@shware/workflow 3.3.0 → 4.0.0

package/dist/host/{router.mjs → ingest.mjs}

@@ -1,17 +1,34 @@
 import { semanticHash } from "../hash.mjs";
 import { BundleIR } from "../ir.mjs";
-import { checkEvent } from "../contract.mjs";
+import { UserErasedError } from "../store/erasure.mjs";
 import { murmur3 } from "../engine/bucket.mjs";
-import { DEVICES_UPDATED_EVENT, PROFILE_UPDATED_EVENT, evaluateCondition, matchesWhere } from "../engine/condition.mjs";
+import { DEVICES_UPDATED_EVENT, evaluateCondition, matchesWhere, profileUpdatedEvent } from "../engine/condition.mjs";
 import { JourneyFactSource } from "../store/facts.mjs";
-import { WAKE_EVENT_TYPE, isInstanceNotFound } from "../cloudflare/bindings.mjs";
 import { d1Store } from "../cloudflare/d1-env.mjs";
-import { recordPushOpen } from "../reporting/tracking.mjs";
 import { SchemaMismatchError } from "../store/index.mjs";
-import * as z from "zod/mini";
-//#region src/host/router.ts
+import { InstanceNotFoundError, WAKE_EVENT_TYPE } from "./platform.mjs";
+//#region src/host/ingest.ts
+/**
+* Ingest: what the host does with what comes in, HTTP aside (that is `http.ts`). An incoming
+* event does four things: it is stored, it wakes waiting instances, it is matched against event
+* triggers, and it re-evaluates segment-trigger membership. An identify merges a profile, which
+* wakes the waits on the properties it patched and re-evaluates segment triggers too. Plus
+* devices, erasure, the segment sweep and bundle deploys.
+*
+* Storage goes through a JourneyStore; the `store` argument defaults to the D1 store built from
+* the env's binding, so a Worker that only has that calls these functions as they are.
+*/
+/**
+* The fast answer for a user with an erasure tombstone (being erased, or erased for good): every
+* ingest-side entry point starts here and does no work for them. The gate itself is the store's
+* conditional write, which throws the same error when the tombstone lands after this check.
+*/
+async function refuseIfErased(store, userId) {
+	if (await store.erasureState(userId) !== "none") throw new UserErasedError(userId);
+}
 async function ingestEvent(env, input, store = d1Store(env)) {
 	if (input.event.startsWith("$")) throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);
+	await refuseIfErased(store, input.userId);
 	const ts = input.ts ?? Date.now();
 	const payload = input.payload ?? {};
 	const id = input.id ?? crypto.randomUUID();
@@ -22,7 +39,7 @@ async function ingestEvent(env, input, store = d1Store(env)) {
 		ts,
 		payload
 	});
-	const woke = await wakeSubscribers(env, store, input.userId, input.event);
+	const woke = await wakeSubscribers(env, store, input.userId, [input.event]);
 	const started = await startTriggeredJourneys(env, store, {
 		...input,
 		payload
@@ -35,14 +52,21 @@ async function ingestEvent(env, input, store = d1Store(env)) {
 		started
 	};
 }
-async function wakeSubscribers(env, store, userId, event) {
+/**
+* Wake every instance of the user waiting on any of `events`, once each: an instance subscribed
+* to several of them (a wait on two profile properties, patched together) gets one wake-up, and
+* the payload names the first event it matched.
+*/
+async function wakeSubscribers(env, store, userId, events) {
+	const handles = /* @__PURE__ */ new Map();
+	for (const event of events) for (const handle of await store.findWakeHandles(userId, event)) if (!handles.has(handle)) handles.set(handle, event);
 	let woke = 0;
-	for (const handle of await store.findWakeHandles(userId, event)) {
+	for (const [handle, event] of handles) {
 		let instance;
 		try {
 			instance = await env.JOURNEY.get(handle);
 		} catch (error) {
-			if (isInstanceNotFound(error)) await store.unsubscribe(handle);
+			if (error instanceof InstanceNotFoundError) await store.unsubscribe(handle);
 			else console.warn(`[workflow] looking up ${handle} to wake it failed`, error);
 			continue;
 		}
@@ -134,30 +158,45 @@ async function refreshSegments(env, store, userId, ts, routes, segments = [], de
 	if (failures.length > 0) throw failures[0];
 	return started;
 }
+/** How many users one sweep page evaluates: a unit of resumable work (AWS checkpoints each). */
+const SWEEP_PAGE_SIZE = 500;
 /**
-* The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a
-* journey's conditions run on, so a member is exactly who a journey would see in it. Membership
-* follows (joiners keep the time they joined, leavers are removed), segment triggers start the
-* journeys of whoever entered by the clock alone, and the store records each segment's size.
-* It walks users one by one: fine for thousands, a large audience wants SQL-side evaluation.
+* What the sweep does before it looks at any user: the runtime's own upkeep (AWS: unconfirmed
+* starts, executions that ended unseen) and the erasures left unfinished (an instance would not
+* stop). A failure of either is logged, never fatal: the pages still run. Users whose erasure is
+* still pending afterwards are skipped by every page (`sweepSegmentsPaged`).
 */
-async function sweepSegments(env, store, now = Date.now()) {
+async function sweepMaintenance(env, store) {
 	try {
 		await env.JOURNEY.maintain?.();
 	} catch (error) {
 		console.error("[workflow] runtime maintenance failed", error);
 	}
-	const erasing = /* @__PURE__ */ new Set();
 	for (const userId of await store.pendingErasures()) try {
-		const { erased } = await eraseUser(env, userId, store);
-		if (!erased) erasing.add(userId);
+		await eraseUser(env, userId, store, Date.now());
 	} catch (error) {
-		erasing.add(userId);
 		console.error(`[workflow] erasure of ${userId} failed`, error);
 	}
+}
+/**
+* One page of the sweep: the users after `after` (ascending, at most `limit`), every deployed
+* segment evaluated for each. The pages are what makes the sweep resumable — a host whose run
+* can be cut short (a Lambda timeout) checkpoints each one and replays the checkpointed pages
+* instead of starting over; `sweepSegments` is the plain loop over them.
+*/
+async function sweepSegmentsPaged(env, store, page) {
+	const now = page.now ?? Date.now();
+	const limit = page.limit ?? 500;
 	const segments = (await store.listSegments()).map((segment) => segment.id);
 	const routes = await store.listSegmentTriggers();
-	const users = (await store.listUserIds()).filter((userId) => !erasing.has(userId));
+	const erasing = new Set(await store.pendingErasures());
+	const listed = await store.listUserIds({
+		after: page.after,
+		limit
+	});
+	const lastUserId = listed.at(-1);
+	if (page.after !== void 0 && lastUserId === page.after) throw new Error(`listUserIds did not advance past ${page.after}: the store ignores 'after'`);
+	const users = listed.filter((userId) => !erasing.has(userId));
 	const started = [];
 	const definitions = /* @__PURE__ */ new Map();
 	for (const userId of users) try {
@@ -165,10 +204,41 @@ async function sweepSegments(env, store, now = Date.now()) {
 	} catch (error) {
 		console.error(`[workflow] segment refresh for ${userId} failed`, error);
 	}
-	const sizes = await store.reporting?.snapshotSegments(now) ?? [];
 	return {
 		users: users.length,
 		started,
+		lastUserId,
+		more: listed.length >= limit
+	};
+}
+/**
+* The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a
+* journey's conditions run on, so a member is exactly who a journey would see in it. Membership
+* follows (joiners keep the time they joined, leavers are removed), segment triggers start the
+* journeys of whoever entered by the clock alone, and the store records each segment's size.
+* It walks users page by page (`sweepSegmentsPaged`): fine for thousands, a large audience wants
+* SQL-side evaluation.
+*/
+async function sweepSegments(env, store, now = Date.now()) {
+	await sweepMaintenance(env, store);
+	let users = 0;
+	const started = [];
+	let after;
+	for (;;) {
+		const page = await sweepSegmentsPaged(env, store, {
+			after,
+			limit: 500,
+			now
+		});
+		users += page.users;
+		started.push(...page.started);
+		if (!page.more || page.lastUserId === void 0) break;
+		after = page.lastUserId;
+	}
+	const sizes = await store.reporting?.snapshotSegments(now) ?? [];
+	return {
+		users,
+		started,
 		sizes
 	};
 }
@@ -222,7 +292,7 @@ async function startJourney(env, store, workflow, hash, userId, ts, trigger, ver
 }
 const utf8 = new TextEncoder();
 /**
-* Instance id: addressable (the router gets it directly to wake it), ≤100
+* Instance id: addressable (the host gets it directly to wake it), ≤100
 * chars, legal charset. The murmur3 fingerprint keeps ids distinct when the
 * sanitized/truncated userId alone would collide.
 */
@@ -237,11 +307,12 @@ function buildInstanceId(workflow, hash, userId, ts) {
 * two identifies landing together cannot lose each other's fields.
 */
 async function identifyUser(env, userId, props, store = d1Store(env)) {
+	await refuseIfErased(store, userId);
 	const ts = Date.now();
 	return {
 		ok: true,
 		props: await store.mergeProfile(userId, props),
-		woke: await wakeSubscribers(env, store, userId, PROFILE_UPDATED_EVENT),
+		woke: await wakeSubscribers(env, store, userId, Object.keys(props).map(profileUpdatedEvent)),
 		started: await refreshSegmentTriggers(env, store, userId, ts)
 	};
 }
@@ -251,22 +322,19 @@ async function identifyUser(env, userId, props, store = d1Store(env)) {
 * `waitUntil`), for the new owner and the previous one.
 */
 async function registerDevice(env, device, store = d1Store(env)) {
+	await refuseIfErased(store, device.userId);
 	const previous = await store.removeDevice(device.token);
 	await store.upsertDevice({
 		...device,
 		ts: device.ts ?? Date.now()
 	});
-	let woke = await wakeSubscribers(env, store, device.userId, DEVICES_UPDATED_EVENT);
-	if (previous !== void 0 && previous !== device.userId) woke += await wakeSubscribers(env, store, previous, DEVICES_UPDATED_EVENT);
+	let woke = await wakeSubscribers(env, store, device.userId, [DEVICES_UPDATED_EVENT]);
+	if (previous !== void 0 && previous !== device.userId) woke += await wakeSubscribers(env, store, previous, [DEVICES_UPDATED_EVENT]);
 	return {
 		ok: true,
 		woke
 	};
 }
-/**
-* A deleted account: everything the engine keeps about the user is erased and the journeys still
-* running for them are terminated, so nothing more is sent. Idempotent.
-*/
 /** Workflow instance states that will never run another step. */
 const STOPPED_STATUSES = /* @__PURE__ */ new Set([
 	"complete",
@@ -274,16 +342,21 @@ const STOPPED_STATUSES = /* @__PURE__ */ new Set([
 	"terminated"
 ]);
 /**
-* Stop one instance for good; true once it is known not to run again. An instance the platform
-* no longer knows, or one already finished (terminate refuses those), counts as stopped. Any other
-* failure is not taken for "already gone": it answers false, and the erasure waits for a retry.
+* Stop one admitted instance for good; true once it is known not to run again: terminated, or
+* already in a terminal state (terminate refuses those). Any other failure is not taken for
+* "already gone": it answers false, and the erasure waits for a retry.
+*
+* An admitted instance the platform no longer knows counts as stopped too — but only an
+* admitted one. Admission is the runner's first act, so an admitted instance did reach the
+* runtime: not found now means it finished and was evicted. An entry that is not admitted is
+* never passed here: for it, not found may just as well mean its `create` is still in flight.
 */
 async function stopInstance(env, instanceId) {
 	let instance;
 	try {
 		instance = await env.JOURNEY.get(instanceId);
 	} catch (error) {
-		if (isInstanceNotFound(error)) return true;
+		if (error instanceof InstanceNotFoundError) return true;
 		console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);
 		return false;
 	}
@@ -299,34 +372,56 @@ async function stopInstance(env, instanceId) {
 	}
 }
 /**
-* Carry out a recorded erasure: stop every running instance of the user, and only once all have
-* stopped erase their data (the request with it). Stopping first means no step can write rows
-* back after the erase; erasing nothing until then keeps the entries that name the instances
-* still to stop, so a retry can finish the job.
+* Carry out a recorded erasure: stop every running instance of the user, and only once all are
+* known not to run erase their data. The tombstone is already committed, so no new entry,
+* event, profile or device of theirs lands meanwhile.
+*
+* An entry's runner admits itself before its first effect (`admitInstance`, mutually exclusive
+* with the tombstone's commit), which splits the running instances in two:
+*
+* - not admitted: nothing of it has run, and nothing will — a `create` still in flight, or a
+*   runner invoked later, meets the tombstone at admission and exits. No stop is needed, and
+*   none would be reliable: the platform may not know the instance yet.
+* - admitted: it did reach the runtime and must be stopped (`stopInstance`), or it would write
+*   rows back after the erase. One that will not stop leaves the erasure pending.
+*
+* Erasing nothing until then keeps the entries that name the instances still to stop, so a
+* retry can finish the job. The tombstone outlives the erase (`erased_at`), which is what makes
+* a repeat idempotent and a late write harmless. There is no straggler to come back for: every
+* write about a user runs in the user's locked transaction, the same lock the tombstone takes,
+* so a write either committed before the tombstone — and `forgetUser` deletes it here — or
+* waited for the lock and is refused by the tombstone it then sees.
 */
-async function eraseUser(env, userId, store) {
+async function eraseUser(env, userId, store, now) {
 	const pending = [];
-	for (const instanceId of await store.runningInstances(userId)) if (!await stopInstance(env, instanceId)) pending.push(instanceId);
+	for (const { instanceId, admitted } of await store.runningInstances(userId)) {
+		if (!admitted) continue;
+		if (!await stopInstance(env, instanceId)) pending.push(instanceId);
+	}
 	if (pending.length > 0) return {
 		erased: false,
 		pending
 	};
-	await store.forgetUser(userId);
+	await store.forgetUser(userId, now);
 	return {
 		erased: true,
 		pending
 	};
 }
 /**
-* Forget a user (a deleted account): the request is recorded first, then carried out. An
-* instance that will not stop leaves it pending — nothing erased yet — and the scheduled sweep
-* retries it; `erased: false` says so.
+* Forget a user (a deleted account): the tombstone is committed first, then the erasure carried
+* out. `erased: true` means every admitted runner of theirs was confirmed stopped, the entries
+* never admitted can never run, and the data is deleted — for good, with no time window and no
+* second pass: the tombstone commits under the user's lock, which every write about the user
+* also takes, so nothing of theirs can land after it. An admitted instance that will not stop
+* leaves it pending — nothing erased yet — and the scheduled sweep retries it; `erased: false`
+* says so. A user already erased answers `erased: true` again, with nothing to do.
 */
 async function forgetUser(env, userId, store = d1Store(env), now = Date.now()) {
 	await store.requestErasure(userId, now);
 	return {
 		ok: true,
-		...await eraseUser(env, userId, store)
+		...await eraseUser(env, userId, store, now)
 	};
 }
 /**
@@ -338,7 +433,7 @@ async function unbindDevice(env, token, store = d1Store(env)) {
 	const owner = await store.unbindDevice(token);
 	return {
 		ok: true,
-		woke: owner === void 0 ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT)
+		woke: owner === void 0 ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT])
 	};
 }
 /** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */
@@ -346,7 +441,7 @@ async function removeDevice(env, token, store = d1Store(env)) {
 	const owner = await store.removeDevice(token);
 	return {
 		ok: true,
-		woke: owner === void 0 ? 0 : await wakeSubscribers(env, store, owner, DEVICES_UPDATED_EVENT)
+		woke: owner === void 0 ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT])
 	};
 }
 /** A versioned deploy on a store that cannot tell which version is live (D1). */
@@ -410,131 +505,7 @@ async function deployBundle(env, bundle, store = d1Store(env), version) {
 		applied
 	};
 }
-/**
-* Request bodies are untrusted JSON. They are read as unknown fields and
-* checked, never cast into the shape they are supposed to have: a cast only
-* silences the compiler, and what arrives here reaches SQL parameters.
-*/
-async function readBody(request) {
-	const body = await request.json();
-	return isPlainObject(body) ? body : {};
-}
-function isPlainObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNonEmptyString(value) {
-	return typeof value === "string" && value.length > 0;
-}
-async function handleRequest(request, env, store = d1Store(env), validation = {}) {
-	const url = new URL(request.url);
-	const json = (body, status = 200) => new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/json" }
-	});
-	const { contract } = validation;
-	const enforce = validation.mode !== "report";
-	/** The contract's verdict: the value to use, or the response refusing the request. */
-	const checked = (result, original, what) => {
-		if (result.ok) return { value: result.data };
-		const issues = result.issues.map((i) => `${i.path || "(root)"}: ${i.message}`);
-		if (!enforce) {
-			console.warn(`[workflow router] contract would refuse ${what}: ${issues.join("; ")}`);
-			return { value: original };
-		}
-		return { refused: json({
-			error: `${what} refused by the contract`,
-			issues: result.issues
-		}, 400) };
-	};
-	if (request.method === "GET" && url.pathname === "/health") return json({ ok: true });
-	if (env.API_TOKEN !== void 0) {
-		if (request.headers.get("authorization") !== `Bearer ${env.API_TOKEN}`) return json({ error: "unauthorized" }, 401);
-	}
-	try {
-		if (request.method === "POST" && url.pathname === "/events") {
-			const { id, userId, event, payload, ts } = await readBody(request);
-			if (!isNonEmptyString(userId) || !isNonEmptyString(event)) return json({ error: "userId and event required" }, 400);
-			if (event.startsWith("$")) return json({ error: "event names starting with $ are reserved" }, 400);
-			if (id !== void 0 && !isNonEmptyString(id)) return json({ error: "id must be a non-empty string" }, 400);
-			if (ts !== void 0 && typeof ts !== "number") return json({ error: "ts must be a number" }, 400);
-			if (payload !== void 0 && !isPlainObject(payload)) return json({ error: "payload must be an object" }, 400);
-			let accepted = payload;
-			if (contract !== void 0) {
-				const verdict = checked(checkEvent(contract, event, payload ?? {}), accepted ?? {}, `event '${event}'${typeof id === "string" ? ` (${id})` : ""}`);
-				if ("refused" in verdict) return verdict.refused;
-				accepted = verdict.value;
-			}
-			return json(await ingestEvent(env, {
-				id,
-				userId,
-				event,
-				payload: accepted,
-				ts
-			}, store));
-		}
-		if (request.method === "POST" && url.pathname === "/identify") {
-			const { userId, props } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
-			if (!isPlainObject(props)) return json({ error: "props must be an object" }, 400);
-			let patch = props;
-			if (contract !== void 0) {
-				const verdict = checked(contract.parseProfilePatch(props), patch, "identify");
-				if ("refused" in verdict) return verdict.refused;
-				patch = verdict.value;
-			}
-			return json(await identifyUser(env, userId, patch, store));
-		}
-		if (request.method === "POST" && url.pathname === "/devices") {
-			const { userId, token, platform, ts } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
-			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
-			if (platform !== "ios" && platform !== "android" && platform !== "web") return json({ error: "platform must be 'ios', 'android' or 'web'" }, 400);
-			if (ts !== void 0 && typeof ts !== "number") return json({ error: "ts must be a number" }, 400);
-			return json(await registerDevice(env, {
-				userId,
-				token,
-				platform,
-				...ts === void 0 ? {} : { ts }
-			}, store));
-		}
-		if (request.method === "POST" && url.pathname === "/messages/opened") {
-			const { userId, messageId } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
-			if (!isNonEmptyString(messageId)) return json({ error: "messageId required" }, 400);
-			return json({
-				ok: true,
-				recorded: store.reporting !== void 0 && await recordPushOpen(store.reporting, userId, messageId)
-			});
-		}
-		if (request.method === "POST" && url.pathname === "/users/forget") {
-			const { userId } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
-			return json(await forgetUser(env, userId, store));
-		}
-		if (request.method === "POST" && url.pathname === "/devices/unbind") {
-			const { token } = await readBody(request);
-			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
-			return json(await unbindDevice(env, token, store));
-		}
-		if (request.method === "POST" && url.pathname === "/devices/remove") {
-			const { token } = await readBody(request);
-			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
-			return json(await removeDevice(env, token, store));
-		}
-		if (request.method === "POST" && url.pathname === "/deploy") return json(await deployBundle(env, await request.json(), store));
-		return json({ error: "not found" }, 404);
-	} catch (error) {
-		if (error instanceof z.core.$ZodError) return json({ error: `invalid payload: ${error.message}` }, 400);
-		if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);
-		if (error instanceof SchemaMismatchError) return json({
-			error: error.message,
-			problems: error.problems
-		}, 503);
-		console.error("[workflow router]", error);
-		return json({ error: "internal error" }, 500);
-	}
-}
 //#endregion
-export { BundleIntegrityError, UnversionedStoreError, deployBundle, forgetUser, handleRequest, identifyUser, ingestEvent, refreshSegmentTriggers, registerDevice, removeDevice, sweepSegments, unbindDevice };
+export { BundleIntegrityError, SWEEP_PAGE_SIZE, UnversionedStoreError, deployBundle, forgetUser, identifyUser, ingestEvent, refreshSegmentTriggers, registerDevice, removeDevice, sweepMaintenance, sweepSegments, sweepSegmentsPaged, unbindDevice, wakeSubscribers };
 
-//# sourceMappingURL=router.mjs.map
+//# sourceMappingURL=ingest.mjs.map

package/dist/host/ingest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.mjs","names":[],"sources":["../../src/host/ingest.ts"],"sourcesContent":["import { d1Store } from '../cloudflare/d1-env';\nimport { murmur3 } from '../engine/bucket';\nimport {\n  DEVICES_UPDATED_EVENT,\n  evaluateCondition,\n  matchesWhere,\n  profileUpdatedEvent,\n} from '../engine/condition';\nimport { semanticHash } from '../hash';\nimport { BundleIR, type ConditionIR, type TriggerIR } from '../ir';\nimport { JourneyFactSource } from '../store/facts';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  type SegmentTriggerRoute,\n  UserErasedError,\n} from '../store/index';\nimport {\n  InstanceNotFoundError,\n  type JourneyEnv,\n  type JourneyParams,\n  WAKE_EVENT_TYPE,\n  type WorkflowInstanceLike,\n} from './platform';\n\n/**\n * Ingest: what the host does with what comes in, HTTP aside (that is `http.ts`). An incoming\n * event does four things: it is stored, it wakes waiting instances, it is matched against event\n * triggers, and it re-evaluates segment-trigger membership. An identify merges a profile, which\n * wakes the waits on the properties it patched and re-evaluates segment triggers too. Plus\n * devices, erasure, the segment sweep and bundle deploys.\n *\n * Storage goes through a JourneyStore; the `store` argument defaults to the D1 store built from\n * the env's binding, so a Worker that only has that calls these functions as they are.\n */\n\n/**\n * The fast answer for a user with an erasure tombstone (being erased, or erased for good): every\n * ingest-side entry point starts here and does no work for them. The gate itself is the store's\n * conditional write, which throws the same error when the tombstone lands after this check.\n */\nasync function refuseIfErased(store: JourneyStore, userId: string): Promise<void> {\n  if ((await store.erasureState(userId)) !== 'none') throw new UserErasedError(userId);\n}\n\nexport interface IngestInput {\n  userId: string;\n  event: string;\n  payload?: Record<string, unknown>;\n  ts?: number;\n  /**\n   * This occurrence's identity, and with it the idempotency of sending it.\n   *\n   * Only the sender can know whether two deliveries describe one occurrence or\n   * two, so the engine does not decide: an id it has already stored makes the\n   * second delivery a no-op. That matters because ingest is reachable from two\n   * retrying callers — an HTTP client retrying a 500, and the interpreter's\n   * send_event step being retried after it already committed its row — and a\n   * second copy of an event silently changes every count- and window-based\n   * condition that reads the log.\n   *\n   * Callers that retry should send an id they can reproduce. Omitting it gets\n   * a fresh one, which records the event as its own occurrence.\n   */\n  id?: string;\n}\n\nexport interface IngestResult {\n  /** The occurrence's identity: the caller's `id`, or the one minted for it. */\n  id: string;\n  /** False when that id was already in the log: nothing was written this time. */\n  stored: boolean;\n  woke: number;\n  started: string[];\n}\n\nexport async function ingestEvent(\n  env: JourneyEnv,\n  input: IngestInput,\n  store: JourneyStore = d1Store(env)\n): Promise<IngestResult> {\n  if (input.event.startsWith('$')) {\n    throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);\n  }\n  // Also reached from a running instance's send_event: an erased user's instances are stopped\n  // before the erase, so one that still gets here is refused like any other writer\n  await refuseIfErased(store, input.userId);\n  const ts = input.ts ?? Date.now();\n  const payload = input.payload ?? {};\n  // No id means the sender is not claiming this is a repeat of anything, which\n  // a fresh one states truthfully — unlike a key derived from the contents,\n  // which would silently collapse two identical events a second apart.\n  const id = input.id ?? crypto.randomUUID();\n\n  const stored = await store.insertEvent({\n    id,\n    userId: input.userId,\n    event: input.event,\n    ts,\n    payload,\n  });\n\n  /*\n   * The rest runs even for a duplicate. A retry arrives precisely because the\n   * first attempt did not finish — it committed the row and then failed — so\n   * returning early would strand the journeys the retry exists to start. Both\n   * halves are independently idempotent: waking an instance that already moved\n   * on is a no-op, and the entry ledger refuses a second entry.\n   */\n  const woke = await wakeSubscribers(env, store, input.userId, [input.event]);\n  const started = await startTriggeredJourneys(env, store, { ...input, payload }, ts);\n  started.push(...(await refreshSegmentTriggers(env, store, input.userId, ts)));\n  return { id, stored, woke, started };\n}\n\n/**\n * Wake every instance of the user waiting on any of `events`, once each: an instance subscribed\n * to several of them (a wait on two profile properties, patched together) gets one wake-up, and\n * the payload names the first event it matched.\n */\nexport async function wakeSubscribers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  events: readonly string[]\n): Promise<number> {\n  const handles = new Map<string, string>(); // handle → the event that matched it first\n  for (const event of events) {\n    for (const handle of await store.findWakeHandles(userId, event)) {\n      if (!handles.has(handle)) handles.set(handle, event);\n    }\n  }\n  let woke = 0;\n  for (const [handle, event] of handles) {\n    let instance: WorkflowInstanceLike;\n    try {\n      instance = await env.JOURNEY.get(handle);\n    } catch (error) {\n      // Unknown instance (errored out without cleanup): drop the dangling subscription. Any\n      // other failure (a database blip) keeps it: deleting would silence the wait for good\n      if (error instanceof InstanceNotFoundError) await store.unsubscribe(handle);\n      else console.warn(`[workflow] looking up ${handle} to wake it failed`, error);\n      continue;\n    }\n    try {\n      await instance.sendEvent({ type: WAKE_EVENT_TYPE, payload: { event } });\n      woke++;\n    } catch {\n      // Transient send failure (or an instance finishing right now): keep the\n      // subscription — a later event retries it, and the wait's own timeout\n      // bounds the damage. Deleting here would silence all future wake-ups.\n    }\n  }\n  return woke;\n}\n\nasync function startTriggeredJourneys(\n  env: JourneyEnv,\n  store: JourneyStore,\n  input: IngestInput & { payload: Record<string, unknown> },\n  ts: number\n): Promise<string[]> {\n  const started: string[] = [];\n  for (const route of await store.findTriggers(input.event)) {\n    // where: the payload gate — evaluated against the incoming event first\n    if (route.where !== null && !matchesWhere(input.payload, route.where)) continue;\n\n    // filter: the profile gate\n    if (route.filter !== null) {\n      const facts = new JourneyFactSource(store, input.userId);\n      if (!(await evaluateCondition(route.filter, facts, ts))) continue;\n    }\n\n    const instanceId = await startJourney(\n      env,\n      store,\n      route.workflow,\n      route.hash,\n      input.userId,\n      ts,\n      {\n        event: input.event,\n        payload: input.payload,\n      },\n      route.version\n    );\n    if (instanceId !== null) started.push(instanceId);\n  }\n  return started;\n}\n\n/**\n * Segment-entry triggers, maintained lazily: on each ingest/identify for a\n * user, re-evaluate every trigger-routed segment for that user and act on the\n * membership transition (enter → start journeys, leave → drop membership so a\n * later re-entry is observable). Purely time-driven drift (an inactivity\n * segment turning true by clock alone) has no event to ride on: the scheduled\n * sweep catches it (`sweepSegments`).\n */\nexport async function refreshSegmentTriggers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number\n): Promise<string[]> {\n  return refreshSegments(env, store, userId, ts, await store.listSegmentTriggers());\n}\n\n/**\n * Re-evaluate segments for one user — the routed ones only, or with `segments` every one named —\n * and act on each membership transition: entering records the membership and starts the\n * segment's routed workflows, leaving drops it. A segment trigger therefore starts journeys for\n * users who enter after it is deployed; a user already a member is not entered again.\n */\nasync function refreshSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number,\n  routes: readonly SegmentTriggerRoute[],\n  segments: readonly string[] = [],\n  // A sweep loads each definition once for all its users, not once per user\n  definitions = new Map<string, ConditionIR | undefined>()\n): Promise<string[]> {\n  const bySegment = new Map<string, { workflow: string; hash: string; version?: string }[]>(\n    segments.map((name) => [name, []])\n  );\n  for (const route of routes) {\n    const list = bySegment.get(route.segment) ?? [];\n    list.push({\n      workflow: route.workflow,\n      hash: route.hash,\n      ...(route.version === undefined ? {} : { version: route.version }),\n    });\n    bySegment.set(route.segment, list);\n  }\n  if (bySegment.size === 0) return [];\n\n  const facts = new JourneyFactSource(store, userId);\n  const started: string[] = [];\n  const failures: unknown[] = [];\n  for (const [segmentId, segmentRoutes] of bySegment) {\n    if (!definitions.has(segmentId)) {\n      definitions.set(segmentId, await store.getSegmentCondition(segmentId));\n    }\n    const definition = definitions.get(segmentId);\n    if (definition === undefined) continue; // route without a definition: broken deploy, skip\n\n    const matches = await evaluateCondition(definition, facts, ts);\n    const member = await store.isSegmentMember(segmentId, userId);\n\n    if (matches && !member) {\n      // Entry transition: the membership and the starts it owes, recorded together\n      await store.addSegmentMember(\n        segmentId,\n        userId,\n        ts,\n        segmentRoutes.map((route) => route.workflow)\n      );\n    } else if (!matches && member) {\n      await store.removeSegmentMember(segmentId, userId);\n      continue;\n    }\n    if (!matches) continue;\n\n    // Every start the entry still owes — a fresh entry's, or one an earlier evaluation failed on.\n    // Each is crossed off once its instance exists, so one workflow failing neither blocks the\n    // others nor gets lost: the next evaluation (the sweep, the user's next event) retries it.\n    const pending = new Set(await store.pendingSegmentStarts(segmentId, userId));\n    for (const route of segmentRoutes) {\n      if (!pending.has(route.workflow)) continue;\n      try {\n        const instanceId = await startJourney(\n          env,\n          store,\n          route.workflow,\n          route.hash,\n          userId,\n          ts,\n          { event: '$segment_entry', payload: { segment: segmentId } },\n          route.version\n        );\n        if (instanceId !== null) started.push(instanceId);\n        await store.completeSegmentStart(segmentId, userId, route.workflow);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n  }\n  // Surface a failure to the caller (an ingest answers 500) once every start had its chance\n  if (failures.length > 0) throw failures[0];\n  return started;\n}\n\nexport interface SweepResult {\n  users: number;\n  /** Journeys the segments' entries started. */\n  started: string[];\n  /** Each deployed segment's size after the sweep (empty when the store keeps no reporting). */\n  sizes: { segment: string; size: number }[];\n}\n\n/** How many users one sweep page evaluates: a unit of resumable work (AWS checkpoints each). */\nexport const SWEEP_PAGE_SIZE = 500;\n\n/**\n * What the sweep does before it looks at any user: the runtime's own upkeep (AWS: unconfirmed\n * starts, executions that ended unseen) and the erasures left unfinished (an instance would not\n * stop). A failure of either is logged, never fatal: the pages still run. Users whose erasure is\n * still pending afterwards are skipped by every page (`sweepSegmentsPaged`).\n */\nexport async function sweepMaintenance(env: JourneyEnv, store: JourneyStore): Promise<void> {\n  try {\n    await env.JOURNEY.maintain?.();\n  } catch (error) {\n    console.error('[workflow] runtime maintenance failed', error);\n  }\n  // Erasures left pending (an admitted instance would not stop, or is still draining): retried\n  // until every one of them is confirmed stopped and the data is gone\n  for (const userId of await store.pendingErasures()) {\n    try {\n      await eraseUser(env, userId, store, Date.now());\n    } catch (error) {\n      // Still pending: the next sweep tries again, and the rest of this one goes on\n      console.error(`[workflow] erasure of ${userId} failed`, error);\n    }\n  }\n}\n\nexport interface SweepPage {\n  /** Users evaluated on this page (those being erased are listed but skipped). */\n  users: number;\n  /** Journeys the segments' entries started on this page. */\n  started: string[];\n  /** The last user id listed, to resume past (`after`); undefined when the page was empty. */\n  lastUserId?: string | undefined;\n  /** Whether the page was full, so another may follow. */\n  more: boolean;\n}\n\n/**\n * One page of the sweep: the users after `after` (ascending, at most `limit`), every deployed\n * segment evaluated for each. The pages are what makes the sweep resumable — a host whose run\n * can be cut short (a Lambda timeout) checkpoints each one and replays the checkpointed pages\n * instead of starting over; `sweepSegments` is the plain loop over them.\n */\nexport async function sweepSegmentsPaged(\n  env: JourneyEnv,\n  store: JourneyStore,\n  page: { after?: string | undefined; limit?: number | undefined; now?: number | undefined }\n): Promise<SweepPage> {\n  const now = page.now ?? Date.now();\n  const limit = page.limit ?? SWEEP_PAGE_SIZE;\n  const segments = (await store.listSegments()).map((segment) => segment.id);\n  const routes = await store.listSegmentTriggers();\n  // Read per page, not once up front: an erasure requested since the last page is honored too\n  const erasing = new Set(await store.pendingErasures());\n  const listed = await store.listUserIds({ after: page.after, limit });\n  const lastUserId = listed.at(-1);\n  // A store that ignores `after` would hand back the same page forever: refuse to loop on it.\n  // Equality only — the order is the store's collation, which JavaScript's `<` does not know\n  if (page.after !== undefined && lastUserId === page.after) {\n    throw new Error(`listUserIds did not advance past ${page.after}: the store ignores 'after'`);\n  }\n  const users = listed.filter((userId) => !erasing.has(userId));\n  const started: string[] = [];\n  const definitions = new Map<string, ConditionIR | undefined>();\n  for (const userId of users) {\n    try {\n      started.push(\n        ...(await refreshSegments(env, store, userId, now, routes, segments, definitions))\n      );\n    } catch (error) {\n      // One user's failed start is kept for the next sweep; it must not stop everyone else's\n      console.error(`[workflow] segment refresh for ${userId} failed`, error);\n    }\n  }\n  return { users: users.length, started, lastUserId, more: listed.length >= limit };\n}\n\n/**\n * The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a\n * journey's conditions run on, so a member is exactly who a journey would see in it. Membership\n * follows (joiners keep the time they joined, leavers are removed), segment triggers start the\n * journeys of whoever entered by the clock alone, and the store records each segment's size.\n * It walks users page by page (`sweepSegmentsPaged`): fine for thousands, a large audience wants\n * SQL-side evaluation.\n */\nexport async function sweepSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<SweepResult> {\n  await sweepMaintenance(env, store);\n  let users = 0;\n  const started: string[] = [];\n  let after: string | undefined;\n  for (;;) {\n    const page = await sweepSegmentsPaged(env, store, { after, limit: SWEEP_PAGE_SIZE, now });\n    users += page.users;\n    started.push(...page.started);\n    if (!page.more || page.lastUserId === undefined) break;\n    after = page.lastUserId;\n  }\n  const sizes = (await store.reporting?.snapshotSegments(now)) ?? [];\n  return { users, started, sizes };\n}\n\n/**\n * Create one journey instance behind the entry ledger. Returns null when the\n * once-policy blocks the entry (the store's attempt is atomic, so concurrent\n * ingests cannot double-enter). A pair whose previous instance is recorded as\n * 'failed' is reclaimed rather than barred forever over one outage.\n */\nasync function startJourney(\n  env: JourneyEnv,\n  store: JourneyStore,\n  workflow: string,\n  hash: string,\n  userId: string,\n  ts: number,\n  trigger: { event: string; payload: Record<string, unknown> },\n  /** The code version whose bundle routed this start, read with the hash (see TriggerRoute). */\n  version?: string\n): Promise<string | null> {\n  const instanceId = buildInstanceId(workflow, hash, userId, ts);\n  const params: JourneyParams = { workflowId: workflow, contentHash: hash, userId, trigger };\n  const execution = await env.JOURNEY.plan?.({ id: instanceId, params, ts, version });\n\n  const outcome = await store.enterJourney({ workflow, userId, instanceId, hash, ts, execution });\n  if (outcome === null) {\n    // Already entered and still alive — unless its start never got through: this retry is the\n    // first chance to finish it\n    await env.JOURNEY.resume?.({ workflow, userId });\n    return null;\n  }\n\n  try {\n    await env.JOURNEY.create({ id: instanceId, params });\n  } catch (error) {\n    // A recorded start stays: the runtime may have taken it, and a retry with the same name\n    // and payload finds that execution instead of starting a second one\n    if (execution !== undefined) throw error;\n    if (outcome === 'reclaimed') {\n      // Put the corpse back rather than deleting it: the entry is still a\n      // failure, and dropping the row would erase that from the ledger.\n      await store.setEntryStatus(instanceId, 'failed');\n    } else {\n      // Roll the ledger back so a retried ingest can enter — otherwise the\n      // once-policy would permanently record an entry that never ran.\n      await store.removeEntry(instanceId);\n    }\n    throw error;\n  }\n  return instanceId;\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * Instance id: addressable (the host gets it directly to wake it), ≤100\n * chars, legal charset. The murmur3 fingerprint keeps ids distinct when the\n * sanitized/truncated userId alone would collide.\n */\nfunction buildInstanceId(workflow: string, hash: string, userId: string, ts: number): string {\n  const uid = userId.replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 24);\n  const fingerprint = murmur3(utf8.encode(userId)).toString(36);\n  return `${workflow.slice(0, 32)}-${hash.slice(0, 8)}-${uid}-${fingerprint}-${ts.toString(36)}`;\n}\n\n/* --------------------------------- identify --------------------------------- */\n\nexport interface IdentifyResult {\n  ok: true;\n  props: ProfileProps;\n  woke: number;\n  started: string[];\n}\n\n/**\n * Merge-patch profile properties (a null removes one), then wake property waits\n * and re-evaluate segment triggers. The merge is one statement in the store, so\n * two identifies landing together cannot lose each other's fields.\n */\nexport async function identifyUser(\n  env: JourneyEnv,\n  userId: string,\n  props: ProfileProps,\n  store: JourneyStore = d1Store(env)\n): Promise<IdentifyResult> {\n  await refuseIfErased(store, userId);\n  const ts = Date.now();\n  const merged = await store.mergeProfile(userId, props);\n  // A property wait subscribes to its own property's channel (see relevantEvents): only the\n  // waits on what this patch touched wake up\n  const woke = await wakeSubscribers(\n    env,\n    store,\n    userId,\n    Object.keys(props).map(profileUpdatedEvent)\n  );\n  // A profile change can move the user into (or out of) a trigger-routed segment\n  const started = await refreshSegmentTriggers(env, store, userId, ts);\n  return { ok: true, props: merged, woke, started };\n}\n\nexport interface DeviceRegistration {\n  userId: string;\n  token: string;\n  platform: string;\n  ts?: number;\n}\n\n/**\n * A push token registered for the user (or moved to them from another account: a token belongs\n * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside\n * `waitUntil`), for the new owner and the previous one.\n */\nexport async function registerDevice(\n  env: JourneyEnv,\n  device: DeviceRegistration,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  await refuseIfErased(store, device.userId);\n  const previous = await store.removeDevice(device.token);\n  await store.upsertDevice({ ...device, ts: device.ts ?? Date.now() });\n  let woke = await wakeSubscribers(env, store, device.userId, [DEVICES_UPDATED_EVENT]);\n  if (previous !== undefined && previous !== device.userId) {\n    woke += await wakeSubscribers(env, store, previous, [DEVICES_UPDATED_EVENT]);\n  }\n  return { ok: true, woke };\n}\n\n/** Workflow instance states that will never run another step. */\nconst STOPPED_STATUSES = new Set(['complete', 'errored', 'terminated']);\n\n/**\n * Stop one admitted instance for good; true once it is known not to run again: terminated, or\n * already in a terminal state (terminate refuses those). Any other failure is not taken for\n * \"already gone\": it answers false, and the erasure waits for a retry.\n *\n * An admitted instance the platform no longer knows counts as stopped too — but only an\n * admitted one. Admission is the runner's first act, so an admitted instance did reach the\n * runtime: not found now means it finished and was evicted. An entry that is not admitted is\n * never passed here: for it, not found may just as well mean its `create` is still in flight.\n */\nasync function stopInstance(env: JourneyEnv, instanceId: string): Promise<boolean> {\n  let instance: WorkflowInstanceLike;\n  try {\n    instance = await env.JOURNEY.get(instanceId);\n  } catch (error) {\n    if (error instanceof InstanceNotFoundError) return true;\n    console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);\n    return false;\n  }\n  if (instance.terminate === undefined) return false;\n  try {\n    await instance.terminate();\n    return true;\n  } catch (error) {\n    const status = await instance.status?.().catch(() => undefined);\n    if (status !== undefined && STOPPED_STATUSES.has(status.status)) return true;\n    console.warn(`[workflow] terminating ${instanceId} failed`, error);\n    return false;\n  }\n}\n\n/**\n * Carry out a recorded erasure: stop every running instance of the user, and only once all are\n * known not to run erase their data. The tombstone is already committed, so no new entry,\n * event, profile or device of theirs lands meanwhile.\n *\n * An entry's runner admits itself before its first effect (`admitInstance`, mutually exclusive\n * with the tombstone's commit), which splits the running instances in two:\n *\n * - not admitted: nothing of it has run, and nothing will — a `create` still in flight, or a\n *   runner invoked later, meets the tombstone at admission and exits. No stop is needed, and\n *   none would be reliable: the platform may not know the instance yet.\n * - admitted: it did reach the runtime and must be stopped (`stopInstance`), or it would write\n *   rows back after the erase. One that will not stop leaves the erasure pending.\n *\n * Erasing nothing until then keeps the entries that name the instances still to stop, so a\n * retry can finish the job. The tombstone outlives the erase (`erased_at`), which is what makes\n * a repeat idempotent and a late write harmless. There is no straggler to come back for: every\n * write about a user runs in the user's locked transaction, the same lock the tombstone takes,\n * so a write either committed before the tombstone — and `forgetUser` deletes it here — or\n * waited for the lock and is refused by the tombstone it then sees.\n */\nasync function eraseUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore,\n  now: number\n): Promise<{ erased: boolean; pending: string[] }> {\n  const pending: string[] = [];\n  for (const { instanceId, admitted } of await store.runningInstances(userId)) {\n    if (!admitted) continue;\n    if (!(await stopInstance(env, instanceId))) pending.push(instanceId);\n  }\n  if (pending.length > 0) return { erased: false, pending };\n  await store.forgetUser(userId, now);\n  return { erased: true, pending };\n}\n\n/**\n * Forget a user (a deleted account): the tombstone is committed first, then the erasure carried\n * out. `erased: true` means every admitted runner of theirs was confirmed stopped, the entries\n * never admitted can never run, and the data is deleted — for good, with no time window and no\n * second pass: the tombstone commits under the user's lock, which every write about the user\n * also takes, so nothing of theirs can land after it. An admitted instance that will not stop\n * leaves it pending — nothing erased yet — and the scheduled sweep retries it; `erased: false`\n * says so. A user already erased answers `erased: true` again, with nothing to do.\n */\nexport async function forgetUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore = d1Store(env),\n  now = Date.now()\n): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n  await store.requestErasure(userId, now);\n  return { ok: true, ...(await eraseUser(env, userId, store, now)) };\n}\n\n/**\n * The user signed out on the device: the token stays registered, bound to nobody, so the next\n * sign-in only has to bind it again. Wakes the former owner's device waits (`reachable('push')`\n * may no longer hold).\n */\nexport async function unbindDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.unbindDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT]);\n  return { ok: true, woke };\n}\n\n/** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */\nexport async function removeDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore = d1Store(env)\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.removeDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT]);\n  return { ok: true, woke };\n}\n\n/* ---------------------------------- deploy ---------------------------------- */\n\nexport interface DeployResult {\n  workflows: string[];\n  /**\n   * Workflows whose trigger type has no runtime routing yet — they deploy (the\n   * IR is stored and versioned) but will never start until the routing lands.\n   * Currently: date (TODO — needs cron + Queues, instance creation is\n   * rate-limited and a date trigger fans out to the whole audience at once)\n   * and webhook (TODO — needs endpoint allocation).\n   */\n  unrouted: { workflow: string; trigger: TriggerIR['type'] }[];\n  /**\n   * Whether the routes now point at this bundle: always for a forced deploy, false for a\n   * versioned one when a version as new or newer is already live (nothing was swapped).\n   */\n  applied: boolean;\n}\n\n/** A versioned deploy on a store that cannot tell which version is live (D1). */\nexport class UnversionedStoreError extends Error {\n  override readonly name = 'UnversionedStoreError';\n  constructor() {\n    super('this store does not record which version is live: deploy with POST /bundle/deploy');\n  }\n}\n\n/** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */\nexport class BundleIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'BundleIntegrityError';\n  }\n}\n\n/**\n * Recompute every declared contentHash and refuse the bundle if one disagrees.\n *\n * The contentHash is the address an in-flight journey reads its IR from, so\n * a hash that does not describe its own content is a way to change what a\n * pinned instance executes: submit an edited flow under the old hash and the\n * next replay picks it up. The compiler always computes the hash it ships, so\n * a mismatch means a hand-rolled payload or a stale client — neither should be\n * able to overwrite a version that journeys are running.\n *\n * Each hash is recomputed exactly the way its compiler produced it: a workflow\n * hashes its whole IR (contentHash strips itself), a segment hashes only its\n * condition. Mirroring them is load-bearing — recomputing a segment over the\n * whole record would reject every honest deploy.\n */\nfunction verifyBundleHashes(parsed: BundleIR): void {\n  const mismatched: string[] = [];\n  for (const workflow of parsed.workflows) {\n    if (semanticHash(workflow) !== workflow.contentHash) {\n      mismatched.push(`workflow '${workflow.id}'`);\n    }\n  }\n  for (const segment of parsed.segments) {\n    if (semanticHash(segment.condition) !== segment.contentHash) {\n      mismatched.push(`segment '${segment.id}'`);\n    }\n  }\n  if (mismatched.length > 0) {\n    throw new BundleIntegrityError(\n      `contentHash does not match content for ${mismatched.join(', ')} — recompile the bundle instead of editing it by hand`\n    );\n  }\n}\n\n/**\n * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed\n * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens\n * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle\n * compiled into it; without one it is forced, whatever is live.\n */\nexport async function deployBundle(\n  env: JourneyEnv,\n  bundle: unknown,\n  store: JourneyStore = d1Store(env),\n  version?: BundleVersion\n): Promise<DeployResult> {\n  if (version !== undefined && store.replaceRoutesIfNewer === undefined) {\n    throw new UnversionedStoreError();\n  }\n  const parsed = BundleIR.parse(bundle);\n  // Before any write: a bad hash must not reach the store, where it would address content it does not describe\n  verifyBundleHashes(parsed);\n  // Nor a bundle the database cannot hold: the host migrates, the engine only checks\n  const problems = (await store.checkSchema?.()) ?? [];\n  if (problems.length > 0) throw new SchemaMismatchError(problems);\n\n  for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);\n  let applied = true;\n  if (version === undefined) await store.replaceRoutes(parsed);\n  else applied = (await store.replaceRoutesIfNewer?.(parsed, version)) ?? false;\n\n  const unrouted = parsed.workflows\n    .filter((workflow) => workflow.trigger.type === 'date' || workflow.trigger.type === 'webhook')\n    .map((workflow) => ({ workflow: workflow.id, trigger: workflow.trigger.type }));\n\n  return {\n    workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),\n    unrouted,\n    applied,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,eAAe,eAAe,OAAqB,QAA+B;CAChF,IAAK,MAAM,MAAM,aAAa,MAAM,MAAO,QAAQ,MAAM,IAAI,gBAAgB,MAAM;AACrF;AAiCA,eAAsB,YACpB,KACA,OACA,QAAsB,QAAQ,GAAG,GACV;CACvB,IAAI,MAAM,MAAM,WAAW,GAAG,GAC5B,MAAM,IAAI,MAAM,eAAe,MAAM,MAAM,uCAAuC;CAIpF,MAAM,eAAe,OAAO,MAAM,MAAM;CACxC,MAAM,KAAK,MAAM,MAAM,KAAK,IAAI;CAChC,MAAM,UAAU,MAAM,WAAW,CAAC;CAIlC,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW;CAEzC,MAAM,SAAS,MAAM,MAAM,YAAY;EACrC;EACA,QAAQ,MAAM;EACd,OAAO,MAAM;EACb;EACA;CACF,CAAC;CASD,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,CAAC,MAAM,KAAK,CAAC;CAC1E,MAAM,UAAU,MAAM,uBAAuB,KAAK,OAAO;EAAE,GAAG;EAAO;CAAQ,GAAG,EAAE;CAClF,QAAQ,KAAK,GAAI,MAAM,uBAAuB,KAAK,OAAO,MAAM,QAAQ,EAAE,CAAE;CAC5E,OAAO;EAAE;EAAI;EAAQ;EAAM;CAAQ;AACrC;;;;;;AAOA,eAAsB,gBACpB,KACA,OACA,QACA,QACiB;CACjB,MAAM,0BAAU,IAAI,IAAoB;CACxC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,QAAQ,KAAK,GAC5D,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG,QAAQ,IAAI,QAAQ,KAAK;CAGvD,IAAI,OAAO;CACX,KAAK,MAAM,CAAC,QAAQ,UAAU,SAAS;EACrC,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,IAAI,QAAQ,IAAI,MAAM;EACzC,SAAS,OAAO;GAGd,IAAI,iBAAiB,uBAAuB,MAAM,MAAM,YAAY,MAAM;QACrE,QAAQ,KAAK,yBAAyB,OAAO,qBAAqB,KAAK;GAC5E;EACF;EACA,IAAI;GACF,MAAM,SAAS,UAAU;IAAE,MAAM;IAAiB,SAAS,EAAE,MAAM;GAAE,CAAC;GACtE;EACF,QAAQ,CAIR;CACF;CACA,OAAO;AACT;AAEA,eAAe,uBACb,KACA,OACA,OACA,IACmB;CACnB,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,MAAM,MAAM,aAAa,MAAM,KAAK,GAAG;EAEzD,IAAI,MAAM,UAAU,QAAQ,CAAC,aAAa,MAAM,SAAS,MAAM,KAAK,GAAG;EAGvE,IAAI,MAAM,WAAW,MAAM;GACzB,MAAM,QAAQ,IAAI,kBAAkB,OAAO,MAAM,MAAM;GACvD,IAAI,CAAE,MAAM,kBAAkB,MAAM,QAAQ,OAAO,EAAE,GAAI;EAC3D;EAEA,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,MAAM,QACN,IACA;GACE,OAAO,MAAM;GACb,SAAS,MAAM;EACjB,GACA,MAAM,OACR;EACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;CAClD;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,uBACpB,KACA,OACA,QACA,IACmB;CACnB,OAAO,gBAAgB,KAAK,OAAO,QAAQ,IAAI,MAAM,MAAM,oBAAoB,CAAC;AAClF;;;;;;;AAQA,eAAe,gBACb,KACA,OACA,QACA,IACA,QACA,WAA8B,CAAC,GAE/B,8BAAc,IAAI,IAAqC,GACpC;CACnB,MAAM,YAAY,IAAI,IACpB,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CACnC;CACA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OAAO,UAAU,IAAI,MAAM,OAAO,KAAK,CAAC;EAC9C,KAAK,KAAK;GACR,UAAU,MAAM;GAChB,MAAM,MAAM;GACZ,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;EAClE,CAAC;EACD,UAAU,IAAI,MAAM,SAAS,IAAI;CACnC;CACA,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,IAAI,kBAAkB,OAAO,MAAM;CACjD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,WAAW,kBAAkB,WAAW;EAClD,IAAI,CAAC,YAAY,IAAI,SAAS,GAC5B,YAAY,IAAI,WAAW,MAAM,MAAM,oBAAoB,SAAS,CAAC;EAEvE,MAAM,aAAa,YAAY,IAAI,SAAS;EAC5C,IAAI,eAAe,KAAA,GAAW;EAE9B,MAAM,UAAU,MAAM,kBAAkB,YAAY,OAAO,EAAE;EAC7D,MAAM,SAAS,MAAM,MAAM,gBAAgB,WAAW,MAAM;EAE5D,IAAI,WAAW,CAAC,QAEd,MAAM,MAAM,iBACV,WACA,QACA,IACA,cAAc,KAAK,UAAU,MAAM,QAAQ,CAC7C;OACK,IAAI,CAAC,WAAW,QAAQ;GAC7B,MAAM,MAAM,oBAAoB,WAAW,MAAM;GACjD;EACF;EACA,IAAI,CAAC,SAAS;EAKd,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,qBAAqB,WAAW,MAAM,CAAC;EAC3E,KAAK,MAAM,SAAS,eAAe;GACjC,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG;GAClC,IAAI;IACF,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,QACA,IACA;KAAE,OAAO;KAAkB,SAAS,EAAE,SAAS,UAAU;IAAE,GAC3D,MAAM,OACR;IACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;IAChD,MAAM,MAAM,qBAAqB,WAAW,QAAQ,MAAM,QAAQ;GACpE,SAAS,OAAO;IACd,SAAS,KAAK,KAAK;GACrB;EACF;CACF;CAEA,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CACxC,OAAO;AACT;;AAWA,MAAa,kBAAkB;;;;;;;AAQ/B,eAAsB,iBAAiB,KAAiB,OAAoC;CAC1F,IAAI;EACF,MAAM,IAAI,QAAQ,WAAW;CAC/B,SAAS,OAAO;EACd,QAAQ,MAAM,yCAAyC,KAAK;CAC9D;CAGA,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,GAC/C,IAAI;EACF,MAAM,UAAU,KAAK,QAAQ,OAAO,KAAK,IAAI,CAAC;CAChD,SAAS,OAAO;EAEd,QAAQ,MAAM,yBAAyB,OAAO,UAAU,KAAK;CAC/D;AAEJ;;;;;;;AAmBA,eAAsB,mBACpB,KACA,OACA,MACoB;CACpB,MAAM,MAAM,KAAK,OAAO,KAAK,IAAI;CACjC,MAAM,QAAQ,KAAK,SAAA;CACnB,MAAM,YAAY,MAAM,MAAM,aAAa,EAAA,CAAG,KAAK,YAAY,QAAQ,EAAE;CACzE,MAAM,SAAS,MAAM,MAAM,oBAAoB;CAE/C,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,gBAAgB,CAAC;CACrD,MAAM,SAAS,MAAM,MAAM,YAAY;EAAE,OAAO,KAAK;EAAO;CAAM,CAAC;CACnE,MAAM,aAAa,OAAO,GAAG,EAAE;CAG/B,IAAI,KAAK,UAAU,KAAA,KAAa,eAAe,KAAK,OAClD,MAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,4BAA4B;CAE7F,MAAM,QAAQ,OAAO,QAAQ,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC;CAC5D,MAAM,UAAoB,CAAC;CAC3B,MAAM,8BAAc,IAAI,IAAqC;CAC7D,KAAK,MAAM,UAAU,OACnB,IAAI;EACF,QAAQ,KACN,GAAI,MAAM,gBAAgB,KAAK,OAAO,QAAQ,KAAK,QAAQ,UAAU,WAAW,CAClF;CACF,SAAS,OAAO;EAEd,QAAQ,MAAM,kCAAkC,OAAO,UAAU,KAAK;CACxE;CAEF,OAAO;EAAE,OAAO,MAAM;EAAQ;EAAS;EAAY,MAAM,OAAO,UAAU;CAAM;AAClF;;;;;;;;;AAUA,eAAsB,cACpB,KACA,OACA,MAAM,KAAK,IAAI,GACO;CACtB,MAAM,iBAAiB,KAAK,KAAK;CACjC,IAAI,QAAQ;CACZ,MAAM,UAAoB,CAAC;CAC3B,IAAI;CACJ,SAAS;EACP,MAAM,OAAO,MAAM,mBAAmB,KAAK,OAAO;GAAE;GAAO,OAAA;GAAwB;EAAI,CAAC;EACxF,SAAS,KAAK;EACd,QAAQ,KAAK,GAAG,KAAK,OAAO;EAC5B,IAAI,CAAC,KAAK,QAAQ,KAAK,eAAe,KAAA,GAAW;EACjD,QAAQ,KAAK;CACf;CACA,MAAM,QAAS,MAAM,MAAM,WAAW,iBAAiB,GAAG,KAAM,CAAC;CACjE,OAAO;EAAE;EAAO;EAAS;CAAM;AACjC;;;;;;;AAQA,eAAe,aACb,KACA,OACA,UACA,MACA,QACA,IACA,SAEA,SACwB;CACxB,MAAM,aAAa,gBAAgB,UAAU,MAAM,QAAQ,EAAE;CAC7D,MAAM,SAAwB;EAAE,YAAY;EAAU,aAAa;EAAM;EAAQ;CAAQ;CACzF,MAAM,YAAY,MAAM,IAAI,QAAQ,OAAO;EAAE,IAAI;EAAY;EAAQ;EAAI;CAAQ,CAAC;CAElF,MAAM,UAAU,MAAM,MAAM,aAAa;EAAE;EAAU;EAAQ;EAAY;EAAM;EAAI;CAAU,CAAC;CAC9F,IAAI,YAAY,MAAM;EAGpB,MAAM,IAAI,QAAQ,SAAS;GAAE;GAAU;EAAO,CAAC;EAC/C,OAAO;CACT;CAEA,IAAI;EACF,MAAM,IAAI,QAAQ,OAAO;GAAE,IAAI;GAAY;EAAO,CAAC;CACrD,SAAS,OAAO;EAGd,IAAI,cAAc,KAAA,GAAW,MAAM;EACnC,IAAI,YAAY,aAGd,MAAM,MAAM,eAAe,YAAY,QAAQ;OAI/C,MAAM,MAAM,YAAY,UAAU;EAEpC,MAAM;CACR;CACA,OAAO;AACT;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAS,gBAAgB,UAAkB,MAAc,QAAgB,IAAoB;CAC3F,MAAM,MAAM,OAAO,QAAQ,mBAAmB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAC9D,MAAM,cAAc,QAAQ,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE;CAC5D,OAAO,GAAG,SAAS,MAAM,GAAG,EAAE,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,YAAY,GAAG,GAAG,SAAS,EAAE;AAC7F;;;;;;AAgBA,eAAsB,aACpB,KACA,QACA,OACA,QAAsB,QAAQ,GAAG,GACR;CACzB,MAAM,eAAe,OAAO,MAAM;CAClC,MAAM,KAAK,KAAK,IAAI;CAYpB,OAAO;EAAE,IAAI;EAAM,OAAO,MAXL,MAAM,aAAa,QAAQ,KAAK;EAWnB,MAAA,MARf,gBACjB,KACA,OACA,QACA,OAAO,KAAK,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAC5C;EAGwC,SAAA,MADlB,uBAAuB,KAAK,OAAO,QAAQ,EAAE;CACnB;AAClD;;;;;;AAcA,eAAsB,eACpB,KACA,QACA,QAAsB,QAAQ,GAAG,GACI;CACrC,MAAM,eAAe,OAAO,OAAO,MAAM;CACzC,MAAM,WAAW,MAAM,MAAM,aAAa,OAAO,KAAK;CACtD,MAAM,MAAM,aAAa;EAAE,GAAG;EAAQ,IAAI,OAAO,MAAM,KAAK,IAAI;CAAE,CAAC;CACnE,IAAI,OAAO,MAAM,gBAAgB,KAAK,OAAO,OAAO,QAAQ,CAAC,qBAAqB,CAAC;CACnF,IAAI,aAAa,KAAA,KAAa,aAAa,OAAO,QAChD,QAAQ,MAAM,gBAAgB,KAAK,OAAO,UAAU,CAAC,qBAAqB,CAAC;CAE7E,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;AAGA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAY;CAAW;AAAY,CAAC;;;;;;;;;;;AAYtE,eAAe,aAAa,KAAiB,YAAsC;CACjF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,IAAI,QAAQ,IAAI,UAAU;CAC7C,SAAS,OAAO;EACd,IAAI,iBAAiB,uBAAuB,OAAO;EACnD,QAAQ,KAAK,yBAAyB,WAAW,qBAAqB,KAAK;EAC3E,OAAO;CACT;CACA,IAAI,SAAS,cAAc,KAAA,GAAW,OAAO;CAC7C,IAAI;EACF,MAAM,SAAS,UAAU;EACzB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9D,IAAI,WAAW,KAAA,KAAa,iBAAiB,IAAI,OAAO,MAAM,GAAG,OAAO;EACxE,QAAQ,KAAK,0BAA0B,WAAW,UAAU,KAAK;EACjE,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAe,UACb,KACA,QACA,OACA,KACiD;CACjD,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,EAAE,YAAY,cAAc,MAAM,MAAM,iBAAiB,MAAM,GAAG;EAC3E,IAAI,CAAC,UAAU;EACf,IAAI,CAAE,MAAM,aAAa,KAAK,UAAU,GAAI,QAAQ,KAAK,UAAU;CACrE;CACA,IAAI,QAAQ,SAAS,GAAG,OAAO;EAAE,QAAQ;EAAO;CAAQ;CACxD,MAAM,MAAM,WAAW,QAAQ,GAAG;CAClC,OAAO;EAAE,QAAQ;EAAM;CAAQ;AACjC;;;;;;;;;;AAWA,eAAsB,WACpB,KACA,QACA,QAAsB,QAAQ,GAAG,GACjC,MAAM,KAAK,IAAI,GAC4C;CAC3D,MAAM,MAAM,eAAe,QAAQ,GAAG;CACtC,OAAO;EAAE,IAAI;EAAM,GAAI,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG;CAAG;AACnE;;;;;;AAOA,eAAsB,aACpB,KACA,OACA,QAAsB,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAO,CAAC,qBAAqB,CAAC;CACpE;AAC1B;;AAGA,eAAsB,aACpB,KACA,OACA,QAAsB,QAAQ,GAAG,GACI;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAO,CAAC,qBAAqB,CAAC;CACpE;AAC1B;;AAsBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,OAAyB;CACzB,cAAc;EACZ,MAAM,mFAAmF;CAC3F;AACF;;AAGA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,mBAAmB,QAAwB;CAClD,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,YAAY,OAAO,WAC5B,IAAI,aAAa,QAAQ,MAAM,SAAS,aACtC,WAAW,KAAK,aAAa,SAAS,GAAG,EAAE;CAG/C,KAAK,MAAM,WAAW,OAAO,UAC3B,IAAI,aAAa,QAAQ,SAAS,MAAM,QAAQ,aAC9C,WAAW,KAAK,YAAY,QAAQ,GAAG,EAAE;CAG7C,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,qBACR,0CAA0C,WAAW,KAAK,IAAI,EAAE,sDAClE;AAEJ;;;;;;;AAQA,eAAsB,aACpB,KACA,QACA,QAAsB,QAAQ,GAAG,GACjC,SACuB;CACvB,IAAI,YAAY,KAAA,KAAa,MAAM,yBAAyB,KAAA,GAC1D,MAAM,IAAI,sBAAsB;CAElC,MAAM,SAAS,SAAS,MAAM,MAAM;CAEpC,mBAAmB,MAAM;CAEzB,MAAM,WAAY,MAAM,MAAM,cAAc,KAAM,CAAC;CACnD,IAAI,SAAS,SAAS,GAAG,MAAM,IAAI,oBAAoB,QAAQ;CAE/D,KAAK,MAAM,YAAY,OAAO,WAAW,MAAM,MAAM,cAAc,QAAQ;CAC3E,IAAI,UAAU;CACd,IAAI,YAAY,KAAA,GAAW,MAAM,MAAM,cAAc,MAAM;MACtD,UAAW,MAAM,MAAM,uBAAuB,QAAQ,OAAO,KAAM;CAExE,MAAM,WAAW,OAAO,UACrB,QAAQ,aAAa,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ,SAAS,SAAS,CAAC,CAC7F,KAAK,cAAc;EAAE,UAAU,SAAS;EAAI,SAAS,SAAS,QAAQ;CAAK,EAAE;CAEhF,OAAO;EACL,WAAW,OAAO,UAAU,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,GAAG;EAC7E;EACA;CACF;AACF"}