@shware/workflow 3.2.0 → 4.0.0

package/dist/store/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/store/index.ts"],"sourcesContent":["import type { PushDevice } from '../engine/ports';\nimport type { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from '../ir';\n\n/**\n * The journey engine's data plane as a port. Everything the ingest router, the\n * runner and the fact source persist or look up goes through this interface,\n * so the storage engine is a deployment choice: D1 + KV (`D1JourneyStore`,\n * the original), Postgres (`PostgresJourneyStore`), or anything else that can\n * satisfy the contract below. Execution (durable steps, sleeps, wake-ups) is\n * the workflow runtime's job and stays out of here.\n *\n * Timestamps are epoch milliseconds throughout; a store may persist them in\n * its native type as long as `sinceMs` comparisons behave.\n */\n\n/**\n * A profile patch or a stored profile. On the way in, `null` means \"remove\n * this property\" (RFC 7386 merge-patch, the only way the API has to unset\n * one); a stored profile never contains null.\n */\nexport type ProfileProps = Record<string, ScalarIR | null | undefined>;\n\nexport interface EventInput {\n  /** The occurrence's identity, chosen by the sender; a second insert with the same id is a no-op. */\n  id: string;\n  userId: string;\n  event: string;\n  ts: number;\n  payload: Record<string, unknown>;\n}\n\nexport interface TriggerRoute {\n  workflow: string;\n  hash: string;\n  /** Payload gate (payload-only condition tree), or null when the trigger has none. */\n  where: ConditionIR | null;\n  /** Profile gate, or null. */\n  filter: ConditionIR | null;\n  /**\n   * The code version that applied these routes (`replaceRoutesIfNewer`); absent after a forced\n   * deploy, or on a store that keeps none. Read in the same row as the hash, so the pair is\n   * always one deploy's.\n   */\n  version?: string | undefined;\n}\n\nexport interface SegmentTriggerRoute {\n  workflow: string;\n  hash: string;\n  segment: string;\n  /** As `TriggerRoute.version`. */\n  version?: string | undefined;\n}\n\n/**\n * A Worker version, as Cloudflare's version metadata binding names it: the bundle compiled into\n * that version goes live only over an older one (`replaceRoutesIfNewer`).\n */\nexport interface BundleVersion {\n  id: string;\n  /** When the version was created (epoch ms): later versions are newer. */\n  createdAt: number;\n}\n\nexport interface EntryInput {\n  workflow: string;\n  userId: string;\n  instanceId: string;\n  hash: string;\n  ts: number;\n  /**\n   * The instance's start, recorded in the same transaction as the entry — for a runtime whose\n   * start is an asynchronous submit (AWS) that may have to be retried. Only a store with\n   * `executions` accepts it.\n   */\n  execution?: ExecutionStart | undefined;\n}\n\n/** How an instance is started on a runtime that submits it: replayed as is on every retry. */\nexport interface ExecutionStart {\n  /** The runtime's idempotency key (the durable execution name). */\n  name: string;\n  /** What is invoked: a qualified function ARN, its version included. */\n  target: string;\n  /** The exact payload: a retried submit must send the same bytes, or the runtime refuses it. */\n  input: string;\n}\n\nexport interface ExecutionRecord extends ExecutionStart {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n  createdAt: number;\n  submittedAt?: number | undefined;\n  arn?: string | undefined;\n  unresolvedAt?: number | undefined;\n  callbackId?: string | undefined;\n  /** Bumped by every wait the instance arms: a wake or a cleanup of an older one leaves it alone. */\n  generation: number;\n  deadlineAt?: number | undefined;\n  checkedAt?: number | undefined;\n  stoppedAt?: number | undefined;\n}\n\n/**\n * What a runtime that submits its starts and parks waits on one-shot callbacks (AWS) keeps\n * beside the entry ledger. The runtime holds the execution history; this holds only the\n * mapping from the engine's instance id to it.\n */\nexport interface ExecutionRegistry {\n  get(instanceId: string): Promise<ExecutionRecord | undefined>;\n  /**\n   * Starts not yet confirmed and not given up on, oldest first: of one (workflow, user) entry\n   * still running, or every one created before `createdBefore`.\n   */\n  pendingStarts(filter: {\n    workflow?: string;\n    userId?: string;\n    createdBefore?: number;\n    limit: number;\n  }): Promise<ExecutionRecord[]>;\n  markSubmitted(instanceId: string, arn: string | undefined, at: number): Promise<void>;\n  markUnresolved(instanceId: string, at: number): Promise<void>;\n  setArn(instanceId: string, arn: string): Promise<void>;\n  /** Record the callback a wait parks on; false when a newer generation is already armed. */\n  armCallback(\n    instanceId: string,\n    callback: { id: string; generation: number; deadlineAt?: number | undefined }\n  ): Promise<boolean>;\n  /** Forget the callback — only if it is still that generation's. */\n  clearCallback(instanceId: string, generation: number): Promise<void>;\n  /** Submitted executions whose entry is still running, least recently checked first. */\n  toReconcile(limit: number, checkedBefore: number): Promise<ExecutionRecord[]>;\n  markChecked(instanceId: string, at: number): Promise<void>;\n  /** Record the first stop; a later one keeps it. */\n  markStopped(instanceId: string, at: number): Promise<void>;\n}\n\n/**\n * How an entry attempt ended: a fresh row, a 'failed' row of a dead instance\n * taken over (the once policy does not bar a user over one outage), or\n * refused because the pair already entered and is still alive.\n */\nexport type EntryOutcome = 'entered' | 'reclaimed' | null;\n\n/** A device registered for pushes: its provider token belongs to the user who registered it last. */\nexport interface DeviceInput {\n  userId: string;\n  token: string;\n  /** `ios` (APNs) or `android` (FCM): which provider the token belongs to. */\n  platform: string;\n  ts: number;\n}\n\n/** A store plus how to release what opening it acquired (a connection, say). */\nexport interface StoreLease {\n  store: JourneyStore;\n  close?: () => Promise<void>;\n}\n\n/**\n * The live database lacks tables or columns the engine reads (an SDK upgrade added them, or the\n * host never ran the migration). Raised before a deploy writes anything.\n */\nexport class SchemaMismatchError extends Error {\n  override readonly name = 'SchemaMismatchError';\n\n  constructor(readonly problems: readonly string[]) {\n    super(\n      `the database does not match @shware/workflow's tables — regenerate the drizzle schema (workflow-ui generate) and run your migrations:\\n  ${problems.join('\\n  ')}`\n    );\n  }\n}\n\n/** A message copy as reporting records it, before it goes out. */\nexport interface MessageRecord {\n  idempotencyKey: string;\n  workflow: string;\n  instanceId: string;\n  nodeId: string;\n  template: string;\n  /** Where the copy lands: `email`, `push_ios`, `push_android`. */\n  channel: string;\n  userId: string;\n  sentAt: number;\n}\n\n/** What a click is judged by. */\nexport interface ClickContext {\n  url: string;\n  deliveredAt: number;\n  linkCount: number;\n  /** The copy's clicks in the window before this one. */\n  recent: { position: number; at: number }[];\n}\n\n/** An open or a click, with the verdict on who made it and where it came from. */\nexport interface Engagement {\n  at: number;\n  machine: boolean;\n  /** The rule that called it a machine; null for a person. */\n  reason: string | null;\n  userAgent: string | null;\n  /** The network the request came from (Cloudflare's `cf.asn`, `cf.asOrganization`, `cf.country`), never the address. */\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\n/**\n * Journey reporting: where each instance stands, every copy and how it was engaged with, segment\n * sizes. A store that keeps it (Postgres) exposes it as `reporting`; the Worker then records it\n * and serves email tracking. Every write is idempotent — a retried step reports again.\n */\n/** Bounds on when an event happened, both inclusive (epoch ms); an absent side is open. */\nexport interface EventWindow {\n  sinceMs?: number;\n  untilMs?: number;\n}\n\nexport interface JourneyReporting {\n  /** The instance entered: its row exists from here, so one a guard ends at once still counts. */\n  instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void>;\n  nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void>;\n  instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void>;\n  /** The copy's row id; the row a retry already wrote, when there is one. */\n  recordMessage(message: MessageRecord): Promise<string>;\n  settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void>;\n  /** An email's tracked links, in document order. */\n  recordLinks(messageId: string, urls: readonly string[]): Promise<void>;\n  /**\n   * Record an open of the copy, judged by `judge` against the copy (its recipient and when it was\n   * delivered — when it was sent, before the transport answered); `undefined` from the judge\n   * records nothing. Read and written in one transaction. False for an unknown copy.\n   */\n  recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean>;\n  /**\n   * Record a click on the copy's link at `position`, judged by `judge` against the link, how\n   * many links the copy has and its clicks of the last `windowMs`. The copy is locked for the\n   * transaction, so clicks arriving together (a scanner following every link at once) are\n   * judged one after another, each seeing the ones before. When the judge asks to `backdate`,\n   * the window's earlier clicks are reclassified with this one's verdict. A click implies an\n   * open. Undefined for an unknown link.\n   */\n  recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined>;\n  /** The email copy's recipient opted out of email: recorded on the copy and as a suppression. False for an unknown copy. */\n  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;\n  /** A push copy the device reported it received. False for an unknown copy. */\n  recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;\n  /** Drop members of segments no longer deployed, then record every deployed segment's size. */\n  snapshotSegments(at: number): Promise<{ segment: string; size: number }[]>;\n}\n\nexport interface JourneyStore {\n  /** Reporting, when the store keeps it (Postgres); D1 stores none. */\n  readonly reporting?: JourneyReporting;\n\n  /**\n   * Record that the user's data must go (a deleted account), before anything is erased: the\n   * request outlives a failure to stop their instances, and the sweep retries it.\n   */\n  requestErasure(userId: string, at: number): Promise<void>;\n  /** Users whose erasure was requested and not finished yet. */\n  pendingErasures(): Promise<string[]>;\n  /** The user's journey instances still running, by the entry ledger. */\n  runningInstances(userId: string): Promise<string[]>;\n  /**\n   * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment\n   * memberships, suppressions, entries and reporting — and the erasure request last. Run only\n   * once no instance of theirs runs any more, or one could write some of it back.\n   */\n  forgetUser(userId: string): Promise<void>;\n\n  /** The user opted out of the channel (recorded by an unsubscribe); stores without reporting omit it. */\n  isSuppressed?(userId: string, channel: string): Promise<boolean>;\n\n  /**\n   * What the live database lacks against the engine's tables (read-only); a deploy refuses to\n   * run while it lists anything. Stores whose schema the engine owns (D1) omit it.\n   */\n  checkSchema?(): Promise<string[]>;\n\n  /* ---------------------------------- events --------------------------------- */\n  /** Append the occurrence; false when its id was already in the log (nothing written). */\n  insertEvent(input: EventInput): Promise<boolean>;\n  /** Occurrences of `event` for the user, optionally only those within the window. */\n  countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;\n  /** The payloads of those occurrences — the caller filters them with the shared evaluator. */\n  listEventPayloads(\n    userId: string,\n    event: string,\n    window?: EventWindow\n  ): Promise<Record<string, unknown>[]>;\n\n  /* --------------------------------- profiles -------------------------------- */\n  getProfile(userId: string): Promise<ProfileProps | undefined>;\n  /**\n   * Merge-patch `props` into the stored profile in one statement (a null\n   * removes the property) and return the result. One statement, because a\n   * read-modify-write loses one of two concurrent identifies.\n   */\n  mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;\n\n  /** Every user the engine knows (a profile or an event): who the segment sweep evaluates. */\n  listUserIds(): Promise<string[]>;\n\n  /* ---------------------------------- devices --------------------------------- */\n  /** The user's push devices, most recently registered first. */\n  listDevices(userId: string): Promise<PushDevice[]>;\n  /**\n   * Register a device: one row per token, so a token registered again moves to the user who\n   * registered it last (a phone signed into another account) and to the front of their list.\n   */\n  upsertDevice(device: DeviceInput): Promise<void>;\n  /** Forget a token (reported dead by APNs / FCM); the user it belonged to, if any. */\n  removeDevice(token: string): Promise<string | undefined>;\n  /**\n   * The user signed out on the device: the token is kept, bound to nobody, until the next sign-in\n   * binds it again. The user it belonged to, if any.\n   */\n  unbindDevice(token: string): Promise<string | undefined>;\n\n  /* ---------------------------- deployed definitions -------------------------- */\n  getSegmentCondition(id: string): Promise<ConditionIR | undefined>;\n  /** Every deployed segment with its definition: what the segment sweep evaluates. */\n  listSegments(): Promise<{ id: string; condition: ConditionIR }[]>;\n  findTriggers(event: string): Promise<TriggerRoute[]>;\n  listSegmentTriggers(): Promise<SegmentTriggerRoute[]>;\n  putWorkflowIR(workflow: WorkflowIR): Promise<void>;\n  getWorkflowIR(contentHash: string): Promise<WorkflowIR | undefined>;\n  /**\n   * Swap the routing tables (segments, event triggers, segment triggers) for\n   * the bundle's — atomically, so a concurrent ingest never sees them half\n   * empty. Workflow bodies are stored separately (`putWorkflowIR`) because they\n   * are content-addressed and outlive the routes that point at them.\n   */\n  replaceRoutes(bundle: BundleIR): Promise<void>;\n  /**\n   * The Worker version whose bundle the routes came from, when one put them there through\n   * `replaceRoutesIfNewer` (a forced deploy leaves it as it was). Read from the database itself,\n   * not a cache in front of it. Stores without it (D1) leave every deploy to `POST /bundle/deploy`.\n   */\n  liveBundleVersion?(): Promise<BundleVersion | undefined>;\n  /**\n   * `replaceRoutes`, only when `version` is newer than the live one, recorded in the same\n   * transaction: two versions serving side by side during a rollout cannot leave the older one's\n   * routes in force. False, with nothing written, when a version as new or newer is live.\n   */\n  replaceRoutesIfNewer?(bundle: BundleIR, version: BundleVersion): Promise<boolean>;\n\n  /* ----------------------------- segment membership --------------------------- */\n  isSegmentMember(segment: string, userId: string): Promise<boolean>;\n  /** Record the membership, with the workflows its entry has to start (see segment_start). */\n  addSegmentMember(\n    segment: string,\n    userId: string,\n    ts: number,\n    workflows: readonly string[]\n  ): Promise<void>;\n  /** The workflows the member's entry has not started yet. */\n  pendingSegmentStarts(segment: string, userId: string): Promise<string[]>;\n  completeSegmentStart(segment: string, userId: string, workflow: string): Promise<void>;\n  /** Drop the membership and any start it still owed. */\n  removeSegmentMember(segment: string, userId: string): Promise<void>;\n\n  /* ------------------------------- entry ledger ------------------------------- */\n  /**\n   * Record the entry (the once policy). Atomic under concurrent ingests: of\n   * two racing attempts exactly one is 'entered' (or 'reclaimed', when the\n   * pair's previous instance is recorded as 'failed') and the other null.\n   */\n  enterJourney(entry: EntryInput): Promise<EntryOutcome>;\n  removeEntry(instanceId: string): Promise<void>;\n  setEntryStatus(instanceId: string, status: string): Promise<void>;\n  /** Execution starts and wake callbacks, for a runtime that needs them (AWS); Postgres only. */\n  readonly executions?: ExecutionRegistry;\n\n  /* ------------------------------ wake subscriptions --------------------------- */\n  /** Distinct wake handles registered for (user, event). */\n  findWakeHandles(userId: string, event: string): Promise<string[]>;\n  /** Register the handle for each event; repeated registrations are idempotent. */\n  subscribe(handle: string, userId: string, events: readonly string[], ts: number): Promise<void>;\n  /** Drop every registration the handle holds. */\n  unsubscribe(handle: string): Promise<void>;\n}\n\nexport { D1JourneyStore } from './d1';\nexport { JourneyFactSource } from './facts';\nexport { PostgresJourneyStore } from './postgres';\nexport { PostgresReporting } from './postgres-reporting';\nexport {\n  DEFAULT_SCHEMA,\n  TABLES,\n  renderDrizzleSchema,\n  renderPostgresDdl,\n  type TableSpec,\n} from './tables';\nexport type { PostgresJourneyStoreOptions, SqlClientLike } from './postgres';\n"],"mappings":";;;;;;;;;;AAoKA,IAAa,sBAAb,cAAyC,MAAM;CAGxB;CAFrB,OAAyB;CAEzB,YAAY,UAAsC;EAChD,MACE,4IAA4I,SAAS,KAAK,MAAM,GAClK;EAHmB,KAAA,WAAA;CAIrB;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/store/index.ts"],"sourcesContent":["import type { PushDevice } from '../engine/ports';\nimport type { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from '../ir';\n\n/**\n * The journey engine's data plane as a port. Everything the ingest router, the\n * runner and the fact source persist or look up goes through this interface,\n * so the storage engine is a deployment choice: D1 + KV (`D1JourneyStore`,\n * the original), Postgres (`PostgresJourneyStore`), or anything else that can\n * satisfy the contract below. Execution (durable steps, sleeps, wake-ups) is\n * the workflow runtime's job and stays out of here.\n *\n * Timestamps are epoch milliseconds throughout; a store may persist them in\n * its native type as long as `sinceMs` comparisons behave.\n */\n\n/**\n * A profile patch or a stored profile. On the way in, `null` means \"remove\n * this property\" (RFC 7386 merge-patch, the only way the API has to unset\n * one); a stored profile never contains null.\n */\nexport type ProfileProps = Record<string, ScalarIR | null | undefined>;\n\nexport interface EventInput {\n  /** The occurrence's identity, chosen by the sender; a second insert with the same id is a no-op. */\n  id: string;\n  userId: string;\n  event: string;\n  ts: number;\n  payload: Record<string, unknown>;\n}\n\nexport interface TriggerRoute {\n  workflow: string;\n  hash: string;\n  /** Payload gate (payload-only condition tree), or null when the trigger has none. */\n  where: ConditionIR | null;\n  /** Profile gate, or null. */\n  filter: ConditionIR | null;\n  /**\n   * The code version that applied these routes (`replaceRoutesIfNewer`); absent after a forced\n   * deploy, or on a store that keeps none. Read in the same row as the hash, so the pair is\n   * always one deploy's.\n   */\n  version?: string | undefined;\n}\n\nexport interface SegmentTriggerRoute {\n  workflow: string;\n  hash: string;\n  segment: string;\n  /** As `TriggerRoute.version`. */\n  version?: string | undefined;\n}\n\n/**\n * A Worker version, as Cloudflare's version metadata binding names it: the bundle compiled into\n * that version goes live only over an older one (`replaceRoutesIfNewer`).\n */\nexport interface BundleVersion {\n  id: string;\n  /** When the version was created (epoch ms): later versions are newer. */\n  createdAt: number;\n}\n\nexport interface EntryInput {\n  workflow: string;\n  userId: string;\n  instanceId: string;\n  hash: string;\n  ts: number;\n  /**\n   * The instance's start, recorded in the same transaction as the entry — for a runtime whose\n   * start is an asynchronous submit (AWS) that may have to be retried. Only a store with\n   * `executions` accepts it.\n   */\n  execution?: ExecutionStart | undefined;\n}\n\n/** How an instance is started on a runtime that submits it: replayed as is on every retry. */\nexport interface ExecutionStart {\n  /** The runtime's idempotency key (the durable execution name). */\n  name: string;\n  /** What is invoked: a qualified function ARN, its version included. */\n  target: string;\n  /** The exact payload: a retried submit must send the same bytes, or the runtime refuses it. */\n  input: string;\n}\n\nexport interface ExecutionRecord extends ExecutionStart {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n  createdAt: number;\n  submittedAt?: number | undefined;\n  arn?: string | undefined;\n  unresolvedAt?: number | undefined;\n  callbackId?: string | undefined;\n  /** Bumped by every wait the instance arms: a wake or a cleanup of an older one leaves it alone. */\n  generation: number;\n  deadlineAt?: number | undefined;\n  checkedAt?: number | undefined;\n  stoppedAt?: number | undefined;\n}\n\n/**\n * What a runtime that submits its starts and parks waits on one-shot callbacks (AWS) keeps\n * beside the entry ledger. The runtime holds the execution history; this holds only the\n * mapping from the engine's instance id to it.\n */\nexport interface ExecutionRegistry {\n  get(instanceId: string): Promise<ExecutionRecord | undefined>;\n  /**\n   * Starts not yet confirmed and not given up on, oldest first: of one (workflow, user) entry\n   * still running, or every one created before `createdBefore`.\n   */\n  pendingStarts(filter: {\n    workflow?: string;\n    userId?: string;\n    createdBefore?: number;\n    limit: number;\n  }): Promise<ExecutionRecord[]>;\n  markSubmitted(instanceId: string, arn: string | undefined, at: number): Promise<void>;\n  markUnresolved(instanceId: string, at: number): Promise<void>;\n  setArn(instanceId: string, arn: string): Promise<void>;\n  /** Record the callback a wait parks on; false when a newer generation is already armed. */\n  armCallback(\n    instanceId: string,\n    callback: { id: string; generation: number; deadlineAt?: number | undefined }\n  ): Promise<boolean>;\n  /** Forget the callback — only if it is still that generation's. */\n  clearCallback(instanceId: string, generation: number): Promise<void>;\n  /** Submitted executions whose entry is still running, least recently checked first. */\n  toReconcile(limit: number, checkedBefore: number): Promise<ExecutionRecord[]>;\n  markChecked(instanceId: string, at: number): Promise<void>;\n  /** Record the first stop; a later one keeps it. */\n  markStopped(instanceId: string, at: number): Promise<void>;\n}\n\n/**\n * How an entry attempt ended: a fresh row, a 'failed' row of a dead instance\n * taken over (the once policy does not bar a user over one outage), or\n * refused because the pair already entered and is still alive.\n */\nexport type EntryOutcome = 'entered' | 'reclaimed' | null;\n\n/** A device registered for pushes: its provider token belongs to the user who registered it last. */\nexport interface DeviceInput {\n  userId: string;\n  token: string;\n  /** `ios` (APNs) or `android` (FCM): which provider the token belongs to. */\n  platform: string;\n  ts: number;\n}\n\n/** An instance of a user still in the ledger, and whether its runner was admitted (see `admitInstance`). */\nexport interface RunningInstance {\n  instanceId: string;\n  /** False until the runner admitted itself: nothing has run, and the tombstone keeps it that way. */\n  admitted: boolean;\n}\n\n/** A store plus how to release what opening it acquired (a connection, say). */\nexport interface StoreLease {\n  store: JourneyStore;\n  close?: () => Promise<void>;\n}\n\nimport type { ErasureState } from './erasure';\n\nexport { type ErasureState, UserErasedError } from './erasure';\n\n/**\n * The live database lacks tables or columns the engine reads (an SDK upgrade added them, or the\n * host never ran the migration). Raised before a deploy writes anything.\n */\nexport class SchemaMismatchError extends Error {\n  override readonly name = 'SchemaMismatchError';\n\n  constructor(readonly problems: readonly string[]) {\n    super(\n      `the database does not match @shware/workflow's tables — regenerate the drizzle schema (workflow-ui generate) and run your migrations:\\n  ${problems.join('\\n  ')}`\n    );\n  }\n}\n\n/** A message copy as reporting records it, before it goes out. */\nexport interface MessageRecord {\n  idempotencyKey: string;\n  workflow: string;\n  instanceId: string;\n  nodeId: string;\n  template: string;\n  /** Where the copy lands: `email`, `push_ios`, `push_android`. */\n  channel: string;\n  userId: string;\n  sentAt: number;\n}\n\n/** What a click is judged by. */\nexport interface ClickContext {\n  url: string;\n  deliveredAt: number;\n  linkCount: number;\n  /** The copy's clicks in the window before this one. */\n  recent: { position: number; at: number }[];\n}\n\n/** An open or a click, with the verdict on who made it and where it came from. */\nexport interface Engagement {\n  at: number;\n  machine: boolean;\n  /** The rule that called it a machine; null for a person. */\n  reason: string | null;\n  userAgent: string | null;\n  /** The network the request came from (Cloudflare's `cf.asn`, `cf.asOrganization`, `cf.country`), never the address. */\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\n/**\n * Journey reporting: where each instance stands, every copy and how it was engaged with, segment\n * sizes. A store that keeps it (Postgres) exposes it as `reporting`; the Worker then records it\n * and serves email tracking. Every write is idempotent — a retried step reports again.\n */\n/** Bounds on when an event happened, both inclusive (epoch ms); an absent side is open. */\nexport interface EventWindow {\n  sinceMs?: number;\n  untilMs?: number;\n}\n\nexport interface JourneyReporting {\n  /** The instance entered: its row exists from here, so one a guard ends at once still counts. */\n  instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void>;\n  nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void>;\n  instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void>;\n  /** The copy's row id; the row a retry already wrote, when there is one. */\n  recordMessage(message: MessageRecord): Promise<string>;\n  settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void>;\n  /** An email's tracked links, in document order. */\n  recordLinks(messageId: string, urls: readonly string[]): Promise<void>;\n  /**\n   * Record an open of the copy, judged by `judge` against the copy (its recipient and when it was\n   * delivered — when it was sent, before the transport answered); `undefined` from the judge\n   * records nothing. Read and written in one transaction. False for an unknown copy.\n   */\n  recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean>;\n  /**\n   * Record a click on the copy's link at `position`, judged by `judge` against the link, how\n   * many links the copy has and its clicks of the last `windowMs`. The copy is locked for the\n   * transaction, so clicks arriving together (a scanner following every link at once) are\n   * judged one after another, each seeing the ones before. When the judge asks to `backdate`,\n   * the window's earlier clicks are reclassified with this one's verdict. A click implies an\n   * open. Undefined for an unknown link.\n   */\n  recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined>;\n  /**\n   * The email copy's recipient opted out of email: recorded on the copy and as a suppression, in\n   * one transaction, which also yields who the recipient is — so the caller acts on the\n   * unsubscribe without a second read. Undefined for an unknown copy.\n   */\n  recordUnsubscribe(messageId: string, at: number): Promise<{ userId: string } | undefined>;\n  /** A push copy the device reported it received. False for an unknown copy. */\n  recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;\n  /** Drop members of segments no longer deployed, then record every deployed segment's size. */\n  snapshotSegments(at: number): Promise<{ segment: string; size: number }[]>;\n}\n\nexport interface JourneyStore {\n  /** Reporting, when the store keeps it (Postgres); D1 stores none. */\n  readonly reporting?: JourneyReporting;\n\n  /**\n   * Record that the user's data must go (a deleted account): the tombstone every write about\n   * the user is conditional on, from here on and for good. Committed before anything is\n   * stopped or erased, so an entry that got in before it is found by the erasure and none gets\n   * in after it. Idempotent: a second request, or one for a user already erased, changes nothing.\n   */\n  requestErasure(userId: string, at: number): Promise<void>;\n  /** Users whose erasure was requested and not carried out yet (`'erasing'`), oldest first. */\n  pendingErasures(): Promise<string[]>;\n  /**\n   * Where the user stands: `'none'` (no tombstone), `'erasing'` (requested, their instances\n   * being stopped, data still there) or `'erased'` (`forgetUser` went through). Both\n   * tombstone states refuse every write about the user; the entry points read this for a fast\n   * answer, and the store's conditional writes are the gate itself.\n   */\n  erasureState(userId: string): Promise<ErasureState>;\n  /** The user's journey instances still running, by the entry ledger. */\n  runningInstances(userId: string): Promise<RunningInstance[]>;\n  /**\n   * The runner's admission, before its first observable effect: records that the instance runs\n   * (`admitted_at`, kept on replay) — unless the user has an erasure tombstone, in which case\n   * nothing is recorded and the runner must not run. Mutually exclusive with `requestErasure`\n   * and `forgetUser` for that user (Postgres: the user's advisory lock), so an erasure either\n   * finds the instance admitted and stops it, or commits its tombstone first and the admission\n   * is refused — never neither.\n   *\n   * A first admission needs the entry running. An instance already admitted is admitted again\n   * whatever the entry's status — the legitimate replay of an instance whose finalisation was\n   * cut short after the entry reached its terminal status, which resumes on its own checkpoint\n   * and finishes what is left. Never a new attempt's way in: false for a terminal entry never\n   * admitted, for an entry no longer in the ledger, for another user's entry, and for an\n   * instance whose entry was reclaimed since (`enterJourney` resets the admission with the\n   * instance id, so a superseded attempt cannot pass under the id it lost).\n   */\n  admitInstance(instanceId: string, userId: string): Promise<boolean>;\n  /**\n   * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment\n   * memberships, entries and reporting — and mark the tombstone erased (`erased_at`), which\n   * stays: a write that was in flight when the data went cannot bring the user back, and the\n   * same id is never reactivated by ingest. Suppressions stay too: an opt-out is a compliance\n   * record keyed by an opaque id, and it outlives the erasure. Run only once no instance of\n   * theirs runs any more, or one could write some of it back. Idempotent. Mutually exclusive\n   * with every write about the user (Postgres: the user's advisory lock; D1: one writer), so\n   * the data is gone when this returns — nothing of theirs lands afterwards.\n   */\n  forgetUser(userId: string, at: number): Promise<void>;\n\n  /** The user opted out of the channel (recorded by an unsubscribe); stores without reporting omit it. */\n  isSuppressed?(userId: string, channel: string): Promise<boolean>;\n\n  /**\n   * What the live database lacks against the engine's tables (read-only); a deploy refuses to\n   * run while it lists anything. Stores whose schema the engine owns (D1) omit it.\n   */\n  checkSchema?(): Promise<string[]>;\n\n  /* ---------------------------------- events --------------------------------- */\n  /**\n   * Append the occurrence; false when its id was already in the log (nothing written). Throws\n   * `UserErasedError` for a user with a tombstone, like every write about a user below.\n   */\n  insertEvent(input: EventInput): Promise<boolean>;\n  /** Occurrences of `event` for the user, optionally only those within the window. */\n  countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;\n  /** The payloads of those occurrences — the caller filters them with the shared evaluator. */\n  listEventPayloads(\n    userId: string,\n    event: string,\n    window?: EventWindow\n  ): Promise<Record<string, unknown>[]>;\n\n  /* --------------------------------- profiles -------------------------------- */\n  getProfile(userId: string): Promise<ProfileProps | undefined>;\n  /**\n   * Merge-patch `props` into the stored profile in one statement (a null\n   * removes the property) and return the result. One statement, because a\n   * read-modify-write loses one of two concurrent identifies.\n   */\n  mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;\n\n  /**\n   * Every user the engine knows (a profile or an event): who the segment sweep evaluates. Ids\n   * come in ascending order; `after` resumes past the last id of the previous page, and `limit`\n   * bounds the page (the whole list without one).\n   */\n  listUserIds(page?: { after?: string | undefined; limit?: number | undefined }): Promise<string[]>;\n\n  /* ---------------------------------- devices --------------------------------- */\n  /** The user's push devices, most recently registered first. */\n  listDevices(userId: string): Promise<PushDevice[]>;\n  /**\n   * Register a device: one row per token, so a token registered again moves to the user who\n   * registered it last (a phone signed into another account) and to the front of their list.\n   */\n  upsertDevice(device: DeviceInput): Promise<void>;\n  /** Forget a token (reported dead by APNs / FCM); the user it belonged to, if any. */\n  removeDevice(token: string): Promise<string | undefined>;\n  /**\n   * The user signed out on the device: the token is kept, bound to nobody, until the next sign-in\n   * binds it again. The user it belonged to, if any.\n   */\n  unbindDevice(token: string): Promise<string | undefined>;\n\n  /* ---------------------------- deployed definitions -------------------------- */\n  getSegmentCondition(id: string): Promise<ConditionIR | undefined>;\n  /** Every deployed segment with its definition: what the segment sweep evaluates. */\n  listSegments(): Promise<{ id: string; condition: ConditionIR }[]>;\n  findTriggers(event: string): Promise<TriggerRoute[]>;\n  listSegmentTriggers(): Promise<SegmentTriggerRoute[]>;\n  putWorkflowIR(workflow: WorkflowIR): Promise<void>;\n  getWorkflowIR(contentHash: string): Promise<WorkflowIR | undefined>;\n  /**\n   * Swap the routing tables (segments, event triggers, segment triggers) for\n   * the bundle's — atomically, so a concurrent ingest never sees them half\n   * empty. Workflow bodies are stored separately (`putWorkflowIR`) because they\n   * are content-addressed and outlive the routes that point at them.\n   */\n  replaceRoutes(bundle: BundleIR): Promise<void>;\n  /**\n   * The Worker version whose bundle the routes came from, when one put them there through\n   * `replaceRoutesIfNewer` (a forced deploy leaves it as it was). Read from the database itself,\n   * not a cache in front of it. Stores without it (D1) leave every deploy to `POST /bundle/deploy`.\n   */\n  liveBundleVersion?(): Promise<BundleVersion | undefined>;\n  /**\n   * `replaceRoutes`, only when `version` is newer than the live one, recorded in the same\n   * transaction: two versions serving side by side during a rollout cannot leave the older one's\n   * routes in force. False, with nothing written, when a version as new or newer is live.\n   */\n  replaceRoutesIfNewer?(bundle: BundleIR, version: BundleVersion): Promise<boolean>;\n\n  /* ----------------------------- segment membership --------------------------- */\n  isSegmentMember(segment: string, userId: string): Promise<boolean>;\n  /** Record the membership, with the workflows its entry has to start (see segment_start). */\n  addSegmentMember(\n    segment: string,\n    userId: string,\n    ts: number,\n    workflows: readonly string[]\n  ): Promise<void>;\n  /** The workflows the member's entry has not started yet. */\n  pendingSegmentStarts(segment: string, userId: string): Promise<string[]>;\n  completeSegmentStart(segment: string, userId: string, workflow: string): Promise<void>;\n  /** Drop the membership and any start it still owed. */\n  removeSegmentMember(segment: string, userId: string): Promise<void>;\n\n  /* ------------------------------- entry ledger ------------------------------- */\n  /**\n   * Record the entry (the once policy). Atomic under concurrent ingests: of\n   * two racing attempts exactly one is 'entered' (or 'reclaimed', when the\n   * pair's previous instance is recorded as 'failed') and the other null.\n   */\n  enterJourney(entry: EntryInput): Promise<EntryOutcome>;\n  removeEntry(instanceId: string): Promise<void>;\n  setEntryStatus(instanceId: string, status: string): Promise<void>;\n  /** Execution starts and wake callbacks, for a runtime that needs them (AWS); Postgres only. */\n  readonly executions?: ExecutionRegistry;\n\n  /* ------------------------------ wake subscriptions --------------------------- */\n  /** Distinct wake handles registered for (user, event). */\n  findWakeHandles(userId: string, event: string): Promise<string[]>;\n  /** Register the handle for each event; repeated registrations are idempotent. */\n  subscribe(handle: string, userId: string, events: readonly string[], ts: number): Promise<void>;\n  /** Drop every registration the handle holds. */\n  unsubscribe(handle: string): Promise<void>;\n}\n\nexport { D1JourneyStore } from './d1';\nexport { JourneyFactSource } from './facts';\nexport { PostgresJourneyStore } from './postgres';\nexport { PostgresReporting } from './postgres-reporting';\nexport {\n  DEFAULT_SCHEMA,\n  TABLES,\n  renderDrizzleSchema,\n  renderPostgresDdl,\n  type TableSpec,\n} from './tables';\nexport type { PostgresJourneyStoreOptions, SqlClientLike } from './postgres';\n"],"mappings":";;;;;;;;;;;AA+KA,IAAa,sBAAb,cAAyC,MAAM;CAGxB;CAFrB,OAAyB;CAEzB,YAAY,UAAsC;EAChD,MACE,4IAA4I,SAAS,KAAK,MAAM,GAClK;EAHmB,KAAA,WAAA;CAIrB;AACF"}

package/dist/store/postgres-reporting.cjs

@@ -1,5 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_store_erasure = require("./erasure.cjs");
 const require_store_sql = require("./sql.cjs");
+const require_store_user_lock = require("./user-lock.cjs");
 //#region src/store/postgres-reporting.ts
 /**
 * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a
@@ -12,67 +14,123 @@ const MS = (column) => `(extract(epoch from ${column}) * 1000)::double precision
 * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
 * is written here, never defaulted, and every write is idempotent: the engine reports again when
 * a step is retried.
+*
+* The instance and message rows are written like the store's rows about a user (postgres.ts,
+* user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's
+* erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after
+* the user was erased — a late start, node or finish — is a no-op, never an upsert that puts
+* the instance back; a copy to be recorded for them is refused (`UserErasedError`, not
+* retryable) so it is never sent.
+*
+* Links, opens, clicks and device deliveries know only the copy's id. Their transaction is
+* pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the
+* owner's user lock, then re-checks that the copy still exists and the owner has no tombstone
+* — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only
+* then locks the copy's row (where the path locks it) and writes. User lock before row lock,
+* always: the erasure deletes under the user lock, so the two never wait on each other in
+* opposite orders. The unsubscribe is the compliance exception: its suppression is written
+* whatever the user's state, under the same lock order for consistency.
 */
 var PostgresReporting = class {
 	sql;
 	t;
-	constructor(sql, t) {
+	schema;
+	constructor(sql, t, schema) {
 		this.sql = sql;
 		this.t = t;
+		this.schema = schema;
+	}
+	/** The condition every row about a user carries: no erasure tombstone for `$user`. */
+	notErased(user) {
+		return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;
+	}
+	/**
+	* The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the
+	* owner's user lock, then the copy re-read under it — present and its owner without a
+	* tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).
+	* `forUpdate` locks the copy's row on that re-read, after the user lock.
+	*/
+	async lockMessage(tx, messageId, forUpdate = false) {
+		await require_store_user_lock.beginReadCommitted(tx);
+		const owner = (await tx.query(`SELECT user_id FROM ${this.t.message} WHERE id = $1`, [messageId])).at(0);
+		if (owner === void 0) return void 0;
+		await require_store_user_lock.lockUser(tx, this.schema, owner.user_id);
+		const row = (await tx.query(`SELECT user_id, ${MS("coalesce(delivered_at, sent_at)")} AS delivered_at
+       FROM ${this.t.message} WHERE id = $1
+         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)
+       ${forUpdate ? "FOR UPDATE" : ""}`, [messageId])).at(0);
+		if (row === void 0) return void 0;
+		return {
+			userId: row.user_id,
+			deliveredAt: Number(row.delivered_at)
+		};
 	}
 	async instanceStarted(input) {
-		await this.sql.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)
-       VALUES ($1, $2, $3, ${TS("$4")}, 'running')
-       ON CONFLICT (instance_id) DO NOTHING`, [
-			input.instanceId,
-			input.workflow,
-			input.userId,
-			input.at
-		]);
+		await this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, input.userId);
+			await tx.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)
+         SELECT $1, $2, $3, ${TS("$4")}, 'running' ${this.notErased("$3")}
+         ON CONFLICT (instance_id) DO NOTHING`, [
+				input.instanceId,
+				input.workflow,
+				input.userId,
+				input.at
+			]);
+		});
 	}
 	async nodeReached(input) {
-		await this.sql.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)
-       VALUES ($1, $2, $3, ${TS("$4")}, $5, ${TS("$4")}, 'running')
-       ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`, [
-			input.instanceId,
-			input.workflow,
-			input.userId,
-			input.at,
-			input.nodeId
-		]);
+		await this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, input.userId);
+			await tx.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)
+         SELECT $1, $2, $3, ${TS("$4")}, $5, ${TS("$4")}, 'running' ${this.notErased("$3")}
+         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`, [
+				input.instanceId,
+				input.workflow,
+				input.userId,
+				input.at,
+				input.nodeId
+			]);
+		});
 	}
 	async instanceFinished(input) {
-		await this.sql.query(`INSERT INTO ${this.t.instance}
-         (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)
-       VALUES ($1, $2, $3, ${TS("$5")}, $4, ${TS("$5")}, ${TS("$6")})
-       ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,
-         finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`, [
-			input.instanceId,
-			input.workflow,
-			input.userId,
-			input.status,
-			input.at,
-			input.convertedAt ?? null
-		]);
+		await this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, input.userId);
+			await tx.query(`INSERT INTO ${this.t.instance}
+           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)
+         SELECT $1, $2, $3, ${TS("$5")}, $4, ${TS("$5")}, ${TS("$6")} ${this.notErased("$3")}
+         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,
+           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`, [
+				input.instanceId,
+				input.workflow,
+				input.userId,
+				input.status,
+				input.at,
+				input.convertedAt ?? null
+			]);
+		});
 	}
 	async recordMessage(message) {
-		const id = (await this.sql.query(`INSERT INTO ${this.t.message}
-         (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, ${TS("$9")})
-       ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key
-       RETURNING id`, [
-			require_store_sql.uuidv7(message.sentAt),
-			message.idempotencyKey,
-			message.workflow,
-			message.instanceId,
-			message.nodeId,
-			message.template,
-			message.channel,
-			message.userId,
-			message.sentAt
-		])).at(0)?.id;
-		if (id === void 0) throw new Error(`message ${message.idempotencyKey} was not recorded`);
-		return id;
+		return this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, message.userId);
+			const id = (await tx.query(`INSERT INTO ${this.t.message}
+           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)
+         SELECT $1, $2, $3, $4, $5, $6, $7, $8, ${TS("$9")} ${this.notErased("$8")}
+         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key
+         RETURNING id`, [
+				require_store_sql.uuidv7(message.sentAt),
+				message.idempotencyKey,
+				message.workflow,
+				message.instanceId,
+				message.nodeId,
+				message.template,
+				message.channel,
+				message.userId,
+				message.sentAt
+			])).at(0)?.id;
+			if (id !== void 0) return id;
+			if ((await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [message.userId])).length > 0) throw new require_store_erasure.UserErasedError(message.userId);
+			throw new Error(`message ${message.idempotencyKey} was not recorded`);
+		});
 	}
 	async settleMessage(idempotencyKey, result, at) {
 		if (result.delivered) await this.sql.query(`UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS("$2")}) WHERE idempotency_key = $1`, [idempotencyKey, at]);
@@ -81,17 +139,16 @@ var PostgresReporting = class {
 	async recordLinks(messageId, urls) {
 		if (urls.length === 0) return;
 		const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(", ");
-		await this.sql.query(`INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`, [messageId, ...urls]);
+		await this.sql.transaction(async (tx) => {
+			if (await this.lockMessage(tx, messageId) === void 0) return;
+			await tx.query(`INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`, [messageId, ...urls]);
+		});
 	}
 	async recordOpen(messageId, judge) {
 		return this.sql.transaction(async (tx) => {
-			const row = (await tx.query(`SELECT user_id, ${MS("coalesce(delivered_at, sent_at)")} AS delivered_at
-         FROM ${this.t.message} WHERE id = $1`, [messageId])).at(0);
-			if (row === void 0) return false;
-			const open = judge({
-				userId: row.user_id,
-				deliveredAt: Number(row.delivered_at)
-			});
+			const message = await this.lockMessage(tx, messageId);
+			if (message === void 0) return false;
+			const open = judge(message);
 			if (open === void 0) return true;
 			await tx.query(`INSERT INTO ${this.t.messageOpen}
            (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)
@@ -119,8 +176,7 @@ var PostgresReporting = class {
 	}
 	async recordClick(messageId, position, at, windowMs, judge) {
 		return this.sql.transaction(async (tx) => {
-			const message = (await tx.query(`SELECT ${MS("coalesce(delivered_at, sent_at)")} AS delivered_at
-         FROM ${this.t.message} WHERE id = $1 FOR UPDATE`, [messageId])).at(0);
+			const message = await this.lockMessage(tx, messageId, true);
 			if (message === void 0) return void 0;
 			const link = (await tx.query(`SELECT l.url,
            (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count
@@ -131,7 +187,7 @@ var PostgresReporting = class {
          WHERE message_id = $1 AND clicked_at >= ${TS("$2")} ORDER BY clicked_at`, [messageId, since]);
 			const { engagement: click, backdate } = judge({
 				url: link.url,
-				deliveredAt: Number(message.delivered_at),
+				deliveredAt: message.deliveredAt,
 				linkCount: Number(link.link_count),
 				recent: recent.map((row) => ({
 					position: row.position,
@@ -179,17 +235,24 @@ var PostgresReporting = class {
 		});
 	}
 	async recordDeviceDelivered(messageId, at) {
-		return (await this.sql.query(`UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS("$2")})
-       WHERE id = $1 RETURNING id`, [messageId, at])).length > 0;
+		return this.sql.transaction(async (tx) => {
+			if (await this.lockMessage(tx, messageId) === void 0) return false;
+			return (await tx.query(`UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS("$2")})
+         WHERE id = $1 RETURNING id`, [messageId, at])).length > 0;
+		});
 	}
 	async recordUnsubscribe(messageId, at) {
 		return this.sql.transaction(async (tx) => {
+			await require_store_user_lock.beginReadCommitted(tx);
+			const owner = (await tx.query(`SELECT user_id FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`, [messageId])).at(0);
+			if (owner === void 0) return void 0;
+			await require_store_user_lock.lockUser(tx, this.schema, owner.user_id);
 			const userId = (await tx.query(`UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS("$2")})
          WHERE id = $1 AND channel = 'email' RETURNING user_id`, [messageId, at])).at(0)?.user_id;
-			if (userId === void 0) return false;
+			if (userId === void 0) return void 0;
 			await tx.query(`INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS("$2")})
          ON CONFLICT DO NOTHING`, [userId, at]);
-			return true;
+			return { userId };
 		});
 	}
 	async snapshotSegments(at) {

package/dist/store/postgres-reporting.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.cjs","names":["uuidv7"],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import type { ClickContext, Engagement, JourneyReporting, MessageRecord } from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>\n  ) {}\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.query(\n      `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n       VALUES ($1, $2, $3, ${TS('$4')}, 'running')\n       ON CONFLICT (instance_id) DO NOTHING`,\n      [input.instanceId, input.workflow, input.userId, input.at]\n    );\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.query(\n      `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n       VALUES ($1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running')\n       ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n      [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n    );\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row\n    await this.sql.query(\n      `INSERT INTO ${this.t.instance}\n         (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n       VALUES ($1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')})\n       ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n         finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n      [\n        input.instanceId,\n        input.workflow,\n        input.userId,\n        input.status,\n        input.at,\n        input.convertedAt ?? null,\n      ]\n    );\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one\n    const rows = await this.sql.query<{ id: string }>(\n      `INSERT INTO ${this.t.message}\n         (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)\n       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, ${TS('$9')})\n       ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n       RETURNING id`,\n      [\n        uuidv7(message.sentAt),\n        message.idempotencyKey,\n        message.workflow,\n        message.instanceId,\n        message.nodeId,\n        message.template,\n        message.channel,\n        message.userId,\n        message.sentAt,\n      ]\n    );\n    const id = rows.at(0)?.id;\n    if (id === undefined) throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    return id;\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.query(\n      `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n      [messageId, ...urls]\n    );\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n        `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n         FROM ${this.t.message} WHERE id = $1`,\n        [messageId]\n      );\n      const row = rows.at(0);\n      if (row === undefined) return false;\n      const open = judge({ userId: row.user_id, deliveredAt: Number(row.delivered_at) });\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock: concurrent clicks on it are judged one at a time\n      const messages = await tx.query<{ delivered_at: number | string }>(\n        `SELECT ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n         FROM ${this.t.message} WHERE id = $1 FOR UPDATE`,\n        [messageId]\n      );\n      const message = messages.at(0);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: Number(message.delivered_at),\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    const rows = await this.sql.query<{ id: string }>(\n      `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n       WHERE id = $1 RETURNING id`,\n      [messageId, at]\n    );\n    return rows.length > 0;\n  }\n\n  async recordUnsubscribe(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      const rows = await tx.query<{ user_id: string }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id`,\n        [messageId, at]\n      );\n      const userId = rows.at(0)?.user_id;\n      if (userId === undefined) return false;\n      // The opt-out itself: the engine sends this user no more email\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS('$2')})\n         ON CONFLICT DO NOTHING`,\n        [userId, at]\n      );\n      return true;\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;AAQA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;AAQ7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CAFnB,YACE,KACA,GACA;EAFiB,KAAA,MAAA;EACA,KAAA,IAAA;CAChB;CAEH,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,SAAS;6BACR,GAAG,IAAI,EAAE;8CAEhC;GAAC,MAAM;GAAY,MAAM;GAAU,MAAM;GAAQ,MAAM;EAAE,CAC3D;CACF;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,SAAS;6BACR,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE;wGAEjD;GAAC,MAAM;GAAY,MAAM;GAAU,MAAM;GAAQ,MAAM;GAAI,MAAM;EAAM,CACzE;CACF;CAEA,MAAM,iBAAiB,OAOL;EAEhB,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,SAAS;;6BAER,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE;;oFAG9D;GACE,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM,eAAe;EACvB,CACF;CACF;CAEA,MAAM,cAAc,SAAyC;EAoB3D,MAAM,MAAK,MAlBQ,KAAK,IAAI,MAC1B,eAAe,KAAK,EAAE,QAAQ;;iDAEa,GAAG,IAAI,EAAE;;sBAGpD;GACEA,kBAAAA,OAAO,QAAQ,MAAM;GACrB,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;EACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;EACvB,IAAI,OAAO,KAAA,GAAW,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EAC1F,OAAO;CACT;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;CACF;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAMxC,MAAM,OAAM,MALO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;gBACjD,KAAK,EAAE,QAAQ,iBACvB,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;GACrB,IAAI,QAAQ,KAAA,GAAW,OAAO;GAC9B,MAAM,OAAO,MAAM;IAAE,QAAQ,IAAI;IAAS,aAAa,OAAO,IAAI,YAAY;GAAE,CAAC;GACjF,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACEA,kBAAAA,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAOxC,MAAM,WAAU,MALO,GAAG,MACxB,UAAU,GAAG,iCAAiC,EAAE;gBACxC,KAAK,EAAE,QAAQ,4BACvB,CAAC,SAAS,CACZ,EAAA,CACyB,GAAG,CAAC;GAC7B,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,OAAO,QAAQ,YAAY;IACxC,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACEA,kBAAAA,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAM3E,QAAO,MALY,KAAK,IAAI,MAC1B,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;oCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;CACvB;CAEA,MAAM,kBAAkB,WAAmB,IAA8B;EACvE,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAMxC,MAAM,UAAS,MALI,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;iEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACoB,GAAG,CAAC,CAAC,EAAE;GAC3B,IAAI,WAAW,KAAA,GAAW,OAAO;GAEjC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,+CAA+C,GAAG,IAAI,EAAE;kCAE1F,CAAC,QAAQ,EAAE,CACb;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}
+{"version":3,"file":"postgres-reporting.cjs","names":["beginReadCommitted","lockUser","lockUserTransaction","uuidv7","UserErasedError"],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import { UserErasedError } from './erasure';\nimport type { ClickContext, Engagement, JourneyReporting, MessageRecord } from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\nimport { beginReadCommitted, lockUser, lockUserTransaction } from './user-lock';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n *\n * The instance and message rows are written like the store's rows about a user (postgres.ts,\n * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's\n * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after\n * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts\n * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not\n * retryable) so it is never sent.\n *\n * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is\n * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the\n * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone\n * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only\n * then locks the copy's row (where the path locks it) and writes. User lock before row lock,\n * always: the erasure deletes under the user lock, so the two never wait on each other in\n * opposite orders. The unsubscribe is the compliance exception: its suppression is written\n * whatever the user's state, under the same lock order for consistency.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>,\n    private readonly schema: string\n  ) {}\n\n  /** The condition every row about a user carries: no erasure tombstone for `$user`. */\n  private notErased(user: string): string {\n    return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;\n  }\n\n  /**\n   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the\n   * owner's user lock, then the copy re-read under it — present and its owner without a\n   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).\n   * `forUpdate` locks the copy's row on that re-read, after the user lock.\n   */\n  private async lockMessage(\n    tx: SqlClientLike,\n    messageId: string,\n    forUpdate = false\n  ): Promise<{ userId: string; deliveredAt: number } | undefined> {\n    await beginReadCommitted(tx);\n    const owners = await tx.query<{ user_id: string }>(\n      `SELECT user_id FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const owner = owners.at(0);\n    if (owner === undefined) return undefined;\n    await lockUser(tx, this.schema, owner.user_id);\n    const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n      `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n       FROM ${this.t.message} WHERE id = $1\n         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)\n       ${forUpdate ? 'FOR UPDATE' : ''}`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    if (row === undefined) return undefined;\n    return { userId: row.user_id, deliveredAt: Number(row.delivered_at) };\n  }\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO NOTHING`,\n        [input.instanceId, input.workflow, input.userId, input.at]\n      );\n    });\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n        [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n      );\n    });\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row —\n    // unless the user is erased, where a late finish must not put one back\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance}\n           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n         SELECT $1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')} ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n        [\n          input.instanceId,\n          input.workflow,\n          input.userId,\n          input.status,\n          input.at,\n          input.convertedAt ?? null,\n        ]\n      );\n    });\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one. With a\n    // tombstone the statement yields nothing, a retry's row included: the copy is not sent\n    return this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, message.userId);\n      const rows = await tx.query<{ id: string }>(\n        `INSERT INTO ${this.t.message}\n           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)\n         SELECT $1, $2, $3, $4, $5, $6, $7, $8, ${TS('$9')} ${this.notErased('$8')}\n         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n         RETURNING id`,\n        [\n          uuidv7(message.sentAt),\n          message.idempotencyKey,\n          message.workflow,\n          message.instanceId,\n          message.nodeId,\n          message.template,\n          message.channel,\n          message.userId,\n          message.sentAt,\n        ]\n      );\n      const id = rows.at(0)?.id;\n      if (id !== undefined) return id;\n      // Nothing recorded: the tombstone refused it, and the sender must stop here\n      const erased = await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [\n        message.userId,\n      ]);\n      if (erased.length > 0) throw new UserErasedError(message.userId);\n      throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    });\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.transaction(async (tx) => {\n      // No copy (or one being erased): nothing to record the links under\n      if ((await this.lockMessage(tx, messageId)) === undefined) return;\n      await tx.query(\n        `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n        [messageId, ...urls]\n      );\n    });\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const message = await this.lockMessage(tx, messageId);\n      if (message === undefined) return false;\n      const open = judge(message);\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock (taken after the user lock): concurrent clicks on it are\n      // judged one at a time\n      const message = await this.lockMessage(tx, messageId, true);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: message.deliveredAt,\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      if ((await this.lockMessage(tx, messageId)) === undefined) return false;\n      const rows = await tx.query<{ id: string }>(\n        `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n         WHERE id = $1 RETURNING id`,\n        [messageId, at]\n      );\n      return rows.length > 0;\n    });\n  }\n\n  async recordUnsubscribe(messageId: string, at: number): Promise<{ userId: string } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The lock order of the other message-id paths (user lock, then the copy's row), so an\n      // unsubscribe and an erasure never wait on each other crosswise. Not the tombstone check:\n      // an opt-out is recorded whatever the user's state, on the copy as long as it is there\n      await beginReadCommitted(tx);\n      const owners = await tx.query<{ user_id: string }>(\n        `SELECT user_id FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`,\n        [messageId]\n      );\n      const owner = owners.at(0);\n      if (owner === undefined) return undefined;\n      await lockUser(tx, this.schema, owner.user_id);\n      // The first unsubscribe sets the time; a later one keeps it and still names the recipient\n      const rows = await tx.query<{ user_id: string }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id`,\n        [messageId, at]\n      );\n      const userId = rows.at(0)?.user_id;\n      if (userId === undefined) return undefined;\n      // The opt-out itself: the engine sends this user no more email\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS('$2')})\n         ON CONFLICT DO NOTHING`,\n        [userId, at]\n      );\n      return { userId };\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;;;;;;;;;;;;;;;;;AAwB7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CACA;CAHnB,YACE,KACA,GACA,QACA;EAHiB,KAAA,MAAA;EACA,KAAA,IAAA;EACA,KAAA,SAAA;CAChB;;CAGH,UAAkB,MAAsB;EACtC,OAAO,mCAAmC,KAAK,EAAE,QAAQ,mBAAmB,KAAK;CACnF;;;;;;;CAQA,MAAc,YACZ,IACA,WACA,YAAY,OACkD;EAC9D,MAAMA,wBAAAA,mBAAmB,EAAE;EAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,iBACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;EACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;EAQ7C,MAAM,OAAM,MAPO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;cACjD,KAAK,EAAE,QAAQ;yCACY,KAAK,EAAE,QAAQ,mBAAmB,KAAK,EAAE,QAAQ;SACjF,YAAY,eAAe,MAC9B,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,OAAO;GAAE,QAAQ,IAAI;GAAS,aAAa,OAAO,IAAI,YAAY;EAAE;CACtE;CAEA,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMC,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;gDAElE;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;GAAE,CAC3D;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;0GAEnF;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;IAAI,MAAM;GAAM,CACzE;EACF,CAAC;CACH;CAEA,MAAM,iBAAiB,OAOL;EAGhB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;;8BAET,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;sFAGrF;IACE,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM,eAAe;GACvB,CACF;EACF,CAAC;CACH;CAEA,MAAM,cAAc,SAAyC;EAG3D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,QAAQ,MAAM;GAmBzD,MAAM,MAAK,MAlBQ,GAAG,MACpB,eAAe,KAAK,EAAE,QAAQ;;kDAEY,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;wBAG3E;IACEC,kBAAAA,OAAO,QAAQ,MAAM;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;GACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;GACvB,IAAI,OAAO,KAAA,GAAW,OAAO;GAK7B,KAAI,MAHiB,GAAG,MAAM,sBAAsB,KAAK,EAAE,QAAQ,sBAAsB,CACvF,QAAQ,MACV,CAAC,EAAA,CACU,SAAS,GAAG,MAAM,IAAIC,sBAAAA,gBAAgB,QAAQ,MAAM;GAC/D,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EACtE,CAAC;CACH;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GAEvC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW;GAC3D,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;EACF,CAAC;CACH;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,SAAS;GACpD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,MAAM,OAAO,MAAM,OAAO;GAC1B,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACED,kBAAAA,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAGxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,WAAW,IAAI;GAC1D,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,QAAQ;IACrB,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACEA,kBAAAA,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAC3E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW,OAAO;GAMlE,QAAO,MALY,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;sCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;EACvB,CAAC;CACH;CAEA,MAAM,kBAAkB,WAAmB,IAAqD;EAC9F,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAIxC,MAAMH,wBAAAA,mBAAmB,EAAE;GAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,uCACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;GACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;GAO7C,MAAM,UAAS,MALI,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;iEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACoB,GAAG,CAAC,CAAC,EAAE;GAC3B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;GAEjC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,+CAA+C,GAAG,IAAI,EAAE;kCAE1F,CAAC,QAAQ,EAAE,CACb;GACA,OAAO,EAAE,OAAO;EAClB,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}

package/dist/store/postgres-reporting.d.cts

@@ -7,11 +7,37 @@ import { ClickContext, Engagement, JourneyReporting, MessageRecord } from "./ind
  * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
  * is written here, never defaulted, and every write is idempotent: the engine reports again when
  * a step is retried.
+ *
+ * The instance and message rows are written like the store's rows about a user (postgres.ts,
+ * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's
+ * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after
+ * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts
+ * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not
+ * retryable) so it is never sent.
+ *
+ * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is
+ * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the
+ * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone
+ * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only
+ * then locks the copy's row (where the path locks it) and writes. User lock before row lock,
+ * always: the erasure deletes under the user lock, so the two never wait on each other in
+ * opposite orders. The unsubscribe is the compliance exception: its suppression is written
+ * whatever the user's state, under the same lock order for consistency.
  */
 export declare class PostgresReporting implements JourneyReporting {
   private readonly sql;
   private readonly t;
-  constructor(sql: SqlClientLike, t: Record<TableKey, string>);
+  private readonly schema;
+  constructor(sql: SqlClientLike, t: Record<TableKey, string>, schema: string);
+  /** The condition every row about a user carries: no erasure tombstone for `$user`. */
+  private notErased;
+  /**
+   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the
+   * owner's user lock, then the copy re-read under it — present and its owner without a
+   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).
+   * `forUpdate` locks the copy's row on that re-read, after the user lock.
+   */
+  private lockMessage;
   instanceStarted(input: {
     workflow: string;
     instanceId: string;
@@ -53,7 +79,9 @@ export declare class PostgresReporting implements JourneyReporting {
     engagement: Engagement;
   } | undefined>;
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
-  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;
+  recordUnsubscribe(messageId: string, at: number): Promise<{
+    userId: string;
+  } | undefined>;
   snapshotSegments(at: number): Promise<{
     segment: string;
     size: number;

package/dist/store/postgres-reporting.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.d.cts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;qBAiBa,6BAA6B;mBAErB;mBACA;EAFnB,YACmB,KAAK,eACL,GAAG,OAAO;EAGvB,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EASE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EASE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAmBE,cAAc,SAAS,gBAAgB;EAyBvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EASzD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAwCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EA4EhC,sBAAsB,mBAAmB,aAAa;EAStD,kBAAkB,mBAAmB,aAAa;EAmBlD,iBAAiB,aAAa;IAAU;IAAiB"}
+{"version":3,"file":"postgres-reporting.d.cts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;qBAmCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAkCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,kBAAkB,mBAAmB,aAAa;IAAU;;EA+B5D,iBAAiB,aAAa;IAAU;IAAiB"}

package/dist/store/postgres-reporting.d.mts

@@ -7,11 +7,37 @@ import { ClickContext, Engagement, JourneyReporting, MessageRecord } from "./ind
  * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
  * is written here, never defaulted, and every write is idempotent: the engine reports again when
  * a step is retried.
+ *
+ * The instance and message rows are written like the store's rows about a user (postgres.ts,
+ * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's
+ * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after
+ * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts
+ * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not
+ * retryable) so it is never sent.
+ *
+ * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is
+ * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the
+ * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone
+ * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only
+ * then locks the copy's row (where the path locks it) and writes. User lock before row lock,
+ * always: the erasure deletes under the user lock, so the two never wait on each other in
+ * opposite orders. The unsubscribe is the compliance exception: its suppression is written
+ * whatever the user's state, under the same lock order for consistency.
  */
 export declare class PostgresReporting implements JourneyReporting {
   private readonly sql;
   private readonly t;
-  constructor(sql: SqlClientLike, t: Record<TableKey, string>);
+  private readonly schema;
+  constructor(sql: SqlClientLike, t: Record<TableKey, string>, schema: string);
+  /** The condition every row about a user carries: no erasure tombstone for `$user`. */
+  private notErased;
+  /**
+   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the
+   * owner's user lock, then the copy re-read under it — present and its owner without a
+   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).
+   * `forUpdate` locks the copy's row on that re-read, after the user lock.
+   */
+  private lockMessage;
   instanceStarted(input: {
     workflow: string;
     instanceId: string;
@@ -53,7 +79,9 @@ export declare class PostgresReporting implements JourneyReporting {
     engagement: Engagement;
   } | undefined>;
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
-  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;
+  recordUnsubscribe(messageId: string, at: number): Promise<{
+    userId: string;
+  } | undefined>;
   snapshotSegments(at: number): Promise<{
     segment: string;
     size: number;

package/dist/store/postgres-reporting.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.d.mts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;qBAiBa,6BAA6B;mBAErB;mBACA;EAFnB,YACmB,KAAK,eACL,GAAG,OAAO;EAGvB,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EASE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EASE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAmBE,cAAc,SAAS,gBAAgB;EAyBvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EASzD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAwCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EA4EhC,sBAAsB,mBAAmB,aAAa;EAStD,kBAAkB,mBAAmB,aAAa;EAmBlD,iBAAiB,aAAa;IAAU;IAAiB"}
+{"version":3,"file":"postgres-reporting.d.mts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;qBAmCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAkCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,kBAAkB,mBAAmB,aAAa;IAAU;;EA+B5D,iBAAiB,aAAa;IAAU;IAAiB"}