IAAU;;;iBAGxB;EACf,WAAW;EACX,QAAQ;;;;;;;qBAQG,uBAAuB;mBACL;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB;;;;;;;;;;;;;;wBAuCxB,mBACd,oCACA,+BACC;;;;;;;;wBAsBa,WACd,cACA,UAAU,iBACV"}

package/dist/email-sender.d.mts

@@ -28,6 +28,11 @@ export interface EmailMessage {
   replyTo?: EmailAddress;
   subject: string;
   html: string;
+  /**
+   * Extra headers, already formatted: `List-Unsubscribe` and `List-Unsubscribe-Post` for an
+   * email that has an unsubscribe link (see `unsubscribeHeaders`).
+   */
+  headers?: Readonly<Record<string, string>>;
   /**
    * `${instanceId}:${nodeId}`: the copy's identity, stable across retries and replays. A provider
    * that de-duplicates on a key receives it; one that cannot (SES) still sends at least once —
@@ -58,6 +63,19 @@ export declare class EmailSender implements MessageSender {
   constructor(options: EmailSenderOptions);
   send(message: OutboundMessage): Promise<void>;
 }
+/**
+ * The list-unsubscribe headers of an email with an unsubscribe link (RFC 2369, RFC 8058), so a
+ * mail client's own unsubscribe button works — Gmail and Yahoo require one-click for bulk mail:
+ *
+ * - With a one-click endpoint (`MessageTracking.unsubscribe`, which reporting provides): the
+ *   header names it, and `List-Unsubscribe-Post` says a POST there unsubscribes at once.
+ * - Without one: the header names the email's own unsubscribe link, with no one-click claim —
+ *   whether that page takes a POST is the app's.
+ * - An email without an unsubscribe link (a receipt) gets neither.
+ *
+ * Only an https URL is named: mail clients and Cloudflare Email refuse any other.
+ */
+export declare function unsubscribeHeaders(unsubscribeUrl: string | undefined, oneClick: string | undefined): Record<string, string> | undefined;
 /**
  * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through
  * `link` (the original URL decoded from its attribute escaping, the tracking URL escaped back) —

package/dist/email-sender.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email-sender.d.mts","names":[],"sources":["../src/email-sender.ts"],"mappings":";;;;;;;;;;;iBAYiB,sBAAsB;EACrC;EACA;;;;;;;;;YAUU,iBACV,kBACA,OAAO,eAAe,0BACnB,QAAQ;;iBAGI;EACf,MAAM;EACN;EACA,UAAU;EACV;EACA;;;;;;EAMA;;;;;;iBAOe;EACf,KAAK,SAAS,eAAe;IAAU;;;iBAGxB;EACf,WAAW;EACX,QAAQ;;;;;;;qBAQG,uBAAuB;mBACL;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB;;;;;;;;;wBAkCxB,WACd,cACA,UAAU,iBACV"}
+{"version":3,"file":"email-sender.d.mts","names":[],"sources":["../src/email-sender.ts"],"mappings":";;;;;;;;;;;iBAYiB,sBAAsB;EACrC;EACA;;;;;;;;;YAUU,iBACV,kBACA,OAAO,eAAe,0BACnB,QAAQ;;iBAGI;EACf,MAAM;EACN;EACA,UAAU;EACV;EACA;;;;;EAKA,UAAU,SAAS;;;;;;EAMnB;;;;;;iBAOe;EACf,KAAK,SAAS,eAAe;IAAU;;;iBAGxB;EACf,WAAW;EACX,QAAQ;;;;;;;qBAQG,uBAAuB;mBACL;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB;;;;;;;;;;;;;;wBAuCxB,mBACd,oCACA,+BACC;;;;;;;;wBAsBa,WACd,cACA,UAAU,iBACV"}

package/dist/email-sender.mjs

@@ -16,16 +16,39 @@ var EmailSender = class {
 		const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(message.template, message.props);
 		const tracked = message.tracking === void 0 ? html : trackEmail(html, message.tracking, unsubscribeUrl);
 		await message.tracking?.commit?.();
+		const headers = unsubscribeHeaders(unsubscribeUrl, message.tracking?.unsubscribe);
 		await this.options.transport.send({
 			from,
 			to: message.recipient,
 			...replyTo === void 0 ? {} : { replyTo },
 			subject,
 			html: tracked,
+			...headers === void 0 ? {} : { headers },
 			idempotencyKey: message.idempotencyKey
 		});
 	}
 };
+/**
+* The list-unsubscribe headers of an email with an unsubscribe link (RFC 2369, RFC 8058), so a
+* mail client's own unsubscribe button works — Gmail and Yahoo require one-click for bulk mail:
+*
+* - With a one-click endpoint (`MessageTracking.unsubscribe`, which reporting provides): the
+*   header names it, and `List-Unsubscribe-Post` says a POST there unsubscribes at once.
+* - Without one: the header names the email's own unsubscribe link, with no one-click claim —
+*   whether that page takes a POST is the app's.
+* - An email without an unsubscribe link (a receipt) gets neither.
+*
+* Only an https URL is named: mail clients and Cloudflare Email refuse any other.
+*/
+function unsubscribeHeaders(unsubscribeUrl, oneClick) {
+	if (unsubscribeUrl === void 0) return void 0;
+	const https = (url) => url?.startsWith("https://") === true;
+	if (https(oneClick)) return {
+		"List-Unsubscribe": `<${oneClick}>`,
+		"List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
+	};
+	if (https(unsubscribeUrl)) return { "List-Unsubscribe": `<${unsubscribeUrl}>` };
+}
 const LINK = /(<a\b[^>]*?\shref\s*=\s*)(["'])(https?:\/\/[^"']+)\2/gi;
 /**
 * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through
@@ -55,6 +78,6 @@ function escapeAttribute(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;");
 }
 //#endregion
-export { EmailSender, trackEmail };
+export { EmailSender, trackEmail, unsubscribeHeaders };
 
 //# sourceMappingURL=email-sender.mjs.map

package/dist/email-sender.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-sender.mjs","names":[],"sources":["../src/email-sender.ts"],"sourcesContent":["import { type EmailAddress, type ResolvedEmail, isUnsubscribeLink } from './email';\nimport type { MessageSender, MessageTracking, OutboundMessage } from './engine/ports';\nimport type { ScalarIR } from './ir';\n\n/**\n * The email channel, split where the runtime stops mattering: `EmailSender` renders a copy,\n * applies its tracking and commits the tracked links — the same on every host — and hands the\n * finished email to an `EmailTransport`, the only part that knows a provider (SES, Cloudflare\n * Email, ...). Nothing here imports a platform module, so a Worker and a Lambda share it.\n */\n\n/** A rendered email: the template's resolved metadata (`resolveEmail`), its subject and its HTML. */\nexport interface RenderedEmail extends ResolvedEmail {\n  subject: string;\n  html: string;\n}\n\n/**\n * Template renderer, injected by the app — this package's core stays free of\n * any react-email dependency (`@shware/workflow/react-email` ships one over a\n * registry). The subject comes back final: it is sent exactly as written, from\n * the template's own sender, and the unsubscribe link is the one the HTML was\n * rendered with.\n */\nexport type EmailRenderer = (\n  template: string,\n  props: Record<string, ScalarIR | undefined>\n) => Promise<RenderedEmail>;\n\n/** A finished email, as a transport takes it: rendered, tracked, addressed. */\nexport interface EmailMessage {\n  from: EmailAddress;\n  to: string;\n  replyTo?: EmailAddress;\n  subject: string;\n  html: string;\n  /**\n   * `${instanceId}:${nodeId}`: the copy's identity, stable across retries and replays. A provider\n   * that de-duplicates on a key receives it; one that cannot (SES) still sends at least once —\n   * the window between the provider accepting the email and the step's checkpoint stays open.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * One email provider. Throwing hands the retry to the durable step; resolving means the provider\n * accepted the email (not that it was delivered).\n */\nexport interface EmailTransport {\n  send(message: EmailMessage): Promise<{ providerMessageId?: string }>;\n}\n\nexport interface EmailSenderOptions {\n  transport: EmailTransport;\n  render: EmailRenderer;\n}\n\n/**\n * The email channel over any transport: render → tracking applied to the HTML → the tracked\n * links committed → the transport. The links resolve before the email exists anywhere a\n * scanner could follow them.\n */\nexport class EmailSender implements MessageSender {\n  constructor(private readonly options: EmailSenderOptions) {}\n\n  async send(message: OutboundMessage): Promise<void> {\n    if (message.channel !== 'email') {\n      throw new Error(`EmailSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`EmailSender: no recipient for user '${message.userId}'`);\n    }\n    const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(\n      message.template,\n      message.props\n    );\n    const tracked =\n      message.tracking === undefined ? html : trackEmail(html, message.tracking, unsubscribeUrl);\n    await message.tracking?.commit?.();\n    await this.options.transport.send({\n      from,\n      to: message.recipient,\n      ...(replyTo === undefined ? {} : { replyTo }),\n      subject,\n      html: tracked,\n      idempotencyKey: message.idempotencyKey,\n    });\n  }\n}\n\nconst LINK = /(<a\\b[^>]*?\\shref\\s*=\\s*)([\"'])(https?:\\/\\/[^\"']+)\\2/gi;\n\n/**\n * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through\n * `link` (the original URL decoded from its attribute escaping, the tracking URL escaped back) —\n * as the unsubscribe link when it is the one the email was rendered with, so what a click on it\n * means is fixed when the email is sent — and the open pixel appended before `</body>`, or at the\n * end when there is none.\n */\nexport function trackEmail(\n  html: string,\n  tracking: MessageTracking,\n  unsubscribeUrl?: string\n): string {\n  const { link, pixel } = tracking;\n  let out = html;\n  if (link !== undefined) {\n    out = out.replace(LINK, (_, start: string, quote: string, attribute: string) => {\n      const url = unescapeAttribute(attribute);\n      const purpose = isUnsubscribeLink(url, unsubscribeUrl) ? 'unsubscribe' : 'link';\n      return `${start}${quote}${escapeAttribute(link(url, purpose))}${quote}`;\n    });\n  }\n  if (pixel !== undefined) {\n    const image = `<img src=\"${escapeAttribute(pixel)}\" width=\"1\" height=\"1\" alt=\"\" style=\"display:block;border:0;width:1px;height:1px\" />`;\n    out = /<\\/body>/i.test(out) ? out.replace(/<\\/body>/i, `${image}</body>`) : `${out}${image}`;\n  }\n  return out;\n}\n\nfunction unescapeAttribute(value: string): string {\n  return value.replaceAll('&amp;', '&').replaceAll('&quot;', '\"').replaceAll('&#x27;', \"'\");\n}\n\nfunction escapeAttribute(value: string): string {\n  return value.replaceAll('&', '&amp;').replaceAll('\"', '&quot;');\n}\n"],"mappings":";;;;;;;AA8DA,IAAa,cAAb,MAAkD;CACnB;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,KAAK,SAAyC;EAClD,IAAI,QAAQ,YAAY,SACtB,MAAM,IAAI,MAAM,qCAAqC,QAAQ,QAAQ,EAAE;EAEzE,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,OAAO,EAAE;EAE1E,MAAM,EAAE,SAAS,MAAM,MAAM,SAAS,mBAAmB,MAAM,KAAK,QAAQ,OAC1E,QAAQ,UACR,QAAQ,KACV;EACA,MAAM,UACJ,QAAQ,aAAa,KAAA,IAAY,OAAO,WAAW,MAAM,QAAQ,UAAU,cAAc;EAC3F,MAAM,QAAQ,UAAU,SAAS;EACjC,MAAM,KAAK,QAAQ,UAAU,KAAK;GAChC;GACA,IAAI,QAAQ;GACZ,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,MAAM;GACN,gBAAgB,QAAQ;EAC1B,CAAC;CACH;AACF;AAEA,MAAM,OAAO;;;;;;;;AASb,SAAgB,WACd,MACA,UACA,gBACQ;CACR,MAAM,EAAE,MAAM,UAAU;CACxB,IAAI,MAAM;CACV,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,QAAQ,OAAO,GAAG,OAAe,OAAe,cAAsB;EAC9E,MAAM,MAAM,kBAAkB,SAAS;EACvC,MAAM,UAAU,kBAAkB,KAAK,cAAc,IAAI,gBAAgB;EACzE,OAAO,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,KAAK,OAAO,CAAC,IAAI;CAClE,CAAC;CAEH,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,aAAa,gBAAgB,KAAK,EAAE;EAClD,MAAM,YAAY,KAAK,GAAG,IAAI,IAAI,QAAQ,aAAa,GAAG,MAAM,QAAQ,IAAI,GAAG,MAAM;CACvF;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;CAChD,OAAO,MAAM,WAAW,SAAS,GAAG,CAAC,CAAC,WAAW,UAAU,IAAG,CAAC,CAAC,WAAW,UAAU,GAAG;AAC1F;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,MAAK,QAAQ;AAChE"}
+{"version":3,"file":"email-sender.mjs","names":[],"sources":["../src/email-sender.ts"],"sourcesContent":["import { type EmailAddress, type ResolvedEmail, isUnsubscribeLink } from './email';\nimport type { MessageSender, MessageTracking, OutboundMessage } from './engine/ports';\nimport type { ScalarIR } from './ir';\n\n/**\n * The email channel, split where the runtime stops mattering: `EmailSender` renders a copy,\n * applies its tracking and commits the tracked links — the same on every host — and hands the\n * finished email to an `EmailTransport`, the only part that knows a provider (SES, Cloudflare\n * Email, ...). Nothing here imports a platform module, so a Worker and a Lambda share it.\n */\n\n/** A rendered email: the template's resolved metadata (`resolveEmail`), its subject and its HTML. */\nexport interface RenderedEmail extends ResolvedEmail {\n  subject: string;\n  html: string;\n}\n\n/**\n * Template renderer, injected by the app — this package's core stays free of\n * any react-email dependency (`@shware/workflow/react-email` ships one over a\n * registry). The subject comes back final: it is sent exactly as written, from\n * the template's own sender, and the unsubscribe link is the one the HTML was\n * rendered with.\n */\nexport type EmailRenderer = (\n  template: string,\n  props: Record<string, ScalarIR | undefined>\n) => Promise<RenderedEmail>;\n\n/** A finished email, as a transport takes it: rendered, tracked, addressed. */\nexport interface EmailMessage {\n  from: EmailAddress;\n  to: string;\n  replyTo?: EmailAddress;\n  subject: string;\n  html: string;\n  /**\n   * Extra headers, already formatted: `List-Unsubscribe` and `List-Unsubscribe-Post` for an\n   * email that has an unsubscribe link (see `unsubscribeHeaders`).\n   */\n  headers?: Readonly<Record<string, string>>;\n  /**\n   * `${instanceId}:${nodeId}`: the copy's identity, stable across retries and replays. A provider\n   * that de-duplicates on a key receives it; one that cannot (SES) still sends at least once —\n   * the window between the provider accepting the email and the step's checkpoint stays open.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * One email provider. Throwing hands the retry to the durable step; resolving means the provider\n * accepted the email (not that it was delivered).\n */\nexport interface EmailTransport {\n  send(message: EmailMessage): Promise<{ providerMessageId?: string }>;\n}\n\nexport interface EmailSenderOptions {\n  transport: EmailTransport;\n  render: EmailRenderer;\n}\n\n/**\n * The email channel over any transport: render → tracking applied to the HTML → the tracked\n * links committed → the transport. The links resolve before the email exists anywhere a\n * scanner could follow them.\n */\nexport class EmailSender implements MessageSender {\n  constructor(private readonly options: EmailSenderOptions) {}\n\n  async send(message: OutboundMessage): Promise<void> {\n    if (message.channel !== 'email') {\n      throw new Error(`EmailSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`EmailSender: no recipient for user '${message.userId}'`);\n    }\n    const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(\n      message.template,\n      message.props\n    );\n    const tracked =\n      message.tracking === undefined ? html : trackEmail(html, message.tracking, unsubscribeUrl);\n    await message.tracking?.commit?.();\n    const headers = unsubscribeHeaders(unsubscribeUrl, message.tracking?.unsubscribe);\n    await this.options.transport.send({\n      from,\n      to: message.recipient,\n      ...(replyTo === undefined ? {} : { replyTo }),\n      subject,\n      html: tracked,\n      ...(headers === undefined ? {} : { headers }),\n      idempotencyKey: message.idempotencyKey,\n    });\n  }\n}\n\n/**\n * The list-unsubscribe headers of an email with an unsubscribe link (RFC 2369, RFC 8058), so a\n * mail client's own unsubscribe button works — Gmail and Yahoo require one-click for bulk mail:\n *\n * - With a one-click endpoint (`MessageTracking.unsubscribe`, which reporting provides): the\n *   header names it, and `List-Unsubscribe-Post` says a POST there unsubscribes at once.\n * - Without one: the header names the email's own unsubscribe link, with no one-click claim —\n *   whether that page takes a POST is the app's.\n * - An email without an unsubscribe link (a receipt) gets neither.\n *\n * Only an https URL is named: mail clients and Cloudflare Email refuse any other.\n */\nexport function unsubscribeHeaders(\n  unsubscribeUrl: string | undefined,\n  oneClick: string | undefined\n): Record<string, string> | undefined {\n  if (unsubscribeUrl === undefined) return undefined;\n  const https = (url: string | undefined) => url?.startsWith('https://') === true;\n  if (https(oneClick)) {\n    return {\n      'List-Unsubscribe': `<${oneClick}>`,\n      'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click',\n    };\n  }\n  if (https(unsubscribeUrl)) return { 'List-Unsubscribe': `<${unsubscribeUrl}>` };\n  return undefined;\n}\n\nconst LINK = /(<a\\b[^>]*?\\shref\\s*=\\s*)([\"'])(https?:\\/\\/[^\"']+)\\2/gi;\n\n/**\n * An email's tracking applied to its rendered HTML: every `http(s)` anchor routed through\n * `link` (the original URL decoded from its attribute escaping, the tracking URL escaped back) —\n * as the unsubscribe link when it is the one the email was rendered with, so what a click on it\n * means is fixed when the email is sent — and the open pixel appended before `</body>`, or at the\n * end when there is none.\n */\nexport function trackEmail(\n  html: string,\n  tracking: MessageTracking,\n  unsubscribeUrl?: string\n): string {\n  const { link, pixel } = tracking;\n  let out = html;\n  if (link !== undefined) {\n    out = out.replace(LINK, (_, start: string, quote: string, attribute: string) => {\n      const url = unescapeAttribute(attribute);\n      const purpose = isUnsubscribeLink(url, unsubscribeUrl) ? 'unsubscribe' : 'link';\n      return `${start}${quote}${escapeAttribute(link(url, purpose))}${quote}`;\n    });\n  }\n  if (pixel !== undefined) {\n    const image = `<img src=\"${escapeAttribute(pixel)}\" width=\"1\" height=\"1\" alt=\"\" style=\"display:block;border:0;width:1px;height:1px\" />`;\n    out = /<\\/body>/i.test(out) ? out.replace(/<\\/body>/i, `${image}</body>`) : `${out}${image}`;\n  }\n  return out;\n}\n\nfunction unescapeAttribute(value: string): string {\n  return value.replaceAll('&amp;', '&').replaceAll('&quot;', '\"').replaceAll('&#x27;', \"'\");\n}\n\nfunction escapeAttribute(value: string): string {\n  return value.replaceAll('&', '&amp;').replaceAll('\"', '&quot;');\n}\n"],"mappings":";;;;;;;AAmEA,IAAa,cAAb,MAAkD;CACnB;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,KAAK,SAAyC;EAClD,IAAI,QAAQ,YAAY,SACtB,MAAM,IAAI,MAAM,qCAAqC,QAAQ,QAAQ,EAAE;EAEzE,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,OAAO,EAAE;EAE1E,MAAM,EAAE,SAAS,MAAM,MAAM,SAAS,mBAAmB,MAAM,KAAK,QAAQ,OAC1E,QAAQ,UACR,QAAQ,KACV;EACA,MAAM,UACJ,QAAQ,aAAa,KAAA,IAAY,OAAO,WAAW,MAAM,QAAQ,UAAU,cAAc;EAC3F,MAAM,QAAQ,UAAU,SAAS;EACjC,MAAM,UAAU,mBAAmB,gBAAgB,QAAQ,UAAU,WAAW;EAChF,MAAM,KAAK,QAAQ,UAAU,KAAK;GAChC;GACA,IAAI,QAAQ;GACZ,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,MAAM;GACN,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C,gBAAgB,QAAQ;EAC1B,CAAC;CACH;AACF;;;;;;;;;;;;;AAcA,SAAgB,mBACd,gBACA,UACoC;CACpC,IAAI,mBAAmB,KAAA,GAAW,OAAO,KAAA;CACzC,MAAM,SAAS,QAA4B,KAAK,WAAW,UAAU,MAAM;CAC3E,IAAI,MAAM,QAAQ,GAChB,OAAO;EACL,oBAAoB,IAAI,SAAS;EACjC,yBAAyB;CAC3B;CAEF,IAAI,MAAM,cAAc,GAAG,OAAO,EAAE,oBAAoB,IAAI,eAAe,GAAG;AAEhF;AAEA,MAAM,OAAO;;;;;;;;AASb,SAAgB,WACd,MACA,UACA,gBACQ;CACR,MAAM,EAAE,MAAM,UAAU;CACxB,IAAI,MAAM;CACV,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,QAAQ,OAAO,GAAG,OAAe,OAAe,cAAsB;EAC9E,MAAM,MAAM,kBAAkB,SAAS;EACvC,MAAM,UAAU,kBAAkB,KAAK,cAAc,IAAI,gBAAgB;EACzE,OAAO,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,KAAK,OAAO,CAAC,IAAI;CAClE,CAAC;CAEH,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,aAAa,gBAAgB,KAAK,EAAE;EAClD,MAAM,YAAY,KAAK,GAAG,IAAI,IAAI,QAAQ,aAAa,GAAG,MAAM,QAAQ,IAAI,GAAG,MAAM;CACvF;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;CAChD,OAAO,MAAM,WAAW,SAAS,GAAG,CAAC,CAAC,WAAW,UAAU,IAAG,CAAC,CAAC,WAAW,UAAU,GAAG;AAC1F;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,MAAK,QAAQ;AAChE"}

package/dist/engine/duration.cjs

@@ -0,0 +1,34 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/engine/duration.ts
+/**
+* The longest an instance of a workflow can live, from its IR: every delay at its longest, every
+* wait to its timeout, a time window as a full week (the furthest the next allowed slot can be),
+* the longest arm of a branch or cohort — and at least the goal's window, which keeps an instance
+* watching after its last step. Message, action and event steps count as instant. A runtime that
+* caps an instance's lifetime (a Lambda durable execution's `ExecutionTimeout`) checks its
+* workflows against it, rather than finding out when the platform stops one midway.
+*/
+const WEEK_MS = 6048e5;
+function flowMs(nodes) {
+	let total = 0;
+	for (const node of nodes) total += nodeMs(node);
+	return total;
+}
+function nodeMs(node) {
+	switch (node.type) {
+		case "delay": return node.duration.ms;
+		case "random_delay": return Math.max(node.min.ms, node.max.ms);
+		case "time_window": return WEEK_MS;
+		case "wait_until": return node.timeout.ms + (Array.isArray(node.onTimeout) ? flowMs(node.onTimeout) : 0);
+		case "branch": return Math.max(flowMs(node.otherwise ?? []), ...node.cases.map((branch) => flowMs(branch.flow)));
+		case "cohort": return Math.max(0, ...node.arms.map((arm) => flowMs(arm.flow)));
+		default: return 0;
+	}
+}
+function longestJourneyMs(ir) {
+	return Math.max(flowMs(ir.flow), ir.goal?.within?.ms ?? 0);
+}
+//#endregion
+exports.longestJourneyMs = longestJourneyMs;
+
+//# sourceMappingURL=duration.cjs.map

package/dist/engine/duration.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.cjs","names":[],"sources":["../../src/engine/duration.ts"],"sourcesContent":["import type { NodeIR, WorkflowIR } from '../ir';\n\n/**\n * The longest an instance of a workflow can live, from its IR: every delay at its longest, every\n * wait to its timeout, a time window as a full week (the furthest the next allowed slot can be),\n * the longest arm of a branch or cohort — and at least the goal's window, which keeps an instance\n * watching after its last step. Message, action and event steps count as instant. A runtime that\n * caps an instance's lifetime (a Lambda durable execution's `ExecutionTimeout`) checks its\n * workflows against it, rather than finding out when the platform stops one midway.\n */\n\nconst WEEK_MS = 7 * 24 * 3_600_000;\n\nfunction flowMs(nodes: readonly NodeIR[]): number {\n  let total = 0;\n  for (const node of nodes) total += nodeMs(node);\n  return total;\n}\n\nfunction nodeMs(node: NodeIR): number {\n  switch (node.type) {\n    case 'delay':\n      return node.duration.ms;\n    case 'random_delay':\n      return Math.max(node.min.ms, node.max.ms);\n    case 'time_window':\n      return WEEK_MS;\n    case 'wait_until':\n      return node.timeout.ms + (Array.isArray(node.onTimeout) ? flowMs(node.onTimeout) : 0);\n    case 'branch':\n      return Math.max(\n        flowMs(node.otherwise ?? []),\n        ...node.cases.map((branch) => flowMs(branch.flow))\n      );\n    case 'cohort':\n      return Math.max(0, ...node.arms.map((arm) => flowMs(arm.flow)));\n    default:\n      return 0;\n  }\n}\n\nexport function longestJourneyMs(ir: Pick<WorkflowIR, 'flow' | 'goal'>): number {\n  return Math.max(flowMs(ir.flow), ir.goal?.within?.ms ?? 0);\n}\n"],"mappings":";;;;;;;;;;AAWA,MAAM,UAAU;AAEhB,SAAS,OAAO,OAAkC;CAChD,IAAI,QAAQ;CACZ,KAAK,MAAM,QAAQ,OAAO,SAAS,OAAO,IAAI;CAC9C,OAAO;AACT;AAEA,SAAS,OAAO,MAAsB;CACpC,QAAQ,KAAK,MAAb;EACE,KAAK,SACH,OAAO,KAAK,SAAS;EACvB,KAAK,gBACH,OAAO,KAAK,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE;EAC1C,KAAK,eACH,OAAO;EACT,KAAK,cACH,OAAO,KAAK,QAAQ,MAAM,MAAM,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI;EACrF,KAAK,UACH,OAAO,KAAK,IACV,OAAO,KAAK,aAAa,CAAC,CAAC,GAC3B,GAAG,KAAK,MAAM,KAAK,WAAW,OAAO,OAAO,IAAI,CAAC,CACnD;EACF,KAAK,UACH,OAAO,KAAK,IAAI,GAAG,GAAG,KAAK,KAAK,KAAK,QAAQ,OAAO,IAAI,IAAI,CAAC,CAAC;EAChE,SACE,OAAO;CACX;AACF;AAEA,SAAgB,iBAAiB,IAA+C;CAC9E,OAAO,KAAK,IAAI,OAAO,GAAG,IAAI,GAAG,GAAG,MAAM,QAAQ,MAAM,CAAC;AAC3D"}

package/dist/engine/duration.d.cts

@@ -0,0 +1,5 @@
+import { WorkflowIR } from "../ir.cjs";
+//#region src/engine/duration.d.ts
+export declare function longestJourneyMs(ir: Pick<WorkflowIR, 'flow' | 'goal'>): number;
+//#endregion
+//# sourceMappingURL=duration.d.cts.map

package/dist/engine/duration.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.cts","names":[],"sources":["../../src/engine/duration.ts"],"mappings":";;wBAyCgB,iBAAiB,IAAI,KAAK"}

package/dist/engine/duration.d.mts

@@ -0,0 +1,5 @@
+import { WorkflowIR } from "../ir.mjs";
+//#region src/engine/duration.d.ts
+export declare function longestJourneyMs(ir: Pick<WorkflowIR, 'flow' | 'goal'>): number;
+//#endregion
+//# sourceMappingURL=duration.d.mts.map

package/dist/engine/duration.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.mts","names":[],"sources":["../../src/engine/duration.ts"],"mappings":";;wBAyCgB,iBAAiB,IAAI,KAAK"}

package/dist/engine/duration.mjs

@@ -0,0 +1,33 @@
+//#region src/engine/duration.ts
+/**
+* The longest an instance of a workflow can live, from its IR: every delay at its longest, every
+* wait to its timeout, a time window as a full week (the furthest the next allowed slot can be),
+* the longest arm of a branch or cohort — and at least the goal's window, which keeps an instance
+* watching after its last step. Message, action and event steps count as instant. A runtime that
+* caps an instance's lifetime (a Lambda durable execution's `ExecutionTimeout`) checks its
+* workflows against it, rather than finding out when the platform stops one midway.
+*/
+const WEEK_MS = 6048e5;
+function flowMs(nodes) {
+	let total = 0;
+	for (const node of nodes) total += nodeMs(node);
+	return total;
+}
+function nodeMs(node) {
+	switch (node.type) {
+		case "delay": return node.duration.ms;
+		case "random_delay": return Math.max(node.min.ms, node.max.ms);
+		case "time_window": return WEEK_MS;
+		case "wait_until": return node.timeout.ms + (Array.isArray(node.onTimeout) ? flowMs(node.onTimeout) : 0);
+		case "branch": return Math.max(flowMs(node.otherwise ?? []), ...node.cases.map((branch) => flowMs(branch.flow)));
+		case "cohort": return Math.max(0, ...node.arms.map((arm) => flowMs(arm.flow)));
+		default: return 0;
+	}
+}
+function longestJourneyMs(ir) {
+	return Math.max(flowMs(ir.flow), ir.goal?.within?.ms ?? 0);
+}
+//#endregion
+export { longestJourneyMs };
+
+//# sourceMappingURL=duration.mjs.map

package/dist/engine/duration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.mjs","names":[],"sources":["../../src/engine/duration.ts"],"sourcesContent":["import type { NodeIR, WorkflowIR } from '../ir';\n\n/**\n * The longest an instance of a workflow can live, from its IR: every delay at its longest, every\n * wait to its timeout, a time window as a full week (the furthest the next allowed slot can be),\n * the longest arm of a branch or cohort — and at least the goal's window, which keeps an instance\n * watching after its last step. Message, action and event steps count as instant. A runtime that\n * caps an instance's lifetime (a Lambda durable execution's `ExecutionTimeout`) checks its\n * workflows against it, rather than finding out when the platform stops one midway.\n */\n\nconst WEEK_MS = 7 * 24 * 3_600_000;\n\nfunction flowMs(nodes: readonly NodeIR[]): number {\n  let total = 0;\n  for (const node of nodes) total += nodeMs(node);\n  return total;\n}\n\nfunction nodeMs(node: NodeIR): number {\n  switch (node.type) {\n    case 'delay':\n      return node.duration.ms;\n    case 'random_delay':\n      return Math.max(node.min.ms, node.max.ms);\n    case 'time_window':\n      return WEEK_MS;\n    case 'wait_until':\n      return node.timeout.ms + (Array.isArray(node.onTimeout) ? flowMs(node.onTimeout) : 0);\n    case 'branch':\n      return Math.max(\n        flowMs(node.otherwise ?? []),\n        ...node.cases.map((branch) => flowMs(branch.flow))\n      );\n    case 'cohort':\n      return Math.max(0, ...node.arms.map((arm) => flowMs(arm.flow)));\n    default:\n      return 0;\n  }\n}\n\nexport function longestJourneyMs(ir: Pick<WorkflowIR, 'flow' | 'goal'>): number {\n  return Math.max(flowMs(ir.flow), ir.goal?.within?.ms ?? 0);\n}\n"],"mappings":";;;;;;;;;AAWA,MAAM,UAAU;AAEhB,SAAS,OAAO,OAAkC;CAChD,IAAI,QAAQ;CACZ,KAAK,MAAM,QAAQ,OAAO,SAAS,OAAO,IAAI;CAC9C,OAAO;AACT;AAEA,SAAS,OAAO,MAAsB;CACpC,QAAQ,KAAK,MAAb;EACE,KAAK,SACH,OAAO,KAAK,SAAS;EACvB,KAAK,gBACH,OAAO,KAAK,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE;EAC1C,KAAK,eACH,OAAO;EACT,KAAK,cACH,OAAO,KAAK,QAAQ,MAAM,MAAM,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI;EACrF,KAAK,UACH,OAAO,KAAK,IACV,OAAO,KAAK,aAAa,CAAC,CAAC,GAC3B,GAAG,KAAK,MAAM,KAAK,WAAW,OAAO,OAAO,IAAI,CAAC,CACnD;EACF,KAAK,UACH,OAAO,KAAK,IAAI,GAAG,GAAG,KAAK,KAAK,KAAK,QAAQ,OAAO,IAAI,IAAI,CAAC,CAAC;EAChE,SACE,OAAO;CACX;AACF;AAEA,SAAgB,iBAAiB,IAA+C;CAC9E,OAAO,KAAK,IAAI,OAAO,GAAG,IAAI,GAAG,GAAG,MAAM,QAAQ,MAAM,CAAC;AAC3D"}

package/dist/engine/index.cjs

@@ -1,4 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_engine_retry = require("./retry.cjs");
+const require_engine_duration = require("./duration.cjs");
 const require_engine_bucket = require("./bucket.cjs");
 const require_engine_condition = require("./condition.cjs");
 const require_engine_time_window = require("./time-window.cjs");
@@ -10,6 +12,9 @@ exports.PROFILE_UPDATED_EVENT = require_engine_condition.PROFILE_UPDATED_EVENT;
 exports.RegistryActionInvoker = require_engine_actions.RegistryActionInvoker;
 exports.evaluateCondition = require_engine_condition.evaluateCondition;
 exports.hashToBucket = require_engine_bucket.hashToBucket;
+exports.isRetryable = require_engine_retry.isRetryable;
+exports.isRetryableStatus = require_engine_retry.isRetryableStatus;
+exports.longestJourneyMs = require_engine_duration.longestJourneyMs;
 exports.matchesWhere = require_engine_condition.matchesWhere;
 exports.murmur3 = require_engine_bucket.murmur3;
 exports.nextWindowStart = require_engine_time_window.nextWindowStart;

package/dist/engine/index.d.cts

@@ -5,4 +5,6 @@ import { DEVICES_UPDATED_EVENT, EvaluateOptions, PROFILE_UPDATED_EVENT, evaluate
 import { runJourney } from "./interpreter.cjs";
 import { scaleDurations, scaleSegmentWindows } from "./time-scale.cjs";
 import { nextWindowStart, resolveTimeZone } from "./time-window.cjs";
-export { type ActionInvocation, type ActionInvoker, type ActionVersionPolicy, DEVICES_UPDATED_EVENT, type EngineStep, type EvaluateOptions, type EventSink, type FactSource, type JourneyContext, type JourneyObserver, type JourneyOutcome, type LinkPurpose, type MessageSender, type MessageTracking, type OutboundMessage, PROFILE_UPDATED_EVENT, type PushDevice, type RegisteredAction, RegistryActionInvoker, type SendResult, evaluateCondition, hashToBucket, matchesWhere, murmur3, nextWindowStart, relevantEvents, resolveTimeZone, runJourney, scaleDurations, scaleSegmentWindows };
+import { longestJourneyMs } from "./duration.cjs";
+import { isRetryable, isRetryableStatus } from "./retry.cjs";
+export { type ActionInvocation, type ActionInvoker, type ActionVersionPolicy, DEVICES_UPDATED_EVENT, type EngineStep, type EvaluateOptions, type EventSink, type FactSource, type JourneyContext, type JourneyObserver, type JourneyOutcome, type LinkPurpose, type MessageSender, type MessageTracking, type OutboundMessage, PROFILE_UPDATED_EVENT, type PushDevice, type RegisteredAction, RegistryActionInvoker, type SendResult, evaluateCondition, hashToBucket, isRetryable, isRetryableStatus, longestJourneyMs, matchesWhere, murmur3, nextWindowStart, relevantEvents, resolveTimeZone, runJourney, scaleDurations, scaleSegmentWindows };

package/dist/engine/index.d.mts

@@ -5,4 +5,6 @@ import { DEVICES_UPDATED_EVENT, EvaluateOptions, PROFILE_UPDATED_EVENT, evaluate
 import { runJourney } from "./interpreter.mjs";
 import { scaleDurations, scaleSegmentWindows } from "./time-scale.mjs";
 import { nextWindowStart, resolveTimeZone } from "./time-window.mjs";
-export { type ActionInvocation, type ActionInvoker, type ActionVersionPolicy, DEVICES_UPDATED_EVENT, type EngineStep, type EvaluateOptions, type EventSink, type FactSource, type JourneyContext, type JourneyObserver, type JourneyOutcome, type LinkPurpose, type MessageSender, type MessageTracking, type OutboundMessage, PROFILE_UPDATED_EVENT, type PushDevice, type RegisteredAction, RegistryActionInvoker, type SendResult, evaluateCondition, hashToBucket, matchesWhere, murmur3, nextWindowStart, relevantEvents, resolveTimeZone, runJourney, scaleDurations, scaleSegmentWindows };
+import { longestJourneyMs } from "./duration.mjs";
+import { isRetryable, isRetryableStatus } from "./retry.mjs";
+export { type ActionInvocation, type ActionInvoker, type ActionVersionPolicy, DEVICES_UPDATED_EVENT, type EngineStep, type EvaluateOptions, type EventSink, type FactSource, type JourneyContext, type JourneyObserver, type JourneyOutcome, type LinkPurpose, type MessageSender, type MessageTracking, type OutboundMessage, PROFILE_UPDATED_EVENT, type PushDevice, type RegisteredAction, RegistryActionInvoker, type SendResult, evaluateCondition, hashToBucket, isRetryable, isRetryableStatus, longestJourneyMs, matchesWhere, murmur3, nextWindowStart, relevantEvents, resolveTimeZone, runJourney, scaleDurations, scaleSegmentWindows };

package/dist/engine/index.mjs

@@ -1,7 +1,9 @@
+import { isRetryable, isRetryableStatus } from "./retry.mjs";
+import { longestJourneyMs } from "./duration.mjs";
 import { hashToBucket, murmur3 } from "./bucket.mjs";
 import { DEVICES_UPDATED_EVENT, PROFILE_UPDATED_EVENT, evaluateCondition, matchesWhere, relevantEvents } from "./condition.mjs";
 import { nextWindowStart, resolveTimeZone } from "./time-window.mjs";
 import { runJourney } from "./interpreter.mjs";
 import { scaleDurations, scaleSegmentWindows } from "./time-scale.mjs";
 import { RegistryActionInvoker } from "./actions.mjs";
-export { DEVICES_UPDATED_EVENT, PROFILE_UPDATED_EVENT, RegistryActionInvoker, evaluateCondition, hashToBucket, matchesWhere, murmur3, nextWindowStart, relevantEvents, resolveTimeZone, runJourney, scaleDurations, scaleSegmentWindows };
+export { DEVICES_UPDATED_EVENT, PROFILE_UPDATED_EVENT, RegistryActionInvoker, evaluateCondition, hashToBucket, isRetryable, isRetryableStatus, longestJourneyMs, matchesWhere, murmur3, nextWindowStart, relevantEvents, resolveTimeZone, runJourney, scaleDurations, scaleSegmentWindows };