@shware/workflow 3.2.0 → 4.0.0

package/dist/reporting/tracking.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"tracking.cjs","names":["isUnsubscribeLink","classifyOpen","BURST_WINDOW_MS","classifyClick"],"sources":["../../src/reporting/tracking.ts"],"sourcesContent":["import { isUnsubscribeLink } from '../email';\nimport type { JourneyReporting } from '../store';\nimport { BURST_WINDOW_MS, classifyClick, classifyOpen } from './classify';\n\n/**\n * The endpoints a journey email's tracking points at (see ./observer.ts), served by journeyWorker\n * without a bearer — recipients open them:\n *\n *   GET /t/o/<message>             the open pixel: records the open, answers a 1×1 GIF\n *   GET /t/l/<message>/<position>  a link: records the click, redirects to the recorded URL\n *   GET /t/u/<message>/<position>  the unsubscribe link: records the click, asks to confirm\n *   POST /t/u/<message>            the unsubscribe confirmation\n *   GET /t/c/<message>/<position>  a link of an email sent before links carried their purpose\n *   POST /t/d/<message>            a push the device received (iOS's notification service\n *                                  extension, a browser's service worker)\n *   POST /t/p/<message>            a push opened, reported by a browser's service worker\n *\n * Every open and click is recorded with its verdict (./classify.ts), and the message keeps its\n * first open and click of each kind. The redirect goes only to the URL recorded for that position,\n * never to one the request carries, so the endpoint cannot bounce visitors anywhere else. An\n * email's unsubscribe link is a tracked link too, and which link it is was fixed when the email was\n * sent (its route): following it shows a confirmation page, and only the confirmation — a POST,\n * which no link scanner sends — counts. Changing a template's or the config's unsubscribe URL, or\n * removing the template, changes nothing for emails already sent.\n *\n * Emails sent before that carry `/t/c/` links, which say nothing of their purpose: one is the\n * unsubscribe link when its recorded URL is `legacyUnsubscribeUrl` (the global unsubscribe URL\n * those emails were all sent with), as it was then.\n */\n\nexport interface TrackingOptions {\n  /**\n   * The unsubscribe URL emails sent with `/t/c/` links carried (the config's `email.unsubscribeUrl`\n   * by default): following such a link to it asks for confirmation instead of redirecting.\n   */\n  legacyUnsubscribeUrl?: string | undefined;\n  /** The name the confirmation pages show (the config's `title`). */\n  product?: string | undefined;\n  /** `email.tracking.quickClickMs`: how soon after delivery an open or click is a weak machine signal. */\n  quickMs?: number | undefined;\n  /** A browser reported a push tapped (`/t/p`): the host records it as an event too (`webPush.openedEvent`). */\n  pushOpened?:\n    | ((open: { messageId: string; userId: string; at: number }) => Promise<void>)\n    | undefined;\n}\n\nconst GIF = Uint8Array.from(\n  atob('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'),\n  (char) => char.charCodeAt(0)\n);\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ninterface Requester {\n  method: string;\n  userAgent: string | null;\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\nfunction requester(request: Request): Requester {\n  const cf = (\n    request as Request & { cf?: { asn?: number; asOrganization?: string; country?: string } }\n  ).cf;\n  return {\n    method: request.method,\n    userAgent: request.headers.get('user-agent'),\n    asn: cf?.asn ?? null,\n    organization: cf?.asOrganization ?? null,\n    country: cf?.country ?? null,\n  };\n}\n\n/** A `/t/...` request's response, or undefined when the path is not a tracking route. */\nexport async function handleTracking(\n  request: Request,\n  reporting: JourneyReporting,\n  options: TrackingOptions = {}\n): Promise<Response | undefined> {\n  const url = new URL(request.url);\n  const path = url.pathname.split('/');\n  const root = path.at(1);\n  const kind = path.at(2);\n  const id = path.at(3);\n  const position = path.at(4);\n  if (root !== 't' || id === undefined || !UUID.test(id)) return undefined;\n  const who = requester(request);\n  const read = who.method === 'GET' || who.method === 'HEAD';\n  if (kind === 'o' && read) {\n    await recordOpen(reporting, id, who, options);\n    return new Response(who.method === 'HEAD' ? null : GIF, {\n      headers: { 'content-type': 'image/gif', 'cache-control': 'no-store, max-age=0' },\n    });\n  }\n  if ((kind === 'l' || kind === 'u' || kind === 'c') && position !== undefined && read) {\n    const target = await recordClick(reporting, id, Number(position), who, options);\n    if (target === undefined) return page(options, 'This link has expired.', 404);\n    const unsubscribe =\n      kind === 'u' || (kind === 'c' && isUnsubscribeLink(target, options.legacyUnsubscribeUrl));\n    if (unsubscribe) {\n      return page(\n        options,\n        `Unsubscribe from ${escape(options.product ?? 'these')} emails?`,\n        200,\n        `<form method=\"post\" action=\"/t/u/${id}\"><button type=\"submit\">Unsubscribe</button></form>`\n      );\n    }\n    return Response.redirect(target, 302);\n  }\n  if (kind === 'd' && who.method === 'POST') {\n    const known = await reporting.recordDeviceDelivered(id, Date.now());\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'p' && who.method === 'POST') {\n    // A notification tap: a person, as the message id is what proves it is theirs\n    const at = Date.now();\n    let userId: string | undefined;\n    const known = await reporting.recordOpen(id, (message) => {\n      userId = message.userId;\n      return { at, machine: false, reason: null, ...network(who) };\n    });\n    if (known && userId !== undefined && options.pushOpened !== undefined) {\n      try {\n        await options.pushOpened({ messageId: id, userId, at });\n      } catch (error) {\n        // The open is recorded; the event is the host's extra, never a reason to fail the beacon\n        console.error(`[workflow] recording push open ${id} as an event failed`, error);\n      }\n    }\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'u' && who.method === 'POST') {\n    const known = await reporting.recordUnsubscribe(id, Date.now());\n    if (!known) return page(options, 'This link has expired.', 404);\n    return page(\n      options,\n      options.product === undefined\n        ? \"You won't get these emails anymore.\"\n        : `You won't get these emails from ${escape(options.product)} anymore.`\n    );\n  }\n  return undefined;\n}\n\n/**\n * A journey push tapped open, as the app reports it (`JourneyClient.messageOpened`): an open on\n * the copy — only the recipient's own, and never a machine, since no proxy or scanner taps a\n * notification. False when the message is unknown or not the user's.\n */\nexport async function recordPushOpen(\n  reporting: JourneyReporting,\n  userId: string,\n  messageId: string,\n  at = Date.now()\n): Promise<boolean> {\n  if (!UUID.test(messageId)) return false;\n  let recorded = false;\n  await reporting.recordOpen(messageId, (message) => {\n    if (message.userId !== userId) return undefined;\n    recorded = true;\n    return {\n      at,\n      machine: false,\n      reason: null,\n      userAgent: null,\n      asn: null,\n      organization: null,\n      country: null,\n    };\n  });\n  return recorded;\n}\n\nasync function recordOpen(\n  reporting: JourneyReporting,\n  id: string,\n  who: Requester,\n  options: TrackingOptions\n) {\n  const at = Date.now();\n  await reporting.recordOpen(id, (message) => ({\n    at,\n    ...classifyOpen(\n      { ...who, sinceDeliveredMs: at - message.deliveredAt },\n      { quickMs: options.quickMs }\n    ),\n    ...network(who),\n  }));\n}\n\nconst network = (who: Requester) => ({\n  userAgent: who.userAgent,\n  asn: who.asn,\n  organization: who.organization,\n  country: who.country,\n});\n\n/** Records the click and answers the URL to send the visitor to, or undefined for an unknown link. */\nasync function recordClick(\n  reporting: JourneyReporting,\n  id: string,\n  position: number,\n  who: Requester,\n  options: TrackingOptions\n): Promise<string | undefined> {\n  if (!Number.isInteger(position) || position < 0) return undefined;\n  const at = Date.now();\n  const recorded = await reporting.recordClick(id, position, at, BURST_WINDOW_MS, (link) => {\n    const linksInBurst = new Set([position, ...link.recent.map((click) => click.position)]).size;\n    const verdict = classifyClick(\n      { ...who, sinceDeliveredMs: at - link.deliveredAt, linksInBurst, linkCount: link.linkCount },\n      { quickMs: options.quickMs }\n    );\n    return {\n      engagement: { at, ...verdict, ...network(who) },\n      backdate: verdict.reason === 'link_burst' || verdict.reason === 'quick+link_pair',\n    };\n  });\n  return recorded?.url;\n}\n\nfunction escape(text: string): string {\n  return text.replace(/[&<>\"']/g, (c) => `&#${c.charCodeAt(0)};`);\n}\n\nfunction page(options: TrackingOptions, message: string, status = 200, extra = ''): Response {\n  const title = escape(options.product ?? 'Email');\n  const html = `<!doctype html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>${title}</title><style>body{font:16px system-ui;margin:0;display:grid;place-items:center;min-height:100vh;background:#fafafa;color:#18181b}main{text-align:center;padding:24px}button{font:inherit;padding:10px 20px;border-radius:9999px;border:0;background:#18181b;color:#fff;cursor:pointer}</style></head><body><main><p>${message}</p>${extra}</main></body></html>`;\n  return new Response(html, { status, headers: { 'content-type': 'text/html; charset=utf-8' } });\n}\n"],"mappings":";;;;AA8CA,MAAM,MAAM,WAAW,KACrB,KAAK,0DAA0D,IAC9D,SAAS,KAAK,WAAW,CAAC,CAC7B;AACA,MAAM,OAAO;AAUb,SAAS,UAAU,SAA6B;CAC9C,MAAM,KACJ,QACA;CACF,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ,QAAQ,IAAI,YAAY;EAC3C,KAAK,IAAI,OAAO;EAChB,cAAc,IAAI,kBAAkB;EACpC,SAAS,IAAI,WAAW;CAC1B;AACF;;AAGA,eAAsB,eACpB,SACA,WACA,UAA2B,CAAC,GACG;CAE/B,MAAM,OAAO,IADG,IAAI,QAAQ,GACb,CAAC,CAAC,SAAS,MAAM,GAAG;CACnC,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,KAAK,KAAK,GAAG,CAAC;CACpB,MAAM,WAAW,KAAK,GAAG,CAAC;CAC1B,IAAI,SAAS,OAAO,OAAO,KAAA,KAAa,CAAC,KAAK,KAAK,EAAE,GAAG,OAAO,KAAA;CAC/D,MAAM,MAAM,UAAU,OAAO;CAC7B,MAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW;CACpD,IAAI,SAAS,OAAO,MAAM;EACxB,MAAM,WAAW,WAAW,IAAI,KAAK,OAAO;EAC5C,OAAO,IAAI,SAAS,IAAI,WAAW,SAAS,OAAO,KAAK,EACtD,SAAS;GAAE,gBAAgB;GAAa,iBAAiB;EAAsB,EACjF,CAAC;CACH;CACA,KAAK,SAAS,OAAO,SAAS,OAAO,SAAS,QAAQ,aAAa,KAAA,KAAa,MAAM;EACpF,MAAM,SAAS,MAAM,YAAY,WAAW,IAAI,OAAO,QAAQ,GAAG,KAAK,OAAO;EAC9E,IAAI,WAAW,KAAA,GAAW,OAAO,KAAK,SAAS,0BAA0B,GAAG;EAG5E,IADE,SAAS,OAAQ,SAAS,OAAOA,cAAAA,kBAAkB,QAAQ,QAAQ,oBAAoB,GAEvF,OAAO,KACL,SACA,oBAAoB,OAAO,QAAQ,WAAW,OAAO,EAAE,WACvD,KACA,oCAAoC,GAAG,oDACzC;EAEF,OAAO,SAAS,SAAS,QAAQ,GAAG;CACtC;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EACzC,MAAM,QAAQ,MAAM,UAAU,sBAAsB,IAAI,KAAK,IAAI,CAAC;EAClE,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EAEzC,MAAM,KAAK,KAAK,IAAI;EACpB,IAAI;EACJ,MAAM,QAAQ,MAAM,UAAU,WAAW,KAAK,YAAY;GACxD,SAAS,QAAQ;GACjB,OAAO;IAAE;IAAI,SAAS;IAAO,QAAQ;IAAM,GAAG,QAAQ,GAAG;GAAE;EAC7D,CAAC;EACD,IAAI,SAAS,WAAW,KAAA,KAAa,QAAQ,eAAe,KAAA,GAC1D,IAAI;GACF,MAAM,QAAQ,WAAW;IAAE,WAAW;IAAI;IAAQ;GAAG,CAAC;EACxD,SAAS,OAAO;GAEd,QAAQ,MAAM,kCAAkC,GAAG,sBAAsB,KAAK;EAChF;EAEF,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EAEzC,IAAI,CAAC,MADe,UAAU,kBAAkB,IAAI,KAAK,IAAI,CAAC,GAClD,OAAO,KAAK,SAAS,0BAA0B,GAAG;EAC9D,OAAO,KACL,SACA,QAAQ,YAAY,KAAA,IAChB,wCACA,mCAAmC,OAAO,QAAQ,OAAO,EAAE,UACjE;CACF;AAEF;;;;;;AAOA,eAAsB,eACpB,WACA,QACA,WACA,KAAK,KAAK,IAAI,GACI;CAClB,IAAI,CAAC,KAAK,KAAK,SAAS,GAAG,OAAO;CAClC,IAAI,WAAW;CACf,MAAM,UAAU,WAAW,YAAY,YAAY;EACjD,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAA;EACtC,WAAW;EACX,OAAO;GACL;GACA,SAAS;GACT,QAAQ;GACR,WAAW;GACX,KAAK;GACL,cAAc;GACd,SAAS;EACX;CACF,CAAC;CACD,OAAO;AACT;AAEA,eAAe,WACb,WACA,IACA,KACA,SACA;CACA,MAAM,KAAK,KAAK,IAAI;CACpB,MAAM,UAAU,WAAW,KAAK,aAAa;EAC3C;EACA,GAAGC,2BAAAA,aACD;GAAE,GAAG;GAAK,kBAAkB,KAAK,QAAQ;EAAY,GACrD,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,GAAG,QAAQ,GAAG;CAChB,EAAE;AACJ;AAEA,MAAM,WAAW,SAAoB;CACnC,WAAW,IAAI;CACf,KAAK,IAAI;CACT,cAAc,IAAI;CAClB,SAAS,IAAI;AACf;;AAGA,eAAe,YACb,WACA,IACA,UACA,KACA,SAC6B;CAC7B,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAA;CACxD,MAAM,KAAK,KAAK,IAAI;CAYpB,QAAO,MAXgB,UAAU,YAAY,IAAI,UAAU,IAAIC,2BAAAA,kBAAkB,SAAS;EACxF,MAAM,gCAAe,IAAI,IAAI,CAAC,UAAU,GAAG,KAAK,OAAO,KAAK,UAAU,MAAM,QAAQ,CAAC,CAAC,EAAA,CAAE;EACxF,MAAM,UAAUC,2BAAAA,cACd;GAAE,GAAG;GAAK,kBAAkB,KAAK,KAAK;GAAa;GAAc,WAAW,KAAK;EAAU,GAC3F,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,OAAO;GACL,YAAY;IAAE;IAAI,GAAG;IAAS,GAAG,QAAQ,GAAG;GAAE;GAC9C,UAAU,QAAQ,WAAW,gBAAgB,QAAQ,WAAW;EAClE;CACF,CAAC,EAAA,EACgB;AACnB;AAEA,SAAS,OAAO,MAAsB;CACpC,OAAO,KAAK,QAAQ,aAAa,MAAM,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE;AAChE;AAEA,SAAS,KAAK,SAA0B,SAAiB,SAAS,KAAK,QAAQ,IAAc;CAE3F,MAAM,OAAO,8HADC,OAAO,QAAQ,WAAW,OACuG,EAAE,wTAAwT,QAAQ,MAAM,MAAM;CAC7d,OAAO,IAAI,SAAS,MAAM;EAAE;EAAQ,SAAS,EAAE,gBAAgB,2BAA2B;CAAE,CAAC;AAC/F"}
+{"version":3,"file":"tracking.cjs","names":["classifyOpen","BURST_WINDOW_MS","classifyClick"],"sources":["../../src/reporting/tracking.ts"],"sourcesContent":["import type { JourneyReporting } from '../store';\nimport { BURST_WINDOW_MS, classifyClick, classifyOpen } from './classify';\n\n/**\n * The endpoints a journey email's tracking points at (see ./observer.ts), served by journeyWorker\n * without a bearer — recipients open them:\n *\n *   GET /t/o/<message>             the open pixel: records the open, answers a 1×1 GIF\n *   GET /t/l/<message>/<position>  a link: records the click, redirects to the recorded URL\n *   GET /t/u/<message>/<position>  the unsubscribe link: records the click, asks to confirm\n *   GET  /t/u/<message>            the List-Unsubscribe header's URL, opened: asks to confirm\n *   POST /t/u/<message>            the unsubscribe confirmation, and the header's one-click\n *                                  unsubscribe (RFC 8058: a mail client's button posts here)\n *   POST /t/d/<message>            a push the device received (iOS's notification service\n *                                  extension, a browser's service worker)\n *   POST /t/p/<message>            a push opened, reported by a browser's service worker\n *\n * Every open and click is recorded with its verdict (./classify.ts), and the message keeps its\n * first open and click of each kind. The redirect goes only to the URL recorded for that position,\n * never to one the request carries, so the endpoint cannot bounce visitors anywhere else. An\n * email's unsubscribe link is a tracked link too, and which link it is was fixed when the email was\n * sent (its route): following it shows a confirmation page, and only the confirmation — a POST,\n * which no link scanner sends — counts. Changing a template's or the config's unsubscribe URL, or\n * removing the template, changes nothing for emails already sent.\n */\n\nexport interface TrackingOptions {\n  /** The name the confirmation pages show (the config's `title`). */\n  product?: string | undefined;\n  /** `email.tracking.quickClickMs`: how soon after delivery an open or click is a weak machine signal. */\n  quickMs?: number | undefined;\n  /** A browser reported a push tapped (`/t/p`): the host records it as an event too (`webPush.openedEvent`). */\n  pushOpened?:\n    | ((open: { messageId: string; userId: string; at: number }) => Promise<void>)\n    | undefined;\n  /**\n   * An unsubscribe was recorded (`POST /t/u`): the host wakes the user's waits that read email\n   * reachability, so an `exitWhen: not(reachable('email'))` takes effect at once. Its failure is\n   * logged, never a reason to fail the unsubscribe.\n   */\n  onUnsubscribed?:\n    | ((unsubscribe: { messageId: string; userId: string; at: number }) => Promise<void>)\n    | undefined;\n}\n\nconst GIF = Uint8Array.from(\n  atob('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'),\n  (char) => char.charCodeAt(0)\n);\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ninterface Requester {\n  method: string;\n  userAgent: string | null;\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\nfunction requester(request: Request): Requester {\n  const cf = (\n    request as Request & { cf?: { asn?: number; asOrganization?: string; country?: string } }\n  ).cf;\n  return {\n    method: request.method,\n    userAgent: request.headers.get('user-agent'),\n    asn: cf?.asn ?? null,\n    organization: cf?.asOrganization ?? null,\n    country: cf?.country ?? null,\n  };\n}\n\n/** A `/t/...` request's response, or undefined when the path is not a tracking route. */\nexport async function handleTracking(\n  request: Request,\n  reporting: JourneyReporting,\n  options: TrackingOptions = {}\n): Promise<Response | undefined> {\n  const url = new URL(request.url);\n  const path = url.pathname.split('/');\n  const root = path.at(1);\n  const kind = path.at(2);\n  const id = path.at(3);\n  const position = path.at(4);\n  if (root !== 't' || id === undefined || !UUID.test(id)) return undefined;\n  const who = requester(request);\n  const read = who.method === 'GET' || who.method === 'HEAD';\n  if (kind === 'o' && read) {\n    await recordOpen(reporting, id, who, options);\n    return new Response(who.method === 'HEAD' ? null : GIF, {\n      headers: { 'content-type': 'image/gif', 'cache-control': 'no-store, max-age=0' },\n    });\n  }\n  if ((kind === 'l' || kind === 'u') && position !== undefined && read) {\n    const target = await recordClick(reporting, id, Number(position), who, options);\n    if (target === undefined) return page(options, 'This link has expired.', 404);\n    if (kind === 'u') return confirmUnsubscribe(options, id);\n    return Response.redirect(target, 302);\n  }\n  // The List-Unsubscribe URL opened in a browser (a client without one-click): the same question\n  if (kind === 'u' && position === undefined && read) return confirmUnsubscribe(options, id);\n  if (kind === 'd' && who.method === 'POST') {\n    const known = await reporting.recordDeviceDelivered(id, Date.now());\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'p' && who.method === 'POST') {\n    // A notification tap: a person, as the message id is what proves it is theirs\n    const at = Date.now();\n    let userId: string | undefined;\n    const known = await reporting.recordOpen(id, (message) => {\n      userId = message.userId;\n      return { at, machine: false, reason: null, ...network(who) };\n    });\n    if (known && userId !== undefined && options.pushOpened !== undefined) {\n      try {\n        await options.pushOpened({ messageId: id, userId, at });\n      } catch (error) {\n        // The open is recorded; the event is the host's extra, never a reason to fail the beacon\n        console.error(`[workflow] recording push open ${id} as an event failed`, error);\n      }\n    }\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'u' && who.method === 'POST') {\n    const at = Date.now();\n    const unsubscribed = await reporting.recordUnsubscribe(id, at);\n    // A mail client's one-click POST must succeed: for a copy no longer on record (its user\n    // erased) there is nothing left to send to, so the answer is the same\n    if (unsubscribed === undefined) return page(options, \"You won't get these emails anymore.\");\n    if (options.onUnsubscribed !== undefined) {\n      try {\n        await options.onUnsubscribed({ messageId: id, userId: unsubscribed.userId, at });\n      } catch (error) {\n        console.error(`[workflow] acting on the unsubscribe of ${id} failed`, error);\n      }\n    }\n    return page(\n      options,\n      options.product === undefined\n        ? \"You won't get these emails anymore.\"\n        : `You won't get these emails from ${escape(options.product)} anymore.`\n    );\n  }\n  return undefined;\n}\n\n/** The question an unsubscribe link, or the List-Unsubscribe URL opened in a browser, asks. */\nfunction confirmUnsubscribe(options: TrackingOptions, id: string): Response {\n  return page(\n    options,\n    `Unsubscribe from ${escape(options.product ?? 'these')} emails?`,\n    200,\n    `<form method=\"post\" action=\"/t/u/${id}\"><button type=\"submit\">Unsubscribe</button></form>`\n  );\n}\n\n/**\n * A journey push tapped open, as the app reports it (`JourneyClient.messageOpened`): an open on\n * the copy — only the recipient's own, and never a machine, since no proxy or scanner taps a\n * notification. False when the message is unknown or not the user's.\n */\nexport async function recordPushOpen(\n  reporting: JourneyReporting,\n  userId: string,\n  messageId: string,\n  at = Date.now()\n): Promise<boolean> {\n  if (!UUID.test(messageId)) return false;\n  let recorded = false;\n  await reporting.recordOpen(messageId, (message) => {\n    if (message.userId !== userId) return undefined;\n    recorded = true;\n    return {\n      at,\n      machine: false,\n      reason: null,\n      userAgent: null,\n      asn: null,\n      organization: null,\n      country: null,\n    };\n  });\n  return recorded;\n}\n\nasync function recordOpen(\n  reporting: JourneyReporting,\n  id: string,\n  who: Requester,\n  options: TrackingOptions\n) {\n  const at = Date.now();\n  await reporting.recordOpen(id, (message) => ({\n    at,\n    ...classifyOpen(\n      { ...who, sinceDeliveredMs: at - message.deliveredAt },\n      { quickMs: options.quickMs }\n    ),\n    ...network(who),\n  }));\n}\n\nconst network = (who: Requester) => ({\n  userAgent: who.userAgent,\n  asn: who.asn,\n  organization: who.organization,\n  country: who.country,\n});\n\n/** Records the click and answers the URL to send the visitor to, or undefined for an unknown link. */\nasync function recordClick(\n  reporting: JourneyReporting,\n  id: string,\n  position: number,\n  who: Requester,\n  options: TrackingOptions\n): Promise<string | undefined> {\n  if (!Number.isInteger(position) || position < 0) return undefined;\n  const at = Date.now();\n  const recorded = await reporting.recordClick(id, position, at, BURST_WINDOW_MS, (link) => {\n    const linksInBurst = new Set([position, ...link.recent.map((click) => click.position)]).size;\n    const verdict = classifyClick(\n      { ...who, sinceDeliveredMs: at - link.deliveredAt, linksInBurst, linkCount: link.linkCount },\n      { quickMs: options.quickMs }\n    );\n    return {\n      engagement: { at, ...verdict, ...network(who) },\n      backdate: verdict.reason === 'link_burst' || verdict.reason === 'quick+link_pair',\n    };\n  });\n  return recorded?.url;\n}\n\nfunction escape(text: string): string {\n  return text.replace(/[&<>\"']/g, (c) => `&#${c.charCodeAt(0)};`);\n}\n\nfunction page(options: TrackingOptions, message: string, status = 200, extra = ''): Response {\n  const title = escape(options.product ?? 'Email');\n  const html = `<!doctype html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>${title}</title><style>body{font:16px system-ui;margin:0;display:grid;place-items:center;min-height:100vh;background:#fafafa;color:#18181b}main{text-align:center;padding:24px}button{font:inherit;padding:10px 20px;border-radius:9999px;border:0;background:#18181b;color:#fff;cursor:pointer}</style></head><body><main><p>${message}</p>${extra}</main></body></html>`;\n  return new Response(html, { status, headers: { 'content-type': 'text/html; charset=utf-8' } });\n}\n"],"mappings":";;;AA6CA,MAAM,MAAM,WAAW,KACrB,KAAK,0DAA0D,IAC9D,SAAS,KAAK,WAAW,CAAC,CAC7B;AACA,MAAM,OAAO;AAUb,SAAS,UAAU,SAA6B;CAC9C,MAAM,KACJ,QACA;CACF,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ,QAAQ,IAAI,YAAY;EAC3C,KAAK,IAAI,OAAO;EAChB,cAAc,IAAI,kBAAkB;EACpC,SAAS,IAAI,WAAW;CAC1B;AACF;;AAGA,eAAsB,eACpB,SACA,WACA,UAA2B,CAAC,GACG;CAE/B,MAAM,OAAO,IADG,IAAI,QAAQ,GACb,CAAC,CAAC,SAAS,MAAM,GAAG;CACnC,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,KAAK,KAAK,GAAG,CAAC;CACpB,MAAM,WAAW,KAAK,GAAG,CAAC;CAC1B,IAAI,SAAS,OAAO,OAAO,KAAA,KAAa,CAAC,KAAK,KAAK,EAAE,GAAG,OAAO,KAAA;CAC/D,MAAM,MAAM,UAAU,OAAO;CAC7B,MAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW;CACpD,IAAI,SAAS,OAAO,MAAM;EACxB,MAAM,WAAW,WAAW,IAAI,KAAK,OAAO;EAC5C,OAAO,IAAI,SAAS,IAAI,WAAW,SAAS,OAAO,KAAK,EACtD,SAAS;GAAE,gBAAgB;GAAa,iBAAiB;EAAsB,EACjF,CAAC;CACH;CACA,KAAK,SAAS,OAAO,SAAS,QAAQ,aAAa,KAAA,KAAa,MAAM;EACpE,MAAM,SAAS,MAAM,YAAY,WAAW,IAAI,OAAO,QAAQ,GAAG,KAAK,OAAO;EAC9E,IAAI,WAAW,KAAA,GAAW,OAAO,KAAK,SAAS,0BAA0B,GAAG;EAC5E,IAAI,SAAS,KAAK,OAAO,mBAAmB,SAAS,EAAE;EACvD,OAAO,SAAS,SAAS,QAAQ,GAAG;CACtC;CAEA,IAAI,SAAS,OAAO,aAAa,KAAA,KAAa,MAAM,OAAO,mBAAmB,SAAS,EAAE;CACzF,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EACzC,MAAM,QAAQ,MAAM,UAAU,sBAAsB,IAAI,KAAK,IAAI,CAAC;EAClE,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EAEzC,MAAM,KAAK,KAAK,IAAI;EACpB,IAAI;EACJ,MAAM,QAAQ,MAAM,UAAU,WAAW,KAAK,YAAY;GACxD,SAAS,QAAQ;GACjB,OAAO;IAAE;IAAI,SAAS;IAAO,QAAQ;IAAM,GAAG,QAAQ,GAAG;GAAE;EAC7D,CAAC;EACD,IAAI,SAAS,WAAW,KAAA,KAAa,QAAQ,eAAe,KAAA,GAC1D,IAAI;GACF,MAAM,QAAQ,WAAW;IAAE,WAAW;IAAI;IAAQ;GAAG,CAAC;EACxD,SAAS,OAAO;GAEd,QAAQ,MAAM,kCAAkC,GAAG,sBAAsB,KAAK;EAChF;EAEF,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EACzC,MAAM,KAAK,KAAK,IAAI;EACpB,MAAM,eAAe,MAAM,UAAU,kBAAkB,IAAI,EAAE;EAG7D,IAAI,iBAAiB,KAAA,GAAW,OAAO,KAAK,SAAS,qCAAqC;EAC1F,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,IAAI;GACF,MAAM,QAAQ,eAAe;IAAE,WAAW;IAAI,QAAQ,aAAa;IAAQ;GAAG,CAAC;EACjF,SAAS,OAAO;GACd,QAAQ,MAAM,2CAA2C,GAAG,UAAU,KAAK;EAC7E;EAEF,OAAO,KACL,SACA,QAAQ,YAAY,KAAA,IAChB,wCACA,mCAAmC,OAAO,QAAQ,OAAO,EAAE,UACjE;CACF;AAEF;;AAGA,SAAS,mBAAmB,SAA0B,IAAsB;CAC1E,OAAO,KACL,SACA,oBAAoB,OAAO,QAAQ,WAAW,OAAO,EAAE,WACvD,KACA,oCAAoC,GAAG,oDACzC;AACF;;;;;;AAOA,eAAsB,eACpB,WACA,QACA,WACA,KAAK,KAAK,IAAI,GACI;CAClB,IAAI,CAAC,KAAK,KAAK,SAAS,GAAG,OAAO;CAClC,IAAI,WAAW;CACf,MAAM,UAAU,WAAW,YAAY,YAAY;EACjD,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAA;EACtC,WAAW;EACX,OAAO;GACL;GACA,SAAS;GACT,QAAQ;GACR,WAAW;GACX,KAAK;GACL,cAAc;GACd,SAAS;EACX;CACF,CAAC;CACD,OAAO;AACT;AAEA,eAAe,WACb,WACA,IACA,KACA,SACA;CACA,MAAM,KAAK,KAAK,IAAI;CACpB,MAAM,UAAU,WAAW,KAAK,aAAa;EAC3C;EACA,GAAGA,2BAAAA,aACD;GAAE,GAAG;GAAK,kBAAkB,KAAK,QAAQ;EAAY,GACrD,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,GAAG,QAAQ,GAAG;CAChB,EAAE;AACJ;AAEA,MAAM,WAAW,SAAoB;CACnC,WAAW,IAAI;CACf,KAAK,IAAI;CACT,cAAc,IAAI;CAClB,SAAS,IAAI;AACf;;AAGA,eAAe,YACb,WACA,IACA,UACA,KACA,SAC6B;CAC7B,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAA;CACxD,MAAM,KAAK,KAAK,IAAI;CAYpB,QAAO,MAXgB,UAAU,YAAY,IAAI,UAAU,IAAIC,2BAAAA,kBAAkB,SAAS;EACxF,MAAM,gCAAe,IAAI,IAAI,CAAC,UAAU,GAAG,KAAK,OAAO,KAAK,UAAU,MAAM,QAAQ,CAAC,CAAC,EAAA,CAAE;EACxF,MAAM,UAAUC,2BAAAA,cACd;GAAE,GAAG;GAAK,kBAAkB,KAAK,KAAK;GAAa;GAAc,WAAW,KAAK;EAAU,GAC3F,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,OAAO;GACL,YAAY;IAAE;IAAI,GAAG;IAAS,GAAG,QAAQ,GAAG;GAAE;GAC9C,UAAU,QAAQ,WAAW,gBAAgB,QAAQ,WAAW;EAClE;CACF,CAAC,EAAA,EACgB;AACnB;AAEA,SAAS,OAAO,MAAsB;CACpC,OAAO,KAAK,QAAQ,aAAa,MAAM,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE;AAChE;AAEA,SAAS,KAAK,SAA0B,SAAiB,SAAS,KAAK,QAAQ,IAAc;CAE3F,MAAM,OAAO,8HADC,OAAO,QAAQ,WAAW,OACuG,EAAE,wTAAwT,QAAQ,MAAM,MAAM;CAC7d,OAAO,IAAI,SAAS,MAAM;EAAE;EAAQ,SAAS,EAAE,gBAAgB,2BAA2B;CAAE,CAAC;AAC/F"}

package/dist/reporting/tracking.d.cts

@@ -7,8 +7,9 @@ import { JourneyReporting } from "../store/index.cjs";
  *   GET /t/o/<message>             the open pixel: records the open, answers a 1×1 GIF
  *   GET /t/l/<message>/<position>  a link: records the click, redirects to the recorded URL
  *   GET /t/u/<message>/<position>  the unsubscribe link: records the click, asks to confirm
- *   POST /t/u/<message>            the unsubscribe confirmation
- *   GET /t/c/<message>/<position>  a link of an email sent before links carried their purpose
+ *   GET  /t/u/<message>            the List-Unsubscribe header's URL, opened: asks to confirm
+ *   POST /t/u/<message>            the unsubscribe confirmation, and the header's one-click
+ *                                  unsubscribe (RFC 8058: a mail client's button posts here)
  *   POST /t/d/<message>            a push the device received (iOS's notification service
  *                                  extension, a browser's service worker)
  *   POST /t/p/<message>            a push opened, reported by a browser's service worker
@@ -20,17 +21,8 @@ import { JourneyReporting } from "../store/index.cjs";
  * sent (its route): following it shows a confirmation page, and only the confirmation — a POST,
  * which no link scanner sends — counts. Changing a template's or the config's unsubscribe URL, or
  * removing the template, changes nothing for emails already sent.
- *
- * Emails sent before that carry `/t/c/` links, which say nothing of their purpose: one is the
- * unsubscribe link when its recorded URL is `legacyUnsubscribeUrl` (the global unsubscribe URL
- * those emails were all sent with), as it was then.
  */
 export interface TrackingOptions {
-  /**
-   * The unsubscribe URL emails sent with `/t/c/` links carried (the config's `email.unsubscribeUrl`
-   * by default): following such a link to it asks for confirmation instead of redirecting.
-   */
-  legacyUnsubscribeUrl?: string | undefined;
   /** The name the confirmation pages show (the config's `title`). */
   product?: string | undefined;
   /** `email.tracking.quickClickMs`: how soon after delivery an open or click is a weak machine signal. */
@@ -41,6 +33,16 @@ export interface TrackingOptions {
     userId: string;
     at: number;
   }) => Promise<void>) | undefined;
+  /**
+   * An unsubscribe was recorded (`POST /t/u`): the host wakes the user's waits that read email
+   * reachability, so an `exitWhen: not(reachable('email'))` takes effect at once. Its failure is
+   * logged, never a reason to fail the unsubscribe.
+   */
+  onUnsubscribed?: ((unsubscribe: {
+    messageId: string;
+    userId: string;
+    at: number;
+  }) => Promise<void>) | undefined;
 }
 /** A `/t/...` request's response, or undefined when the path is not a tracking route. */
 export declare function handleTracking(request: Request, reporting: JourneyReporting, options?: TrackingOptions): Promise<Response | undefined>;

package/dist/reporting/tracking.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"tracking.d.cts","names":[],"sources":["../../src/reporting/tracking.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BiB;;;;;EAKf;;EAEA;;EAEA;;EAEA,eACM;IAAQ;IAAmB;IAAgB;QAAiB;;;wBAgC9C,eACpB,SAAS,SACT,WAAW,kBACX,UAAS,kBACR,QAAQ;;;;;;wBAuEW,eACpB,WAAW,kBACX,gBACA,mBACA,cACC"}
+{"version":3,"file":"tracking.d.cts","names":[],"sources":["../../src/reporting/tracking.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;iBA0BiB;;EAEf;;EAEA;;EAEA,eACM;IAAQ;IAAmB;IAAgB;QAAiB;;;;;;EAOlE,mBACM;IAAe;IAAmB;IAAgB;QAAiB;;;wBAgCrD,eACpB,SAAS,SACT,WAAW,kBACX,UAAS,kBACR,QAAQ;;;;;;wBAoFW,eACpB,WAAW,kBACX,gBACA,mBACA,cACC"}

package/dist/reporting/tracking.d.mts

@@ -7,8 +7,9 @@ import { JourneyReporting } from "../store/index.mjs";
  *   GET /t/o/<message>             the open pixel: records the open, answers a 1×1 GIF
  *   GET /t/l/<message>/<position>  a link: records the click, redirects to the recorded URL
  *   GET /t/u/<message>/<position>  the unsubscribe link: records the click, asks to confirm
- *   POST /t/u/<message>            the unsubscribe confirmation
- *   GET /t/c/<message>/<position>  a link of an email sent before links carried their purpose
+ *   GET  /t/u/<message>            the List-Unsubscribe header's URL, opened: asks to confirm
+ *   POST /t/u/<message>            the unsubscribe confirmation, and the header's one-click
+ *                                  unsubscribe (RFC 8058: a mail client's button posts here)
  *   POST /t/d/<message>            a push the device received (iOS's notification service
  *                                  extension, a browser's service worker)
  *   POST /t/p/<message>            a push opened, reported by a browser's service worker
@@ -20,17 +21,8 @@ import { JourneyReporting } from "../store/index.mjs";
  * sent (its route): following it shows a confirmation page, and only the confirmation — a POST,
  * which no link scanner sends — counts. Changing a template's or the config's unsubscribe URL, or
  * removing the template, changes nothing for emails already sent.
- *
- * Emails sent before that carry `/t/c/` links, which say nothing of their purpose: one is the
- * unsubscribe link when its recorded URL is `legacyUnsubscribeUrl` (the global unsubscribe URL
- * those emails were all sent with), as it was then.
  */
 export interface TrackingOptions {
-  /**
-   * The unsubscribe URL emails sent with `/t/c/` links carried (the config's `email.unsubscribeUrl`
-   * by default): following such a link to it asks for confirmation instead of redirecting.
-   */
-  legacyUnsubscribeUrl?: string | undefined;
   /** The name the confirmation pages show (the config's `title`). */
   product?: string | undefined;
   /** `email.tracking.quickClickMs`: how soon after delivery an open or click is a weak machine signal. */
@@ -41,6 +33,16 @@ export interface TrackingOptions {
     userId: string;
     at: number;
   }) => Promise<void>) | undefined;
+  /**
+   * An unsubscribe was recorded (`POST /t/u`): the host wakes the user's waits that read email
+   * reachability, so an `exitWhen: not(reachable('email'))` takes effect at once. Its failure is
+   * logged, never a reason to fail the unsubscribe.
+   */
+  onUnsubscribed?: ((unsubscribe: {
+    messageId: string;
+    userId: string;
+    at: number;
+  }) => Promise<void>) | undefined;
 }
 /** A `/t/...` request's response, or undefined when the path is not a tracking route. */
 export declare function handleTracking(request: Request, reporting: JourneyReporting, options?: TrackingOptions): Promise<Response | undefined>;

package/dist/reporting/tracking.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"tracking.d.mts","names":[],"sources":["../../src/reporting/tracking.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BiB;;;;;EAKf;;EAEA;;EAEA;;EAEA,eACM;IAAQ;IAAmB;IAAgB;QAAiB;;;wBAgC9C,eACpB,SAAS,SACT,WAAW,kBACX,UAAS,kBACR,QAAQ;;;;;;wBAuEW,eACpB,WAAW,kBACX,gBACA,mBACA,cACC"}
+{"version":3,"file":"tracking.d.mts","names":[],"sources":["../../src/reporting/tracking.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;iBA0BiB;;EAEf;;EAEA;;EAEA,eACM;IAAQ;IAAmB;IAAgB;QAAiB;;;;;;EAOlE,mBACM;IAAe;IAAmB;IAAgB;QAAiB;;;wBAgCrD,eACpB,SAAS,SACT,WAAW,kBACX,UAAS,kBACR,QAAQ;;;;;;wBAoFW,eACpB,WAAW,kBACX,gBACA,mBACA,cACC"}

package/dist/reporting/tracking.mjs

@@ -1,4 +1,3 @@
-import { isUnsubscribeLink } from "../email.mjs";
 import { BURST_WINDOW_MS, classifyClick, classifyOpen } from "./classify.mjs";
 //#region src/reporting/tracking.ts
 const GIF = Uint8Array.from(atob("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"), (char) => char.charCodeAt(0));
@@ -30,12 +29,13 @@ async function handleTracking(request, reporting, options = {}) {
 			"cache-control": "no-store, max-age=0"
 		} });
 	}
-	if ((kind === "l" || kind === "u" || kind === "c") && position !== void 0 && read) {
+	if ((kind === "l" || kind === "u") && position !== void 0 && read) {
 		const target = await recordClick(reporting, id, Number(position), who, options);
 		if (target === void 0) return page(options, "This link has expired.", 404);
-		if (kind === "u" || kind === "c" && isUnsubscribeLink(target, options.legacyUnsubscribeUrl)) return page(options, `Unsubscribe from ${escape(options.product ?? "these")} emails?`, 200, `<form method="post" action="/t/u/${id}"><button type="submit">Unsubscribe</button></form>`);
+		if (kind === "u") return confirmUnsubscribe(options, id);
 		return Response.redirect(target, 302);
 	}
+	if (kind === "u" && position === void 0 && read) return confirmUnsubscribe(options, id);
 	if (kind === "d" && who.method === "POST") {
 		const known = await reporting.recordDeviceDelivered(id, Date.now());
 		return new Response(null, { status: known ? 204 : 404 });
@@ -64,10 +64,25 @@ async function handleTracking(request, reporting, options = {}) {
 		return new Response(null, { status: known ? 204 : 404 });
 	}
 	if (kind === "u" && who.method === "POST") {
-		if (!await reporting.recordUnsubscribe(id, Date.now())) return page(options, "This link has expired.", 404);
+		const at = Date.now();
+		const unsubscribed = await reporting.recordUnsubscribe(id, at);
+		if (unsubscribed === void 0) return page(options, "You won't get these emails anymore.");
+		if (options.onUnsubscribed !== void 0) try {
+			await options.onUnsubscribed({
+				messageId: id,
+				userId: unsubscribed.userId,
+				at
+			});
+		} catch (error) {
+			console.error(`[workflow] acting on the unsubscribe of ${id} failed`, error);
+		}
 		return page(options, options.product === void 0 ? "You won't get these emails anymore." : `You won't get these emails from ${escape(options.product)} anymore.`);
 	}
 }
+/** The question an unsubscribe link, or the List-Unsubscribe URL opened in a browser, asks. */
+function confirmUnsubscribe(options, id) {
+	return page(options, `Unsubscribe from ${escape(options.product ?? "these")} emails?`, 200, `<form method="post" action="/t/u/${id}"><button type="submit">Unsubscribe</button></form>`);
+}
 /**
 * A journey push tapped open, as the app reports it (`JourneyClient.messageOpened`): an open on
 * the copy — only the recipient's own, and never a machine, since no proxy or scanner taps a

package/dist/reporting/tracking.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"tracking.mjs","names":[],"sources":["../../src/reporting/tracking.ts"],"sourcesContent":["import { isUnsubscribeLink } from '../email';\nimport type { JourneyReporting } from '../store';\nimport { BURST_WINDOW_MS, classifyClick, classifyOpen } from './classify';\n\n/**\n * The endpoints a journey email's tracking points at (see ./observer.ts), served by journeyWorker\n * without a bearer — recipients open them:\n *\n *   GET /t/o/<message>             the open pixel: records the open, answers a 1×1 GIF\n *   GET /t/l/<message>/<position>  a link: records the click, redirects to the recorded URL\n *   GET /t/u/<message>/<position>  the unsubscribe link: records the click, asks to confirm\n *   POST /t/u/<message>            the unsubscribe confirmation\n *   GET /t/c/<message>/<position>  a link of an email sent before links carried their purpose\n *   POST /t/d/<message>            a push the device received (iOS's notification service\n *                                  extension, a browser's service worker)\n *   POST /t/p/<message>            a push opened, reported by a browser's service worker\n *\n * Every open and click is recorded with its verdict (./classify.ts), and the message keeps its\n * first open and click of each kind. The redirect goes only to the URL recorded for that position,\n * never to one the request carries, so the endpoint cannot bounce visitors anywhere else. An\n * email's unsubscribe link is a tracked link too, and which link it is was fixed when the email was\n * sent (its route): following it shows a confirmation page, and only the confirmation — a POST,\n * which no link scanner sends — counts. Changing a template's or the config's unsubscribe URL, or\n * removing the template, changes nothing for emails already sent.\n *\n * Emails sent before that carry `/t/c/` links, which say nothing of their purpose: one is the\n * unsubscribe link when its recorded URL is `legacyUnsubscribeUrl` (the global unsubscribe URL\n * those emails were all sent with), as it was then.\n */\n\nexport interface TrackingOptions {\n  /**\n   * The unsubscribe URL emails sent with `/t/c/` links carried (the config's `email.unsubscribeUrl`\n   * by default): following such a link to it asks for confirmation instead of redirecting.\n   */\n  legacyUnsubscribeUrl?: string | undefined;\n  /** The name the confirmation pages show (the config's `title`). */\n  product?: string | undefined;\n  /** `email.tracking.quickClickMs`: how soon after delivery an open or click is a weak machine signal. */\n  quickMs?: number | undefined;\n  /** A browser reported a push tapped (`/t/p`): the host records it as an event too (`webPush.openedEvent`). */\n  pushOpened?:\n    | ((open: { messageId: string; userId: string; at: number }) => Promise<void>)\n    | undefined;\n}\n\nconst GIF = Uint8Array.from(\n  atob('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'),\n  (char) => char.charCodeAt(0)\n);\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ninterface Requester {\n  method: string;\n  userAgent: string | null;\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\nfunction requester(request: Request): Requester {\n  const cf = (\n    request as Request & { cf?: { asn?: number; asOrganization?: string; country?: string } }\n  ).cf;\n  return {\n    method: request.method,\n    userAgent: request.headers.get('user-agent'),\n    asn: cf?.asn ?? null,\n    organization: cf?.asOrganization ?? null,\n    country: cf?.country ?? null,\n  };\n}\n\n/** A `/t/...` request's response, or undefined when the path is not a tracking route. */\nexport async function handleTracking(\n  request: Request,\n  reporting: JourneyReporting,\n  options: TrackingOptions = {}\n): Promise<Response | undefined> {\n  const url = new URL(request.url);\n  const path = url.pathname.split('/');\n  const root = path.at(1);\n  const kind = path.at(2);\n  const id = path.at(3);\n  const position = path.at(4);\n  if (root !== 't' || id === undefined || !UUID.test(id)) return undefined;\n  const who = requester(request);\n  const read = who.method === 'GET' || who.method === 'HEAD';\n  if (kind === 'o' && read) {\n    await recordOpen(reporting, id, who, options);\n    return new Response(who.method === 'HEAD' ? null : GIF, {\n      headers: { 'content-type': 'image/gif', 'cache-control': 'no-store, max-age=0' },\n    });\n  }\n  if ((kind === 'l' || kind === 'u' || kind === 'c') && position !== undefined && read) {\n    const target = await recordClick(reporting, id, Number(position), who, options);\n    if (target === undefined) return page(options, 'This link has expired.', 404);\n    const unsubscribe =\n      kind === 'u' || (kind === 'c' && isUnsubscribeLink(target, options.legacyUnsubscribeUrl));\n    if (unsubscribe) {\n      return page(\n        options,\n        `Unsubscribe from ${escape(options.product ?? 'these')} emails?`,\n        200,\n        `<form method=\"post\" action=\"/t/u/${id}\"><button type=\"submit\">Unsubscribe</button></form>`\n      );\n    }\n    return Response.redirect(target, 302);\n  }\n  if (kind === 'd' && who.method === 'POST') {\n    const known = await reporting.recordDeviceDelivered(id, Date.now());\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'p' && who.method === 'POST') {\n    // A notification tap: a person, as the message id is what proves it is theirs\n    const at = Date.now();\n    let userId: string | undefined;\n    const known = await reporting.recordOpen(id, (message) => {\n      userId = message.userId;\n      return { at, machine: false, reason: null, ...network(who) };\n    });\n    if (known && userId !== undefined && options.pushOpened !== undefined) {\n      try {\n        await options.pushOpened({ messageId: id, userId, at });\n      } catch (error) {\n        // The open is recorded; the event is the host's extra, never a reason to fail the beacon\n        console.error(`[workflow] recording push open ${id} as an event failed`, error);\n      }\n    }\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'u' && who.method === 'POST') {\n    const known = await reporting.recordUnsubscribe(id, Date.now());\n    if (!known) return page(options, 'This link has expired.', 404);\n    return page(\n      options,\n      options.product === undefined\n        ? \"You won't get these emails anymore.\"\n        : `You won't get these emails from ${escape(options.product)} anymore.`\n    );\n  }\n  return undefined;\n}\n\n/**\n * A journey push tapped open, as the app reports it (`JourneyClient.messageOpened`): an open on\n * the copy — only the recipient's own, and never a machine, since no proxy or scanner taps a\n * notification. False when the message is unknown or not the user's.\n */\nexport async function recordPushOpen(\n  reporting: JourneyReporting,\n  userId: string,\n  messageId: string,\n  at = Date.now()\n): Promise<boolean> {\n  if (!UUID.test(messageId)) return false;\n  let recorded = false;\n  await reporting.recordOpen(messageId, (message) => {\n    if (message.userId !== userId) return undefined;\n    recorded = true;\n    return {\n      at,\n      machine: false,\n      reason: null,\n      userAgent: null,\n      asn: null,\n      organization: null,\n      country: null,\n    };\n  });\n  return recorded;\n}\n\nasync function recordOpen(\n  reporting: JourneyReporting,\n  id: string,\n  who: Requester,\n  options: TrackingOptions\n) {\n  const at = Date.now();\n  await reporting.recordOpen(id, (message) => ({\n    at,\n    ...classifyOpen(\n      { ...who, sinceDeliveredMs: at - message.deliveredAt },\n      { quickMs: options.quickMs }\n    ),\n    ...network(who),\n  }));\n}\n\nconst network = (who: Requester) => ({\n  userAgent: who.userAgent,\n  asn: who.asn,\n  organization: who.organization,\n  country: who.country,\n});\n\n/** Records the click and answers the URL to send the visitor to, or undefined for an unknown link. */\nasync function recordClick(\n  reporting: JourneyReporting,\n  id: string,\n  position: number,\n  who: Requester,\n  options: TrackingOptions\n): Promise<string | undefined> {\n  if (!Number.isInteger(position) || position < 0) return undefined;\n  const at = Date.now();\n  const recorded = await reporting.recordClick(id, position, at, BURST_WINDOW_MS, (link) => {\n    const linksInBurst = new Set([position, ...link.recent.map((click) => click.position)]).size;\n    const verdict = classifyClick(\n      { ...who, sinceDeliveredMs: at - link.deliveredAt, linksInBurst, linkCount: link.linkCount },\n      { quickMs: options.quickMs }\n    );\n    return {\n      engagement: { at, ...verdict, ...network(who) },\n      backdate: verdict.reason === 'link_burst' || verdict.reason === 'quick+link_pair',\n    };\n  });\n  return recorded?.url;\n}\n\nfunction escape(text: string): string {\n  return text.replace(/[&<>\"']/g, (c) => `&#${c.charCodeAt(0)};`);\n}\n\nfunction page(options: TrackingOptions, message: string, status = 200, extra = ''): Response {\n  const title = escape(options.product ?? 'Email');\n  const html = `<!doctype html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>${title}</title><style>body{font:16px system-ui;margin:0;display:grid;place-items:center;min-height:100vh;background:#fafafa;color:#18181b}main{text-align:center;padding:24px}button{font:inherit;padding:10px 20px;border-radius:9999px;border:0;background:#18181b;color:#fff;cursor:pointer}</style></head><body><main><p>${message}</p>${extra}</main></body></html>`;\n  return new Response(html, { status, headers: { 'content-type': 'text/html; charset=utf-8' } });\n}\n"],"mappings":";;;AA8CA,MAAM,MAAM,WAAW,KACrB,KAAK,0DAA0D,IAC9D,SAAS,KAAK,WAAW,CAAC,CAC7B;AACA,MAAM,OAAO;AAUb,SAAS,UAAU,SAA6B;CAC9C,MAAM,KACJ,QACA;CACF,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ,QAAQ,IAAI,YAAY;EAC3C,KAAK,IAAI,OAAO;EAChB,cAAc,IAAI,kBAAkB;EACpC,SAAS,IAAI,WAAW;CAC1B;AACF;;AAGA,eAAsB,eACpB,SACA,WACA,UAA2B,CAAC,GACG;CAE/B,MAAM,OAAO,IADG,IAAI,QAAQ,GACb,CAAC,CAAC,SAAS,MAAM,GAAG;CACnC,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,KAAK,KAAK,GAAG,CAAC;CACpB,MAAM,WAAW,KAAK,GAAG,CAAC;CAC1B,IAAI,SAAS,OAAO,OAAO,KAAA,KAAa,CAAC,KAAK,KAAK,EAAE,GAAG,OAAO,KAAA;CAC/D,MAAM,MAAM,UAAU,OAAO;CAC7B,MAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW;CACpD,IAAI,SAAS,OAAO,MAAM;EACxB,MAAM,WAAW,WAAW,IAAI,KAAK,OAAO;EAC5C,OAAO,IAAI,SAAS,IAAI,WAAW,SAAS,OAAO,KAAK,EACtD,SAAS;GAAE,gBAAgB;GAAa,iBAAiB;EAAsB,EACjF,CAAC;CACH;CACA,KAAK,SAAS,OAAO,SAAS,OAAO,SAAS,QAAQ,aAAa,KAAA,KAAa,MAAM;EACpF,MAAM,SAAS,MAAM,YAAY,WAAW,IAAI,OAAO,QAAQ,GAAG,KAAK,OAAO;EAC9E,IAAI,WAAW,KAAA,GAAW,OAAO,KAAK,SAAS,0BAA0B,GAAG;EAG5E,IADE,SAAS,OAAQ,SAAS,OAAO,kBAAkB,QAAQ,QAAQ,oBAAoB,GAEvF,OAAO,KACL,SACA,oBAAoB,OAAO,QAAQ,WAAW,OAAO,EAAE,WACvD,KACA,oCAAoC,GAAG,oDACzC;EAEF,OAAO,SAAS,SAAS,QAAQ,GAAG;CACtC;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EACzC,MAAM,QAAQ,MAAM,UAAU,sBAAsB,IAAI,KAAK,IAAI,CAAC;EAClE,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EAEzC,MAAM,KAAK,KAAK,IAAI;EACpB,IAAI;EACJ,MAAM,QAAQ,MAAM,UAAU,WAAW,KAAK,YAAY;GACxD,SAAS,QAAQ;GACjB,OAAO;IAAE;IAAI,SAAS;IAAO,QAAQ;IAAM,GAAG,QAAQ,GAAG;GAAE;EAC7D,CAAC;EACD,IAAI,SAAS,WAAW,KAAA,KAAa,QAAQ,eAAe,KAAA,GAC1D,IAAI;GACF,MAAM,QAAQ,WAAW;IAAE,WAAW;IAAI;IAAQ;GAAG,CAAC;EACxD,SAAS,OAAO;GAEd,QAAQ,MAAM,kCAAkC,GAAG,sBAAsB,KAAK;EAChF;EAEF,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EAEzC,IAAI,CAAC,MADe,UAAU,kBAAkB,IAAI,KAAK,IAAI,CAAC,GAClD,OAAO,KAAK,SAAS,0BAA0B,GAAG;EAC9D,OAAO,KACL,SACA,QAAQ,YAAY,KAAA,IAChB,wCACA,mCAAmC,OAAO,QAAQ,OAAO,EAAE,UACjE;CACF;AAEF;;;;;;AAOA,eAAsB,eACpB,WACA,QACA,WACA,KAAK,KAAK,IAAI,GACI;CAClB,IAAI,CAAC,KAAK,KAAK,SAAS,GAAG,OAAO;CAClC,IAAI,WAAW;CACf,MAAM,UAAU,WAAW,YAAY,YAAY;EACjD,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAA;EACtC,WAAW;EACX,OAAO;GACL;GACA,SAAS;GACT,QAAQ;GACR,WAAW;GACX,KAAK;GACL,cAAc;GACd,SAAS;EACX;CACF,CAAC;CACD,OAAO;AACT;AAEA,eAAe,WACb,WACA,IACA,KACA,SACA;CACA,MAAM,KAAK,KAAK,IAAI;CACpB,MAAM,UAAU,WAAW,KAAK,aAAa;EAC3C;EACA,GAAG,aACD;GAAE,GAAG;GAAK,kBAAkB,KAAK,QAAQ;EAAY,GACrD,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,GAAG,QAAQ,GAAG;CAChB,EAAE;AACJ;AAEA,MAAM,WAAW,SAAoB;CACnC,WAAW,IAAI;CACf,KAAK,IAAI;CACT,cAAc,IAAI;CAClB,SAAS,IAAI;AACf;;AAGA,eAAe,YACb,WACA,IACA,UACA,KACA,SAC6B;CAC7B,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAA;CACxD,MAAM,KAAK,KAAK,IAAI;CAYpB,QAAO,MAXgB,UAAU,YAAY,IAAI,UAAU,IAAI,kBAAkB,SAAS;EACxF,MAAM,gCAAe,IAAI,IAAI,CAAC,UAAU,GAAG,KAAK,OAAO,KAAK,UAAU,MAAM,QAAQ,CAAC,CAAC,EAAA,CAAE;EACxF,MAAM,UAAU,cACd;GAAE,GAAG;GAAK,kBAAkB,KAAK,KAAK;GAAa;GAAc,WAAW,KAAK;EAAU,GAC3F,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,OAAO;GACL,YAAY;IAAE;IAAI,GAAG;IAAS,GAAG,QAAQ,GAAG;GAAE;GAC9C,UAAU,QAAQ,WAAW,gBAAgB,QAAQ,WAAW;EAClE;CACF,CAAC,EAAA,EACgB;AACnB;AAEA,SAAS,OAAO,MAAsB;CACpC,OAAO,KAAK,QAAQ,aAAa,MAAM,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE;AAChE;AAEA,SAAS,KAAK,SAA0B,SAAiB,SAAS,KAAK,QAAQ,IAAc;CAE3F,MAAM,OAAO,8HADC,OAAO,QAAQ,WAAW,OACuG,EAAE,wTAAwT,QAAQ,MAAM,MAAM;CAC7d,OAAO,IAAI,SAAS,MAAM;EAAE;EAAQ,SAAS,EAAE,gBAAgB,2BAA2B;CAAE,CAAC;AAC/F"}
+{"version":3,"file":"tracking.mjs","names":[],"sources":["../../src/reporting/tracking.ts"],"sourcesContent":["import type { JourneyReporting } from '../store';\nimport { BURST_WINDOW_MS, classifyClick, classifyOpen } from './classify';\n\n/**\n * The endpoints a journey email's tracking points at (see ./observer.ts), served by journeyWorker\n * without a bearer — recipients open them:\n *\n *   GET /t/o/<message>             the open pixel: records the open, answers a 1×1 GIF\n *   GET /t/l/<message>/<position>  a link: records the click, redirects to the recorded URL\n *   GET /t/u/<message>/<position>  the unsubscribe link: records the click, asks to confirm\n *   GET  /t/u/<message>            the List-Unsubscribe header's URL, opened: asks to confirm\n *   POST /t/u/<message>            the unsubscribe confirmation, and the header's one-click\n *                                  unsubscribe (RFC 8058: a mail client's button posts here)\n *   POST /t/d/<message>            a push the device received (iOS's notification service\n *                                  extension, a browser's service worker)\n *   POST /t/p/<message>            a push opened, reported by a browser's service worker\n *\n * Every open and click is recorded with its verdict (./classify.ts), and the message keeps its\n * first open and click of each kind. The redirect goes only to the URL recorded for that position,\n * never to one the request carries, so the endpoint cannot bounce visitors anywhere else. An\n * email's unsubscribe link is a tracked link too, and which link it is was fixed when the email was\n * sent (its route): following it shows a confirmation page, and only the confirmation — a POST,\n * which no link scanner sends — counts. Changing a template's or the config's unsubscribe URL, or\n * removing the template, changes nothing for emails already sent.\n */\n\nexport interface TrackingOptions {\n  /** The name the confirmation pages show (the config's `title`). */\n  product?: string | undefined;\n  /** `email.tracking.quickClickMs`: how soon after delivery an open or click is a weak machine signal. */\n  quickMs?: number | undefined;\n  /** A browser reported a push tapped (`/t/p`): the host records it as an event too (`webPush.openedEvent`). */\n  pushOpened?:\n    | ((open: { messageId: string; userId: string; at: number }) => Promise<void>)\n    | undefined;\n  /**\n   * An unsubscribe was recorded (`POST /t/u`): the host wakes the user's waits that read email\n   * reachability, so an `exitWhen: not(reachable('email'))` takes effect at once. Its failure is\n   * logged, never a reason to fail the unsubscribe.\n   */\n  onUnsubscribed?:\n    | ((unsubscribe: { messageId: string; userId: string; at: number }) => Promise<void>)\n    | undefined;\n}\n\nconst GIF = Uint8Array.from(\n  atob('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'),\n  (char) => char.charCodeAt(0)\n);\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ninterface Requester {\n  method: string;\n  userAgent: string | null;\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\nfunction requester(request: Request): Requester {\n  const cf = (\n    request as Request & { cf?: { asn?: number; asOrganization?: string; country?: string } }\n  ).cf;\n  return {\n    method: request.method,\n    userAgent: request.headers.get('user-agent'),\n    asn: cf?.asn ?? null,\n    organization: cf?.asOrganization ?? null,\n    country: cf?.country ?? null,\n  };\n}\n\n/** A `/t/...` request's response, or undefined when the path is not a tracking route. */\nexport async function handleTracking(\n  request: Request,\n  reporting: JourneyReporting,\n  options: TrackingOptions = {}\n): Promise<Response | undefined> {\n  const url = new URL(request.url);\n  const path = url.pathname.split('/');\n  const root = path.at(1);\n  const kind = path.at(2);\n  const id = path.at(3);\n  const position = path.at(4);\n  if (root !== 't' || id === undefined || !UUID.test(id)) return undefined;\n  const who = requester(request);\n  const read = who.method === 'GET' || who.method === 'HEAD';\n  if (kind === 'o' && read) {\n    await recordOpen(reporting, id, who, options);\n    return new Response(who.method === 'HEAD' ? null : GIF, {\n      headers: { 'content-type': 'image/gif', 'cache-control': 'no-store, max-age=0' },\n    });\n  }\n  if ((kind === 'l' || kind === 'u') && position !== undefined && read) {\n    const target = await recordClick(reporting, id, Number(position), who, options);\n    if (target === undefined) return page(options, 'This link has expired.', 404);\n    if (kind === 'u') return confirmUnsubscribe(options, id);\n    return Response.redirect(target, 302);\n  }\n  // The List-Unsubscribe URL opened in a browser (a client without one-click): the same question\n  if (kind === 'u' && position === undefined && read) return confirmUnsubscribe(options, id);\n  if (kind === 'd' && who.method === 'POST') {\n    const known = await reporting.recordDeviceDelivered(id, Date.now());\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'p' && who.method === 'POST') {\n    // A notification tap: a person, as the message id is what proves it is theirs\n    const at = Date.now();\n    let userId: string | undefined;\n    const known = await reporting.recordOpen(id, (message) => {\n      userId = message.userId;\n      return { at, machine: false, reason: null, ...network(who) };\n    });\n    if (known && userId !== undefined && options.pushOpened !== undefined) {\n      try {\n        await options.pushOpened({ messageId: id, userId, at });\n      } catch (error) {\n        // The open is recorded; the event is the host's extra, never a reason to fail the beacon\n        console.error(`[workflow] recording push open ${id} as an event failed`, error);\n      }\n    }\n    return new Response(null, { status: known ? 204 : 404 });\n  }\n  if (kind === 'u' && who.method === 'POST') {\n    const at = Date.now();\n    const unsubscribed = await reporting.recordUnsubscribe(id, at);\n    // A mail client's one-click POST must succeed: for a copy no longer on record (its user\n    // erased) there is nothing left to send to, so the answer is the same\n    if (unsubscribed === undefined) return page(options, \"You won't get these emails anymore.\");\n    if (options.onUnsubscribed !== undefined) {\n      try {\n        await options.onUnsubscribed({ messageId: id, userId: unsubscribed.userId, at });\n      } catch (error) {\n        console.error(`[workflow] acting on the unsubscribe of ${id} failed`, error);\n      }\n    }\n    return page(\n      options,\n      options.product === undefined\n        ? \"You won't get these emails anymore.\"\n        : `You won't get these emails from ${escape(options.product)} anymore.`\n    );\n  }\n  return undefined;\n}\n\n/** The question an unsubscribe link, or the List-Unsubscribe URL opened in a browser, asks. */\nfunction confirmUnsubscribe(options: TrackingOptions, id: string): Response {\n  return page(\n    options,\n    `Unsubscribe from ${escape(options.product ?? 'these')} emails?`,\n    200,\n    `<form method=\"post\" action=\"/t/u/${id}\"><button type=\"submit\">Unsubscribe</button></form>`\n  );\n}\n\n/**\n * A journey push tapped open, as the app reports it (`JourneyClient.messageOpened`): an open on\n * the copy — only the recipient's own, and never a machine, since no proxy or scanner taps a\n * notification. False when the message is unknown or not the user's.\n */\nexport async function recordPushOpen(\n  reporting: JourneyReporting,\n  userId: string,\n  messageId: string,\n  at = Date.now()\n): Promise<boolean> {\n  if (!UUID.test(messageId)) return false;\n  let recorded = false;\n  await reporting.recordOpen(messageId, (message) => {\n    if (message.userId !== userId) return undefined;\n    recorded = true;\n    return {\n      at,\n      machine: false,\n      reason: null,\n      userAgent: null,\n      asn: null,\n      organization: null,\n      country: null,\n    };\n  });\n  return recorded;\n}\n\nasync function recordOpen(\n  reporting: JourneyReporting,\n  id: string,\n  who: Requester,\n  options: TrackingOptions\n) {\n  const at = Date.now();\n  await reporting.recordOpen(id, (message) => ({\n    at,\n    ...classifyOpen(\n      { ...who, sinceDeliveredMs: at - message.deliveredAt },\n      { quickMs: options.quickMs }\n    ),\n    ...network(who),\n  }));\n}\n\nconst network = (who: Requester) => ({\n  userAgent: who.userAgent,\n  asn: who.asn,\n  organization: who.organization,\n  country: who.country,\n});\n\n/** Records the click and answers the URL to send the visitor to, or undefined for an unknown link. */\nasync function recordClick(\n  reporting: JourneyReporting,\n  id: string,\n  position: number,\n  who: Requester,\n  options: TrackingOptions\n): Promise<string | undefined> {\n  if (!Number.isInteger(position) || position < 0) return undefined;\n  const at = Date.now();\n  const recorded = await reporting.recordClick(id, position, at, BURST_WINDOW_MS, (link) => {\n    const linksInBurst = new Set([position, ...link.recent.map((click) => click.position)]).size;\n    const verdict = classifyClick(\n      { ...who, sinceDeliveredMs: at - link.deliveredAt, linksInBurst, linkCount: link.linkCount },\n      { quickMs: options.quickMs }\n    );\n    return {\n      engagement: { at, ...verdict, ...network(who) },\n      backdate: verdict.reason === 'link_burst' || verdict.reason === 'quick+link_pair',\n    };\n  });\n  return recorded?.url;\n}\n\nfunction escape(text: string): string {\n  return text.replace(/[&<>\"']/g, (c) => `&#${c.charCodeAt(0)};`);\n}\n\nfunction page(options: TrackingOptions, message: string, status = 200, extra = ''): Response {\n  const title = escape(options.product ?? 'Email');\n  const html = `<!doctype html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>${title}</title><style>body{font:16px system-ui;margin:0;display:grid;place-items:center;min-height:100vh;background:#fafafa;color:#18181b}main{text-align:center;padding:24px}button{font:inherit;padding:10px 20px;border-radius:9999px;border:0;background:#18181b;color:#fff;cursor:pointer}</style></head><body><main><p>${message}</p>${extra}</main></body></html>`;\n  return new Response(html, { status, headers: { 'content-type': 'text/html; charset=utf-8' } });\n}\n"],"mappings":";;AA6CA,MAAM,MAAM,WAAW,KACrB,KAAK,0DAA0D,IAC9D,SAAS,KAAK,WAAW,CAAC,CAC7B;AACA,MAAM,OAAO;AAUb,SAAS,UAAU,SAA6B;CAC9C,MAAM,KACJ,QACA;CACF,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ,QAAQ,IAAI,YAAY;EAC3C,KAAK,IAAI,OAAO;EAChB,cAAc,IAAI,kBAAkB;EACpC,SAAS,IAAI,WAAW;CAC1B;AACF;;AAGA,eAAsB,eACpB,SACA,WACA,UAA2B,CAAC,GACG;CAE/B,MAAM,OAAO,IADG,IAAI,QAAQ,GACb,CAAC,CAAC,SAAS,MAAM,GAAG;CACnC,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,OAAO,KAAK,GAAG,CAAC;CACtB,MAAM,KAAK,KAAK,GAAG,CAAC;CACpB,MAAM,WAAW,KAAK,GAAG,CAAC;CAC1B,IAAI,SAAS,OAAO,OAAO,KAAA,KAAa,CAAC,KAAK,KAAK,EAAE,GAAG,OAAO,KAAA;CAC/D,MAAM,MAAM,UAAU,OAAO;CAC7B,MAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW;CACpD,IAAI,SAAS,OAAO,MAAM;EACxB,MAAM,WAAW,WAAW,IAAI,KAAK,OAAO;EAC5C,OAAO,IAAI,SAAS,IAAI,WAAW,SAAS,OAAO,KAAK,EACtD,SAAS;GAAE,gBAAgB;GAAa,iBAAiB;EAAsB,EACjF,CAAC;CACH;CACA,KAAK,SAAS,OAAO,SAAS,QAAQ,aAAa,KAAA,KAAa,MAAM;EACpE,MAAM,SAAS,MAAM,YAAY,WAAW,IAAI,OAAO,QAAQ,GAAG,KAAK,OAAO;EAC9E,IAAI,WAAW,KAAA,GAAW,OAAO,KAAK,SAAS,0BAA0B,GAAG;EAC5E,IAAI,SAAS,KAAK,OAAO,mBAAmB,SAAS,EAAE;EACvD,OAAO,SAAS,SAAS,QAAQ,GAAG;CACtC;CAEA,IAAI,SAAS,OAAO,aAAa,KAAA,KAAa,MAAM,OAAO,mBAAmB,SAAS,EAAE;CACzF,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EACzC,MAAM,QAAQ,MAAM,UAAU,sBAAsB,IAAI,KAAK,IAAI,CAAC;EAClE,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EAEzC,MAAM,KAAK,KAAK,IAAI;EACpB,IAAI;EACJ,MAAM,QAAQ,MAAM,UAAU,WAAW,KAAK,YAAY;GACxD,SAAS,QAAQ;GACjB,OAAO;IAAE;IAAI,SAAS;IAAO,QAAQ;IAAM,GAAG,QAAQ,GAAG;GAAE;EAC7D,CAAC;EACD,IAAI,SAAS,WAAW,KAAA,KAAa,QAAQ,eAAe,KAAA,GAC1D,IAAI;GACF,MAAM,QAAQ,WAAW;IAAE,WAAW;IAAI;IAAQ;GAAG,CAAC;EACxD,SAAS,OAAO;GAEd,QAAQ,MAAM,kCAAkC,GAAG,sBAAsB,KAAK;EAChF;EAEF,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,QAAQ,MAAM,IAAI,CAAC;CACzD;CACA,IAAI,SAAS,OAAO,IAAI,WAAW,QAAQ;EACzC,MAAM,KAAK,KAAK,IAAI;EACpB,MAAM,eAAe,MAAM,UAAU,kBAAkB,IAAI,EAAE;EAG7D,IAAI,iBAAiB,KAAA,GAAW,OAAO,KAAK,SAAS,qCAAqC;EAC1F,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,IAAI;GACF,MAAM,QAAQ,eAAe;IAAE,WAAW;IAAI,QAAQ,aAAa;IAAQ;GAAG,CAAC;EACjF,SAAS,OAAO;GACd,QAAQ,MAAM,2CAA2C,GAAG,UAAU,KAAK;EAC7E;EAEF,OAAO,KACL,SACA,QAAQ,YAAY,KAAA,IAChB,wCACA,mCAAmC,OAAO,QAAQ,OAAO,EAAE,UACjE;CACF;AAEF;;AAGA,SAAS,mBAAmB,SAA0B,IAAsB;CAC1E,OAAO,KACL,SACA,oBAAoB,OAAO,QAAQ,WAAW,OAAO,EAAE,WACvD,KACA,oCAAoC,GAAG,oDACzC;AACF;;;;;;AAOA,eAAsB,eACpB,WACA,QACA,WACA,KAAK,KAAK,IAAI,GACI;CAClB,IAAI,CAAC,KAAK,KAAK,SAAS,GAAG,OAAO;CAClC,IAAI,WAAW;CACf,MAAM,UAAU,WAAW,YAAY,YAAY;EACjD,IAAI,QAAQ,WAAW,QAAQ,OAAO,KAAA;EACtC,WAAW;EACX,OAAO;GACL;GACA,SAAS;GACT,QAAQ;GACR,WAAW;GACX,KAAK;GACL,cAAc;GACd,SAAS;EACX;CACF,CAAC;CACD,OAAO;AACT;AAEA,eAAe,WACb,WACA,IACA,KACA,SACA;CACA,MAAM,KAAK,KAAK,IAAI;CACpB,MAAM,UAAU,WAAW,KAAK,aAAa;EAC3C;EACA,GAAG,aACD;GAAE,GAAG;GAAK,kBAAkB,KAAK,QAAQ;EAAY,GACrD,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,GAAG,QAAQ,GAAG;CAChB,EAAE;AACJ;AAEA,MAAM,WAAW,SAAoB;CACnC,WAAW,IAAI;CACf,KAAK,IAAI;CACT,cAAc,IAAI;CAClB,SAAS,IAAI;AACf;;AAGA,eAAe,YACb,WACA,IACA,UACA,KACA,SAC6B;CAC7B,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAA;CACxD,MAAM,KAAK,KAAK,IAAI;CAYpB,QAAO,MAXgB,UAAU,YAAY,IAAI,UAAU,IAAI,kBAAkB,SAAS;EACxF,MAAM,gCAAe,IAAI,IAAI,CAAC,UAAU,GAAG,KAAK,OAAO,KAAK,UAAU,MAAM,QAAQ,CAAC,CAAC,EAAA,CAAE;EACxF,MAAM,UAAU,cACd;GAAE,GAAG;GAAK,kBAAkB,KAAK,KAAK;GAAa;GAAc,WAAW,KAAK;EAAU,GAC3F,EAAE,SAAS,QAAQ,QAAQ,CAC7B;EACA,OAAO;GACL,YAAY;IAAE;IAAI,GAAG;IAAS,GAAG,QAAQ,GAAG;GAAE;GAC9C,UAAU,QAAQ,WAAW,gBAAgB,QAAQ,WAAW;EAClE;CACF,CAAC,EAAA,EACgB;AACnB;AAEA,SAAS,OAAO,MAAsB;CACpC,OAAO,KAAK,QAAQ,aAAa,MAAM,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE;AAChE;AAEA,SAAS,KAAK,SAA0B,SAAiB,SAAS,KAAK,QAAQ,IAAc;CAE3F,MAAM,OAAO,8HADC,OAAO,QAAQ,WAAW,OACuG,EAAE,wTAAwT,QAAQ,MAAM,MAAM;CAC7d,OAAO,IAAI,SAAS,MAAM;EAAE;EAAQ,SAAS,EAAE,gBAAgB,2BAA2B;CAAE,CAAC;AAC/F"}

package/dist/store/d1.cjs

@@ -1,21 +1,42 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_ir = require("../ir.cjs");
+const require_store_erasure = require("./erasure.cjs");
 //#region src/store/d1.ts
 /**
-* The original data plane: D1 for the tables (see ../cloudflare/schema.sql)
-* and KV for the content-addressed workflow bodies (`wf:${contentHash}`).
-* The SQL below is exactly what the router and fact source used to inline —
-* the in-memory FakeD1 in the tests dispatches on these strings verbatim.
+* The condition every write about a user carries, as the last bound parameter: no erasure
+* tombstone for the user. Inside the statement, so the check and the write share one snapshot.
+*/
+const NOT_ERASED = "WHERE NOT EXISTS (SELECT 1 FROM erasures WHERE user_id = ?)";
+/**
+* The D1 data plane: one database for everything (see ../cloudflare/schema.sql),
+* the content-addressed workflow bodies included — beside the routes that name
+* them, so a deploy is read-your-writes (KV's eventual consistency would let a
+* route name a body that is not readable yet). The in-memory FakeD1 in the
+* tests dispatches on these statements.
+*
+* Every write about a user is one statement conditional on their erasure tombstone not
+* existing (`INSERT ... SELECT ... WHERE NOT EXISTS`): a write that changed nothing is then
+* read back once to tell a refusal (`UserErasedError`) from a plain no-op. D1 has one writer,
+* so a statement is atomic against every other: the runner's admission is one conditional
+* UPDATE, and a tombstone either precedes it (refused) or follows it (the erasure finds the
+* instance admitted) — no lock needed.
 */
 var D1JourneyStore = class {
 	db;
-	kv;
-	constructor(db, kv) {
+	constructor(db) {
 		this.db = db;
-		this.kv = kv;
 	}
 	async insertEvent(input) {
-		return ((await this.db.prepare("INSERT OR IGNORE INTO events (id, user_id, name, ts, payload) VALUES (?, ?, ?, ?, ?)").bind(input.id, input.userId, input.event, input.ts, JSON.stringify(input.payload)).run()).meta?.changes ?? 1) > 0;
+		if (((await this.db.prepare(`INSERT OR IGNORE INTO events (id, user_id, name, ts, payload) SELECT ?, ?, ?, ?, ? ${NOT_ERASED}`).bind(input.id, input.userId, input.event, input.ts, JSON.stringify(input.payload), input.userId).run()).meta?.changes ?? 1) > 0) return true;
+		await this.refuseIfErased(input.userId);
+		return false;
+	}
+	/**
+	* A conditional write changed nothing: on that path only, read why. Throws when the tombstone
+	* refused it; returns when the statement had another reason (a duplicate, an entry taken).
+	*/
+	async refuseIfErased(userId) {
+		if (await this.erasureState(userId) !== "none") throw new require_store_erasure.UserErasedError(userId);
 	}
 	/** The event rows of one user and name, within the window's bounds (both inclusive). */
 	eventWindow(userId, event, window) {
@@ -49,11 +70,26 @@ var D1JourneyStore = class {
 	}
 	async mergeProfile(userId, props) {
 		const patch = JSON.stringify(props);
-		const row = await this.db.prepare("INSERT INTO profiles (user_id, props) VALUES (?, json_patch('{}', ?)) ON CONFLICT(user_id) DO UPDATE SET props = json_patch(profiles.props, ?) RETURNING props").bind(userId, patch, patch).first();
-		return row === null ? stripNulls(props) : JSON.parse(row.props);
-	}
-	async listUserIds() {
-		const { results } = await this.db.prepare("SELECT user_id FROM profiles UNION SELECT DISTINCT user_id FROM events").bind().all();
+		const replaced = Object.entries(props).filter(([, value]) => typeof value === "object" && value !== null).map(([key]) => key);
+		const stored = replaced.length === 0 ? "profiles.props" : `json_remove(profiles.props, ${replaced.map(() => "?").join(", ")})`;
+		const row = await this.db.prepare(`INSERT INTO profiles (user_id, props) SELECT ?, json_patch('{}', ?) ${NOT_ERASED} ON CONFLICT(user_id) DO UPDATE SET props = json_patch(${stored}, ?) RETURNING props`).bind(userId, patch, userId, ...replaced.map(jsonPath), patch).first();
+		if (row !== null) return JSON.parse(row.props);
+		await this.refuseIfErased(userId);
+		return stripNulls(props);
+	}
+	async listUserIds(page) {
+		const params = [];
+		let where = "";
+		if (page?.after !== void 0) {
+			where = " WHERE user_id > ?";
+			params.push(page.after);
+		}
+		let limit = "";
+		if (page?.limit !== void 0) {
+			limit = " LIMIT ?";
+			params.push(page.limit);
+		}
+		const { results } = await this.db.prepare(`SELECT user_id FROM (SELECT user_id FROM profiles UNION SELECT user_id FROM events)${where} ORDER BY user_id${limit}`).bind(...params).all();
 		return results.map((row) => row.user_id);
 	}
 	async listDevices(userId) {
@@ -61,30 +97,40 @@ var D1JourneyStore = class {
 		return results;
 	}
 	async upsertDevice(device) {
-		await this.db.prepare("INSERT INTO devices (token, user_id, platform, ts) VALUES (?, ?, ?, ?) ON CONFLICT (token) DO UPDATE SET user_id = excluded.user_id, platform = excluded.platform, ts = excluded.ts").bind(device.token, device.userId, device.platform, device.ts).run();
+		if (((await this.db.prepare(`INSERT INTO devices (token, user_id, platform, ts) SELECT ?, ?, ?, ? ${NOT_ERASED} ON CONFLICT (token) DO UPDATE SET user_id = excluded.user_id, platform = excluded.platform, ts = excluded.ts`).bind(device.token, device.userId, device.platform, device.ts, device.userId).run()).meta?.changes ?? 1) === 0) throw new require_store_erasure.UserErasedError(device.userId);
 	}
 	async requestErasure(userId, at) {
 		await this.db.prepare("INSERT OR IGNORE INTO erasures (user_id, ts) VALUES (?, ?)").bind(userId, at).run();
 	}
 	async pendingErasures() {
-		const { results } = await this.db.prepare("SELECT user_id FROM erasures ORDER BY ts").bind().all();
+		const { results } = await this.db.prepare("SELECT user_id FROM erasures WHERE erased_at IS NULL ORDER BY ts").bind().all();
 		return results.map((row) => row.user_id);
 	}
+	async erasureState(userId) {
+		const row = await this.db.prepare("SELECT erased_at FROM erasures WHERE user_id = ?").bind(userId).first();
+		if (row === null) return "none";
+		return row.erased_at === null ? "erasing" : "erased";
+	}
 	async runningInstances(userId) {
-		const { results } = await this.db.prepare("SELECT instance_id FROM entries WHERE user_id = ? AND status = 'running'").bind(userId).all();
-		return results.map((row) => row.instance_id);
+		const { results } = await this.db.prepare("SELECT instance_id, admitted_at IS NOT NULL AS admitted FROM entries WHERE user_id = ? AND status = 'running'").bind(userId).all();
+		return results.map((row) => ({
+			instanceId: row.instance_id,
+			admitted: Boolean(row.admitted)
+		}));
 	}
-	async forgetUser(userId) {
-		await this.db.batch([
+	async admitInstance(instanceId, userId) {
+		return await this.db.prepare("UPDATE entries SET admitted_at = COALESCE(admitted_at, ?) WHERE instance_id = ? AND user_id = ? AND (status = 'running' OR admitted_at IS NOT NULL) AND NOT EXISTS (SELECT 1 FROM erasures WHERE user_id = ?) RETURNING instance_id").bind(Date.now(), instanceId, userId, userId).first() !== null;
+	}
+	async forgetUser(userId, at) {
+		await this.db.batch([...[
 			"entries",
 			"subscriptions",
 			"segment_starts",
 			"segment_members",
 			"devices",
 			"events",
-			"profiles",
-			"erasures"
-		].map((table) => this.db.prepare(`DELETE FROM ${table} WHERE user_id = ?`).bind(userId)));
+			"profiles"
+		].map((table) => this.db.prepare(`DELETE FROM ${table} WHERE user_id = ?`).bind(userId)), this.db.prepare("UPDATE erasures SET erased_at = COALESCE(erased_at, ?) WHERE user_id = ?").bind(at, userId)]);
 	}
 	async removeDevice(token) {
 		return (await this.db.prepare("DELETE FROM devices WHERE token = ? RETURNING user_id").bind(token).first())?.user_id ?? void 0;
@@ -119,11 +165,11 @@ var D1JourneyStore = class {
 		return results;
 	}
 	async putWorkflowIR(workflow) {
-		await this.kv.put(`wf:${workflow.contentHash}`, JSON.stringify(workflow));
+		await this.db.prepare("INSERT OR REPLACE INTO workflow_ir (content_hash, ir) VALUES (?, ?)").bind(workflow.contentHash, JSON.stringify(workflow)).run();
 	}
 	async getWorkflowIR(contentHash) {
-		const raw = await this.kv.get(`wf:${contentHash}`);
-		return raw === null ? void 0 : require_ir.WorkflowIR.parse(JSON.parse(raw));
+		const row = await this.db.prepare("SELECT ir FROM workflow_ir WHERE content_hash = ?").bind(contentHash).first();
+		return row === null ? void 0 : require_ir.WorkflowIR.parse(JSON.parse(row.ir));
 	}
 	async replaceRoutes(bundle) {
 		await this.db.batch([
@@ -142,7 +188,8 @@ var D1JourneyStore = class {
 		return await this.db.prepare("SELECT 1 AS x FROM segment_members WHERE segment = ? AND user_id = ?").bind(segment, userId).first() !== null;
 	}
 	async addSegmentMember(segment, userId, ts, workflows) {
-		await this.db.batch([this.db.prepare("INSERT OR IGNORE INTO segment_members (segment, user_id, ts) VALUES (?, ?, ?)").bind(segment, userId, ts), ...workflows.map((workflow) => this.db.prepare("INSERT OR IGNORE INTO segment_starts (segment, workflow, user_id, ts) VALUES (?, ?, ?, ?)").bind(segment, workflow, userId, ts))]);
+		const [member] = await this.db.batch([this.db.prepare(`INSERT OR IGNORE INTO segment_members (segment, user_id, ts) SELECT ?, ?, ? ${NOT_ERASED}`).bind(segment, userId, ts, userId), ...workflows.map((workflow) => this.db.prepare(`INSERT OR IGNORE INTO segment_starts (segment, workflow, user_id, ts) SELECT ?, ?, ?, ? ${NOT_ERASED}`).bind(segment, workflow, userId, ts, userId))]);
+		if ((member.meta?.changes ?? 1) === 0) await this.refuseIfErased(userId);
 	}
 	async pendingSegmentStarts(segment, userId) {
 		const { results } = await this.db.prepare("SELECT workflow FROM segment_starts WHERE segment = ? AND user_id = ?").bind(segment, userId).all();
@@ -156,8 +203,10 @@ var D1JourneyStore = class {
 	}
 	async enterJourney(entry) {
 		if (entry.execution !== void 0) throw new Error("D1JourneyStore keeps no execution starts: this runtime needs Postgres");
-		if (((await this.db.prepare("INSERT OR IGNORE INTO entries (workflow, user_id, instance_id, hash, status, ts) VALUES (?, ?, ?, ?, ?, ?)").bind(entry.workflow, entry.userId, entry.instanceId, entry.hash, "running", entry.ts).run()).meta?.changes ?? 1) !== 0) return "entered";
-		return ((await this.db.prepare("UPDATE entries SET instance_id = ?, hash = ?, status = 'running', ts = ? WHERE workflow = ? AND user_id = ? AND status = 'failed'").bind(entry.instanceId, entry.hash, entry.ts, entry.workflow, entry.userId).run()).meta?.changes ?? 0) > 0 ? "reclaimed" : null;
+		if (((await this.db.prepare(`INSERT OR IGNORE INTO entries (workflow, user_id, instance_id, hash, status, ts) SELECT ?, ?, ?, ?, ?, ? ${NOT_ERASED}`).bind(entry.workflow, entry.userId, entry.instanceId, entry.hash, "running", entry.ts, entry.userId).run()).meta?.changes ?? 1) !== 0) return "entered";
+		if (((await this.db.prepare("UPDATE entries SET instance_id = ?, hash = ?, status = 'running', ts = ?, admitted_at = NULL WHERE workflow = ? AND user_id = ? AND status = 'failed' AND NOT EXISTS (SELECT 1 FROM erasures WHERE user_id = ?)").bind(entry.instanceId, entry.hash, entry.ts, entry.workflow, entry.userId, entry.userId).run()).meta?.changes ?? 0) > 0) return "reclaimed";
+		await this.refuseIfErased(entry.userId);
+		return null;
 	}
 	async removeEntry(instanceId) {
 		await this.db.prepare("DELETE FROM entries WHERE instance_id = ?").bind(instanceId).run();
@@ -170,7 +219,9 @@ var D1JourneyStore = class {
 		return results.map((row) => row.handle);
 	}
 	async subscribe(handle, userId, events, ts) {
-		for (const event of events) await this.db.prepare("INSERT OR IGNORE INTO subscriptions (user_id, event, wake_handle, ts) VALUES (?, ?, ?, ?)").bind(userId, event, handle, ts).run();
+		let skipped = false;
+		for (const event of events) if (((await this.db.prepare(`INSERT OR IGNORE INTO subscriptions (user_id, event, wake_handle, ts) SELECT ?, ?, ?, ? ${NOT_ERASED}`).bind(userId, event, handle, ts, userId).run()).meta?.changes ?? 1) === 0) skipped = true;
+		if (skipped) await this.refuseIfErased(userId);
 	}
 	async unsubscribe(handle) {
 		await this.db.prepare("DELETE FROM subscriptions WHERE wake_handle = ?").bind(handle).run();
@@ -180,6 +231,14 @@ var D1JourneyStore = class {
 function stripNulls(props) {
 	return Object.fromEntries(Object.entries(props).filter(([, value]) => value !== null));
 }
+/**
+* The SQLite JSON path of a top-level key. Quoted, so dots and brackets in the key are literal;
+* a double quote has no escape in SQLite's path syntax, so such a key cannot be addressed.
+*/
+function jsonPath(key) {
+	if (key.includes("\"")) throw new Error(`profile property "${key}" cannot hold an object: its name contains a quote`);
+	return `$."${key}"`;
+}
 //#endregion
 exports.D1JourneyStore = D1JourneyStore;