@shware/workflow 3.2.0 → 4.0.0

package/dist/store/erasure.cjs

@@ -0,0 +1,22 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/store/erasure.ts
+/**
+* The user has an erasure tombstone — requested and under way, or carried out — so nothing may
+* be written about them: a write that got through would come back after the erase, or bring an
+* erased user back. Thrown by the store from the conditional write itself (the gate), and by the
+* entry points that check first for a fast answer; the HTTP surface answers 410.
+*/
+var UserErasedError = class extends Error {
+	userId;
+	name = "UserErasedError";
+	/** The tombstone is permanent: a retry meets it again. */
+	retryable = false;
+	constructor(userId) {
+		super(`user ${userId} is erased`);
+		this.userId = userId;
+	}
+};
+//#endregion
+exports.UserErasedError = UserErasedError;
+
+//# sourceMappingURL=erasure.cjs.map

package/dist/store/erasure.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.cjs","names":[],"sources":["../../src/store/erasure.ts"],"sourcesContent":["/** Where a user stands with erasure: see `JourneyStore.erasureState`. */\nexport type ErasureState = 'none' | 'erasing' | 'erased';\n\n/**\n * The user has an erasure tombstone — requested and under way, or carried out — so nothing may\n * be written about them: a write that got through would come back after the erase, or bring an\n * erased user back. Thrown by the store from the conditional write itself (the gate), and by the\n * entry points that check first for a fast answer; the HTTP surface answers 410.\n */\nexport class UserErasedError extends Error {\n  override readonly name = 'UserErasedError';\n  /** The tombstone is permanent: a retry meets it again. */\n  readonly retryable = false;\n  constructor(readonly userId: string) {\n    super(`user ${userId} is erased`);\n  }\n}\n"],"mappings":";;;;;;;;AASA,IAAa,kBAAb,cAAqC,MAAM;CAIpB;CAHrB,OAAyB;;CAEzB,YAAqB;CACrB,YAAY,QAAyB;EACnC,MAAM,QAAQ,OAAO,WAAW;EADb,KAAA,SAAA;CAErB;AACF"}

package/dist/store/erasure.d.cts

@@ -0,0 +1,18 @@
+//#region src/store/erasure.d.ts
+/** Where a user stands with erasure: see `JourneyStore.erasureState`. */
+export type ErasureState = 'none' | 'erasing' | 'erased';
+/**
+ * The user has an erasure tombstone — requested and under way, or carried out — so nothing may
+ * be written about them: a write that got through would come back after the erase, or bring an
+ * erased user back. Thrown by the store from the conditional write itself (the gate), and by the
+ * entry points that check first for a fast answer; the HTTP surface answers 410.
+ */
+export declare class UserErasedError extends Error {
+  readonly userId: string;
+  readonly name = "UserErasedError";
+  /** The tombstone is permanent: a retry meets it again. */
+  readonly retryable = false;
+  constructor(userId: string);
+}
+//#endregion
+//# sourceMappingURL=erasure.d.cts.map

package/dist/store/erasure.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.d.cts","names":[],"sources":["../../src/store/erasure.ts"],"mappings":";;YACY;;;;;;;qBAQC,wBAAwB;WAId;WAHH;;WAET;EACT,YAAqB"}

package/dist/store/erasure.d.mts

@@ -0,0 +1,18 @@
+//#region src/store/erasure.d.ts
+/** Where a user stands with erasure: see `JourneyStore.erasureState`. */
+export type ErasureState = 'none' | 'erasing' | 'erased';
+/**
+ * The user has an erasure tombstone — requested and under way, or carried out — so nothing may
+ * be written about them: a write that got through would come back after the erase, or bring an
+ * erased user back. Thrown by the store from the conditional write itself (the gate), and by the
+ * entry points that check first for a fast answer; the HTTP surface answers 410.
+ */
+export declare class UserErasedError extends Error {
+  readonly userId: string;
+  readonly name = "UserErasedError";
+  /** The tombstone is permanent: a retry meets it again. */
+  readonly retryable = false;
+  constructor(userId: string);
+}
+//#endregion
+//# sourceMappingURL=erasure.d.mts.map

package/dist/store/erasure.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.d.mts","names":[],"sources":["../../src/store/erasure.ts"],"mappings":";;YACY;;;;;;;qBAQC,wBAAwB;WAId;WAHH;;WAET;EACT,YAAqB"}

package/dist/store/erasure.mjs

@@ -0,0 +1,21 @@
+//#region src/store/erasure.ts
+/**
+* The user has an erasure tombstone — requested and under way, or carried out — so nothing may
+* be written about them: a write that got through would come back after the erase, or bring an
+* erased user back. Thrown by the store from the conditional write itself (the gate), and by the
+* entry points that check first for a fast answer; the HTTP surface answers 410.
+*/
+var UserErasedError = class extends Error {
+	userId;
+	name = "UserErasedError";
+	/** The tombstone is permanent: a retry meets it again. */
+	retryable = false;
+	constructor(userId) {
+		super(`user ${userId} is erased`);
+		this.userId = userId;
+	}
+};
+//#endregion
+export { UserErasedError };
+
+//# sourceMappingURL=erasure.mjs.map

package/dist/store/erasure.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure.mjs","names":[],"sources":["../../src/store/erasure.ts"],"sourcesContent":["/** Where a user stands with erasure: see `JourneyStore.erasureState`. */\nexport type ErasureState = 'none' | 'erasing' | 'erased';\n\n/**\n * The user has an erasure tombstone — requested and under way, or carried out — so nothing may\n * be written about them: a write that got through would come back after the erase, or bring an\n * erased user back. Thrown by the store from the conditional write itself (the gate), and by the\n * entry points that check first for a fast answer; the HTTP surface answers 410.\n */\nexport class UserErasedError extends Error {\n  override readonly name = 'UserErasedError';\n  /** The tombstone is permanent: a retry meets it again. */\n  readonly retryable = false;\n  constructor(readonly userId: string) {\n    super(`user ${userId} is erased`);\n  }\n}\n"],"mappings":";;;;;;;AASA,IAAa,kBAAb,cAAqC,MAAM;CAIpB;CAHrB,OAAyB;;CAEzB,YAAqB;CACrB,YAAY,QAAyB;EACnC,MAAM,QAAQ,OAAO,WAAW;EADb,KAAA,SAAA;CAErB;AACF"}

package/dist/store/index.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_store_erasure = require("./erasure.cjs");
 const require_store_postgres_reporting = require("./postgres-reporting.cjs");
 const require_store_tables = require("./tables.cjs");
 const require_store_postgres = require("./postgres.cjs");
@@ -25,6 +26,7 @@ exports.PostgresJourneyStore = require_store_postgres.PostgresJourneyStore;
 exports.PostgresReporting = require_store_postgres_reporting.PostgresReporting;
 exports.SchemaMismatchError = SchemaMismatchError;
 exports.TABLES = require_store_tables.TABLES;
+exports.UserErasedError = require_store_erasure.UserErasedError;
 exports.renderDrizzleSchema = require_store_tables.renderDrizzleSchema;
 exports.renderPostgresDdl = require_store_tables.renderPostgresDdl;
 

package/dist/store/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../src/store/index.ts"],"sourcesContent":["import type { PushDevice } from '../engine/ports';\nimport type { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from '../ir';\n\n/**\n * The journey engine's data plane as a port. Everything the ingest router, the\n * runner and the fact source persist or look up goes through this interface,\n * so the storage engine is a deployment choice: D1 + KV (`D1JourneyStore`,\n * the original), Postgres (`PostgresJourneyStore`), or anything else that can\n * satisfy the contract below. Execution (durable steps, sleeps, wake-ups) is\n * the workflow runtime's job and stays out of here.\n *\n * Timestamps are epoch milliseconds throughout; a store may persist them in\n * its native type as long as `sinceMs` comparisons behave.\n */\n\n/**\n * A profile patch or a stored profile. On the way in, `null` means \"remove\n * this property\" (RFC 7386 merge-patch, the only way the API has to unset\n * one); a stored profile never contains null.\n */\nexport type ProfileProps = Record<string, ScalarIR | null | undefined>;\n\nexport interface EventInput {\n  /** The occurrence's identity, chosen by the sender; a second insert with the same id is a no-op. */\n  id: string;\n  userId: string;\n  event: string;\n  ts: number;\n  payload: Record<string, unknown>;\n}\n\nexport interface TriggerRoute {\n  workflow: string;\n  hash: string;\n  /** Payload gate (payload-only condition tree), or null when the trigger has none. */\n  where: ConditionIR | null;\n  /** Profile gate, or null. */\n  filter: ConditionIR | null;\n  /**\n   * The code version that applied these routes (`replaceRoutesIfNewer`); absent after a forced\n   * deploy, or on a store that keeps none. Read in the same row as the hash, so the pair is\n   * always one deploy's.\n   */\n  version?: string | undefined;\n}\n\nexport interface SegmentTriggerRoute {\n  workflow: string;\n  hash: string;\n  segment: string;\n  /** As `TriggerRoute.version`. */\n  version?: string | undefined;\n}\n\n/**\n * A Worker version, as Cloudflare's version metadata binding names it: the bundle compiled into\n * that version goes live only over an older one (`replaceRoutesIfNewer`).\n */\nexport interface BundleVersion {\n  id: string;\n  /** When the version was created (epoch ms): later versions are newer. */\n  createdAt: number;\n}\n\nexport interface EntryInput {\n  workflow: string;\n  userId: string;\n  instanceId: string;\n  hash: string;\n  ts: number;\n  /**\n   * The instance's start, recorded in the same transaction as the entry — for a runtime whose\n   * start is an asynchronous submit (AWS) that may have to be retried. Only a store with\n   * `executions` accepts it.\n   */\n  execution?: ExecutionStart | undefined;\n}\n\n/** How an instance is started on a runtime that submits it: replayed as is on every retry. */\nexport interface ExecutionStart {\n  /** The runtime's idempotency key (the durable execution name). */\n  name: string;\n  /** What is invoked: a qualified function ARN, its version included. */\n  target: string;\n  /** The exact payload: a retried submit must send the same bytes, or the runtime refuses it. */\n  input: string;\n}\n\nexport interface ExecutionRecord extends ExecutionStart {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n  createdAt: number;\n  submittedAt?: number | undefined;\n  arn?: string | undefined;\n  unresolvedAt?: number | undefined;\n  callbackId?: string | undefined;\n  /** Bumped by every wait the instance arms: a wake or a cleanup of an older one leaves it alone. */\n  generation: number;\n  deadlineAt?: number | undefined;\n  checkedAt?: number | undefined;\n  stoppedAt?: number | undefined;\n}\n\n/**\n * What a runtime that submits its starts and parks waits on one-shot callbacks (AWS) keeps\n * beside the entry ledger. The runtime holds the execution history; this holds only the\n * mapping from the engine's instance id to it.\n */\nexport interface ExecutionRegistry {\n  get(instanceId: string): Promise<ExecutionRecord | undefined>;\n  /**\n   * Starts not yet confirmed and not given up on, oldest first: of one (workflow, user) entry\n   * still running, or every one created before `createdBefore`.\n   */\n  pendingStarts(filter: {\n    workflow?: string;\n    userId?: string;\n    createdBefore?: number;\n    limit: number;\n  }): Promise<ExecutionRecord[]>;\n  markSubmitted(instanceId: string, arn: string | undefined, at: number): Promise<void>;\n  markUnresolved(instanceId: string, at: number): Promise<void>;\n  setArn(instanceId: string, arn: string): Promise<void>;\n  /** Record the callback a wait parks on; false when a newer generation is already armed. */\n  armCallback(\n    instanceId: string,\n    callback: { id: string; generation: number; deadlineAt?: number | undefined }\n  ): Promise<boolean>;\n  /** Forget the callback — only if it is still that generation's. */\n  clearCallback(instanceId: string, generation: number): Promise<void>;\n  /** Submitted executions whose entry is still running, least recently checked first. */\n  toReconcile(limit: number, checkedBefore: number): Promise<ExecutionRecord[]>;\n  markChecked(instanceId: string, at: number): Promise<void>;\n  /** Record the first stop; a later one keeps it. */\n  markStopped(instanceId: string, at: number): Promise<void>;\n}\n\n/**\n * How an entry attempt ended: a fresh row, a 'failed' row of a dead instance\n * taken over (the once policy does not bar a user over one outage), or\n * refused because the pair already entered and is still alive.\n */\nexport type EntryOutcome = 'entered' | 'reclaimed' | null;\n\n/** A device registered for pushes: its provider token belongs to the user who registered it last. */\nexport interface DeviceInput {\n  userId: string;\n  token: string;\n  /** `ios` (APNs) or `android` (FCM): which provider the token belongs to. */\n  platform: string;\n  ts: number;\n}\n\n/** A store plus how to release what opening it acquired (a connection, say). */\nexport interface StoreLease {\n  store: JourneyStore;\n  close?: () => Promise<void>;\n}\n\n/**\n * The live database lacks tables or columns the engine reads (an SDK upgrade added them, or the\n * host never ran the migration). Raised before a deploy writes anything.\n */\nexport class SchemaMismatchError extends Error {\n  override readonly name = 'SchemaMismatchError';\n\n  constructor(readonly problems: readonly string[]) {\n    super(\n      `the database does not match @shware/workflow's tables — regenerate the drizzle schema (workflow-ui generate) and run your migrations:\\n  ${problems.join('\\n  ')}`\n    );\n  }\n}\n\n/** A message copy as reporting records it, before it goes out. */\nexport interface MessageRecord {\n  idempotencyKey: string;\n  workflow: string;\n  instanceId: string;\n  nodeId: string;\n  template: string;\n  /** Where the copy lands: `email`, `push_ios`, `push_android`. */\n  channel: string;\n  userId: string;\n  sentAt: number;\n}\n\n/** What a click is judged by. */\nexport interface ClickContext {\n  url: string;\n  deliveredAt: number;\n  linkCount: number;\n  /** The copy's clicks in the window before this one. */\n  recent: { position: number; at: number }[];\n}\n\n/** An open or a click, with the verdict on who made it and where it came from. */\nexport interface Engagement {\n  at: number;\n  machine: boolean;\n  /** The rule that called it a machine; null for a person. */\n  reason: string | null;\n  userAgent: string | null;\n  /** The network the request came from (Cloudflare's `cf.asn`, `cf.asOrganization`, `cf.country`), never the address. */\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\n/**\n * Journey reporting: where each instance stands, every copy and how it was engaged with, segment\n * sizes. A store that keeps it (Postgres) exposes it as `reporting`; the Worker then records it\n * and serves email tracking. Every write is idempotent — a retried step reports again.\n */\n/** Bounds on when an event happened, both inclusive (epoch ms); an absent side is open. */\nexport interface EventWindow {\n  sinceMs?: number;\n  untilMs?: number;\n}\n\nexport interface JourneyReporting {\n  /** The instance entered: its row exists from here, so one a guard ends at once still counts. */\n  instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void>;\n  nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void>;\n  instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void>;\n  /** The copy's row id; the row a retry already wrote, when there is one. */\n  recordMessage(message: MessageRecord): Promise<string>;\n  settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void>;\n  /** An email's tracked links, in document order. */\n  recordLinks(messageId: string, urls: readonly string[]): Promise<void>;\n  /**\n   * Record an open of the copy, judged by `judge` against the copy (its recipient and when it was\n   * delivered — when it was sent, before the transport answered); `undefined` from the judge\n   * records nothing. Read and written in one transaction. False for an unknown copy.\n   */\n  recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean>;\n  /**\n   * Record a click on the copy's link at `position`, judged by `judge` against the link, how\n   * many links the copy has and its clicks of the last `windowMs`. The copy is locked for the\n   * transaction, so clicks arriving together (a scanner following every link at once) are\n   * judged one after another, each seeing the ones before. When the judge asks to `backdate`,\n   * the window's earlier clicks are reclassified with this one's verdict. A click implies an\n   * open. Undefined for an unknown link.\n   */\n  recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined>;\n  /** The email copy's recipient opted out of email: recorded on the copy and as a suppression. False for an unknown copy. */\n  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;\n  /** A push copy the device reported it received. False for an unknown copy. */\n  recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;\n  /** Drop members of segments no longer deployed, then record every deployed segment's size. */\n  snapshotSegments(at: number): Promise<{ segment: string; size: number }[]>;\n}\n\nexport interface JourneyStore {\n  /** Reporting, when the store keeps it (Postgres); D1 stores none. */\n  readonly reporting?: JourneyReporting;\n\n  /**\n   * Record that the user's data must go (a deleted account), before anything is erased: the\n   * request outlives a failure to stop their instances, and the sweep retries it.\n   */\n  requestErasure(userId: string, at: number): Promise<void>;\n  /** Users whose erasure was requested and not finished yet. */\n  pendingErasures(): Promise<string[]>;\n  /** The user's journey instances still running, by the entry ledger. */\n  runningInstances(userId: string): Promise<string[]>;\n  /**\n   * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment\n   * memberships, suppressions, entries and reporting — and the erasure request last. Run only\n   * once no instance of theirs runs any more, or one could write some of it back.\n   */\n  forgetUser(userId: string): Promise<void>;\n\n  /** The user opted out of the channel (recorded by an unsubscribe); stores without reporting omit it. */\n  isSuppressed?(userId: string, channel: string): Promise<boolean>;\n\n  /**\n   * What the live database lacks against the engine's tables (read-only); a deploy refuses to\n   * run while it lists anything. Stores whose schema the engine owns (D1) omit it.\n   */\n  checkSchema?(): Promise<string[]>;\n\n  /* ---------------------------------- events --------------------------------- */\n  /** Append the occurrence; false when its id was already in the log (nothing written). */\n  insertEvent(input: EventInput): Promise<boolean>;\n  /** Occurrences of `event` for the user, optionally only those within the window. */\n  countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;\n  /** The payloads of those occurrences — the caller filters them with the shared evaluator. */\n  listEventPayloads(\n    userId: string,\n    event: string,\n    window?: EventWindow\n  ): Promise<Record<string, unknown>[]>;\n\n  /* --------------------------------- profiles -------------------------------- */\n  getProfile(userId: string): Promise<ProfileProps | undefined>;\n  /**\n   * Merge-patch `props` into the stored profile in one statement (a null\n   * removes the property) and return the result. One statement, because a\n   * read-modify-write loses one of two concurrent identifies.\n   */\n  mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;\n\n  /** Every user the engine knows (a profile or an event): who the segment sweep evaluates. */\n  listUserIds(): Promise<string[]>;\n\n  /* ---------------------------------- devices --------------------------------- */\n  /** The user's push devices, most recently registered first. */\n  listDevices(userId: string): Promise<PushDevice[]>;\n  /**\n   * Register a device: one row per token, so a token registered again moves to the user who\n   * registered it last (a phone signed into another account) and to the front of their list.\n   */\n  upsertDevice(device: DeviceInput): Promise<void>;\n  /** Forget a token (reported dead by APNs / FCM); the user it belonged to, if any. */\n  removeDevice(token: string): Promise<string | undefined>;\n  /**\n   * The user signed out on the device: the token is kept, bound to nobody, until the next sign-in\n   * binds it again. The user it belonged to, if any.\n   */\n  unbindDevice(token: string): Promise<string | undefined>;\n\n  /* ---------------------------- deployed definitions -------------------------- */\n  getSegmentCondition(id: string): Promise<ConditionIR | undefined>;\n  /** Every deployed segment with its definition: what the segment sweep evaluates. */\n  listSegments(): Promise<{ id: string; condition: ConditionIR }[]>;\n  findTriggers(event: string): Promise<TriggerRoute[]>;\n  listSegmentTriggers(): Promise<SegmentTriggerRoute[]>;\n  putWorkflowIR(workflow: WorkflowIR): Promise<void>;\n  getWorkflowIR(contentHash: string): Promise<WorkflowIR | undefined>;\n  /**\n   * Swap the routing tables (segments, event triggers, segment triggers) for\n   * the bundle's — atomically, so a concurrent ingest never sees them half\n   * empty. Workflow bodies are stored separately (`putWorkflowIR`) because they\n   * are content-addressed and outlive the routes that point at them.\n   */\n  replaceRoutes(bundle: BundleIR): Promise<void>;\n  /**\n   * The Worker version whose bundle the routes came from, when one put them there through\n   * `replaceRoutesIfNewer` (a forced deploy leaves it as it was). Read from the database itself,\n   * not a cache in front of it. Stores without it (D1) leave every deploy to `POST /bundle/deploy`.\n   */\n  liveBundleVersion?(): Promise<BundleVersion | undefined>;\n  /**\n   * `replaceRoutes`, only when `version` is newer than the live one, recorded in the same\n   * transaction: two versions serving side by side during a rollout cannot leave the older one's\n   * routes in force. False, with nothing written, when a version as new or newer is live.\n   */\n  replaceRoutesIfNewer?(bundle: BundleIR, version: BundleVersion): Promise<boolean>;\n\n  /* ----------------------------- segment membership --------------------------- */\n  isSegmentMember(segment: string, userId: string): Promise<boolean>;\n  /** Record the membership, with the workflows its entry has to start (see segment_start). */\n  addSegmentMember(\n    segment: string,\n    userId: string,\n    ts: number,\n    workflows: readonly string[]\n  ): Promise<void>;\n  /** The workflows the member's entry has not started yet. */\n  pendingSegmentStarts(segment: string, userId: string): Promise<string[]>;\n  completeSegmentStart(segment: string, userId: string, workflow: string): Promise<void>;\n  /** Drop the membership and any start it still owed. */\n  removeSegmentMember(segment: string, userId: string): Promise<void>;\n\n  /* ------------------------------- entry ledger ------------------------------- */\n  /**\n   * Record the entry (the once policy). Atomic under concurrent ingests: of\n   * two racing attempts exactly one is 'entered' (or 'reclaimed', when the\n   * pair's previous instance is recorded as 'failed') and the other null.\n   */\n  enterJourney(entry: EntryInput): Promise<EntryOutcome>;\n  removeEntry(instanceId: string): Promise<void>;\n  setEntryStatus(instanceId: string, status: string): Promise<void>;\n  /** Execution starts and wake callbacks, for a runtime that needs them (AWS); Postgres only. */\n  readonly executions?: ExecutionRegistry;\n\n  /* ------------------------------ wake subscriptions --------------------------- */\n  /** Distinct wake handles registered for (user, event). */\n  findWakeHandles(userId: string, event: string): Promise<string[]>;\n  /** Register the handle for each event; repeated registrations are idempotent. */\n  subscribe(handle: string, userId: string, events: readonly string[], ts: number): Promise<void>;\n  /** Drop every registration the handle holds. */\n  unsubscribe(handle: string): Promise<void>;\n}\n\nexport { D1JourneyStore } from './d1';\nexport { JourneyFactSource } from './facts';\nexport { PostgresJourneyStore } from './postgres';\nexport { PostgresReporting } from './postgres-reporting';\nexport {\n  DEFAULT_SCHEMA,\n  TABLES,\n  renderDrizzleSchema,\n  renderPostgresDdl,\n  type TableSpec,\n} from './tables';\nexport type { PostgresJourneyStoreOptions, SqlClientLike } from './postgres';\n"],"mappings":";;;;;;;;;;;AAoKA,IAAa,sBAAb,cAAyC,MAAM;CAGxB;CAFrB,OAAyB;CAEzB,YAAY,UAAsC;EAChD,MACE,4IAA4I,SAAS,KAAK,MAAM,GAClK;EAHmB,KAAA,WAAA;CAIrB;AACF"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/store/index.ts"],"sourcesContent":["import type { PushDevice } from '../engine/ports';\nimport type { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from '../ir';\n\n/**\n * The journey engine's data plane as a port. Everything the ingest router, the\n * runner and the fact source persist or look up goes through this interface,\n * so the storage engine is a deployment choice: D1 + KV (`D1JourneyStore`,\n * the original), Postgres (`PostgresJourneyStore`), or anything else that can\n * satisfy the contract below. Execution (durable steps, sleeps, wake-ups) is\n * the workflow runtime's job and stays out of here.\n *\n * Timestamps are epoch milliseconds throughout; a store may persist them in\n * its native type as long as `sinceMs` comparisons behave.\n */\n\n/**\n * A profile patch or a stored profile. On the way in, `null` means \"remove\n * this property\" (RFC 7386 merge-patch, the only way the API has to unset\n * one); a stored profile never contains null.\n */\nexport type ProfileProps = Record<string, ScalarIR | null | undefined>;\n\nexport interface EventInput {\n  /** The occurrence's identity, chosen by the sender; a second insert with the same id is a no-op. */\n  id: string;\n  userId: string;\n  event: string;\n  ts: number;\n  payload: Record<string, unknown>;\n}\n\nexport interface TriggerRoute {\n  workflow: string;\n  hash: string;\n  /** Payload gate (payload-only condition tree), or null when the trigger has none. */\n  where: ConditionIR | null;\n  /** Profile gate, or null. */\n  filter: ConditionIR | null;\n  /**\n   * The code version that applied these routes (`replaceRoutesIfNewer`); absent after a forced\n   * deploy, or on a store that keeps none. Read in the same row as the hash, so the pair is\n   * always one deploy's.\n   */\n  version?: string | undefined;\n}\n\nexport interface SegmentTriggerRoute {\n  workflow: string;\n  hash: string;\n  segment: string;\n  /** As `TriggerRoute.version`. */\n  version?: string | undefined;\n}\n\n/**\n * A Worker version, as Cloudflare's version metadata binding names it: the bundle compiled into\n * that version goes live only over an older one (`replaceRoutesIfNewer`).\n */\nexport interface BundleVersion {\n  id: string;\n  /** When the version was created (epoch ms): later versions are newer. */\n  createdAt: number;\n}\n\nexport interface EntryInput {\n  workflow: string;\n  userId: string;\n  instanceId: string;\n  hash: string;\n  ts: number;\n  /**\n   * The instance's start, recorded in the same transaction as the entry — for a runtime whose\n   * start is an asynchronous submit (AWS) that may have to be retried. Only a store with\n   * `executions` accepts it.\n   */\n  execution?: ExecutionStart | undefined;\n}\n\n/** How an instance is started on a runtime that submits it: replayed as is on every retry. */\nexport interface ExecutionStart {\n  /** The runtime's idempotency key (the durable execution name). */\n  name: string;\n  /** What is invoked: a qualified function ARN, its version included. */\n  target: string;\n  /** The exact payload: a retried submit must send the same bytes, or the runtime refuses it. */\n  input: string;\n}\n\nexport interface ExecutionRecord extends ExecutionStart {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n  createdAt: number;\n  submittedAt?: number | undefined;\n  arn?: string | undefined;\n  unresolvedAt?: number | undefined;\n  callbackId?: string | undefined;\n  /** Bumped by every wait the instance arms: a wake or a cleanup of an older one leaves it alone. */\n  generation: number;\n  deadlineAt?: number | undefined;\n  checkedAt?: number | undefined;\n  stoppedAt?: number | undefined;\n}\n\n/**\n * What a runtime that submits its starts and parks waits on one-shot callbacks (AWS) keeps\n * beside the entry ledger. The runtime holds the execution history; this holds only the\n * mapping from the engine's instance id to it.\n */\nexport interface ExecutionRegistry {\n  get(instanceId: string): Promise<ExecutionRecord | undefined>;\n  /**\n   * Starts not yet confirmed and not given up on, oldest first: of one (workflow, user) entry\n   * still running, or every one created before `createdBefore`.\n   */\n  pendingStarts(filter: {\n    workflow?: string;\n    userId?: string;\n    createdBefore?: number;\n    limit: number;\n  }): Promise<ExecutionRecord[]>;\n  markSubmitted(instanceId: string, arn: string | undefined, at: number): Promise<void>;\n  markUnresolved(instanceId: string, at: number): Promise<void>;\n  setArn(instanceId: string, arn: string): Promise<void>;\n  /** Record the callback a wait parks on; false when a newer generation is already armed. */\n  armCallback(\n    instanceId: string,\n    callback: { id: string; generation: number; deadlineAt?: number | undefined }\n  ): Promise<boolean>;\n  /** Forget the callback — only if it is still that generation's. */\n  clearCallback(instanceId: string, generation: number): Promise<void>;\n  /** Submitted executions whose entry is still running, least recently checked first. */\n  toReconcile(limit: number, checkedBefore: number): Promise<ExecutionRecord[]>;\n  markChecked(instanceId: string, at: number): Promise<void>;\n  /** Record the first stop; a later one keeps it. */\n  markStopped(instanceId: string, at: number): Promise<void>;\n}\n\n/**\n * How an entry attempt ended: a fresh row, a 'failed' row of a dead instance\n * taken over (the once policy does not bar a user over one outage), or\n * refused because the pair already entered and is still alive.\n */\nexport type EntryOutcome = 'entered' | 'reclaimed' | null;\n\n/** A device registered for pushes: its provider token belongs to the user who registered it last. */\nexport interface DeviceInput {\n  userId: string;\n  token: string;\n  /** `ios` (APNs) or `android` (FCM): which provider the token belongs to. */\n  platform: string;\n  ts: number;\n}\n\n/** An instance of a user still in the ledger, and whether its runner was admitted (see `admitInstance`). */\nexport interface RunningInstance {\n  instanceId: string;\n  /** False until the runner admitted itself: nothing has run, and the tombstone keeps it that way. */\n  admitted: boolean;\n}\n\n/** A store plus how to release what opening it acquired (a connection, say). */\nexport interface StoreLease {\n  store: JourneyStore;\n  close?: () => Promise<void>;\n}\n\nimport type { ErasureState } from './erasure';\n\nexport { type ErasureState, UserErasedError } from './erasure';\n\n/**\n * The live database lacks tables or columns the engine reads (an SDK upgrade added them, or the\n * host never ran the migration). Raised before a deploy writes anything.\n */\nexport class SchemaMismatchError extends Error {\n  override readonly name = 'SchemaMismatchError';\n\n  constructor(readonly problems: readonly string[]) {\n    super(\n      `the database does not match @shware/workflow's tables — regenerate the drizzle schema (workflow-ui generate) and run your migrations:\\n  ${problems.join('\\n  ')}`\n    );\n  }\n}\n\n/** A message copy as reporting records it, before it goes out. */\nexport interface MessageRecord {\n  idempotencyKey: string;\n  workflow: string;\n  instanceId: string;\n  nodeId: string;\n  template: string;\n  /** Where the copy lands: `email`, `push_ios`, `push_android`. */\n  channel: string;\n  userId: string;\n  sentAt: number;\n}\n\n/** What a click is judged by. */\nexport interface ClickContext {\n  url: string;\n  deliveredAt: number;\n  linkCount: number;\n  /** The copy's clicks in the window before this one. */\n  recent: { position: number; at: number }[];\n}\n\n/** An open or a click, with the verdict on who made it and where it came from. */\nexport interface Engagement {\n  at: number;\n  machine: boolean;\n  /** The rule that called it a machine; null for a person. */\n  reason: string | null;\n  userAgent: string | null;\n  /** The network the request came from (Cloudflare's `cf.asn`, `cf.asOrganization`, `cf.country`), never the address. */\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\n/**\n * Journey reporting: where each instance stands, every copy and how it was engaged with, segment\n * sizes. A store that keeps it (Postgres) exposes it as `reporting`; the Worker then records it\n * and serves email tracking. Every write is idempotent — a retried step reports again.\n */\n/** Bounds on when an event happened, both inclusive (epoch ms); an absent side is open. */\nexport interface EventWindow {\n  sinceMs?: number;\n  untilMs?: number;\n}\n\nexport interface JourneyReporting {\n  /** The instance entered: its row exists from here, so one a guard ends at once still counts. */\n  instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void>;\n  nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void>;\n  instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void>;\n  /** The copy's row id; the row a retry already wrote, when there is one. */\n  recordMessage(message: MessageRecord): Promise<string>;\n  settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void>;\n  /** An email's tracked links, in document order. */\n  recordLinks(messageId: string, urls: readonly string[]): Promise<void>;\n  /**\n   * Record an open of the copy, judged by `judge` against the copy (its recipient and when it was\n   * delivered — when it was sent, before the transport answered); `undefined` from the judge\n   * records nothing. Read and written in one transaction. False for an unknown copy.\n   */\n  recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean>;\n  /**\n   * Record a click on the copy's link at `position`, judged by `judge` against the link, how\n   * many links the copy has and its clicks of the last `windowMs`. The copy is locked for the\n   * transaction, so clicks arriving together (a scanner following every link at once) are\n   * judged one after another, each seeing the ones before. When the judge asks to `backdate`,\n   * the window's earlier clicks are reclassified with this one's verdict. A click implies an\n   * open. Undefined for an unknown link.\n   */\n  recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined>;\n  /**\n   * The email copy's recipient opted out of email: recorded on the copy and as a suppression, in\n   * one transaction, which also yields who the recipient is — so the caller acts on the\n   * unsubscribe without a second read. Undefined for an unknown copy.\n   */\n  recordUnsubscribe(messageId: string, at: number): Promise<{ userId: string } | undefined>;\n  /** A push copy the device reported it received. False for an unknown copy. */\n  recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;\n  /** Drop members of segments no longer deployed, then record every deployed segment's size. */\n  snapshotSegments(at: number): Promise<{ segment: string; size: number }[]>;\n}\n\nexport interface JourneyStore {\n  /** Reporting, when the store keeps it (Postgres); D1 stores none. */\n  readonly reporting?: JourneyReporting;\n\n  /**\n   * Record that the user's data must go (a deleted account): the tombstone every write about\n   * the user is conditional on, from here on and for good. Committed before anything is\n   * stopped or erased, so an entry that got in before it is found by the erasure and none gets\n   * in after it. Idempotent: a second request, or one for a user already erased, changes nothing.\n   */\n  requestErasure(userId: string, at: number): Promise<void>;\n  /** Users whose erasure was requested and not carried out yet (`'erasing'`), oldest first. */\n  pendingErasures(): Promise<string[]>;\n  /**\n   * Where the user stands: `'none'` (no tombstone), `'erasing'` (requested, their instances\n   * being stopped, data still there) or `'erased'` (`forgetUser` went through). Both\n   * tombstone states refuse every write about the user; the entry points read this for a fast\n   * answer, and the store's conditional writes are the gate itself.\n   */\n  erasureState(userId: string): Promise<ErasureState>;\n  /** The user's journey instances still running, by the entry ledger. */\n  runningInstances(userId: string): Promise<RunningInstance[]>;\n  /**\n   * The runner's admission, before its first observable effect: records that the instance runs\n   * (`admitted_at`, kept on replay) — unless the user has an erasure tombstone, in which case\n   * nothing is recorded and the runner must not run. Mutually exclusive with `requestErasure`\n   * and `forgetUser` for that user (Postgres: the user's advisory lock), so an erasure either\n   * finds the instance admitted and stops it, or commits its tombstone first and the admission\n   * is refused — never neither.\n   *\n   * A first admission needs the entry running. An instance already admitted is admitted again\n   * whatever the entry's status — the legitimate replay of an instance whose finalisation was\n   * cut short after the entry reached its terminal status, which resumes on its own checkpoint\n   * and finishes what is left. Never a new attempt's way in: false for a terminal entry never\n   * admitted, for an entry no longer in the ledger, for another user's entry, and for an\n   * instance whose entry was reclaimed since (`enterJourney` resets the admission with the\n   * instance id, so a superseded attempt cannot pass under the id it lost).\n   */\n  admitInstance(instanceId: string, userId: string): Promise<boolean>;\n  /**\n   * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment\n   * memberships, entries and reporting — and mark the tombstone erased (`erased_at`), which\n   * stays: a write that was in flight when the data went cannot bring the user back, and the\n   * same id is never reactivated by ingest. Suppressions stay too: an opt-out is a compliance\n   * record keyed by an opaque id, and it outlives the erasure. Run only once no instance of\n   * theirs runs any more, or one could write some of it back. Idempotent. Mutually exclusive\n   * with every write about the user (Postgres: the user's advisory lock; D1: one writer), so\n   * the data is gone when this returns — nothing of theirs lands afterwards.\n   */\n  forgetUser(userId: string, at: number): Promise<void>;\n\n  /** The user opted out of the channel (recorded by an unsubscribe); stores without reporting omit it. */\n  isSuppressed?(userId: string, channel: string): Promise<boolean>;\n\n  /**\n   * What the live database lacks against the engine's tables (read-only); a deploy refuses to\n   * run while it lists anything. Stores whose schema the engine owns (D1) omit it.\n   */\n  checkSchema?(): Promise<string[]>;\n\n  /* ---------------------------------- events --------------------------------- */\n  /**\n   * Append the occurrence; false when its id was already in the log (nothing written). Throws\n   * `UserErasedError` for a user with a tombstone, like every write about a user below.\n   */\n  insertEvent(input: EventInput): Promise<boolean>;\n  /** Occurrences of `event` for the user, optionally only those within the window. */\n  countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;\n  /** The payloads of those occurrences — the caller filters them with the shared evaluator. */\n  listEventPayloads(\n    userId: string,\n    event: string,\n    window?: EventWindow\n  ): Promise<Record<string, unknown>[]>;\n\n  /* --------------------------------- profiles -------------------------------- */\n  getProfile(userId: string): Promise<ProfileProps | undefined>;\n  /**\n   * Merge-patch `props` into the stored profile in one statement (a null\n   * removes the property) and return the result. One statement, because a\n   * read-modify-write loses one of two concurrent identifies.\n   */\n  mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;\n\n  /**\n   * Every user the engine knows (a profile or an event): who the segment sweep evaluates. Ids\n   * come in ascending order; `after` resumes past the last id of the previous page, and `limit`\n   * bounds the page (the whole list without one).\n   */\n  listUserIds(page?: { after?: string | undefined; limit?: number | undefined }): Promise<string[]>;\n\n  /* ---------------------------------- devices --------------------------------- */\n  /** The user's push devices, most recently registered first. */\n  listDevices(userId: string): Promise<PushDevice[]>;\n  /**\n   * Register a device: one row per token, so a token registered again moves to the user who\n   * registered it last (a phone signed into another account) and to the front of their list.\n   */\n  upsertDevice(device: DeviceInput): Promise<void>;\n  /** Forget a token (reported dead by APNs / FCM); the user it belonged to, if any. */\n  removeDevice(token: string): Promise<string | undefined>;\n  /**\n   * The user signed out on the device: the token is kept, bound to nobody, until the next sign-in\n   * binds it again. The user it belonged to, if any.\n   */\n  unbindDevice(token: string): Promise<string | undefined>;\n\n  /* ---------------------------- deployed definitions -------------------------- */\n  getSegmentCondition(id: string): Promise<ConditionIR | undefined>;\n  /** Every deployed segment with its definition: what the segment sweep evaluates. */\n  listSegments(): Promise<{ id: string; condition: ConditionIR }[]>;\n  findTriggers(event: string): Promise<TriggerRoute[]>;\n  listSegmentTriggers(): Promise<SegmentTriggerRoute[]>;\n  putWorkflowIR(workflow: WorkflowIR): Promise<void>;\n  getWorkflowIR(contentHash: string): Promise<WorkflowIR | undefined>;\n  /**\n   * Swap the routing tables (segments, event triggers, segment triggers) for\n   * the bundle's — atomically, so a concurrent ingest never sees them half\n   * empty. Workflow bodies are stored separately (`putWorkflowIR`) because they\n   * are content-addressed and outlive the routes that point at them.\n   */\n  replaceRoutes(bundle: BundleIR): Promise<void>;\n  /**\n   * The Worker version whose bundle the routes came from, when one put them there through\n   * `replaceRoutesIfNewer` (a forced deploy leaves it as it was). Read from the database itself,\n   * not a cache in front of it. Stores without it (D1) leave every deploy to `POST /bundle/deploy`.\n   */\n  liveBundleVersion?(): Promise<BundleVersion | undefined>;\n  /**\n   * `replaceRoutes`, only when `version` is newer than the live one, recorded in the same\n   * transaction: two versions serving side by side during a rollout cannot leave the older one's\n   * routes in force. False, with nothing written, when a version as new or newer is live.\n   */\n  replaceRoutesIfNewer?(bundle: BundleIR, version: BundleVersion): Promise<boolean>;\n\n  /* ----------------------------- segment membership --------------------------- */\n  isSegmentMember(segment: string, userId: string): Promise<boolean>;\n  /** Record the membership, with the workflows its entry has to start (see segment_start). */\n  addSegmentMember(\n    segment: string,\n    userId: string,\n    ts: number,\n    workflows: readonly string[]\n  ): Promise<void>;\n  /** The workflows the member's entry has not started yet. */\n  pendingSegmentStarts(segment: string, userId: string): Promise<string[]>;\n  completeSegmentStart(segment: string, userId: string, workflow: string): Promise<void>;\n  /** Drop the membership and any start it still owed. */\n  removeSegmentMember(segment: string, userId: string): Promise<void>;\n\n  /* ------------------------------- entry ledger ------------------------------- */\n  /**\n   * Record the entry (the once policy). Atomic under concurrent ingests: of\n   * two racing attempts exactly one is 'entered' (or 'reclaimed', when the\n   * pair's previous instance is recorded as 'failed') and the other null.\n   */\n  enterJourney(entry: EntryInput): Promise<EntryOutcome>;\n  removeEntry(instanceId: string): Promise<void>;\n  setEntryStatus(instanceId: string, status: string): Promise<void>;\n  /** Execution starts and wake callbacks, for a runtime that needs them (AWS); Postgres only. */\n  readonly executions?: ExecutionRegistry;\n\n  /* ------------------------------ wake subscriptions --------------------------- */\n  /** Distinct wake handles registered for (user, event). */\n  findWakeHandles(userId: string, event: string): Promise<string[]>;\n  /** Register the handle for each event; repeated registrations are idempotent. */\n  subscribe(handle: string, userId: string, events: readonly string[], ts: number): Promise<void>;\n  /** Drop every registration the handle holds. */\n  unsubscribe(handle: string): Promise<void>;\n}\n\nexport { D1JourneyStore } from './d1';\nexport { JourneyFactSource } from './facts';\nexport { PostgresJourneyStore } from './postgres';\nexport { PostgresReporting } from './postgres-reporting';\nexport {\n  DEFAULT_SCHEMA,\n  TABLES,\n  renderDrizzleSchema,\n  renderPostgresDdl,\n  type TableSpec,\n} from './tables';\nexport type { PostgresJourneyStoreOptions, SqlClientLike } from './postgres';\n"],"mappings":";;;;;;;;;;;;AA+KA,IAAa,sBAAb,cAAyC,MAAM;CAGxB;CAFrB,OAAyB;CAEzB,YAAY,UAAsC;EAChD,MACE,4IAA4I,SAAS,KAAK,MAAM,GAClK;EAHmB,KAAA,WAAA;CAIrB;AACF"}

package/dist/store/index.d.cts

@@ -1,5 +1,6 @@
 import { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from "../ir.cjs";
 import { PushDevice } from "../engine/ports.cjs";
+import { ErasureState, UserErasedError } from "./erasure.cjs";
 import { D1JourneyStore } from "./d1.cjs";
 import { JourneyFactSource } from "./facts.cjs";
 import { SqlClientLike } from "./sql.cjs";
@@ -147,6 +148,12 @@ export interface DeviceInput {
   platform: string;
   ts: number;
 }
+/** An instance of a user still in the ledger, and whether its runner was admitted (see `admitInstance`). */
+export interface RunningInstance {
+  instanceId: string;
+  /** False until the runner admitted itself: nothing has run, and the tombstone keeps it that way. */
+  admitted: boolean;
+}
 /** A store plus how to release what opening it acquired (a connection, say). */
 export interface StoreLease {
   store: JourneyStore;
@@ -263,8 +270,14 @@ export interface JourneyReporting {
     url: string;
     engagement: Engagement;
   } | undefined>;
-  /** The email copy's recipient opted out of email: recorded on the copy and as a suppression. False for an unknown copy. */
-  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;
+  /**
+   * The email copy's recipient opted out of email: recorded on the copy and as a suppression, in
+   * one transaction, which also yields who the recipient is — so the caller acts on the
+   * unsubscribe without a second read. Undefined for an unknown copy.
+   */
+  recordUnsubscribe(messageId: string, at: number): Promise<{
+    userId: string;
+  } | undefined>;
   /** A push copy the device reported it received. False for an unknown copy. */
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
   /** Drop members of segments no longer deployed, then record every deployed segment's size. */
@@ -277,20 +290,51 @@ export interface JourneyStore {
   /** Reporting, when the store keeps it (Postgres); D1 stores none. */
   readonly reporting?: JourneyReporting;
   /**
-   * Record that the user's data must go (a deleted account), before anything is erased: the
-   * request outlives a failure to stop their instances, and the sweep retries it.
+   * Record that the user's data must go (a deleted account): the tombstone every write about
+   * the user is conditional on, from here on and for good. Committed before anything is
+   * stopped or erased, so an entry that got in before it is found by the erasure and none gets
+   * in after it. Idempotent: a second request, or one for a user already erased, changes nothing.
    */
   requestErasure(userId: string, at: number): Promise<void>;
-  /** Users whose erasure was requested and not finished yet. */
+  /** Users whose erasure was requested and not carried out yet (`'erasing'`), oldest first. */
   pendingErasures(): Promise<string[]>;
+  /**
+   * Where the user stands: `'none'` (no tombstone), `'erasing'` (requested, their instances
+   * being stopped, data still there) or `'erased'` (`forgetUser` went through). Both
+   * tombstone states refuse every write about the user; the entry points read this for a fast
+   * answer, and the store's conditional writes are the gate itself.
+   */
+  erasureState(userId: string): Promise<ErasureState>;
   /** The user's journey instances still running, by the entry ledger. */
-  runningInstances(userId: string): Promise<string[]>;
+  runningInstances(userId: string): Promise<RunningInstance[]>;
+  /**
+   * The runner's admission, before its first observable effect: records that the instance runs
+   * (`admitted_at`, kept on replay) — unless the user has an erasure tombstone, in which case
+   * nothing is recorded and the runner must not run. Mutually exclusive with `requestErasure`
+   * and `forgetUser` for that user (Postgres: the user's advisory lock), so an erasure either
+   * finds the instance admitted and stops it, or commits its tombstone first and the admission
+   * is refused — never neither.
+   *
+   * A first admission needs the entry running. An instance already admitted is admitted again
+   * whatever the entry's status — the legitimate replay of an instance whose finalisation was
+   * cut short after the entry reached its terminal status, which resumes on its own checkpoint
+   * and finishes what is left. Never a new attempt's way in: false for a terminal entry never
+   * admitted, for an entry no longer in the ledger, for another user's entry, and for an
+   * instance whose entry was reclaimed since (`enterJourney` resets the admission with the
+   * instance id, so a superseded attempt cannot pass under the id it lost).
+   */
+  admitInstance(instanceId: string, userId: string): Promise<boolean>;
   /**
    * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment
-   * memberships, suppressions, entries and reporting — and the erasure request last. Run only
-   * once no instance of theirs runs any more, or one could write some of it back.
+   * memberships, entries and reporting — and mark the tombstone erased (`erased_at`), which
+   * stays: a write that was in flight when the data went cannot bring the user back, and the
+   * same id is never reactivated by ingest. Suppressions stay too: an opt-out is a compliance
+   * record keyed by an opaque id, and it outlives the erasure. Run only once no instance of
+   * theirs runs any more, or one could write some of it back. Idempotent. Mutually exclusive
+   * with every write about the user (Postgres: the user's advisory lock; D1: one writer), so
+   * the data is gone when this returns — nothing of theirs lands afterwards.
    */
-  forgetUser(userId: string): Promise<void>;
+  forgetUser(userId: string, at: number): Promise<void>;
   /** The user opted out of the channel (recorded by an unsubscribe); stores without reporting omit it. */
   isSuppressed?(userId: string, channel: string): Promise<boolean>;
   /**
@@ -298,7 +342,10 @@ export interface JourneyStore {
    * run while it lists anything. Stores whose schema the engine owns (D1) omit it.
    */
   checkSchema?(): Promise<string[]>;
-  /** Append the occurrence; false when its id was already in the log (nothing written). */
+  /**
+   * Append the occurrence; false when its id was already in the log (nothing written). Throws
+   * `UserErasedError` for a user with a tombstone, like every write about a user below.
+   */
   insertEvent(input: EventInput): Promise<boolean>;
   /** Occurrences of `event` for the user, optionally only those within the window. */
   countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;
@@ -311,8 +358,15 @@ export interface JourneyStore {
    * read-modify-write loses one of two concurrent identifies.
    */
   mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;
-  /** Every user the engine knows (a profile or an event): who the segment sweep evaluates. */
-  listUserIds(): Promise<string[]>;
+  /**
+   * Every user the engine knows (a profile or an event): who the segment sweep evaluates. Ids
+   * come in ascending order; `after` resumes past the last id of the previous page, and `limit`
+   * bounds the page (the whole list without one).
+   */
+  listUserIds(page?: {
+    after?: string | undefined;
+    limit?: number | undefined;
+  }): Promise<string[]>;
   /** The user's push devices, most recently registered first. */
   listDevices(userId: string): Promise<PushDevice[]>;
   /**
@@ -382,5 +436,5 @@ export interface JourneyStore {
   unsubscribe(handle: string): Promise<void>;
 }
 //#endregion
-export { D1JourneyStore, DEFAULT_SCHEMA, JourneyFactSource, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type SqlClientLike, TABLES, type TableSpec, renderDrizzleSchema, renderPostgresDdl };
+export { D1JourneyStore, DEFAULT_SCHEMA, type ErasureState, JourneyFactSource, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type SqlClientLike, TABLES, type TableSpec, UserErasedError, renderDrizzleSchema, renderPostgresDdl };
 //# sourceMappingURL=index.d.cts.map

package/dist/store/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;YAoBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;;;;;EAMR;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;;EAMA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;EACA;;EAEA;EACA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAOH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;EACvC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;EAEtC,kBAAkB,mBAAmB,aAAa;;EAElD,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;iBAG1C;;WAEN,YAAY;;;;;EAMrB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;EAEnB,iBAAiB,iBAAiB;;;;;;EAMlC,WAAW,iBAAiB;;EAG5B,cAAc,gBAAgB,kBAAkB;;;;;EAMhD,gBAAgB;;EAIhB,YAAY,OAAO,aAAa;;EAEhC,YAAY,gBAAgB,eAAe,SAAS,cAAc;;EAElE,kBACE,gBACA,eACA,SAAS,cACR,QAAQ;EAGX,WAAW,iBAAiB,QAAQ;;;;;;EAMpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;;EAG3D,eAAe;;EAIf,YAAY,iBAAiB,QAAQ;;;;;EAKrC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;EAO5C,cAAc,QAAQ,WAAW;;;;;;EAMjC,sBAAsB,QAAQ;;;;;;EAM9B,sBAAsB,QAAQ,UAAU,SAAS,gBAAgB;EAGjE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;WAE3C,aAAa;;EAItB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;YAoBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;;;;;EAMR;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;;EAMA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;EACA;;EAEA;EACA;;;iBAIe;EACf;;EAEA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAWH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;EACvC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;;;;;EAMtC,kBAAkB,mBAAmB,aAAa;IAAU;;;EAE5D,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;iBAG1C;;WAEN,YAAY;;;;;;;EAQrB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;;;;;;EAOnB,aAAa,iBAAiB,QAAQ;;EAEtC,iBAAiB,iBAAiB,QAAQ;;;;;;;;;;;;;;;;;EAiB1C,cAAc,oBAAoB,iBAAiB;;;;;;;;;;;EAWnD,WAAW,gBAAgB,aAAa;;EAGxC,cAAc,gBAAgB,kBAAkB;;;;;EAMhD,gBAAgB;;;;;EAOhB,YAAY,OAAO,aAAa;;EAEhC,YAAY,gBAAgB,eAAe,SAAS,cAAc;;EAElE,kBACE,gBACA,eACA,SAAS,cACR,QAAQ;EAGX,WAAW,iBAAiB,QAAQ;;;;;;EAMpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;;;;;;EAO3D,YAAY;IAAS;IAA4B;MAA+B;;EAIhF,YAAY,iBAAiB,QAAQ;;;;;EAKrC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;EAO5C,cAAc,QAAQ,WAAW;;;;;;EAMjC,sBAAsB,QAAQ;;;;;;EAM9B,sBAAsB,QAAQ,UAAU,SAAS,gBAAgB;EAGjE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;WAE3C,aAAa;;EAItB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}

package/dist/store/index.d.mts

@@ -1,5 +1,6 @@
 import { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from "../ir.mjs";
 import { PushDevice } from "../engine/ports.mjs";
+import { ErasureState, UserErasedError } from "./erasure.mjs";
 import { D1JourneyStore } from "./d1.mjs";
 import { JourneyFactSource } from "./facts.mjs";
 import { SqlClientLike } from "./sql.mjs";
@@ -147,6 +148,12 @@ export interface DeviceInput {
   platform: string;
   ts: number;
 }
+/** An instance of a user still in the ledger, and whether its runner was admitted (see `admitInstance`). */
+export interface RunningInstance {
+  instanceId: string;
+  /** False until the runner admitted itself: nothing has run, and the tombstone keeps it that way. */
+  admitted: boolean;
+}
 /** A store plus how to release what opening it acquired (a connection, say). */
 export interface StoreLease {
   store: JourneyStore;
@@ -263,8 +270,14 @@ export interface JourneyReporting {
     url: string;
     engagement: Engagement;
   } | undefined>;
-  /** The email copy's recipient opted out of email: recorded on the copy and as a suppression. False for an unknown copy. */
-  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;
+  /**
+   * The email copy's recipient opted out of email: recorded on the copy and as a suppression, in
+   * one transaction, which also yields who the recipient is — so the caller acts on the
+   * unsubscribe without a second read. Undefined for an unknown copy.
+   */
+  recordUnsubscribe(messageId: string, at: number): Promise<{
+    userId: string;
+  } | undefined>;
   /** A push copy the device reported it received. False for an unknown copy. */
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
   /** Drop members of segments no longer deployed, then record every deployed segment's size. */
@@ -277,20 +290,51 @@ export interface JourneyStore {
   /** Reporting, when the store keeps it (Postgres); D1 stores none. */
   readonly reporting?: JourneyReporting;
   /**
-   * Record that the user's data must go (a deleted account), before anything is erased: the
-   * request outlives a failure to stop their instances, and the sweep retries it.
+   * Record that the user's data must go (a deleted account): the tombstone every write about
+   * the user is conditional on, from here on and for good. Committed before anything is
+   * stopped or erased, so an entry that got in before it is found by the erasure and none gets
+   * in after it. Idempotent: a second request, or one for a user already erased, changes nothing.
    */
   requestErasure(userId: string, at: number): Promise<void>;
-  /** Users whose erasure was requested and not finished yet. */
+  /** Users whose erasure was requested and not carried out yet (`'erasing'`), oldest first. */
   pendingErasures(): Promise<string[]>;
+  /**
+   * Where the user stands: `'none'` (no tombstone), `'erasing'` (requested, their instances
+   * being stopped, data still there) or `'erased'` (`forgetUser` went through). Both
+   * tombstone states refuse every write about the user; the entry points read this for a fast
+   * answer, and the store's conditional writes are the gate itself.
+   */
+  erasureState(userId: string): Promise<ErasureState>;
   /** The user's journey instances still running, by the entry ledger. */
-  runningInstances(userId: string): Promise<string[]>;
+  runningInstances(userId: string): Promise<RunningInstance[]>;
+  /**
+   * The runner's admission, before its first observable effect: records that the instance runs
+   * (`admitted_at`, kept on replay) — unless the user has an erasure tombstone, in which case
+   * nothing is recorded and the runner must not run. Mutually exclusive with `requestErasure`
+   * and `forgetUser` for that user (Postgres: the user's advisory lock), so an erasure either
+   * finds the instance admitted and stops it, or commits its tombstone first and the admission
+   * is refused — never neither.
+   *
+   * A first admission needs the entry running. An instance already admitted is admitted again
+   * whatever the entry's status — the legitimate replay of an instance whose finalisation was
+   * cut short after the entry reached its terminal status, which resumes on its own checkpoint
+   * and finishes what is left. Never a new attempt's way in: false for a terminal entry never
+   * admitted, for an entry no longer in the ledger, for another user's entry, and for an
+   * instance whose entry was reclaimed since (`enterJourney` resets the admission with the
+   * instance id, so a superseded attempt cannot pass under the id it lost).
+   */
+  admitInstance(instanceId: string, userId: string): Promise<boolean>;
   /**
    * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment
-   * memberships, suppressions, entries and reporting — and the erasure request last. Run only
-   * once no instance of theirs runs any more, or one could write some of it back.
+   * memberships, entries and reporting — and mark the tombstone erased (`erased_at`), which
+   * stays: a write that was in flight when the data went cannot bring the user back, and the
+   * same id is never reactivated by ingest. Suppressions stay too: an opt-out is a compliance
+   * record keyed by an opaque id, and it outlives the erasure. Run only once no instance of
+   * theirs runs any more, or one could write some of it back. Idempotent. Mutually exclusive
+   * with every write about the user (Postgres: the user's advisory lock; D1: one writer), so
+   * the data is gone when this returns — nothing of theirs lands afterwards.
    */
-  forgetUser(userId: string): Promise<void>;
+  forgetUser(userId: string, at: number): Promise<void>;
   /** The user opted out of the channel (recorded by an unsubscribe); stores without reporting omit it. */
   isSuppressed?(userId: string, channel: string): Promise<boolean>;
   /**
@@ -298,7 +342,10 @@ export interface JourneyStore {
    * run while it lists anything. Stores whose schema the engine owns (D1) omit it.
    */
   checkSchema?(): Promise<string[]>;
-  /** Append the occurrence; false when its id was already in the log (nothing written). */
+  /**
+   * Append the occurrence; false when its id was already in the log (nothing written). Throws
+   * `UserErasedError` for a user with a tombstone, like every write about a user below.
+   */
   insertEvent(input: EventInput): Promise<boolean>;
   /** Occurrences of `event` for the user, optionally only those within the window. */
   countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;
@@ -311,8 +358,15 @@ export interface JourneyStore {
    * read-modify-write loses one of two concurrent identifies.
    */
   mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;
-  /** Every user the engine knows (a profile or an event): who the segment sweep evaluates. */
-  listUserIds(): Promise<string[]>;
+  /**
+   * Every user the engine knows (a profile or an event): who the segment sweep evaluates. Ids
+   * come in ascending order; `after` resumes past the last id of the previous page, and `limit`
+   * bounds the page (the whole list without one).
+   */
+  listUserIds(page?: {
+    after?: string | undefined;
+    limit?: number | undefined;
+  }): Promise<string[]>;
   /** The user's push devices, most recently registered first. */
   listDevices(userId: string): Promise<PushDevice[]>;
   /**
@@ -382,5 +436,5 @@ export interface JourneyStore {
   unsubscribe(handle: string): Promise<void>;
 }
 //#endregion
-export { D1JourneyStore, DEFAULT_SCHEMA, JourneyFactSource, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type SqlClientLike, TABLES, type TableSpec, renderDrizzleSchema, renderPostgresDdl };
+export { D1JourneyStore, DEFAULT_SCHEMA, type ErasureState, JourneyFactSource, PostgresJourneyStore, type PostgresJourneyStoreOptions, PostgresReporting, type SqlClientLike, TABLES, type TableSpec, UserErasedError, renderDrizzleSchema, renderPostgresDdl };
 //# sourceMappingURL=index.d.mts.map

package/dist/store/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;YAoBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;;;;;EAMR;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;;EAMA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;EACA;;EAEA;EACA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAOH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;EACvC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;EAEtC,kBAAkB,mBAAmB,aAAa;;EAElD,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;iBAG1C;;WAEN,YAAY;;;;;EAMrB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;EAEnB,iBAAiB,iBAAiB;;;;;;EAMlC,WAAW,iBAAiB;;EAG5B,cAAc,gBAAgB,kBAAkB;;;;;EAMhD,gBAAgB;;EAIhB,YAAY,OAAO,aAAa;;EAEhC,YAAY,gBAAgB,eAAe,SAAS,cAAc;;EAElE,kBACE,gBACA,eACA,SAAS,cACR,QAAQ;EAGX,WAAW,iBAAiB,QAAQ;;;;;;EAMpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;;EAG3D,eAAe;;EAIf,YAAY,iBAAiB,QAAQ;;;;;EAKrC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;EAO5C,cAAc,QAAQ,WAAW;;;;;;EAMjC,sBAAsB,QAAQ;;;;;;EAM9B,sBAAsB,QAAQ,UAAU,SAAS,gBAAgB;EAGjE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;WAE3C,aAAa;;EAItB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;YAoBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;;;;;EAMR;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;;EAMA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;EACA;;EAEA;EACA;;;iBAIe;EACf;;EAEA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAWH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;EACvC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;;;;;EAMtC,kBAAkB,mBAAmB,aAAa;IAAU;;;EAE5D,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;iBAG1C;;WAEN,YAAY;;;;;;;EAQrB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;;;;;;EAOnB,aAAa,iBAAiB,QAAQ;;EAEtC,iBAAiB,iBAAiB,QAAQ;;;;;;;;;;;;;;;;;EAiB1C,cAAc,oBAAoB,iBAAiB;;;;;;;;;;;EAWnD,WAAW,gBAAgB,aAAa;;EAGxC,cAAc,gBAAgB,kBAAkB;;;;;EAMhD,gBAAgB;;;;;EAOhB,YAAY,OAAO,aAAa;;EAEhC,YAAY,gBAAgB,eAAe,SAAS,cAAc;;EAElE,kBACE,gBACA,eACA,SAAS,cACR,QAAQ;EAGX,WAAW,iBAAiB,QAAQ;;;;;;EAMpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;;;;;;EAO3D,YAAY;IAAS;IAA4B;MAA+B;;EAIhF,YAAY,iBAAiB,QAAQ;;;;;EAKrC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;EAO5C,cAAc,QAAQ,WAAW;;;;;;EAMjC,sBAAsB,QAAQ;;;;;;EAM9B,sBAAsB,QAAQ,UAAU,SAAS,gBAAgB;EAGjE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;WAE3C,aAAa;;EAItB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}

package/dist/store/index.mjs

@@ -1,3 +1,4 @@
+import { UserErasedError } from "./erasure.mjs";
 import { PostgresReporting } from "./postgres-reporting.mjs";
 import { DEFAULT_SCHEMA, TABLES, renderDrizzleSchema, renderPostgresDdl } from "./tables.mjs";
 import { PostgresJourneyStore } from "./postgres.mjs";
@@ -17,6 +18,6 @@ var SchemaMismatchError = class extends Error {
 	}
 };
 //#endregion
-export { D1JourneyStore, DEFAULT_SCHEMA, JourneyFactSource, PostgresJourneyStore, PostgresReporting, SchemaMismatchError, TABLES, renderDrizzleSchema, renderPostgresDdl };
+export { D1JourneyStore, DEFAULT_SCHEMA, JourneyFactSource, PostgresJourneyStore, PostgresReporting, SchemaMismatchError, TABLES, UserErasedError, renderDrizzleSchema, renderPostgresDdl };
 
 //# sourceMappingURL=index.mjs.map