@shware/workflow 3.1.0 → 3.3.0

package/dist/engine/ports.d.cts

@@ -113,6 +113,12 @@ export interface MessageTracking {
   link?: (url: string, purpose: LinkPurpose) => string;
   /** Loaded when the email is opened. */
   pixel?: string;
+  /**
+   * This copy's one-click unsubscribe endpoint (RFC 8058): a POST there, with no confirmation
+   * and no session, unsubscribes the recipient. The email sender puts it in the
+   * `List-Unsubscribe` header, so a mail client's own unsubscribe button works.
+   */
+  unsubscribe?: string;
   /** Extra string keys in the push payload. */
   data?: Record<string, string>;
   /**

package/dist/engine/ports.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;EAGnD,MAAM,cAAc,aAAa;;EAGjC,WAAW,cAAc,sBAAsB;;;;;;;;;;;;;;;EAgB/C,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;EAM3B,YAAY,cAAc,oBAAoB;;;iBAI/B;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;EAEvB,cAAc,SAAS,YAAY;;iBAGpB;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;;;;;EAMT;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;EAGnD,MAAM,cAAc,aAAa;;EAGjC,WAAW,cAAc,sBAAsB;;;;;;;;;;;;;;;EAgB/C,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;EAM3B,YAAY,cAAc,oBAAoB;;;iBAI/B;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;EAEvB,cAAc,SAAS,YAAY;;iBAGpB;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;;;;;EAMT;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/engine/ports.d.mts

@@ -113,6 +113,12 @@ export interface MessageTracking {
   link?: (url: string, purpose: LinkPurpose) => string;
   /** Loaded when the email is opened. */
   pixel?: string;
+  /**
+   * This copy's one-click unsubscribe endpoint (RFC 8058): a POST there, with no confirmation
+   * and no session, unsubscribes the recipient. The email sender puts it in the
+   * `List-Unsubscribe` header, so a mail client's own unsubscribe button works.
+   */
+  unsubscribe?: string;
   /** Extra string keys in the push payload. */
   data?: Record<string, string>;
   /**

package/dist/engine/ports.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;EAGnD,MAAM,cAAc,aAAa;;EAGjC,WAAW,cAAc,sBAAsB;;;;;;;;;;;;;;;EAgB/C,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;EAM3B,YAAY,cAAc,oBAAoB;;;iBAI/B;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;EAEvB,cAAc,SAAS,YAAY;;iBAGpB;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;;;;;EAMT;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;EAGnD,MAAM,cAAc,aAAa;;EAGjC,WAAW,cAAc,sBAAsB;;;;;;;;;;;;;;;EAgB/C,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;EAM3B,YAAY,cAAc,oBAAoB;;;iBAI/B;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;EAEvB,cAAc,SAAS,YAAY;;iBAGpB;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;;;;;EAMT;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/engine/retry.cjs

@@ -0,0 +1,29 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/engine/retry.ts
+/**
+* Which step failures a retry would only repeat. A durable step retries what it throws; an
+* error that is the same on every attempt — a template refusing its props, the contract
+* refusing an emitted event, a provider rejecting the request itself — ends the step at once
+* instead of burning the retry budget and delaying the journey. Every runtime adapter asks this
+* one rule.
+*/
+/** Errors the engine raises that are deterministic by construction. */
+const DETERMINISTIC = /* @__PURE__ */ new Set(["TemplateValidationError", "ContractValidationError"]);
+/**
+* False for an error a retry cannot fix: one of the engine's deterministic refusals, or any
+* error that says so with `retryable: false` (the transports' 4xx answers).
+*/
+function isRetryable(error) {
+	if (!(error instanceof Error)) return true;
+	if (DETERMINISTIC.has(error.name)) return false;
+	return error.retryable !== false;
+}
+/** An HTTP answer a retry can change: a timeout, throttling, or the provider's own fault. */
+function isRetryableStatus(status) {
+	return status === 408 || status === 429 || status >= 500;
+}
+//#endregion
+exports.isRetryable = isRetryable;
+exports.isRetryableStatus = isRetryableStatus;
+
+//# sourceMappingURL=retry.cjs.map

package/dist/engine/retry.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.cjs","names":[],"sources":["../../src/engine/retry.ts"],"sourcesContent":["/**\n * Which step failures a retry would only repeat. A durable step retries what it throws; an\n * error that is the same on every attempt — a template refusing its props, the contract\n * refusing an emitted event, a provider rejecting the request itself — ends the step at once\n * instead of burning the retry budget and delaying the journey. Every runtime adapter asks this\n * one rule.\n */\n\n/** Errors the engine raises that are deterministic by construction. */\nconst DETERMINISTIC = new Set(['TemplateValidationError', 'ContractValidationError']);\n\n/**\n * False for an error a retry cannot fix: one of the engine's deterministic refusals, or any\n * error that says so with `retryable: false` (the transports' 4xx answers).\n */\nexport function isRetryable(error: unknown): boolean {\n  if (!(error instanceof Error)) return true;\n  if (DETERMINISTIC.has(error.name)) return false;\n  return (error as { retryable?: unknown }).retryable !== false;\n}\n\n/** An HTTP answer a retry can change: a timeout, throttling, or the provider's own fault. */\nexport function isRetryableStatus(status: number): boolean {\n  return status === 408 || status === 429 || status >= 500;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,gCAAgB,IAAI,IAAI,CAAC,2BAA2B,yBAAyB,CAAC;;;;;AAMpF,SAAgB,YAAY,OAAyB;CACnD,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI,cAAc,IAAI,MAAM,IAAI,GAAG,OAAO;CAC1C,OAAQ,MAAkC,cAAc;AAC1D;;AAGA,SAAgB,kBAAkB,QAAyB;CACzD,OAAO,WAAW,OAAO,WAAW,OAAO,UAAU;AACvD"}

package/dist/engine/retry.d.cts

@@ -0,0 +1,17 @@
+//#region src/engine/retry.d.ts
+/**
+ * Which step failures a retry would only repeat. A durable step retries what it throws; an
+ * error that is the same on every attempt — a template refusing its props, the contract
+ * refusing an emitted event, a provider rejecting the request itself — ends the step at once
+ * instead of burning the retry budget and delaying the journey. Every runtime adapter asks this
+ * one rule.
+ */
+/**
+ * False for an error a retry cannot fix: one of the engine's deterministic refusals, or any
+ * error that says so with `retryable: false` (the transports' 4xx answers).
+ */
+export declare function isRetryable(error: unknown): boolean;
+/** An HTTP answer a retry can change: a timeout, throttling, or the provider's own fault. */
+export declare function isRetryableStatus(status: number): boolean;
+//#endregion
+//# sourceMappingURL=retry.d.cts.map

package/dist/engine/retry.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.cts","names":[],"sources":["../../src/engine/retry.ts"],"mappings":";;;;;;;;;;;;wBAegB,YAAY;;wBAOZ,kBAAkB"}

package/dist/engine/retry.d.mts

@@ -0,0 +1,17 @@
+//#region src/engine/retry.d.ts
+/**
+ * Which step failures a retry would only repeat. A durable step retries what it throws; an
+ * error that is the same on every attempt — a template refusing its props, the contract
+ * refusing an emitted event, a provider rejecting the request itself — ends the step at once
+ * instead of burning the retry budget and delaying the journey. Every runtime adapter asks this
+ * one rule.
+ */
+/**
+ * False for an error a retry cannot fix: one of the engine's deterministic refusals, or any
+ * error that says so with `retryable: false` (the transports' 4xx answers).
+ */
+export declare function isRetryable(error: unknown): boolean;
+/** An HTTP answer a retry can change: a timeout, throttling, or the provider's own fault. */
+export declare function isRetryableStatus(status: number): boolean;
+//#endregion
+//# sourceMappingURL=retry.d.mts.map

package/dist/engine/retry.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.mts","names":[],"sources":["../../src/engine/retry.ts"],"mappings":";;;;;;;;;;;;wBAegB,YAAY;;wBAOZ,kBAAkB"}

package/dist/engine/retry.mjs

@@ -0,0 +1,27 @@
+//#region src/engine/retry.ts
+/**
+* Which step failures a retry would only repeat. A durable step retries what it throws; an
+* error that is the same on every attempt — a template refusing its props, the contract
+* refusing an emitted event, a provider rejecting the request itself — ends the step at once
+* instead of burning the retry budget and delaying the journey. Every runtime adapter asks this
+* one rule.
+*/
+/** Errors the engine raises that are deterministic by construction. */
+const DETERMINISTIC = /* @__PURE__ */ new Set(["TemplateValidationError", "ContractValidationError"]);
+/**
+* False for an error a retry cannot fix: one of the engine's deterministic refusals, or any
+* error that says so with `retryable: false` (the transports' 4xx answers).
+*/
+function isRetryable(error) {
+	if (!(error instanceof Error)) return true;
+	if (DETERMINISTIC.has(error.name)) return false;
+	return error.retryable !== false;
+}
+/** An HTTP answer a retry can change: a timeout, throttling, or the provider's own fault. */
+function isRetryableStatus(status) {
+	return status === 408 || status === 429 || status >= 500;
+}
+//#endregion
+export { isRetryable, isRetryableStatus };
+
+//# sourceMappingURL=retry.mjs.map

package/dist/engine/retry.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.mjs","names":[],"sources":["../../src/engine/retry.ts"],"sourcesContent":["/**\n * Which step failures a retry would only repeat. A durable step retries what it throws; an\n * error that is the same on every attempt — a template refusing its props, the contract\n * refusing an emitted event, a provider rejecting the request itself — ends the step at once\n * instead of burning the retry budget and delaying the journey. Every runtime adapter asks this\n * one rule.\n */\n\n/** Errors the engine raises that are deterministic by construction. */\nconst DETERMINISTIC = new Set(['TemplateValidationError', 'ContractValidationError']);\n\n/**\n * False for an error a retry cannot fix: one of the engine's deterministic refusals, or any\n * error that says so with `retryable: false` (the transports' 4xx answers).\n */\nexport function isRetryable(error: unknown): boolean {\n  if (!(error instanceof Error)) return true;\n  if (DETERMINISTIC.has(error.name)) return false;\n  return (error as { retryable?: unknown }).retryable !== false;\n}\n\n/** An HTTP answer a retry can change: a timeout, throttling, or the provider's own fault. */\nexport function isRetryableStatus(status: number): boolean {\n  return status === 408 || status === 429 || status >= 500;\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,gCAAgB,IAAI,IAAI,CAAC,2BAA2B,yBAAyB,CAAC;;;;;AAMpF,SAAgB,YAAY,OAAyB;CACnD,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI,cAAc,IAAI,MAAM,IAAI,GAAG,OAAO;CAC1C,OAAQ,MAAkC,cAAc;AAC1D;;AAGA,SAAgB,kBAAkB,QAAyB;CACzD,OAAO,WAAW,OAAO,WAAW,OAAO,UAAU;AACvD"}

package/dist/host/journey-host.cjs

@@ -26,10 +26,25 @@ var EnvValidationError = class extends Error {
 		this.issues = issues;
 	}
 };
+function sendsEmail(nodes) {
+	return nodes.some((node) => {
+		switch (node.type) {
+			case "message": return node.channel === "email";
+			case "wait_until": return Array.isArray(node.onTimeout) && sendsEmail(node.onTimeout);
+			case "branch": return node.cases.some((branch) => sendsEmail(branch.flow)) || sendsEmail(node.otherwise ?? []);
+			case "cohort": return node.arms.some((arm) => sendsEmail(arm.flow));
+			default: return false;
+		}
+	});
+}
 function createJourneyHost(options, platform = {}) {
 	const { config } = options;
 	const emailIds = require_templates.indexTemplates("email", config.templates?.email);
 	require_email.assertEmailConfig(config, emailIds.values());
+	if (options.email === void 0 && options.messages === void 0) {
+		const emailing = require_config.compileConfig(config).workflows.filter((workflow) => sendsEmail(workflow.flow));
+		if (emailing.length > 0) throw new TypeError(`workflows ${emailing.map((w) => `'${w.id}'`).join(", ")} send email, but the host has no \`email\` transport: pass \`email: (env) => cloudflareEmailTransport(...)\` or \`sesEmailTransport(...)\``);
+	}
 	const checked = /* @__PURE__ */ new WeakMap();
 	const checkEnv = (env) => {
 		if (options.env === void 0) return env;

package/dist/host/journey-host.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"journey-host.cjs","names":["indexTemplates","z","compileConfig","d1Store","runtimeFromConfig","scaleSegmentWindows","channelsFromConfig","reportingObserver","RegistryActionInvoker","registryValidator","registryRenderer","handleTracking","checkEvent","ContractValidationError","ingestEvent","sweepSegments","deployBundle","SchemaMismatchError","TemplateValidationError","handleRequest"],"sources":["../../src/host/journey-host.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { JourneyEnv, JourneyParams } from '../cloudflare/bindings';\nimport { d1Store } from '../cloudflare/d1-env';\nimport { type JourneyConfig, compileConfig } from '../config';\nimport { ContractValidationError, checkEvent } from '../contract';\nimport { assertEmailConfig } from '../email';\nimport type { EmailTransport } from '../email-sender';\nimport { RegistryActionInvoker } from '../engine/actions';\nimport type { JourneyObserver, MessageSender } from '../engine/ports';\nimport { scaleSegmentWindows } from '../engine/time-scale';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { registryRenderer } from '../react-email';\nimport { reportingObserver } from '../reporting/observer';\nimport { handleTracking } from '../reporting/tracking';\nimport type { JourneyRuntimeOptions } from '../runtime';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  SchemaMismatchError,\n  type StoreLease,\n} from '../store/index';\nimport { DEFAULT_SCHEMA } from '../store/tables';\nimport { TemplateValidationError, indexTemplates, registryValidator } from '../templates';\nimport { channelsFromConfig, runtimeFromConfig } from './channels';\nimport type { JourneyRunParts } from './execute';\nimport {\n  type SweepResult,\n  deployBundle,\n  handleRequest,\n  ingestEvent,\n  sweepSegments,\n} from './router';\n\n/**\n * What a journey host is, apart from the runtime it runs on: the validated environment, the\n * store lease, the outlets a run is wired to, the HTTP API (tracking, sweep, bundle, preview,\n * ingest) and the bundle that goes live with the code. `journeyWorker` (Cloudflare) and\n * `journeyLambda` (AWS) are this plus how their platform starts, wakes and stops instances.\n */\n\nexport interface JourneyHostOptions<Env extends JourneyEnv> {\n  /**\n   * The project's `workflow.config.ts` (`defineConfig`): what the host\n   * deploys (`GET /bundle`, `POST /bundle/deploy` serve `compileConfig`), the\n   * template registries the senders, the validator and `/preview` render from,\n   * the contract every `/events` and `/identify` is checked against, the email\n   * defaults, actions, and the runtime / APNs / FCM settings. Secrets come\n   * from the env under the names `JourneyEnv` documents.\n   */\n  config: JourneyConfig;\n  /**\n   * The data plane, opened per request and per workflow run. Return a\n   * `StoreLease` when the client must be released afterwards (a Postgres\n   * connection); defaults to D1 + KV from the env's bindings. `database` is\n   * the config's (`schema` defaulting to `workflow`), for a Postgres store:\n   *\n   *   store: (env, database) => postgresJsStore(env.DATABASE_URL, database)\n   */\n  store?: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /**\n   * Where journey emails go: a transport built from the validated env —\n   * `sesEmailTransport(...)`, `cloudflareEmailTransport(...)`, or your own. Which one is\n   * independent of where the workflow runs. Without it the email channel fails its sends,\n   * saying so.\n   */\n  email?: (env: Env) => EmailTransport;\n  /**\n   * Reporting hooks: node arrivals, every copy sent (with the tracking it should carry — click\n   * links and an open pixel for email, payload data for a push), and how each instance ended.\n   * By default a store that keeps reporting (Postgres) records them itself, and the host\n   * serves the email tracking routes (`/t/...`, on `WORKFLOW_ORIGIN`); override to report\n   * elsewhere.\n   */\n  observer?: (env: Env, store: JourneyStore) => JourneyObserver;\n  /**\n   * Message outlet override (tests, a custom gateway): replaces every channel, `email`\n   * included. By default the channels the config describes.\n   */\n  messages?: (env: Env, store: JourneyStore) => MessageSender;\n  /** Per-instance runtime options override (a tester in fast-forward); by default `config.runtime` for `ENVIRONMENT`. */\n  runtime?: (env: Env, params: JourneyParams) => JourneyRuntimeOptions;\n  /**\n   * The host's environment, as a zod schema over its vars and secrets (bindings pass through\n   * untouched): checked the first time the host runs, so a missing or malformed variable fails\n   * there — every problem listed — not at the send that needs it. Webhook templates read their\n   * URL from the parsed values: `webhook: (env: Env) => env.WEBHOOK_DISCORD_ALERTS`.\n   */\n  env?: core.$ZodType<object>;\n  /** 'enforce' (default) answers an event or patch the contract refuses with a 400; 'report' only logs it. */\n  contractMode?: 'enforce' | 'report';\n}\n\n/** The host's environment failed its schema (`env` option). */\nexport class EnvValidationError extends Error {\n  override readonly name = 'EnvValidationError';\n  constructor(readonly issues: readonly string[]) {\n    super(`the host's environment is invalid:\\n  ${issues.join('\\n  ')}`);\n  }\n}\n\nexport interface JourneyHost<Env extends JourneyEnv> {\n  config: JourneyConfig;\n  /** The env, parsed by the schema once per env object (throws EnvValidationError). */\n  checkEnv(env: Env): Env;\n  /** A store for one request or run, its segment windows scaled with the runtime. */\n  lease(env: Env): Required<StoreLease>;\n  /** The bundle compiled into this code. */\n  bundle(): BundleIR;\n  /** The outlets one run is wired to (the store is the run's). */\n  runParts(env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts;\n  /** The HTTP API over one store: tracking, sweep, bundle, preview, then the ingest router. */\n  handle(request: Request, env: Env, store: JourneyStore): Promise<Response>;\n  /** The scheduled sweep (`sweepSegments`) on a store of its own. */\n  sweep(env: Env): Promise<SweepResult>;\n  /**\n   * Make the bundle compiled into `version` live, once per process, only over an older live\n   * version (the store records it). Undefined when there is nothing to do; a failure is logged\n   * and retried a minute later.\n   */\n  applyOwnBundle(env: Env, version: BundleVersion | undefined): Promise<void> | undefined;\n}\n\n/** What the platform adapter itself contributes. */\nexport interface JourneyPlatform {\n  /** An HTTP/2 fetch for APNs, where the runtime's own fetch is HTTP/1.1 (Node). */\n  apnsFetch?: typeof fetch;\n}\n\nexport function createJourneyHost<Env extends JourneyEnv>(\n  options: JourneyHostOptions<Env>,\n  platform: JourneyPlatform = {}\n): JourneyHost<Env> {\n  const { config } = options;\n  const emailIds = indexTemplates('email', config.templates?.email);\n  // A config still on `emails` (its sender would be silently dropped) fails here, not at a send\n  assertEmailConfig(config, emailIds.values());\n  // Parsed once per env object: the runtime hands the same one to every request of an isolate\n  const checked = new WeakMap<object, Env>();\n  const checkEnv = (env: Env): Env => {\n    if (options.env === undefined) return env;\n    const cached = checked.get(env);\n    if (cached !== undefined) return cached;\n    const result = z.safeParse(options.env, env);\n    if (!result.success) {\n      // Names and reasons only: the values are secrets\n      throw new EnvValidationError(\n        result.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)\n      );\n    }\n    const merged: Env = { ...env, ...result.data };\n    checked.set(env, merged);\n    return merged;\n  };\n  let compiled: BundleIR | undefined;\n  const bundle = () => (compiled ??= compileConfig(config));\n  const emails = config.templates?.email;\n  const database = { schema: config.database?.schema ?? DEFAULT_SCHEMA };\n  // In fast-forward, segment windows scale with the journeys reading them (time-scale.ts)\n  const lease = (env: Env): Required<StoreLease> => {\n    const opened = options.store === undefined ? d1Store(env) : options.store(env, database);\n    const noop = async () => {};\n    const factor = runtimeFromConfig(config, env).timeScale;\n    return 'store' in opened\n      ? { store: scaleSegmentWindows(opened.store, factor), close: opened.close ?? noop }\n      : { store: scaleSegmentWindows(opened, factor), close: noop };\n  };\n\n  const messages = (env: Env, store: JourneyStore): MessageSender => {\n    if (options.messages !== undefined) return options.messages(env, store);\n    return channelsFromConfig(config, env, {\n      store,\n      email: options.email?.(env),\n      apnsFetch: platform.apnsFetch,\n    });\n  };\n\n  const observer = (env: Env, store: JourneyStore): JourneyObserver | undefined => {\n    if (options.observer !== undefined) return options.observer(env, store);\n    return store.reporting === undefined\n      ? undefined\n      : reportingObserver(store.reporting, env.WORKFLOW_ORIGIN);\n  };\n\n  const runParts = (env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts => ({\n    store,\n    env,\n    runtime:\n      options.runtime === undefined ? runtimeFromConfig(config, env) : options.runtime(env, params),\n    messages: messages(env, store),\n    // An action ref is a registered action structurally: the same object carries name, code and hash\n    actions: new RegistryActionInvoker(config.actions ?? []),\n    contract: config.contract,\n    validator: registryValidator(config.templates ?? {}),\n    observer: observer(env, store),\n  });\n\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n\n  const authorized = (request: Request, env: Env): boolean =>\n    env.API_TOKEN === undefined ||\n    request.headers.get('authorization') === `Bearer ${env.API_TOKEN}`;\n\n  const preview = emails === undefined ? undefined : registryRenderer(emails, config.email);\n\n  const handle = async (request: Request, env: Env, store: JourneyStore): Promise<Response> => {\n    const url = new URL(request.url);\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    if (url.pathname.startsWith('/t/') && store.reporting !== undefined) {\n      const openedEvent = config.webPush?.openedEvent;\n      const tracked = await handleTracking(request, store.reporting, {\n        legacyUnsubscribeUrl: config.email?.unsubscribeUrl,\n        product: config.title,\n        quickMs: config.email?.tracking?.quickClickMs,\n        pushOpened:\n          openedEvent === undefined\n            ? undefined\n            : async ({ messageId, userId, at }) => {\n                const payload: Record<string, unknown> = { message_id: messageId };\n                const contract = config.contract;\n                const verdict =\n                  contract === undefined ? undefined : checkEvent(contract, openedEvent, payload);\n                if (verdict !== undefined && !verdict.ok) {\n                  throw new ContractValidationError(openedEvent, verdict.issues);\n                }\n                // Keyed by the copy: a second tap of the same notification is the same event\n                await ingestEvent(\n                  env,\n                  {\n                    id: `${openedEvent}:${messageId}`,\n                    userId,\n                    event: openedEvent,\n                    payload: verdict?.data ?? payload,\n                    ts: at,\n                  },\n                  store\n                );\n              },\n      });\n      if (tracked !== undefined) return tracked;\n    }\n    if (url.pathname === '/segments/sweep') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      return json(await sweepSegments(env, store));\n    }\n    if (url.pathname === '/bundle') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      return json(bundle());\n    }\n    if (url.pathname === '/bundle/deploy') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      try {\n        return json(await deployBundle(env, bundle(), store));\n      } catch (error) {\n        if (!(error instanceof SchemaMismatchError)) throw error;\n        return json({ error: error.message, problems: error.problems }, 503);\n      }\n    }\n    if (emails !== undefined && preview !== undefined && url.pathname.startsWith('/preview/')) {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      const key = url.pathname.slice('/preview/'.length);\n      if (!emailIds.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown = {};\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (typeof props !== 'object' || props === null || Array.isArray(props)) {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      try {\n        const { subject, html } = await preview(key, props as Record<string, ScalarIR>);\n        return new Response(html, {\n          headers: { 'content-type': 'text/html; charset=utf-8', 'x-subject': subject },\n        });\n      } catch (error) {\n        // The query string is the props: a refusal is the caller's to fix, with the field paths\n        if (error instanceof TemplateValidationError) {\n          return json({ error: error.message, issues: error.issues }, 400);\n        }\n        throw error;\n      }\n    }\n    return handleRequest(request, env, store, {\n      contract: config.contract,\n      mode: options.contractMode,\n    });\n  };\n\n  const sweep = async (env: Env) => {\n    const { store, close } = lease(env);\n    try {\n      return await sweepSegments(env, store);\n    } finally {\n      await close();\n    }\n  };\n\n  // The bundle compiled into this version goes live on its own, once per process: the first\n  // request or scheduled run reads which version's bundle is live (one row) and applies this one\n  // only over an older version, so one still serving during a rollout can never put its routes\n  // back. A failure (say the migrations have not run) is logged and retried a minute later. Only\n  // the request that starts the check gets its promise back: a request context cannot wait on\n  // another's I/O.\n  let applying: Promise<void> | undefined;\n  let retryAt = 0;\n  const applyOwnBundle = (env: Env, version: BundleVersion | undefined) => {\n    if (version === undefined || version.id === '' || Number.isNaN(version.createdAt)) {\n      return undefined;\n    }\n    if (applying !== undefined || Date.now() < retryAt) return undefined;\n    applying = (async () => {\n      const { store, close } = lease(env);\n      try {\n        if (store.liveBundleVersion === undefined) return; // D1: POST /bundle/deploy\n        const live = await store.liveBundleVersion();\n        if (live !== undefined && (live.id === version.id || live.createdAt >= version.createdAt))\n          return;\n        const result = await deployBundle(env, bundle(), store, version);\n        if (result.applied) console.log(`[workflow] version ${version.id} is live`);\n      } finally {\n        await close();\n      }\n    })().catch((error: unknown) => {\n      applying = undefined;\n      retryAt = Date.now() + 60_000;\n      console.error(`[workflow] could not make version ${version.id} live`, error);\n    });\n    return applying;\n  };\n\n  return { config, checkEnv, lease, bundle, runParts, handle, sweep, applyOwnBundle };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA8FA,IAAa,qBAAb,cAAwC,MAAM;CAEvB;CADrB,OAAyB;CACzB,YAAY,QAAoC;EAC9C,MAAM,yCAAyC,OAAO,KAAK,MAAM,GAAG;EADjD,KAAA,SAAA;CAErB;AACF;AA8BA,SAAgB,kBACd,SACA,WAA4B,CAAC,GACX;CAClB,MAAM,EAAE,WAAW;CACnB,MAAM,WAAWA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;CAEhE,cAAA,kBAAkB,QAAQ,SAAS,OAAO,CAAC;CAE3C,MAAM,0BAAU,IAAI,QAAqB;CACzC,MAAM,YAAY,QAAkB;EAClC,IAAI,QAAQ,QAAQ,KAAA,GAAW,OAAO;EACtC,MAAM,SAAS,QAAQ,IAAI,GAAG;EAC9B,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,SAASC,SAAE,UAAU,QAAQ,KAAK,GAAG;EAC3C,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,mBACR,OAAO,MAAM,OAAO,KAAK,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,SAAS,IAAI,MAAM,SAAS,CAC5F;EAEF,MAAM,SAAc;GAAE,GAAG;GAAK,GAAG,OAAO;EAAK;EAC7C,QAAQ,IAAI,KAAK,MAAM;EACvB,OAAO;CACT;CACA,IAAI;CACJ,MAAM,eAAgB,aAAaC,eAAAA,cAAc,MAAM;CACvD,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,WAAW,EAAE,QAAQ,OAAO,UAAU,UAAA,WAAyB;CAErE,MAAM,SAAS,QAAmC;EAChD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAYC,0BAAAA,QAAQ,GAAG,IAAI,QAAQ,MAAM,KAAK,QAAQ;EACvF,MAAM,OAAO,YAAY,CAAC;EAC1B,MAAM,SAASC,sBAAAA,kBAAkB,QAAQ,GAAG,CAAC,CAAC;EAC9C,OAAO,WAAW,SACd;GAAE,OAAOC,0BAAAA,oBAAoB,OAAO,OAAO,MAAM;GAAG,OAAO,OAAO,SAAS;EAAK,IAChF;GAAE,OAAOA,0BAAAA,oBAAoB,QAAQ,MAAM;GAAG,OAAO;EAAK;CAChE;CAEA,MAAM,YAAY,KAAU,UAAuC;EACjE,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAOC,sBAAAA,mBAAmB,QAAQ,KAAK;GACrC;GACA,OAAO,QAAQ,QAAQ,GAAG;GAC1B,WAAW,SAAS;EACtB,CAAC;CACH;CAEA,MAAM,YAAY,KAAU,UAAqD;EAC/E,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAO,MAAM,cAAc,KAAA,IACvB,KAAA,IACAC,2BAAAA,kBAAkB,MAAM,WAAW,IAAI,eAAe;CAC5D;CAEA,MAAM,YAAY,KAAU,OAAqB,YAA4C;EAC3F;EACA;EACA,SACE,QAAQ,YAAY,KAAA,IAAYH,sBAAAA,kBAAkB,QAAQ,GAAG,IAAI,QAAQ,QAAQ,KAAK,MAAM;EAC9F,UAAU,SAAS,KAAK,KAAK;EAE7B,SAAS,IAAII,uBAAAA,sBAAsB,OAAO,WAAW,CAAC,CAAC;EACvD,UAAU,OAAO;EACjB,WAAWC,kBAAAA,kBAAkB,OAAO,aAAa,CAAC,CAAC;EACnD,UAAU,SAAS,KAAK,KAAK;CAC/B;CAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CAEH,MAAM,cAAc,SAAkB,QACpC,IAAI,cAAc,KAAA,KAClB,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI;CAEzD,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAYC,oBAAAA,iBAAiB,QAAQ,OAAO,KAAK;CAExF,MAAM,SAAS,OAAO,SAAkB,KAAU,UAA2C;EAC3F,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAE/B,IAAI,IAAI,SAAS,WAAW,KAAK,KAAK,MAAM,cAAc,KAAA,GAAW;GACnE,MAAM,cAAc,OAAO,SAAS;GACpC,MAAM,UAAU,MAAMC,2BAAAA,eAAe,SAAS,MAAM,WAAW;IAC7D,sBAAsB,OAAO,OAAO;IACpC,SAAS,OAAO;IAChB,SAAS,OAAO,OAAO,UAAU;IACjC,YACE,gBAAgB,KAAA,IACZ,KAAA,IACA,OAAO,EAAE,WAAW,QAAQ,SAAS;KACnC,MAAM,UAAmC,EAAE,YAAY,UAAU;KACjE,MAAM,WAAW,OAAO;KACxB,MAAM,UACJ,aAAa,KAAA,IAAY,KAAA,IAAYC,iBAAAA,WAAW,UAAU,aAAa,OAAO;KAChF,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,IACpC,MAAM,IAAIC,iBAAAA,wBAAwB,aAAa,QAAQ,MAAM;KAG/D,MAAMC,oBAAAA,YACJ,KACA;MACE,IAAI,GAAG,YAAY,GAAG;MACtB;MACA,OAAO;MACP,SAAS,SAAS,QAAQ;MAC1B,IAAI;KACN,GACA,KACF;IACF;GACR,CAAC;GACD,IAAI,YAAY,KAAA,GAAW,OAAO;EACpC;EACA,IAAI,IAAI,aAAa,mBAAmB;GACtC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,OAAO,KAAK,MAAMC,oBAAAA,cAAc,KAAK,KAAK,CAAC;EAC7C;EACA,IAAI,IAAI,aAAa,WAAW;GAC9B,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,OAAO,KAAK,OAAO,CAAC;EACtB;EACA,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,IAAI;IACF,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,GAAG,KAAK,CAAC;GACtD,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiBC,oBAAAA,sBAAsB,MAAM;IACnD,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,UAAU,MAAM;IAAS,GAAG,GAAG;GACrE;EACF;EACA,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,KAAa,IAAI,SAAS,WAAW,WAAW,GAAG;GACzF,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEpF,IAAI,QAAiB,CAAC;GACtB,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAE3D,IAAI;IACF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,KAAK,KAAiC;IAC9E,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;KAAE,gBAAgB;KAA4B,aAAa;IAAQ,EAC9E,CAAC;GACH,SAAS,OAAO;IAEd,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,QAAQ,MAAM;IAAO,GAAG,GAAG;IAEjE,MAAM;GACR;EACF;EACA,OAAOC,oBAAAA,cAAc,SAAS,KAAK,OAAO;GACxC,UAAU,OAAO;GACjB,MAAM,QAAQ;EAChB,CAAC;CACH;CAEA,MAAM,QAAQ,OAAO,QAAa;EAChC,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GACF,OAAO,MAAMJ,oBAAAA,cAAc,KAAK,KAAK;EACvC,UAAU;GACR,MAAM,MAAM;EACd;CACF;CAQA,IAAI;CACJ,IAAI,UAAU;CACd,MAAM,kBAAkB,KAAU,YAAuC;EACvE,IAAI,YAAY,KAAA,KAAa,QAAQ,OAAO,MAAM,OAAO,MAAM,QAAQ,SAAS,GAC9E;EAEF,IAAI,aAAa,KAAA,KAAa,KAAK,IAAI,IAAI,SAAS,OAAO,KAAA;EAC3D,YAAY,YAAY;GACtB,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;GAClC,IAAI;IACF,IAAI,MAAM,sBAAsB,KAAA,GAAW;IAC3C,MAAM,OAAO,MAAM,MAAM,kBAAkB;IAC3C,IAAI,SAAS,KAAA,MAAc,KAAK,OAAO,QAAQ,MAAM,KAAK,aAAa,QAAQ,YAC7E;IAEF,KAAI,MADiBC,oBAAAA,aAAa,KAAK,OAAO,GAAG,OAAO,OAAO,EAAA,CACpD,SAAS,QAAQ,IAAI,sBAAsB,QAAQ,GAAG,SAAS;GAC5E,UAAU;IACR,MAAM,MAAM;GACd;EACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;GAC7B,WAAW,KAAA;GACX,UAAU,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,qCAAqC,QAAQ,GAAG,QAAQ,KAAK;EAC7E,CAAC;EACD,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAO;EAAQ;EAAU;EAAQ;EAAO;CAAe;AACpF"}
+{"version":3,"file":"journey-host.cjs","names":["indexTemplates","compileConfig","z","d1Store","runtimeFromConfig","scaleSegmentWindows","channelsFromConfig","reportingObserver","RegistryActionInvoker","registryValidator","registryRenderer","handleTracking","checkEvent","ContractValidationError","ingestEvent","sweepSegments","deployBundle","SchemaMismatchError","TemplateValidationError","handleRequest"],"sources":["../../src/host/journey-host.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { JourneyEnv, JourneyParams } from '../cloudflare/bindings';\nimport { d1Store } from '../cloudflare/d1-env';\nimport { type JourneyConfig, compileConfig } from '../config';\nimport { ContractValidationError, checkEvent } from '../contract';\nimport { assertEmailConfig } from '../email';\nimport type { EmailTransport } from '../email-sender';\nimport { RegistryActionInvoker } from '../engine/actions';\nimport type { JourneyObserver, MessageSender } from '../engine/ports';\nimport { scaleSegmentWindows } from '../engine/time-scale';\nimport type { BundleIR, NodeIR, ScalarIR } from '../ir';\nimport { registryRenderer } from '../react-email';\nimport { reportingObserver } from '../reporting/observer';\nimport { handleTracking } from '../reporting/tracking';\nimport type { JourneyRuntimeOptions } from '../runtime';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  SchemaMismatchError,\n  type StoreLease,\n} from '../store/index';\nimport { DEFAULT_SCHEMA } from '../store/tables';\nimport { TemplateValidationError, indexTemplates, registryValidator } from '../templates';\nimport { channelsFromConfig, runtimeFromConfig } from './channels';\nimport type { JourneyRunParts } from './execute';\nimport {\n  type SweepResult,\n  deployBundle,\n  handleRequest,\n  ingestEvent,\n  sweepSegments,\n} from './router';\n\n/**\n * What a journey host is, apart from the runtime it runs on: the validated environment, the\n * store lease, the outlets a run is wired to, the HTTP API (tracking, sweep, bundle, preview,\n * ingest) and the bundle that goes live with the code. `journeyWorker` (Cloudflare) and\n * `journeyLambda` (AWS) are this plus how their platform starts, wakes and stops instances.\n */\n\nexport interface JourneyHostOptions<Env extends JourneyEnv> {\n  /**\n   * The project's `workflow.config.ts` (`defineConfig`): what the host\n   * deploys (`GET /bundle`, `POST /bundle/deploy` serve `compileConfig`), the\n   * template registries the senders, the validator and `/preview` render from,\n   * the contract every `/events` and `/identify` is checked against, the email\n   * defaults, actions, and the runtime / APNs / FCM settings. Secrets come\n   * from the env under the names `JourneyEnv` documents.\n   */\n  config: JourneyConfig;\n  /**\n   * The data plane, opened per request and per workflow run. Return a\n   * `StoreLease` when the client must be released afterwards (a Postgres\n   * connection); defaults to D1 + KV from the env's bindings. `database` is\n   * the config's (`schema` defaulting to `workflow`), for a Postgres store:\n   *\n   *   store: (env, database) => postgresJsStore(env.DATABASE_URL, database)\n   */\n  store?: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /**\n   * Where journey emails go: a transport built from the validated env —\n   * `sesEmailTransport(...)`, `cloudflareEmailTransport(...)`, or your own. Which one is\n   * independent of where the workflow runs. Without it the email channel fails its sends,\n   * saying so.\n   */\n  email?: (env: Env) => EmailTransport;\n  /**\n   * Reporting hooks: node arrivals, every copy sent (with the tracking it should carry — click\n   * links and an open pixel for email, payload data for a push), and how each instance ended.\n   * By default a store that keeps reporting (Postgres) records them itself, and the host\n   * serves the email tracking routes (`/t/...`, on `WORKFLOW_ORIGIN`); override to report\n   * elsewhere.\n   */\n  observer?: (env: Env, store: JourneyStore) => JourneyObserver;\n  /**\n   * Message outlet override (tests, a custom gateway): replaces every channel, `email`\n   * included. By default the channels the config describes.\n   */\n  messages?: (env: Env, store: JourneyStore) => MessageSender;\n  /** Per-instance runtime options override (a tester in fast-forward); by default `config.runtime` for `ENVIRONMENT`. */\n  runtime?: (env: Env, params: JourneyParams) => JourneyRuntimeOptions;\n  /**\n   * The host's environment, as a zod schema over its vars and secrets (bindings pass through\n   * untouched): checked the first time the host runs, so a missing or malformed variable fails\n   * there — every problem listed — not at the send that needs it. Webhook templates read their\n   * URL from the parsed values: `webhook: (env: Env) => env.WEBHOOK_DISCORD_ALERTS`.\n   */\n  env?: core.$ZodType<object>;\n  /** 'enforce' (default) answers an event or patch the contract refuses with a 400; 'report' only logs it. */\n  contractMode?: 'enforce' | 'report';\n}\n\n/** The host's environment failed its schema (`env` option). */\nexport class EnvValidationError extends Error {\n  override readonly name = 'EnvValidationError';\n  constructor(readonly issues: readonly string[]) {\n    super(`the host's environment is invalid:\\n  ${issues.join('\\n  ')}`);\n  }\n}\n\nexport interface JourneyHost<Env extends JourneyEnv> {\n  config: JourneyConfig;\n  /** The env, parsed by the schema once per env object (throws EnvValidationError). */\n  checkEnv(env: Env): Env;\n  /** A store for one request or run, its segment windows scaled with the runtime. */\n  lease(env: Env): Required<StoreLease>;\n  /** The bundle compiled into this code. */\n  bundle(): BundleIR;\n  /** The outlets one run is wired to (the store is the run's). */\n  runParts(env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts;\n  /** The HTTP API over one store: tracking, sweep, bundle, preview, then the ingest router. */\n  handle(request: Request, env: Env, store: JourneyStore): Promise<Response>;\n  /** The scheduled sweep (`sweepSegments`) on a store of its own. */\n  sweep(env: Env): Promise<SweepResult>;\n  /**\n   * Make the bundle compiled into `version` live, once per process, only over an older live\n   * version (the store records it). Undefined when there is nothing to do; a failure is logged\n   * and retried a minute later.\n   */\n  applyOwnBundle(env: Env, version: BundleVersion | undefined): Promise<void> | undefined;\n}\n\n/** What the platform adapter itself contributes. */\nexport interface JourneyPlatform {\n  /** An HTTP/2 fetch for APNs, where the runtime's own fetch is HTTP/1.1 (Node). */\n  apnsFetch?: typeof fetch;\n}\n\nfunction sendsEmail(nodes: readonly NodeIR[]): boolean {\n  return nodes.some((node) => {\n    switch (node.type) {\n      case 'message':\n        return node.channel === 'email';\n      case 'wait_until':\n        return Array.isArray(node.onTimeout) && sendsEmail(node.onTimeout);\n      case 'branch':\n        return (\n          node.cases.some((branch) => sendsEmail(branch.flow)) || sendsEmail(node.otherwise ?? [])\n        );\n      case 'cohort':\n        return node.arms.some((arm) => sendsEmail(arm.flow));\n      default:\n        return false;\n    }\n  });\n}\n\nexport function createJourneyHost<Env extends JourneyEnv>(\n  options: JourneyHostOptions<Env>,\n  platform: JourneyPlatform = {}\n): JourneyHost<Env> {\n  const { config } = options;\n  const emailIds = indexTemplates('email', config.templates?.email);\n  // A config still on `emails` (its sender would be silently dropped) fails here, not at a send\n  assertEmailConfig(config, emailIds.values());\n  // A journey that emails with nowhere to send fails here too, not at its first email\n  if (options.email === undefined && options.messages === undefined) {\n    const emailing = compileConfig(config).workflows.filter((workflow) =>\n      sendsEmail(workflow.flow)\n    );\n    if (emailing.length > 0) {\n      throw new TypeError(\n        `workflows ${emailing.map((w) => `'${w.id}'`).join(', ')} send email, but the host has no ` +\n          '`email` transport: pass `email: (env) => cloudflareEmailTransport(...)` or `sesEmailTransport(...)`'\n      );\n    }\n  }\n  // Parsed once per env object: the runtime hands the same one to every request of an isolate\n  const checked = new WeakMap<object, Env>();\n  const checkEnv = (env: Env): Env => {\n    if (options.env === undefined) return env;\n    const cached = checked.get(env);\n    if (cached !== undefined) return cached;\n    const result = z.safeParse(options.env, env);\n    if (!result.success) {\n      // Names and reasons only: the values are secrets\n      throw new EnvValidationError(\n        result.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)\n      );\n    }\n    const merged: Env = { ...env, ...result.data };\n    checked.set(env, merged);\n    return merged;\n  };\n  let compiled: BundleIR | undefined;\n  const bundle = () => (compiled ??= compileConfig(config));\n  const emails = config.templates?.email;\n  const database = { schema: config.database?.schema ?? DEFAULT_SCHEMA };\n  // In fast-forward, segment windows scale with the journeys reading them (time-scale.ts)\n  const lease = (env: Env): Required<StoreLease> => {\n    const opened = options.store === undefined ? d1Store(env) : options.store(env, database);\n    const noop = async () => {};\n    const factor = runtimeFromConfig(config, env).timeScale;\n    return 'store' in opened\n      ? { store: scaleSegmentWindows(opened.store, factor), close: opened.close ?? noop }\n      : { store: scaleSegmentWindows(opened, factor), close: noop };\n  };\n\n  const messages = (env: Env, store: JourneyStore): MessageSender => {\n    if (options.messages !== undefined) return options.messages(env, store);\n    return channelsFromConfig(config, env, {\n      store,\n      email: options.email?.(env),\n      apnsFetch: platform.apnsFetch,\n    });\n  };\n\n  const observer = (env: Env, store: JourneyStore): JourneyObserver | undefined => {\n    if (options.observer !== undefined) return options.observer(env, store);\n    return store.reporting === undefined\n      ? undefined\n      : reportingObserver(store.reporting, env.WORKFLOW_ORIGIN);\n  };\n\n  const runParts = (env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts => ({\n    store,\n    env,\n    runtime:\n      options.runtime === undefined ? runtimeFromConfig(config, env) : options.runtime(env, params),\n    messages: messages(env, store),\n    // An action ref is a registered action structurally: the same object carries name, code and hash\n    actions: new RegistryActionInvoker(config.actions ?? []),\n    contract: config.contract,\n    validator: registryValidator(config.templates ?? {}),\n    observer: observer(env, store),\n  });\n\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n\n  const authorized = (request: Request, env: Env): boolean =>\n    env.API_TOKEN === undefined ||\n    request.headers.get('authorization') === `Bearer ${env.API_TOKEN}`;\n\n  const preview = emails === undefined ? undefined : registryRenderer(emails, config.email);\n\n  const handle = async (request: Request, env: Env, store: JourneyStore): Promise<Response> => {\n    const url = new URL(request.url);\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    if (url.pathname.startsWith('/t/') && store.reporting !== undefined) {\n      const openedEvent = config.webPush?.openedEvent;\n      const tracked = await handleTracking(request, store.reporting, {\n        legacyUnsubscribeUrl: config.email?.unsubscribeUrl,\n        product: config.title,\n        quickMs: config.email?.tracking?.quickClickMs,\n        pushOpened:\n          openedEvent === undefined\n            ? undefined\n            : async ({ messageId, userId, at }) => {\n                const payload: Record<string, unknown> = { message_id: messageId };\n                const contract = config.contract;\n                const verdict =\n                  contract === undefined ? undefined : checkEvent(contract, openedEvent, payload);\n                if (verdict !== undefined && !verdict.ok) {\n                  throw new ContractValidationError(openedEvent, verdict.issues);\n                }\n                // Keyed by the copy: a second tap of the same notification is the same event\n                await ingestEvent(\n                  env,\n                  {\n                    id: `${openedEvent}:${messageId}`,\n                    userId,\n                    event: openedEvent,\n                    payload: verdict?.data ?? payload,\n                    ts: at,\n                  },\n                  store\n                );\n              },\n      });\n      if (tracked !== undefined) return tracked;\n    }\n    if (url.pathname === '/segments/sweep') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      return json(await sweepSegments(env, store));\n    }\n    if (url.pathname === '/bundle') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      return json(bundle());\n    }\n    if (url.pathname === '/bundle/deploy') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      try {\n        return json(await deployBundle(env, bundle(), store));\n      } catch (error) {\n        if (!(error instanceof SchemaMismatchError)) throw error;\n        return json({ error: error.message, problems: error.problems }, 503);\n      }\n    }\n    if (emails !== undefined && preview !== undefined && url.pathname.startsWith('/preview/')) {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      const key = url.pathname.slice('/preview/'.length);\n      if (!emailIds.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown = {};\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (typeof props !== 'object' || props === null || Array.isArray(props)) {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      try {\n        const { subject, html } = await preview(key, props as Record<string, ScalarIR>);\n        return new Response(html, {\n          headers: { 'content-type': 'text/html; charset=utf-8', 'x-subject': subject },\n        });\n      } catch (error) {\n        // The query string is the props: a refusal is the caller's to fix, with the field paths\n        if (error instanceof TemplateValidationError) {\n          return json({ error: error.message, issues: error.issues }, 400);\n        }\n        throw error;\n      }\n    }\n    return handleRequest(request, env, store, {\n      contract: config.contract,\n      mode: options.contractMode,\n    });\n  };\n\n  const sweep = async (env: Env) => {\n    const { store, close } = lease(env);\n    try {\n      return await sweepSegments(env, store);\n    } finally {\n      await close();\n    }\n  };\n\n  // The bundle compiled into this version goes live on its own, once per process: the first\n  // request or scheduled run reads which version's bundle is live (one row) and applies this one\n  // only over an older version, so one still serving during a rollout can never put its routes\n  // back. A failure (say the migrations have not run) is logged and retried a minute later. Only\n  // the request that starts the check gets its promise back: a request context cannot wait on\n  // another's I/O.\n  let applying: Promise<void> | undefined;\n  let retryAt = 0;\n  const applyOwnBundle = (env: Env, version: BundleVersion | undefined) => {\n    if (version === undefined || version.id === '' || Number.isNaN(version.createdAt)) {\n      return undefined;\n    }\n    if (applying !== undefined || Date.now() < retryAt) return undefined;\n    applying = (async () => {\n      const { store, close } = lease(env);\n      try {\n        if (store.liveBundleVersion === undefined) return; // D1: POST /bundle/deploy\n        const live = await store.liveBundleVersion();\n        if (live !== undefined && (live.id === version.id || live.createdAt >= version.createdAt))\n          return;\n        const result = await deployBundle(env, bundle(), store, version);\n        if (result.applied) console.log(`[workflow] version ${version.id} is live`);\n      } finally {\n        await close();\n      }\n    })().catch((error: unknown) => {\n      applying = undefined;\n      retryAt = Date.now() + 60_000;\n      console.error(`[workflow] could not make version ${version.id} live`, error);\n    });\n    return applying;\n  };\n\n  return { config, checkEnv, lease, bundle, runParts, handle, sweep, applyOwnBundle };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA8FA,IAAa,qBAAb,cAAwC,MAAM;CAEvB;CADrB,OAAyB;CACzB,YAAY,QAAoC;EAC9C,MAAM,yCAAyC,OAAO,KAAK,MAAM,GAAG;EADjD,KAAA,SAAA;CAErB;AACF;AA8BA,SAAS,WAAW,OAAmC;CACrD,OAAO,MAAM,MAAM,SAAS;EAC1B,QAAQ,KAAK,MAAb;GACE,KAAK,WACH,OAAO,KAAK,YAAY;GAC1B,KAAK,cACH,OAAO,MAAM,QAAQ,KAAK,SAAS,KAAK,WAAW,KAAK,SAAS;GACnE,KAAK,UACH,OACE,KAAK,MAAM,MAAM,WAAW,WAAW,OAAO,IAAI,CAAC,KAAK,WAAW,KAAK,aAAa,CAAC,CAAC;GAE3F,KAAK,UACH,OAAO,KAAK,KAAK,MAAM,QAAQ,WAAW,IAAI,IAAI,CAAC;GACrD,SACE,OAAO;EACX;CACF,CAAC;AACH;AAEA,SAAgB,kBACd,SACA,WAA4B,CAAC,GACX;CAClB,MAAM,EAAE,WAAW;CACnB,MAAM,WAAWA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;CAEhE,cAAA,kBAAkB,QAAQ,SAAS,OAAO,CAAC;CAE3C,IAAI,QAAQ,UAAU,KAAA,KAAa,QAAQ,aAAa,KAAA,GAAW;EACjE,MAAM,WAAWC,eAAAA,cAAc,MAAM,CAAC,CAAC,UAAU,QAAQ,aACvD,WAAW,SAAS,IAAI,CAC1B;EACA,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,UACR,aAAa,SAAS,KAAK,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,2IAE3D;CAEJ;CAEA,MAAM,0BAAU,IAAI,QAAqB;CACzC,MAAM,YAAY,QAAkB;EAClC,IAAI,QAAQ,QAAQ,KAAA,GAAW,OAAO;EACtC,MAAM,SAAS,QAAQ,IAAI,GAAG;EAC9B,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,SAASC,SAAE,UAAU,QAAQ,KAAK,GAAG;EAC3C,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,mBACR,OAAO,MAAM,OAAO,KAAK,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,SAAS,IAAI,MAAM,SAAS,CAC5F;EAEF,MAAM,SAAc;GAAE,GAAG;GAAK,GAAG,OAAO;EAAK;EAC7C,QAAQ,IAAI,KAAK,MAAM;EACvB,OAAO;CACT;CACA,IAAI;CACJ,MAAM,eAAgB,aAAaD,eAAAA,cAAc,MAAM;CACvD,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,WAAW,EAAE,QAAQ,OAAO,UAAU,UAAA,WAAyB;CAErE,MAAM,SAAS,QAAmC;EAChD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAYE,0BAAAA,QAAQ,GAAG,IAAI,QAAQ,MAAM,KAAK,QAAQ;EACvF,MAAM,OAAO,YAAY,CAAC;EAC1B,MAAM,SAASC,sBAAAA,kBAAkB,QAAQ,GAAG,CAAC,CAAC;EAC9C,OAAO,WAAW,SACd;GAAE,OAAOC,0BAAAA,oBAAoB,OAAO,OAAO,MAAM;GAAG,OAAO,OAAO,SAAS;EAAK,IAChF;GAAE,OAAOA,0BAAAA,oBAAoB,QAAQ,MAAM;GAAG,OAAO;EAAK;CAChE;CAEA,MAAM,YAAY,KAAU,UAAuC;EACjE,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAOC,sBAAAA,mBAAmB,QAAQ,KAAK;GACrC;GACA,OAAO,QAAQ,QAAQ,GAAG;GAC1B,WAAW,SAAS;EACtB,CAAC;CACH;CAEA,MAAM,YAAY,KAAU,UAAqD;EAC/E,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAO,MAAM,cAAc,KAAA,IACvB,KAAA,IACAC,2BAAAA,kBAAkB,MAAM,WAAW,IAAI,eAAe;CAC5D;CAEA,MAAM,YAAY,KAAU,OAAqB,YAA4C;EAC3F;EACA;EACA,SACE,QAAQ,YAAY,KAAA,IAAYH,sBAAAA,kBAAkB,QAAQ,GAAG,IAAI,QAAQ,QAAQ,KAAK,MAAM;EAC9F,UAAU,SAAS,KAAK,KAAK;EAE7B,SAAS,IAAII,uBAAAA,sBAAsB,OAAO,WAAW,CAAC,CAAC;EACvD,UAAU,OAAO;EACjB,WAAWC,kBAAAA,kBAAkB,OAAO,aAAa,CAAC,CAAC;EACnD,UAAU,SAAS,KAAK,KAAK;CAC/B;CAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CAEH,MAAM,cAAc,SAAkB,QACpC,IAAI,cAAc,KAAA,KAClB,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI;CAEzD,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAYC,oBAAAA,iBAAiB,QAAQ,OAAO,KAAK;CAExF,MAAM,SAAS,OAAO,SAAkB,KAAU,UAA2C;EAC3F,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAE/B,IAAI,IAAI,SAAS,WAAW,KAAK,KAAK,MAAM,cAAc,KAAA,GAAW;GACnE,MAAM,cAAc,OAAO,SAAS;GACpC,MAAM,UAAU,MAAMC,2BAAAA,eAAe,SAAS,MAAM,WAAW;IAC7D,sBAAsB,OAAO,OAAO;IACpC,SAAS,OAAO;IAChB,SAAS,OAAO,OAAO,UAAU;IACjC,YACE,gBAAgB,KAAA,IACZ,KAAA,IACA,OAAO,EAAE,WAAW,QAAQ,SAAS;KACnC,MAAM,UAAmC,EAAE,YAAY,UAAU;KACjE,MAAM,WAAW,OAAO;KACxB,MAAM,UACJ,aAAa,KAAA,IAAY,KAAA,IAAYC,iBAAAA,WAAW,UAAU,aAAa,OAAO;KAChF,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,IACpC,MAAM,IAAIC,iBAAAA,wBAAwB,aAAa,QAAQ,MAAM;KAG/D,MAAMC,oBAAAA,YACJ,KACA;MACE,IAAI,GAAG,YAAY,GAAG;MACtB;MACA,OAAO;MACP,SAAS,SAAS,QAAQ;MAC1B,IAAI;KACN,GACA,KACF;IACF;GACR,CAAC;GACD,IAAI,YAAY,KAAA,GAAW,OAAO;EACpC;EACA,IAAI,IAAI,aAAa,mBAAmB;GACtC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,OAAO,KAAK,MAAMC,oBAAAA,cAAc,KAAK,KAAK,CAAC;EAC7C;EACA,IAAI,IAAI,aAAa,WAAW;GAC9B,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,OAAO,KAAK,OAAO,CAAC;EACtB;EACA,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,IAAI;IACF,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,GAAG,KAAK,CAAC;GACtD,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiBC,oBAAAA,sBAAsB,MAAM;IACnD,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,UAAU,MAAM;IAAS,GAAG,GAAG;GACrE;EACF;EACA,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,KAAa,IAAI,SAAS,WAAW,WAAW,GAAG;GACzF,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEpF,IAAI,QAAiB,CAAC;GACtB,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAE3D,IAAI;IACF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,KAAK,KAAiC;IAC9E,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;KAAE,gBAAgB;KAA4B,aAAa;IAAQ,EAC9E,CAAC;GACH,SAAS,OAAO;IAEd,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,QAAQ,MAAM;IAAO,GAAG,GAAG;IAEjE,MAAM;GACR;EACF;EACA,OAAOC,oBAAAA,cAAc,SAAS,KAAK,OAAO;GACxC,UAAU,OAAO;GACjB,MAAM,QAAQ;EAChB,CAAC;CACH;CAEA,MAAM,QAAQ,OAAO,QAAa;EAChC,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GACF,OAAO,MAAMJ,oBAAAA,cAAc,KAAK,KAAK;EACvC,UAAU;GACR,MAAM,MAAM;EACd;CACF;CAQA,IAAI;CACJ,IAAI,UAAU;CACd,MAAM,kBAAkB,KAAU,YAAuC;EACvE,IAAI,YAAY,KAAA,KAAa,QAAQ,OAAO,MAAM,OAAO,MAAM,QAAQ,SAAS,GAC9E;EAEF,IAAI,aAAa,KAAA,KAAa,KAAK,IAAI,IAAI,SAAS,OAAO,KAAA;EAC3D,YAAY,YAAY;GACtB,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;GAClC,IAAI;IACF,IAAI,MAAM,sBAAsB,KAAA,GAAW;IAC3C,MAAM,OAAO,MAAM,MAAM,kBAAkB;IAC3C,IAAI,SAAS,KAAA,MAAc,KAAK,OAAO,QAAQ,MAAM,KAAK,aAAa,QAAQ,YAC7E;IAEF,KAAI,MADiBC,oBAAAA,aAAa,KAAK,OAAO,GAAG,OAAO,OAAO,EAAA,CACpD,SAAS,QAAQ,IAAI,sBAAsB,QAAQ,GAAG,SAAS;GAC5E,UAAU;IACR,MAAM,MAAM;GACd;EACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;GAC7B,WAAW,KAAA;GACX,UAAU,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,qCAAqC,QAAQ,GAAG,QAAQ,KAAK;EAC7E,CAAC;EACD,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAO;EAAQ;EAAU;EAAQ;EAAO;CAAe;AACpF"}

package/dist/host/journey-host.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"journey-host.d.cts","names":[],"sources":["../../src/host/journey-host.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAyCiB,mBAAmB,YAAY;;;;;;;;;EAS9C,QAAQ;;;;;;;;;EASR,SAAS,KAAK,KAAK;IAAY;QAAqB,eAAe;;;;;;;EAOnE,SAAS,KAAK,QAAQ;;;;;;;;EAQtB,YAAY,KAAK,KAAK,OAAO,iBAAiB;;;;;EAK9C,YAAY,KAAK,KAAK,OAAO,iBAAiB;;EAE9C,WAAW,KAAK,KAAK,QAAQ,kBAAkB;;;;;;;EAO/C,MAAM,KAAK;;EAEX;;;qBAIW,2BAA2B;WAEjB;WADH;EAClB,YAAqB;;iBAKN,YAAY,YAAY;EACvC,QAAQ;;EAER,SAAS,KAAK,MAAM;;EAEpB,MAAM,KAAK,MAAM,SAAS;;EAE1B,UAAU;;EAEV,SAAS,KAAK,KAAK,OAAO,cAAc,QAAQ,gBAAgB;;EAEhE,OAAO,SAAS,SAAS,KAAK,KAAK,OAAO,eAAe,QAAQ;;EAEjE,MAAM,KAAK,MAAM,QAAQ;;;;;;EAMzB,eAAe,KAAK,KAAK,SAAS,4BAA4B;;;iBAI/C;;EAEf,mBAAmB;;wBAGL,kBAAkB,YAAY,YAC5C,SAAS,mBAAmB,MAC5B,WAAU,kBACT,YAAY"}
+{"version":3,"file":"journey-host.d.cts","names":[],"sources":["../../src/host/journey-host.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAyCiB,mBAAmB,YAAY;;;;;;;;;EAS9C,QAAQ;;;;;;;;;EASR,SAAS,KAAK,KAAK;IAAY;QAAqB,eAAe;;;;;;;EAOnE,SAAS,KAAK,QAAQ;;;;;;;;EAQtB,YAAY,KAAK,KAAK,OAAO,iBAAiB;;;;;EAK9C,YAAY,KAAK,KAAK,OAAO,iBAAiB;;EAE9C,WAAW,KAAK,KAAK,QAAQ,kBAAkB;;;;;;;EAO/C,MAAM,KAAK;;EAEX;;;qBAIW,2BAA2B;WAEjB;WADH;EAClB,YAAqB;;iBAKN,YAAY,YAAY;EACvC,QAAQ;;EAER,SAAS,KAAK,MAAM;;EAEpB,MAAM,KAAK,MAAM,SAAS;;EAE1B,UAAU;;EAEV,SAAS,KAAK,KAAK,OAAO,cAAc,QAAQ,gBAAgB;;EAEhE,OAAO,SAAS,SAAS,KAAK,KAAK,OAAO,eAAe,QAAQ;;EAEjE,MAAM,KAAK,MAAM,QAAQ;;;;;;EAMzB,eAAe,KAAK,KAAK,SAAS,4BAA4B;;;iBAI/C;;EAEf,mBAAmB;;wBAsBL,kBAAkB,YAAY,YAC5C,SAAS,mBAAmB,MAC5B,WAAU,kBACT,YAAY"}

package/dist/host/journey-host.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"journey-host.d.mts","names":[],"sources":["../../src/host/journey-host.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAyCiB,mBAAmB,YAAY;;;;;;;;;EAS9C,QAAQ;;;;;;;;;EASR,SAAS,KAAK,KAAK;IAAY;QAAqB,eAAe;;;;;;;EAOnE,SAAS,KAAK,QAAQ;;;;;;;;EAQtB,YAAY,KAAK,KAAK,OAAO,iBAAiB;;;;;EAK9C,YAAY,KAAK,KAAK,OAAO,iBAAiB;;EAE9C,WAAW,KAAK,KAAK,QAAQ,kBAAkB;;;;;;;EAO/C,MAAM,KAAK;;EAEX;;;qBAIW,2BAA2B;WAEjB;WADH;EAClB,YAAqB;;iBAKN,YAAY,YAAY;EACvC,QAAQ;;EAER,SAAS,KAAK,MAAM;;EAEpB,MAAM,KAAK,MAAM,SAAS;;EAE1B,UAAU;;EAEV,SAAS,KAAK,KAAK,OAAO,cAAc,QAAQ,gBAAgB;;EAEhE,OAAO,SAAS,SAAS,KAAK,KAAK,OAAO,eAAe,QAAQ;;EAEjE,MAAM,KAAK,MAAM,QAAQ;;;;;;EAMzB,eAAe,KAAK,KAAK,SAAS,4BAA4B;;;iBAI/C;;EAEf,mBAAmB;;wBAGL,kBAAkB,YAAY,YAC5C,SAAS,mBAAmB,MAC5B,WAAU,kBACT,YAAY"}
+{"version":3,"file":"journey-host.d.mts","names":[],"sources":["../../src/host/journey-host.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAyCiB,mBAAmB,YAAY;;;;;;;;;EAS9C,QAAQ;;;;;;;;;EASR,SAAS,KAAK,KAAK;IAAY;QAAqB,eAAe;;;;;;;EAOnE,SAAS,KAAK,QAAQ;;;;;;;;EAQtB,YAAY,KAAK,KAAK,OAAO,iBAAiB;;;;;EAK9C,YAAY,KAAK,KAAK,OAAO,iBAAiB;;EAE9C,WAAW,KAAK,KAAK,QAAQ,kBAAkB;;;;;;;EAO/C,MAAM,KAAK;;EAEX;;;qBAIW,2BAA2B;WAEjB;WADH;EAClB,YAAqB;;iBAKN,YAAY,YAAY;EACvC,QAAQ;;EAER,SAAS,KAAK,MAAM;;EAEpB,MAAM,KAAK,MAAM,SAAS;;EAE1B,UAAU;;EAEV,SAAS,KAAK,KAAK,OAAO,cAAc,QAAQ,gBAAgB;;EAEhE,OAAO,SAAS,SAAS,KAAK,KAAK,OAAO,eAAe,QAAQ;;EAEjE,MAAM,KAAK,MAAM,QAAQ;;;;;;EAMzB,eAAe,KAAK,KAAK,SAAS,4BAA4B;;;iBAI/C;;EAEf,mBAAmB;;wBAsBL,kBAAkB,YAAY,YAC5C,SAAS,mBAAmB,MAC5B,WAAU,kBACT,YAAY"}

package/dist/host/journey-host.mjs

@@ -23,10 +23,25 @@ var EnvValidationError = class extends Error {
 		this.issues = issues;
 	}
 };
+function sendsEmail(nodes) {
+	return nodes.some((node) => {
+		switch (node.type) {
+			case "message": return node.channel === "email";
+			case "wait_until": return Array.isArray(node.onTimeout) && sendsEmail(node.onTimeout);
+			case "branch": return node.cases.some((branch) => sendsEmail(branch.flow)) || sendsEmail(node.otherwise ?? []);
+			case "cohort": return node.arms.some((arm) => sendsEmail(arm.flow));
+			default: return false;
+		}
+	});
+}
 function createJourneyHost(options, platform = {}) {
 	const { config } = options;
 	const emailIds = indexTemplates("email", config.templates?.email);
 	assertEmailConfig(config, emailIds.values());
+	if (options.email === void 0 && options.messages === void 0) {
+		const emailing = compileConfig(config).workflows.filter((workflow) => sendsEmail(workflow.flow));
+		if (emailing.length > 0) throw new TypeError(`workflows ${emailing.map((w) => `'${w.id}'`).join(", ")} send email, but the host has no \`email\` transport: pass \`email: (env) => cloudflareEmailTransport(...)\` or \`sesEmailTransport(...)\``);
+	}
 	const checked = /* @__PURE__ */ new WeakMap();
 	const checkEnv = (env) => {
 		if (options.env === void 0) return env;

package/dist/host/journey-host.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"journey-host.mjs","names":[],"sources":["../../src/host/journey-host.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { JourneyEnv, JourneyParams } from '../cloudflare/bindings';\nimport { d1Store } from '../cloudflare/d1-env';\nimport { type JourneyConfig, compileConfig } from '../config';\nimport { ContractValidationError, checkEvent } from '../contract';\nimport { assertEmailConfig } from '../email';\nimport type { EmailTransport } from '../email-sender';\nimport { RegistryActionInvoker } from '../engine/actions';\nimport type { JourneyObserver, MessageSender } from '../engine/ports';\nimport { scaleSegmentWindows } from '../engine/time-scale';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { registryRenderer } from '../react-email';\nimport { reportingObserver } from '../reporting/observer';\nimport { handleTracking } from '../reporting/tracking';\nimport type { JourneyRuntimeOptions } from '../runtime';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  SchemaMismatchError,\n  type StoreLease,\n} from '../store/index';\nimport { DEFAULT_SCHEMA } from '../store/tables';\nimport { TemplateValidationError, indexTemplates, registryValidator } from '../templates';\nimport { channelsFromConfig, runtimeFromConfig } from './channels';\nimport type { JourneyRunParts } from './execute';\nimport {\n  type SweepResult,\n  deployBundle,\n  handleRequest,\n  ingestEvent,\n  sweepSegments,\n} from './router';\n\n/**\n * What a journey host is, apart from the runtime it runs on: the validated environment, the\n * store lease, the outlets a run is wired to, the HTTP API (tracking, sweep, bundle, preview,\n * ingest) and the bundle that goes live with the code. `journeyWorker` (Cloudflare) and\n * `journeyLambda` (AWS) are this plus how their platform starts, wakes and stops instances.\n */\n\nexport interface JourneyHostOptions<Env extends JourneyEnv> {\n  /**\n   * The project's `workflow.config.ts` (`defineConfig`): what the host\n   * deploys (`GET /bundle`, `POST /bundle/deploy` serve `compileConfig`), the\n   * template registries the senders, the validator and `/preview` render from,\n   * the contract every `/events` and `/identify` is checked against, the email\n   * defaults, actions, and the runtime / APNs / FCM settings. Secrets come\n   * from the env under the names `JourneyEnv` documents.\n   */\n  config: JourneyConfig;\n  /**\n   * The data plane, opened per request and per workflow run. Return a\n   * `StoreLease` when the client must be released afterwards (a Postgres\n   * connection); defaults to D1 + KV from the env's bindings. `database` is\n   * the config's (`schema` defaulting to `workflow`), for a Postgres store:\n   *\n   *   store: (env, database) => postgresJsStore(env.DATABASE_URL, database)\n   */\n  store?: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /**\n   * Where journey emails go: a transport built from the validated env —\n   * `sesEmailTransport(...)`, `cloudflareEmailTransport(...)`, or your own. Which one is\n   * independent of where the workflow runs. Without it the email channel fails its sends,\n   * saying so.\n   */\n  email?: (env: Env) => EmailTransport;\n  /**\n   * Reporting hooks: node arrivals, every copy sent (with the tracking it should carry — click\n   * links and an open pixel for email, payload data for a push), and how each instance ended.\n   * By default a store that keeps reporting (Postgres) records them itself, and the host\n   * serves the email tracking routes (`/t/...`, on `WORKFLOW_ORIGIN`); override to report\n   * elsewhere.\n   */\n  observer?: (env: Env, store: JourneyStore) => JourneyObserver;\n  /**\n   * Message outlet override (tests, a custom gateway): replaces every channel, `email`\n   * included. By default the channels the config describes.\n   */\n  messages?: (env: Env, store: JourneyStore) => MessageSender;\n  /** Per-instance runtime options override (a tester in fast-forward); by default `config.runtime` for `ENVIRONMENT`. */\n  runtime?: (env: Env, params: JourneyParams) => JourneyRuntimeOptions;\n  /**\n   * The host's environment, as a zod schema over its vars and secrets (bindings pass through\n   * untouched): checked the first time the host runs, so a missing or malformed variable fails\n   * there — every problem listed — not at the send that needs it. Webhook templates read their\n   * URL from the parsed values: `webhook: (env: Env) => env.WEBHOOK_DISCORD_ALERTS`.\n   */\n  env?: core.$ZodType<object>;\n  /** 'enforce' (default) answers an event or patch the contract refuses with a 400; 'report' only logs it. */\n  contractMode?: 'enforce' | 'report';\n}\n\n/** The host's environment failed its schema (`env` option). */\nexport class EnvValidationError extends Error {\n  override readonly name = 'EnvValidationError';\n  constructor(readonly issues: readonly string[]) {\n    super(`the host's environment is invalid:\\n  ${issues.join('\\n  ')}`);\n  }\n}\n\nexport interface JourneyHost<Env extends JourneyEnv> {\n  config: JourneyConfig;\n  /** The env, parsed by the schema once per env object (throws EnvValidationError). */\n  checkEnv(env: Env): Env;\n  /** A store for one request or run, its segment windows scaled with the runtime. */\n  lease(env: Env): Required<StoreLease>;\n  /** The bundle compiled into this code. */\n  bundle(): BundleIR;\n  /** The outlets one run is wired to (the store is the run's). */\n  runParts(env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts;\n  /** The HTTP API over one store: tracking, sweep, bundle, preview, then the ingest router. */\n  handle(request: Request, env: Env, store: JourneyStore): Promise<Response>;\n  /** The scheduled sweep (`sweepSegments`) on a store of its own. */\n  sweep(env: Env): Promise<SweepResult>;\n  /**\n   * Make the bundle compiled into `version` live, once per process, only over an older live\n   * version (the store records it). Undefined when there is nothing to do; a failure is logged\n   * and retried a minute later.\n   */\n  applyOwnBundle(env: Env, version: BundleVersion | undefined): Promise<void> | undefined;\n}\n\n/** What the platform adapter itself contributes. */\nexport interface JourneyPlatform {\n  /** An HTTP/2 fetch for APNs, where the runtime's own fetch is HTTP/1.1 (Node). */\n  apnsFetch?: typeof fetch;\n}\n\nexport function createJourneyHost<Env extends JourneyEnv>(\n  options: JourneyHostOptions<Env>,\n  platform: JourneyPlatform = {}\n): JourneyHost<Env> {\n  const { config } = options;\n  const emailIds = indexTemplates('email', config.templates?.email);\n  // A config still on `emails` (its sender would be silently dropped) fails here, not at a send\n  assertEmailConfig(config, emailIds.values());\n  // Parsed once per env object: the runtime hands the same one to every request of an isolate\n  const checked = new WeakMap<object, Env>();\n  const checkEnv = (env: Env): Env => {\n    if (options.env === undefined) return env;\n    const cached = checked.get(env);\n    if (cached !== undefined) return cached;\n    const result = z.safeParse(options.env, env);\n    if (!result.success) {\n      // Names and reasons only: the values are secrets\n      throw new EnvValidationError(\n        result.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)\n      );\n    }\n    const merged: Env = { ...env, ...result.data };\n    checked.set(env, merged);\n    return merged;\n  };\n  let compiled: BundleIR | undefined;\n  const bundle = () => (compiled ??= compileConfig(config));\n  const emails = config.templates?.email;\n  const database = { schema: config.database?.schema ?? DEFAULT_SCHEMA };\n  // In fast-forward, segment windows scale with the journeys reading them (time-scale.ts)\n  const lease = (env: Env): Required<StoreLease> => {\n    const opened = options.store === undefined ? d1Store(env) : options.store(env, database);\n    const noop = async () => {};\n    const factor = runtimeFromConfig(config, env).timeScale;\n    return 'store' in opened\n      ? { store: scaleSegmentWindows(opened.store, factor), close: opened.close ?? noop }\n      : { store: scaleSegmentWindows(opened, factor), close: noop };\n  };\n\n  const messages = (env: Env, store: JourneyStore): MessageSender => {\n    if (options.messages !== undefined) return options.messages(env, store);\n    return channelsFromConfig(config, env, {\n      store,\n      email: options.email?.(env),\n      apnsFetch: platform.apnsFetch,\n    });\n  };\n\n  const observer = (env: Env, store: JourneyStore): JourneyObserver | undefined => {\n    if (options.observer !== undefined) return options.observer(env, store);\n    return store.reporting === undefined\n      ? undefined\n      : reportingObserver(store.reporting, env.WORKFLOW_ORIGIN);\n  };\n\n  const runParts = (env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts => ({\n    store,\n    env,\n    runtime:\n      options.runtime === undefined ? runtimeFromConfig(config, env) : options.runtime(env, params),\n    messages: messages(env, store),\n    // An action ref is a registered action structurally: the same object carries name, code and hash\n    actions: new RegistryActionInvoker(config.actions ?? []),\n    contract: config.contract,\n    validator: registryValidator(config.templates ?? {}),\n    observer: observer(env, store),\n  });\n\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n\n  const authorized = (request: Request, env: Env): boolean =>\n    env.API_TOKEN === undefined ||\n    request.headers.get('authorization') === `Bearer ${env.API_TOKEN}`;\n\n  const preview = emails === undefined ? undefined : registryRenderer(emails, config.email);\n\n  const handle = async (request: Request, env: Env, store: JourneyStore): Promise<Response> => {\n    const url = new URL(request.url);\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    if (url.pathname.startsWith('/t/') && store.reporting !== undefined) {\n      const openedEvent = config.webPush?.openedEvent;\n      const tracked = await handleTracking(request, store.reporting, {\n        legacyUnsubscribeUrl: config.email?.unsubscribeUrl,\n        product: config.title,\n        quickMs: config.email?.tracking?.quickClickMs,\n        pushOpened:\n          openedEvent === undefined\n            ? undefined\n            : async ({ messageId, userId, at }) => {\n                const payload: Record<string, unknown> = { message_id: messageId };\n                const contract = config.contract;\n                const verdict =\n                  contract === undefined ? undefined : checkEvent(contract, openedEvent, payload);\n                if (verdict !== undefined && !verdict.ok) {\n                  throw new ContractValidationError(openedEvent, verdict.issues);\n                }\n                // Keyed by the copy: a second tap of the same notification is the same event\n                await ingestEvent(\n                  env,\n                  {\n                    id: `${openedEvent}:${messageId}`,\n                    userId,\n                    event: openedEvent,\n                    payload: verdict?.data ?? payload,\n                    ts: at,\n                  },\n                  store\n                );\n              },\n      });\n      if (tracked !== undefined) return tracked;\n    }\n    if (url.pathname === '/segments/sweep') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      return json(await sweepSegments(env, store));\n    }\n    if (url.pathname === '/bundle') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      return json(bundle());\n    }\n    if (url.pathname === '/bundle/deploy') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      try {\n        return json(await deployBundle(env, bundle(), store));\n      } catch (error) {\n        if (!(error instanceof SchemaMismatchError)) throw error;\n        return json({ error: error.message, problems: error.problems }, 503);\n      }\n    }\n    if (emails !== undefined && preview !== undefined && url.pathname.startsWith('/preview/')) {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      const key = url.pathname.slice('/preview/'.length);\n      if (!emailIds.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown = {};\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (typeof props !== 'object' || props === null || Array.isArray(props)) {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      try {\n        const { subject, html } = await preview(key, props as Record<string, ScalarIR>);\n        return new Response(html, {\n          headers: { 'content-type': 'text/html; charset=utf-8', 'x-subject': subject },\n        });\n      } catch (error) {\n        // The query string is the props: a refusal is the caller's to fix, with the field paths\n        if (error instanceof TemplateValidationError) {\n          return json({ error: error.message, issues: error.issues }, 400);\n        }\n        throw error;\n      }\n    }\n    return handleRequest(request, env, store, {\n      contract: config.contract,\n      mode: options.contractMode,\n    });\n  };\n\n  const sweep = async (env: Env) => {\n    const { store, close } = lease(env);\n    try {\n      return await sweepSegments(env, store);\n    } finally {\n      await close();\n    }\n  };\n\n  // The bundle compiled into this version goes live on its own, once per process: the first\n  // request or scheduled run reads which version's bundle is live (one row) and applies this one\n  // only over an older version, so one still serving during a rollout can never put its routes\n  // back. A failure (say the migrations have not run) is logged and retried a minute later. Only\n  // the request that starts the check gets its promise back: a request context cannot wait on\n  // another's I/O.\n  let applying: Promise<void> | undefined;\n  let retryAt = 0;\n  const applyOwnBundle = (env: Env, version: BundleVersion | undefined) => {\n    if (version === undefined || version.id === '' || Number.isNaN(version.createdAt)) {\n      return undefined;\n    }\n    if (applying !== undefined || Date.now() < retryAt) return undefined;\n    applying = (async () => {\n      const { store, close } = lease(env);\n      try {\n        if (store.liveBundleVersion === undefined) return; // D1: POST /bundle/deploy\n        const live = await store.liveBundleVersion();\n        if (live !== undefined && (live.id === version.id || live.createdAt >= version.createdAt))\n          return;\n        const result = await deployBundle(env, bundle(), store, version);\n        if (result.applied) console.log(`[workflow] version ${version.id} is live`);\n      } finally {\n        await close();\n      }\n    })().catch((error: unknown) => {\n      applying = undefined;\n      retryAt = Date.now() + 60_000;\n      console.error(`[workflow] could not make version ${version.id} live`, error);\n    });\n    return applying;\n  };\n\n  return { config, checkEnv, lease, bundle, runParts, handle, sweep, applyOwnBundle };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8FA,IAAa,qBAAb,cAAwC,MAAM;CAEvB;CADrB,OAAyB;CACzB,YAAY,QAAoC;EAC9C,MAAM,yCAAyC,OAAO,KAAK,MAAM,GAAG;EADjD,KAAA,SAAA;CAErB;AACF;AA8BA,SAAgB,kBACd,SACA,WAA4B,CAAC,GACX;CAClB,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,eAAe,SAAS,OAAO,WAAW,KAAK;CAEhE,kBAAkB,QAAQ,SAAS,OAAO,CAAC;CAE3C,MAAM,0BAAU,IAAI,QAAqB;CACzC,MAAM,YAAY,QAAkB;EAClC,IAAI,QAAQ,QAAQ,KAAA,GAAW,OAAO;EACtC,MAAM,SAAS,QAAQ,IAAI,GAAG;EAC9B,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,SAAS,EAAE,UAAU,QAAQ,KAAK,GAAG;EAC3C,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,mBACR,OAAO,MAAM,OAAO,KAAK,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,SAAS,IAAI,MAAM,SAAS,CAC5F;EAEF,MAAM,SAAc;GAAE,GAAG;GAAK,GAAG,OAAO;EAAK;EAC7C,QAAQ,IAAI,KAAK,MAAM;EACvB,OAAO;CACT;CACA,IAAI;CACJ,MAAM,eAAgB,aAAa,cAAc,MAAM;CACvD,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,WAAW,EAAE,QAAQ,OAAO,UAAU,UAAA,WAAyB;CAErE,MAAM,SAAS,QAAmC;EAChD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,QAAQ,GAAG,IAAI,QAAQ,MAAM,KAAK,QAAQ;EACvF,MAAM,OAAO,YAAY,CAAC;EAC1B,MAAM,SAAS,kBAAkB,QAAQ,GAAG,CAAC,CAAC;EAC9C,OAAO,WAAW,SACd;GAAE,OAAO,oBAAoB,OAAO,OAAO,MAAM;GAAG,OAAO,OAAO,SAAS;EAAK,IAChF;GAAE,OAAO,oBAAoB,QAAQ,MAAM;GAAG,OAAO;EAAK;CAChE;CAEA,MAAM,YAAY,KAAU,UAAuC;EACjE,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAO,mBAAmB,QAAQ,KAAK;GACrC;GACA,OAAO,QAAQ,QAAQ,GAAG;GAC1B,WAAW,SAAS;EACtB,CAAC;CACH;CAEA,MAAM,YAAY,KAAU,UAAqD;EAC/E,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAO,MAAM,cAAc,KAAA,IACvB,KAAA,IACA,kBAAkB,MAAM,WAAW,IAAI,eAAe;CAC5D;CAEA,MAAM,YAAY,KAAU,OAAqB,YAA4C;EAC3F;EACA;EACA,SACE,QAAQ,YAAY,KAAA,IAAY,kBAAkB,QAAQ,GAAG,IAAI,QAAQ,QAAQ,KAAK,MAAM;EAC9F,UAAU,SAAS,KAAK,KAAK;EAE7B,SAAS,IAAI,sBAAsB,OAAO,WAAW,CAAC,CAAC;EACvD,UAAU,OAAO;EACjB,WAAW,kBAAkB,OAAO,aAAa,CAAC,CAAC;EACnD,UAAU,SAAS,KAAK,KAAK;CAC/B;CAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CAEH,MAAM,cAAc,SAAkB,QACpC,IAAI,cAAc,KAAA,KAClB,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI;CAEzD,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,iBAAiB,QAAQ,OAAO,KAAK;CAExF,MAAM,SAAS,OAAO,SAAkB,KAAU,UAA2C;EAC3F,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAE/B,IAAI,IAAI,SAAS,WAAW,KAAK,KAAK,MAAM,cAAc,KAAA,GAAW;GACnE,MAAM,cAAc,OAAO,SAAS;GACpC,MAAM,UAAU,MAAM,eAAe,SAAS,MAAM,WAAW;IAC7D,sBAAsB,OAAO,OAAO;IACpC,SAAS,OAAO;IAChB,SAAS,OAAO,OAAO,UAAU;IACjC,YACE,gBAAgB,KAAA,IACZ,KAAA,IACA,OAAO,EAAE,WAAW,QAAQ,SAAS;KACnC,MAAM,UAAmC,EAAE,YAAY,UAAU;KACjE,MAAM,WAAW,OAAO;KACxB,MAAM,UACJ,aAAa,KAAA,IAAY,KAAA,IAAY,WAAW,UAAU,aAAa,OAAO;KAChF,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,IACpC,MAAM,IAAI,wBAAwB,aAAa,QAAQ,MAAM;KAG/D,MAAM,YACJ,KACA;MACE,IAAI,GAAG,YAAY,GAAG;MACtB;MACA,OAAO;MACP,SAAS,SAAS,QAAQ;MAC1B,IAAI;KACN,GACA,KACF;IACF;GACR,CAAC;GACD,IAAI,YAAY,KAAA,GAAW,OAAO;EACpC;EACA,IAAI,IAAI,aAAa,mBAAmB;GACtC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,OAAO,KAAK,MAAM,cAAc,KAAK,KAAK,CAAC;EAC7C;EACA,IAAI,IAAI,aAAa,WAAW;GAC9B,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,OAAO,KAAK,OAAO,CAAC;EACtB;EACA,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,IAAI;IACF,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,GAAG,KAAK,CAAC;GACtD,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,sBAAsB,MAAM;IACnD,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,UAAU,MAAM;IAAS,GAAG,GAAG;GACrE;EACF;EACA,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,KAAa,IAAI,SAAS,WAAW,WAAW,GAAG;GACzF,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEpF,IAAI,QAAiB,CAAC;GACtB,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAE3D,IAAI;IACF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,KAAK,KAAiC;IAC9E,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;KAAE,gBAAgB;KAA4B,aAAa;IAAQ,EAC9E,CAAC;GACH,SAAS,OAAO;IAEd,IAAI,iBAAiB,yBACnB,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,QAAQ,MAAM;IAAO,GAAG,GAAG;IAEjE,MAAM;GACR;EACF;EACA,OAAO,cAAc,SAAS,KAAK,OAAO;GACxC,UAAU,OAAO;GACjB,MAAM,QAAQ;EAChB,CAAC;CACH;CAEA,MAAM,QAAQ,OAAO,QAAa;EAChC,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GACF,OAAO,MAAM,cAAc,KAAK,KAAK;EACvC,UAAU;GACR,MAAM,MAAM;EACd;CACF;CAQA,IAAI;CACJ,IAAI,UAAU;CACd,MAAM,kBAAkB,KAAU,YAAuC;EACvE,IAAI,YAAY,KAAA,KAAa,QAAQ,OAAO,MAAM,OAAO,MAAM,QAAQ,SAAS,GAC9E;EAEF,IAAI,aAAa,KAAA,KAAa,KAAK,IAAI,IAAI,SAAS,OAAO,KAAA;EAC3D,YAAY,YAAY;GACtB,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;GAClC,IAAI;IACF,IAAI,MAAM,sBAAsB,KAAA,GAAW;IAC3C,MAAM,OAAO,MAAM,MAAM,kBAAkB;IAC3C,IAAI,SAAS,KAAA,MAAc,KAAK,OAAO,QAAQ,MAAM,KAAK,aAAa,QAAQ,YAC7E;IAEF,KAAI,MADiB,aAAa,KAAK,OAAO,GAAG,OAAO,OAAO,EAAA,CACpD,SAAS,QAAQ,IAAI,sBAAsB,QAAQ,GAAG,SAAS;GAC5E,UAAU;IACR,MAAM,MAAM;GACd;EACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;GAC7B,WAAW,KAAA;GACX,UAAU,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,qCAAqC,QAAQ,GAAG,QAAQ,KAAK;EAC7E,CAAC;EACD,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAO;EAAQ;EAAU;EAAQ;EAAO;CAAe;AACpF"}
+{"version":3,"file":"journey-host.mjs","names":[],"sources":["../../src/host/journey-host.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { JourneyEnv, JourneyParams } from '../cloudflare/bindings';\nimport { d1Store } from '../cloudflare/d1-env';\nimport { type JourneyConfig, compileConfig } from '../config';\nimport { ContractValidationError, checkEvent } from '../contract';\nimport { assertEmailConfig } from '../email';\nimport type { EmailTransport } from '../email-sender';\nimport { RegistryActionInvoker } from '../engine/actions';\nimport type { JourneyObserver, MessageSender } from '../engine/ports';\nimport { scaleSegmentWindows } from '../engine/time-scale';\nimport type { BundleIR, NodeIR, ScalarIR } from '../ir';\nimport { registryRenderer } from '../react-email';\nimport { reportingObserver } from '../reporting/observer';\nimport { handleTracking } from '../reporting/tracking';\nimport type { JourneyRuntimeOptions } from '../runtime';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  SchemaMismatchError,\n  type StoreLease,\n} from '../store/index';\nimport { DEFAULT_SCHEMA } from '../store/tables';\nimport { TemplateValidationError, indexTemplates, registryValidator } from '../templates';\nimport { channelsFromConfig, runtimeFromConfig } from './channels';\nimport type { JourneyRunParts } from './execute';\nimport {\n  type SweepResult,\n  deployBundle,\n  handleRequest,\n  ingestEvent,\n  sweepSegments,\n} from './router';\n\n/**\n * What a journey host is, apart from the runtime it runs on: the validated environment, the\n * store lease, the outlets a run is wired to, the HTTP API (tracking, sweep, bundle, preview,\n * ingest) and the bundle that goes live with the code. `journeyWorker` (Cloudflare) and\n * `journeyLambda` (AWS) are this plus how their platform starts, wakes and stops instances.\n */\n\nexport interface JourneyHostOptions<Env extends JourneyEnv> {\n  /**\n   * The project's `workflow.config.ts` (`defineConfig`): what the host\n   * deploys (`GET /bundle`, `POST /bundle/deploy` serve `compileConfig`), the\n   * template registries the senders, the validator and `/preview` render from,\n   * the contract every `/events` and `/identify` is checked against, the email\n   * defaults, actions, and the runtime / APNs / FCM settings. Secrets come\n   * from the env under the names `JourneyEnv` documents.\n   */\n  config: JourneyConfig;\n  /**\n   * The data plane, opened per request and per workflow run. Return a\n   * `StoreLease` when the client must be released afterwards (a Postgres\n   * connection); defaults to D1 + KV from the env's bindings. `database` is\n   * the config's (`schema` defaulting to `workflow`), for a Postgres store:\n   *\n   *   store: (env, database) => postgresJsStore(env.DATABASE_URL, database)\n   */\n  store?: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /**\n   * Where journey emails go: a transport built from the validated env —\n   * `sesEmailTransport(...)`, `cloudflareEmailTransport(...)`, or your own. Which one is\n   * independent of where the workflow runs. Without it the email channel fails its sends,\n   * saying so.\n   */\n  email?: (env: Env) => EmailTransport;\n  /**\n   * Reporting hooks: node arrivals, every copy sent (with the tracking it should carry — click\n   * links and an open pixel for email, payload data for a push), and how each instance ended.\n   * By default a store that keeps reporting (Postgres) records them itself, and the host\n   * serves the email tracking routes (`/t/...`, on `WORKFLOW_ORIGIN`); override to report\n   * elsewhere.\n   */\n  observer?: (env: Env, store: JourneyStore) => JourneyObserver;\n  /**\n   * Message outlet override (tests, a custom gateway): replaces every channel, `email`\n   * included. By default the channels the config describes.\n   */\n  messages?: (env: Env, store: JourneyStore) => MessageSender;\n  /** Per-instance runtime options override (a tester in fast-forward); by default `config.runtime` for `ENVIRONMENT`. */\n  runtime?: (env: Env, params: JourneyParams) => JourneyRuntimeOptions;\n  /**\n   * The host's environment, as a zod schema over its vars and secrets (bindings pass through\n   * untouched): checked the first time the host runs, so a missing or malformed variable fails\n   * there — every problem listed — not at the send that needs it. Webhook templates read their\n   * URL from the parsed values: `webhook: (env: Env) => env.WEBHOOK_DISCORD_ALERTS`.\n   */\n  env?: core.$ZodType<object>;\n  /** 'enforce' (default) answers an event or patch the contract refuses with a 400; 'report' only logs it. */\n  contractMode?: 'enforce' | 'report';\n}\n\n/** The host's environment failed its schema (`env` option). */\nexport class EnvValidationError extends Error {\n  override readonly name = 'EnvValidationError';\n  constructor(readonly issues: readonly string[]) {\n    super(`the host's environment is invalid:\\n  ${issues.join('\\n  ')}`);\n  }\n}\n\nexport interface JourneyHost<Env extends JourneyEnv> {\n  config: JourneyConfig;\n  /** The env, parsed by the schema once per env object (throws EnvValidationError). */\n  checkEnv(env: Env): Env;\n  /** A store for one request or run, its segment windows scaled with the runtime. */\n  lease(env: Env): Required<StoreLease>;\n  /** The bundle compiled into this code. */\n  bundle(): BundleIR;\n  /** The outlets one run is wired to (the store is the run's). */\n  runParts(env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts;\n  /** The HTTP API over one store: tracking, sweep, bundle, preview, then the ingest router. */\n  handle(request: Request, env: Env, store: JourneyStore): Promise<Response>;\n  /** The scheduled sweep (`sweepSegments`) on a store of its own. */\n  sweep(env: Env): Promise<SweepResult>;\n  /**\n   * Make the bundle compiled into `version` live, once per process, only over an older live\n   * version (the store records it). Undefined when there is nothing to do; a failure is logged\n   * and retried a minute later.\n   */\n  applyOwnBundle(env: Env, version: BundleVersion | undefined): Promise<void> | undefined;\n}\n\n/** What the platform adapter itself contributes. */\nexport interface JourneyPlatform {\n  /** An HTTP/2 fetch for APNs, where the runtime's own fetch is HTTP/1.1 (Node). */\n  apnsFetch?: typeof fetch;\n}\n\nfunction sendsEmail(nodes: readonly NodeIR[]): boolean {\n  return nodes.some((node) => {\n    switch (node.type) {\n      case 'message':\n        return node.channel === 'email';\n      case 'wait_until':\n        return Array.isArray(node.onTimeout) && sendsEmail(node.onTimeout);\n      case 'branch':\n        return (\n          node.cases.some((branch) => sendsEmail(branch.flow)) || sendsEmail(node.otherwise ?? [])\n        );\n      case 'cohort':\n        return node.arms.some((arm) => sendsEmail(arm.flow));\n      default:\n        return false;\n    }\n  });\n}\n\nexport function createJourneyHost<Env extends JourneyEnv>(\n  options: JourneyHostOptions<Env>,\n  platform: JourneyPlatform = {}\n): JourneyHost<Env> {\n  const { config } = options;\n  const emailIds = indexTemplates('email', config.templates?.email);\n  // A config still on `emails` (its sender would be silently dropped) fails here, not at a send\n  assertEmailConfig(config, emailIds.values());\n  // A journey that emails with nowhere to send fails here too, not at its first email\n  if (options.email === undefined && options.messages === undefined) {\n    const emailing = compileConfig(config).workflows.filter((workflow) =>\n      sendsEmail(workflow.flow)\n    );\n    if (emailing.length > 0) {\n      throw new TypeError(\n        `workflows ${emailing.map((w) => `'${w.id}'`).join(', ')} send email, but the host has no ` +\n          '`email` transport: pass `email: (env) => cloudflareEmailTransport(...)` or `sesEmailTransport(...)`'\n      );\n    }\n  }\n  // Parsed once per env object: the runtime hands the same one to every request of an isolate\n  const checked = new WeakMap<object, Env>();\n  const checkEnv = (env: Env): Env => {\n    if (options.env === undefined) return env;\n    const cached = checked.get(env);\n    if (cached !== undefined) return cached;\n    const result = z.safeParse(options.env, env);\n    if (!result.success) {\n      // Names and reasons only: the values are secrets\n      throw new EnvValidationError(\n        result.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)\n      );\n    }\n    const merged: Env = { ...env, ...result.data };\n    checked.set(env, merged);\n    return merged;\n  };\n  let compiled: BundleIR | undefined;\n  const bundle = () => (compiled ??= compileConfig(config));\n  const emails = config.templates?.email;\n  const database = { schema: config.database?.schema ?? DEFAULT_SCHEMA };\n  // In fast-forward, segment windows scale with the journeys reading them (time-scale.ts)\n  const lease = (env: Env): Required<StoreLease> => {\n    const opened = options.store === undefined ? d1Store(env) : options.store(env, database);\n    const noop = async () => {};\n    const factor = runtimeFromConfig(config, env).timeScale;\n    return 'store' in opened\n      ? { store: scaleSegmentWindows(opened.store, factor), close: opened.close ?? noop }\n      : { store: scaleSegmentWindows(opened, factor), close: noop };\n  };\n\n  const messages = (env: Env, store: JourneyStore): MessageSender => {\n    if (options.messages !== undefined) return options.messages(env, store);\n    return channelsFromConfig(config, env, {\n      store,\n      email: options.email?.(env),\n      apnsFetch: platform.apnsFetch,\n    });\n  };\n\n  const observer = (env: Env, store: JourneyStore): JourneyObserver | undefined => {\n    if (options.observer !== undefined) return options.observer(env, store);\n    return store.reporting === undefined\n      ? undefined\n      : reportingObserver(store.reporting, env.WORKFLOW_ORIGIN);\n  };\n\n  const runParts = (env: Env, store: JourneyStore, params: JourneyParams): JourneyRunParts => ({\n    store,\n    env,\n    runtime:\n      options.runtime === undefined ? runtimeFromConfig(config, env) : options.runtime(env, params),\n    messages: messages(env, store),\n    // An action ref is a registered action structurally: the same object carries name, code and hash\n    actions: new RegistryActionInvoker(config.actions ?? []),\n    contract: config.contract,\n    validator: registryValidator(config.templates ?? {}),\n    observer: observer(env, store),\n  });\n\n  const json = (body: unknown, status = 200): Response =>\n    new Response(JSON.stringify(body), {\n      status,\n      headers: { 'content-type': 'application/json' },\n    });\n\n  const authorized = (request: Request, env: Env): boolean =>\n    env.API_TOKEN === undefined ||\n    request.headers.get('authorization') === `Bearer ${env.API_TOKEN}`;\n\n  const preview = emails === undefined ? undefined : registryRenderer(emails, config.email);\n\n  const handle = async (request: Request, env: Env, store: JourneyStore): Promise<Response> => {\n    const url = new URL(request.url);\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    if (url.pathname.startsWith('/t/') && store.reporting !== undefined) {\n      const openedEvent = config.webPush?.openedEvent;\n      const tracked = await handleTracking(request, store.reporting, {\n        legacyUnsubscribeUrl: config.email?.unsubscribeUrl,\n        product: config.title,\n        quickMs: config.email?.tracking?.quickClickMs,\n        pushOpened:\n          openedEvent === undefined\n            ? undefined\n            : async ({ messageId, userId, at }) => {\n                const payload: Record<string, unknown> = { message_id: messageId };\n                const contract = config.contract;\n                const verdict =\n                  contract === undefined ? undefined : checkEvent(contract, openedEvent, payload);\n                if (verdict !== undefined && !verdict.ok) {\n                  throw new ContractValidationError(openedEvent, verdict.issues);\n                }\n                // Keyed by the copy: a second tap of the same notification is the same event\n                await ingestEvent(\n                  env,\n                  {\n                    id: `${openedEvent}:${messageId}`,\n                    userId,\n                    event: openedEvent,\n                    payload: verdict?.data ?? payload,\n                    ts: at,\n                  },\n                  store\n                );\n              },\n      });\n      if (tracked !== undefined) return tracked;\n    }\n    if (url.pathname === '/segments/sweep') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      return json(await sweepSegments(env, store));\n    }\n    if (url.pathname === '/bundle') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      return json(bundle());\n    }\n    if (url.pathname === '/bundle/deploy') {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'POST') return json({ error: 'method not allowed' }, 405);\n      try {\n        return json(await deployBundle(env, bundle(), store));\n      } catch (error) {\n        if (!(error instanceof SchemaMismatchError)) throw error;\n        return json({ error: error.message, problems: error.problems }, 503);\n      }\n    }\n    if (emails !== undefined && preview !== undefined && url.pathname.startsWith('/preview/')) {\n      if (!authorized(request, env)) return json({ error: 'unauthorized' }, 401);\n      if (request.method !== 'GET') return json({ error: 'method not allowed' }, 405);\n      const key = url.pathname.slice('/preview/'.length);\n      if (!emailIds.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown = {};\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (typeof props !== 'object' || props === null || Array.isArray(props)) {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      try {\n        const { subject, html } = await preview(key, props as Record<string, ScalarIR>);\n        return new Response(html, {\n          headers: { 'content-type': 'text/html; charset=utf-8', 'x-subject': subject },\n        });\n      } catch (error) {\n        // The query string is the props: a refusal is the caller's to fix, with the field paths\n        if (error instanceof TemplateValidationError) {\n          return json({ error: error.message, issues: error.issues }, 400);\n        }\n        throw error;\n      }\n    }\n    return handleRequest(request, env, store, {\n      contract: config.contract,\n      mode: options.contractMode,\n    });\n  };\n\n  const sweep = async (env: Env) => {\n    const { store, close } = lease(env);\n    try {\n      return await sweepSegments(env, store);\n    } finally {\n      await close();\n    }\n  };\n\n  // The bundle compiled into this version goes live on its own, once per process: the first\n  // request or scheduled run reads which version's bundle is live (one row) and applies this one\n  // only over an older version, so one still serving during a rollout can never put its routes\n  // back. A failure (say the migrations have not run) is logged and retried a minute later. Only\n  // the request that starts the check gets its promise back: a request context cannot wait on\n  // another's I/O.\n  let applying: Promise<void> | undefined;\n  let retryAt = 0;\n  const applyOwnBundle = (env: Env, version: BundleVersion | undefined) => {\n    if (version === undefined || version.id === '' || Number.isNaN(version.createdAt)) {\n      return undefined;\n    }\n    if (applying !== undefined || Date.now() < retryAt) return undefined;\n    applying = (async () => {\n      const { store, close } = lease(env);\n      try {\n        if (store.liveBundleVersion === undefined) return; // D1: POST /bundle/deploy\n        const live = await store.liveBundleVersion();\n        if (live !== undefined && (live.id === version.id || live.createdAt >= version.createdAt))\n          return;\n        const result = await deployBundle(env, bundle(), store, version);\n        if (result.applied) console.log(`[workflow] version ${version.id} is live`);\n      } finally {\n        await close();\n      }\n    })().catch((error: unknown) => {\n      applying = undefined;\n      retryAt = Date.now() + 60_000;\n      console.error(`[workflow] could not make version ${version.id} live`, error);\n    });\n    return applying;\n  };\n\n  return { config, checkEnv, lease, bundle, runParts, handle, sweep, applyOwnBundle };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8FA,IAAa,qBAAb,cAAwC,MAAM;CAEvB;CADrB,OAAyB;CACzB,YAAY,QAAoC;EAC9C,MAAM,yCAAyC,OAAO,KAAK,MAAM,GAAG;EADjD,KAAA,SAAA;CAErB;AACF;AA8BA,SAAS,WAAW,OAAmC;CACrD,OAAO,MAAM,MAAM,SAAS;EAC1B,QAAQ,KAAK,MAAb;GACE,KAAK,WACH,OAAO,KAAK,YAAY;GAC1B,KAAK,cACH,OAAO,MAAM,QAAQ,KAAK,SAAS,KAAK,WAAW,KAAK,SAAS;GACnE,KAAK,UACH,OACE,KAAK,MAAM,MAAM,WAAW,WAAW,OAAO,IAAI,CAAC,KAAK,WAAW,KAAK,aAAa,CAAC,CAAC;GAE3F,KAAK,UACH,OAAO,KAAK,KAAK,MAAM,QAAQ,WAAW,IAAI,IAAI,CAAC;GACrD,SACE,OAAO;EACX;CACF,CAAC;AACH;AAEA,SAAgB,kBACd,SACA,WAA4B,CAAC,GACX;CAClB,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,eAAe,SAAS,OAAO,WAAW,KAAK;CAEhE,kBAAkB,QAAQ,SAAS,OAAO,CAAC;CAE3C,IAAI,QAAQ,UAAU,KAAA,KAAa,QAAQ,aAAa,KAAA,GAAW;EACjE,MAAM,WAAW,cAAc,MAAM,CAAC,CAAC,UAAU,QAAQ,aACvD,WAAW,SAAS,IAAI,CAC1B;EACA,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,UACR,aAAa,SAAS,KAAK,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,2IAE3D;CAEJ;CAEA,MAAM,0BAAU,IAAI,QAAqB;CACzC,MAAM,YAAY,QAAkB;EAClC,IAAI,QAAQ,QAAQ,KAAA,GAAW,OAAO;EACtC,MAAM,SAAS,QAAQ,IAAI,GAAG;EAC9B,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,MAAM,SAAS,EAAE,UAAU,QAAQ,KAAK,GAAG;EAC3C,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,mBACR,OAAO,MAAM,OAAO,KAAK,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,SAAS,IAAI,MAAM,SAAS,CAC5F;EAEF,MAAM,SAAc;GAAE,GAAG;GAAK,GAAG,OAAO;EAAK;EAC7C,QAAQ,IAAI,KAAK,MAAM;EACvB,OAAO;CACT;CACA,IAAI;CACJ,MAAM,eAAgB,aAAa,cAAc,MAAM;CACvD,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,WAAW,EAAE,QAAQ,OAAO,UAAU,UAAA,WAAyB;CAErE,MAAM,SAAS,QAAmC;EAChD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,QAAQ,GAAG,IAAI,QAAQ,MAAM,KAAK,QAAQ;EACvF,MAAM,OAAO,YAAY,CAAC;EAC1B,MAAM,SAAS,kBAAkB,QAAQ,GAAG,CAAC,CAAC;EAC9C,OAAO,WAAW,SACd;GAAE,OAAO,oBAAoB,OAAO,OAAO,MAAM;GAAG,OAAO,OAAO,SAAS;EAAK,IAChF;GAAE,OAAO,oBAAoB,QAAQ,MAAM;GAAG,OAAO;EAAK;CAChE;CAEA,MAAM,YAAY,KAAU,UAAuC;EACjE,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAO,mBAAmB,QAAQ,KAAK;GACrC;GACA,OAAO,QAAQ,QAAQ,GAAG;GAC1B,WAAW,SAAS;EACtB,CAAC;CACH;CAEA,MAAM,YAAY,KAAU,UAAqD;EAC/E,IAAI,QAAQ,aAAa,KAAA,GAAW,OAAO,QAAQ,SAAS,KAAK,KAAK;EACtE,OAAO,MAAM,cAAc,KAAA,IACvB,KAAA,IACA,kBAAkB,MAAM,WAAW,IAAI,eAAe;CAC5D;CAEA,MAAM,YAAY,KAAU,OAAqB,YAA4C;EAC3F;EACA;EACA,SACE,QAAQ,YAAY,KAAA,IAAY,kBAAkB,QAAQ,GAAG,IAAI,QAAQ,QAAQ,KAAK,MAAM;EAC9F,UAAU,SAAS,KAAK,KAAK;EAE7B,SAAS,IAAI,sBAAsB,OAAO,WAAW,CAAC,CAAC;EACvD,UAAU,OAAO;EACjB,WAAW,kBAAkB,OAAO,aAAa,CAAC,CAAC;EACnD,UAAU,SAAS,KAAK,KAAK;CAC/B;CAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACjC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;CAEH,MAAM,cAAc,SAAkB,QACpC,IAAI,cAAc,KAAA,KAClB,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,IAAI;CAEzD,MAAM,UAAU,WAAW,KAAA,IAAY,KAAA,IAAY,iBAAiB,QAAQ,OAAO,KAAK;CAExF,MAAM,SAAS,OAAO,SAAkB,KAAU,UAA2C;EAC3F,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAE/B,IAAI,IAAI,SAAS,WAAW,KAAK,KAAK,MAAM,cAAc,KAAA,GAAW;GACnE,MAAM,cAAc,OAAO,SAAS;GACpC,MAAM,UAAU,MAAM,eAAe,SAAS,MAAM,WAAW;IAC7D,sBAAsB,OAAO,OAAO;IACpC,SAAS,OAAO;IAChB,SAAS,OAAO,OAAO,UAAU;IACjC,YACE,gBAAgB,KAAA,IACZ,KAAA,IACA,OAAO,EAAE,WAAW,QAAQ,SAAS;KACnC,MAAM,UAAmC,EAAE,YAAY,UAAU;KACjE,MAAM,WAAW,OAAO;KACxB,MAAM,UACJ,aAAa,KAAA,IAAY,KAAA,IAAY,WAAW,UAAU,aAAa,OAAO;KAChF,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,IACpC,MAAM,IAAI,wBAAwB,aAAa,QAAQ,MAAM;KAG/D,MAAM,YACJ,KACA;MACE,IAAI,GAAG,YAAY,GAAG;MACtB;MACA,OAAO;MACP,SAAS,SAAS,QAAQ;MAC1B,IAAI;KACN,GACA,KACF;IACF;GACR,CAAC;GACD,IAAI,YAAY,KAAA,GAAW,OAAO;EACpC;EACA,IAAI,IAAI,aAAa,mBAAmB;GACtC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,OAAO,KAAK,MAAM,cAAc,KAAK,KAAK,CAAC;EAC7C;EACA,IAAI,IAAI,aAAa,WAAW;GAC9B,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,OAAO,KAAK,OAAO,CAAC;EACtB;EACA,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC/E,IAAI;IACF,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,GAAG,KAAK,CAAC;GACtD,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,sBAAsB,MAAM;IACnD,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,UAAU,MAAM;IAAS,GAAG,GAAG;GACrE;EACF;EACA,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,KAAa,IAAI,SAAS,WAAW,WAAW,GAAG;GACzF,IAAI,CAAC,WAAW,SAAS,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GACzE,IAAI,QAAQ,WAAW,OAAO,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC9E,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEpF,IAAI,QAAiB,CAAC;GACtB,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAE3D,IAAI;IACF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,KAAK,KAAiC;IAC9E,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;KAAE,gBAAgB;KAA4B,aAAa;IAAQ,EAC9E,CAAC;GACH,SAAS,OAAO;IAEd,IAAI,iBAAiB,yBACnB,OAAO,KAAK;KAAE,OAAO,MAAM;KAAS,QAAQ,MAAM;IAAO,GAAG,GAAG;IAEjE,MAAM;GACR;EACF;EACA,OAAO,cAAc,SAAS,KAAK,OAAO;GACxC,UAAU,OAAO;GACjB,MAAM,QAAQ;EAChB,CAAC;CACH;CAEA,MAAM,QAAQ,OAAO,QAAa;EAChC,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;EAClC,IAAI;GACF,OAAO,MAAM,cAAc,KAAK,KAAK;EACvC,UAAU;GACR,MAAM,MAAM;EACd;CACF;CAQA,IAAI;CACJ,IAAI,UAAU;CACd,MAAM,kBAAkB,KAAU,YAAuC;EACvE,IAAI,YAAY,KAAA,KAAa,QAAQ,OAAO,MAAM,OAAO,MAAM,QAAQ,SAAS,GAC9E;EAEF,IAAI,aAAa,KAAA,KAAa,KAAK,IAAI,IAAI,SAAS,OAAO,KAAA;EAC3D,YAAY,YAAY;GACtB,MAAM,EAAE,OAAO,UAAU,MAAM,GAAG;GAClC,IAAI;IACF,IAAI,MAAM,sBAAsB,KAAA,GAAW;IAC3C,MAAM,OAAO,MAAM,MAAM,kBAAkB;IAC3C,IAAI,SAAS,KAAA,MAAc,KAAK,OAAO,QAAQ,MAAM,KAAK,aAAa,QAAQ,YAC7E;IAEF,KAAI,MADiB,aAAa,KAAK,OAAO,GAAG,OAAO,OAAO,EAAA,CACpD,SAAS,QAAQ,IAAI,sBAAsB,QAAQ,GAAG,SAAS;GAC5E,UAAU;IACR,MAAM,MAAM;GACd;EACF,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;GAC7B,WAAW,KAAA;GACX,UAAU,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,qCAAqC,QAAQ,GAAG,QAAQ,KAAK;EAC7E,CAAC;EACD,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAO;EAAQ;EAAU;EAAQ;EAAO;CAAe;AACpF"}

package/dist/reporting/observer.cjs

@@ -36,6 +36,7 @@ function reportingObserver(reporting, origin) {
 						return `${base}/t/${purpose === "unsubscribe" ? "u" : "l"}/${id}/${urls.length - 1}`;
 					},
 					pixel: `${base}/t/o/${id}`,
+					unsubscribe: `${base}/t/u/${id}`,
 					commit: () => reporting.recordLinks(id, urls)
 				};
 			}

package/dist/reporting/observer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"observer.cjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KAEtB,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}
+{"version":3,"file":"observer.cjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}

package/dist/reporting/observer.mjs

@@ -35,6 +35,7 @@ function reportingObserver(reporting, origin) {
 						return `${base}/t/${purpose === "unsubscribe" ? "u" : "l"}/${id}/${urls.length - 1}`;
 					},
 					pixel: `${base}/t/o/${id}`,
+					unsubscribe: `${base}/t/u/${id}`,
 					commit: () => reporting.recordLinks(id, urls)
 				};
 			}

package/dist/reporting/observer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"observer.mjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KAEtB,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}
+{"version":3,"file":"observer.mjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}

package/dist/reporting/tracking.cjs

@@ -34,9 +34,10 @@ async function handleTracking(request, reporting, options = {}) {
 	if ((kind === "l" || kind === "u" || kind === "c") && position !== void 0 && read) {
 		const target = await recordClick(reporting, id, Number(position), who, options);
 		if (target === void 0) return page(options, "This link has expired.", 404);
-		if (kind === "u" || kind === "c" && require_email.isUnsubscribeLink(target, options.legacyUnsubscribeUrl)) return page(options, `Unsubscribe from ${escape(options.product ?? "these")} emails?`, 200, `<form method="post" action="/t/u/${id}"><button type="submit">Unsubscribe</button></form>`);
+		if (kind === "u" || kind === "c" && require_email.isUnsubscribeLink(target, options.legacyUnsubscribeUrl)) return confirmUnsubscribe(options, id);
 		return Response.redirect(target, 302);
 	}
+	if (kind === "u" && position === void 0 && read) return confirmUnsubscribe(options, id);
 	if (kind === "d" && who.method === "POST") {
 		const known = await reporting.recordDeviceDelivered(id, Date.now());
 		return new Response(null, { status: known ? 204 : 404 });
@@ -65,10 +66,14 @@ async function handleTracking(request, reporting, options = {}) {
 		return new Response(null, { status: known ? 204 : 404 });
 	}
 	if (kind === "u" && who.method === "POST") {
-		if (!await reporting.recordUnsubscribe(id, Date.now())) return page(options, "This link has expired.", 404);
+		if (!await reporting.recordUnsubscribe(id, Date.now())) return page(options, "You won't get these emails anymore.");
 		return page(options, options.product === void 0 ? "You won't get these emails anymore." : `You won't get these emails from ${escape(options.product)} anymore.`);
 	}
 }
+/** The question an unsubscribe link, or the List-Unsubscribe URL opened in a browser, asks. */
+function confirmUnsubscribe(options, id) {
+	return page(options, `Unsubscribe from ${escape(options.product ?? "these")} emails?`, 200, `<form method="post" action="/t/u/${id}"><button type="submit">Unsubscribe</button></form>`);
+}
 /**
 * A journey push tapped open, as the app reports it (`JourneyClient.messageOpened`): an open on
 * the copy — only the recipient's own, and never a machine, since no proxy or scanner taps a