@shware/workflow 3.3.0 → 4.0.0

package/dist/aws/instances.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"instances.mjs","names":[],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../cloudflare/bindings';\nimport { murmur3 } from '../engine/bucket';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * The durable execution name for one start of an instance: the instance id, cut to fit, with a\n * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's\n * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.\n */\nexport function executionName(instanceId: string, attempt: string): string {\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const token = attempt.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8);\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  const suffix = `-${fingerprint}-${token}`;\n  return `${safe.slice(0, 64 - suffix.length)}${suffix}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /**\n   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is\n   * the code version whose routes named it.\n   */\n  target(contentHash: string, version?: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  /**\n   * How long after a stop an invocation already running may still act: Lambda cannot interrupt\n   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.\n   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.\n   */\n  stopDrainMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n  private readonly stopDrainMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n    this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;\n  }\n\n  /**\n   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed\n   * under the same instance id (an event replayed with its ts) must start a new execution — the\n   * old name would return the closed one. Retries of this attempt reuse the recorded name.\n   */\n  async plan(options: {\n    id: string;\n    params: JourneyParams;\n    ts: number;\n    version?: string | undefined;\n  }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id, crypto.randomUUID().slice(0, 8)),\n      target: await this.options.target(options.params.contentHash, options.version),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  /** Stopped so recently that an invocation running at the time may still be acting. */\n  private draining(record: ExecutionRecord): boolean {\n    return record.stoppedAt !== undefined && this.now() - record.stoppedAt < this.stopDrainMs;\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        // Stopped before: done once an invocation that was running then has had time to end\n        if (record.stoppedAt !== undefined) {\n          if (this.draining(record)) {\n            throw new Error(`${id} was stopped; its running invocation may still be finishing`);\n          }\n          return;\n        }\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        // One that finished on its own has no invocation left to drain\n        const state = await lambda.executionState(arn);\n        if (state === 'succeeded' || state === 'failed' || state === 'timed_out') return;\n        if (!(await lambda.stopExecution(arn))) throw new Error(`stopping ${id} failed`);\n        // A stop does not interrupt an invocation already running: it goes on to its next\n        // checkpoint, side effects included. The erasure waits (see stopDrainMs)\n        await executions.markStopped(id, this.now());\n        throw new Error(`${id} is stopped; its running invocation may still be finishing`);\n      },\n      status: async () => {\n        const record = await current();\n        if (this.draining(record)) return { status: 'running' };\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAgB,cAAc,YAAoB,SAAyB;CACzE,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;CAE7D,MAAM,SAAS,IAAI,GADI,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE,IAChG,GAAG;CAClC,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO,MAAM,IAAI;AAChD;AA4BA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAM1B;CAL7B;CACA;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;EACzD,KAAK,cAAc,QAAQ,eAAe,KAAK;CACjD;;;;;;CAOA,MAAM,KAAK,SAKiB;EAC1B,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,IAAI,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;GAC/D,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,aAAa,QAAQ,OAAO;GAC7E,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAI,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;;CAGA,SAAiB,QAAkC;EACjD,OAAO,OAAO,cAAc,KAAA,KAAa,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAChF;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAET,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAE7B,IAAI,OAAO,cAAc,KAAA,GAAW;KAClC,IAAI,KAAK,SAAS,MAAM,GACtB,MAAM,IAAI,MAAM,GAAG,GAAG,4DAA4D;KAEpF;IACF;IACA,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IAEA,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAC7C,IAAI,UAAU,eAAe,UAAU,YAAY,UAAU,aAAa;IAC1E,IAAI,CAAE,MAAM,OAAO,cAAc,GAAG,GAAI,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;IAG/E,MAAM,WAAW,YAAY,IAAI,KAAK,IAAI,CAAC;IAC3C,MAAM,IAAI,MAAM,GAAG,GAAG,2DAA2D;GACnF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,QAAQ,UAAU;IACtD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}
+{"version":3,"file":"instances.mjs","names":[],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import { murmur3 } from '../engine/bucket';\nimport {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../host/platform';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * The durable execution name for one start of an instance: the instance id, cut to fit, with a\n * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's\n * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.\n */\nexport function executionName(instanceId: string, attempt: string): string {\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const token = attempt.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8);\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  const suffix = `-${fingerprint}-${token}`;\n  return `${safe.slice(0, 64 - suffix.length)}${suffix}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /**\n   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is\n   * the code version whose routes named it.\n   */\n  target(contentHash: string, version?: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  /**\n   * How long after a stop an invocation already running may still act: Lambda cannot interrupt\n   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.\n   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.\n   */\n  stopDrainMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n  private readonly stopDrainMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n    this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;\n  }\n\n  /**\n   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed\n   * under the same instance id (an event replayed with its ts) must start a new execution — the\n   * old name would return the closed one. Retries of this attempt reuse the recorded name.\n   */\n  async plan(options: {\n    id: string;\n    params: JourneyParams;\n    ts: number;\n    version?: string | undefined;\n  }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id, crypto.randomUUID().slice(0, 8)),\n      target: await this.options.target(options.params.contentHash, options.version),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  /** Stopped so recently that an invocation running at the time may still be acting. */\n  private draining(record: ExecutionRecord): boolean {\n    return record.stoppedAt !== undefined && this.now() - record.stoppedAt < this.stopDrainMs;\n  }\n\n  /**\n   * The one judgment every path makes of an execution the platform reports stopped — by\n   * `terminate`, by an operator, or seen by `reconcile` before the stop was recorded: the first\n   * sighting is recorded (`markStopped` keeps an earlier time, so no poll ever extends the\n   * drain), and the record is read again so the verdict rests on what is committed now, not on\n   * the snapshot a caller read before its API calls. A write or read that fails throws: an\n   * unknown stop time is never taken for \"safely stopped\". Undefined means the record is gone —\n   * the erasure finished with it meanwhile.\n   */\n  private async observeStop(instanceId: string): Promise<ExecutionRecord | undefined> {\n    await this.options.executions.markStopped(instanceId, this.now());\n    return this.options.executions.get(instanceId);\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // The verdict is taken on the record as it is now: `toReconcile` handed over a snapshot,\n      // and a stop may have been recorded since — by `terminate`, or here, at its first sighting\n      const fresh =\n        state === 'stopped'\n          ? await this.observeStop(record.instanceId)\n          : await this.options.executions.get(record.instanceId);\n      if (fresh === undefined) return;\n      if (this.draining(fresh)) {\n        // Stopped, but an invocation running at the stop may still be acting: the entry stays\n        // running until the drain has passed, so an erasure keeps waiting for it (`status`\n        // says running too), and the next look finalizes it\n        await this.options.executions.markChecked(record.instanceId, now);\n        return;\n      }\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        // Stopped before: done once an invocation that was running then has had time to end\n        if (record.stoppedAt !== undefined) {\n          if (this.draining(record)) {\n            throw new Error(`${id} was stopped; its running invocation may still be finishing`);\n          }\n          return;\n        }\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        // One that finished on its own has no invocation left to drain\n        const state = await lambda.executionState(arn);\n        if (state === 'succeeded' || state === 'failed' || state === 'timed_out') return;\n        // A stop does not interrupt an invocation already running: it goes on to its next\n        // checkpoint, side effects included. The erasure waits (see stopDrainMs). One already\n        // stopped (by an operator, or a stop whose record did not land) is not stopped again:\n        // its first sighting is recorded and the same drain judged\n        if (state !== 'stopped' && !(await lambda.stopExecution(arn))) {\n          throw new Error(`stopping ${id} failed`);\n        }\n        const fresh = await this.observeStop(id);\n        if (fresh !== undefined && this.draining(fresh)) {\n          throw new Error(`${id} is stopped; its running invocation may still be finishing`);\n        }\n      },\n      status: async () => {\n        const record = await current();\n        if (this.draining(record)) return { status: 'running' };\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        if (state === 'stopped') {\n          // Stopped, seen here first or recorded since this read: the drain is the judgment\n          const fresh = await this.observeStop(id);\n          if (fresh !== undefined && this.draining(fresh)) return { status: 'running' };\n        }\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAgB,cAAc,YAAoB,SAAyB;CACzE,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;CAE7D,MAAM,SAAS,IAAI,GADI,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE,IAChG,GAAG;CAClC,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO,MAAM,IAAI;AAChD;AA4BA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAM1B;CAL7B;CACA;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;EACzD,KAAK,cAAc,QAAQ,eAAe,KAAK;CACjD;;;;;;CAOA,MAAM,KAAK,SAKiB;EAC1B,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,IAAI,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;GAC/D,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,aAAa,QAAQ,OAAO;GAC7E,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAI,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;;CAGA,SAAiB,QAAkC;EACjD,OAAO,OAAO,cAAc,KAAA,KAAa,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAChF;;;;;;;;;;CAWA,MAAc,YAAY,YAA0D;EAClF,MAAM,KAAK,QAAQ,WAAW,YAAY,YAAY,KAAK,IAAI,CAAC;EAChE,OAAO,KAAK,QAAQ,WAAW,IAAI,UAAU;CAC/C;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAGT,MAAM,QACJ,UAAU,YACN,MAAM,KAAK,YAAY,OAAO,UAAU,IACxC,MAAM,KAAK,QAAQ,WAAW,IAAI,OAAO,UAAU;GACzD,IAAI,UAAU,KAAA,GAAW;GACzB,IAAI,KAAK,SAAS,KAAK,GAAG;IAIxB,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;IAChE;GACF;GAEA,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAE7B,IAAI,OAAO,cAAc,KAAA,GAAW;KAClC,IAAI,KAAK,SAAS,MAAM,GACtB,MAAM,IAAI,MAAM,GAAG,GAAG,4DAA4D;KAEpF;IACF;IACA,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IAEA,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAC7C,IAAI,UAAU,eAAe,UAAU,YAAY,UAAU,aAAa;IAK1E,IAAI,UAAU,aAAa,CAAE,MAAM,OAAO,cAAc,GAAG,GACzD,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;IAEzC,MAAM,QAAQ,MAAM,KAAK,YAAY,EAAE;IACvC,IAAI,UAAU,KAAA,KAAa,KAAK,SAAS,KAAK,GAC5C,MAAM,IAAI,MAAM,GAAG,GAAG,2DAA2D;GAErF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,QAAQ,UAAU;IACtD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,IAAI,UAAU,WAAW;KAEvB,MAAM,QAAQ,MAAM,KAAK,YAAY,EAAE;KACvC,IAAI,UAAU,KAAA,KAAa,KAAK,SAAS,KAAK,GAAG,OAAO,EAAE,QAAQ,UAAU;IAC9E;IACA,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}

package/dist/client.cjs

@@ -69,9 +69,12 @@ var JourneyClient = class {
 	* reports as gone is dropped — and journeys waiting on `reachable('push')` wake.
 	*/
 	registerDevice(userId, device) {
+		const { token, platform, ts } = device;
 		return this.post("/devices", {
 			userId,
-			...device
+			token,
+			platform,
+			...ts === void 0 ? {} : { ts }
 		});
 	}
 	/**

package/dist/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { DeployResult, IdentifyResult, IngestResult } from './cloudflare';\nimport type { Contract, ContractIssue, ProfilePatch } from './contract';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web' }\n  ): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices', { userId, ...device });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private async post<T>(path: string, body: unknown): Promise<T> {\n    const headers: Record<string, string> = { 'content-type': 'application/json' };\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n"],"mappings":";;AA0BA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAuBA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,OAAO,KAAK,KAAK,YAAY;GAAE;GAAQ,GAAG;EAAO,CAAC;CACpD;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,MAAc,KAAQ,MAAc,MAA2B;EAC7D,MAAM,UAAkC,EAAE,gBAAgB,mBAAmB;EAC7E,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF"}
+{"version":3,"file":"client.cjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch } from './contract';\nimport type { DeployResult, IdentifyResult, IngestResult } from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private async post<T>(path: string, body: unknown): Promise<T> {\n    const headers: Record<string, string> = { 'content-type': 'application/json' };\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n"],"mappings":";;AA0BA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAuBA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,MAAc,KAAQ,MAAc,MAA2B;EAC7D,MAAM,UAAkC,EAAE,gBAAgB,mBAAmB;EAC7E,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF"}

package/dist/client.d.cts

@@ -1,7 +1,6 @@
 import { ProfileProps } from "./store/index.cjs";
 import { Contract, ContractIssue, ProfilePatch } from "./contract.cjs";
-import { DeployResult, IdentifyResult, IngestResult } from "./host/router.cjs";
-import "./cloudflare/index.cjs";
+import { DeployResult, IdentifyResult, IngestResult } from "./host/ingest.cjs";
 import * as core from "zod/v4/core";
 //#region src/client.d.ts
 /**
@@ -67,6 +66,7 @@ export declare class JourneyClient<C extends Contract | undefined = undefined> {
   registerDevice(userId: string, device: {
     token: string;
     platform: 'ios' | 'android' | 'web';
+    ts?: number;
   }): Promise<{
     ok: true;
     woke: number;

package/dist/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;;;iBAYiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;iBAGF;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;MACxB;IAAU;IAAU;;;;;;EAQvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,OAAO,kBAAkB,QAAQ;UAInB"}
+{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;;iBAYiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;iBAGF;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,OAAO,kBAAkB,QAAQ;UAInB"}

package/dist/client.d.mts

@@ -1,7 +1,6 @@
 import { ProfileProps } from "./store/index.mjs";
 import { Contract, ContractIssue, ProfilePatch } from "./contract.mjs";
-import { DeployResult, IdentifyResult, IngestResult } from "./host/router.mjs";
-import "./cloudflare/index.mjs";
+import { DeployResult, IdentifyResult, IngestResult } from "./host/ingest.mjs";
 import * as core from "zod/v4/core";
 //#region src/client.d.ts
 /**
@@ -67,6 +66,7 @@ export declare class JourneyClient<C extends Contract | undefined = undefined> {
   registerDevice(userId: string, device: {
     token: string;
     platform: 'ios' | 'android' | 'web';
+    ts?: number;
   }): Promise<{
     ok: true;
     woke: number;

package/dist/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;;;iBAYiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;iBAGF;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;MACxB;IAAU;IAAU;;;;;;EAQvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,OAAO,kBAAkB,QAAQ;UAInB"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;;iBAYiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;iBAGF;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,OAAO,kBAAkB,QAAQ;UAInB"}

package/dist/client.mjs

@@ -68,9 +68,12 @@ var JourneyClient = class {
 	* reports as gone is dropped — and journeys waiting on `reachable('push')` wake.
 	*/
 	registerDevice(userId, device) {
+		const { token, platform, ts } = device;
 		return this.post("/devices", {
 			userId,
-			...device
+			token,
+			platform,
+			...ts === void 0 ? {} : { ts }
 		});
 	}
 	/**

package/dist/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { DeployResult, IdentifyResult, IngestResult } from './cloudflare';\nimport type { Contract, ContractIssue, ProfilePatch } from './contract';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web' }\n  ): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices', { userId, ...device });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private async post<T>(path: string, body: unknown): Promise<T> {\n    const headers: Record<string, string> = { 'content-type': 'application/json' };\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n"],"mappings":";AA0BA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAuBA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,OAAO,KAAK,KAAK,YAAY;GAAE;GAAQ,GAAG;EAAO,CAAC;CACpD;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,MAAc,KAAQ,MAAc,MAA2B;EAC7D,MAAM,UAAkC,EAAE,gBAAgB,mBAAmB;EAC7E,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch } from './contract';\nimport type { DeployResult, IdentifyResult, IngestResult } from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private async post<T>(path: string, body: unknown): Promise<T> {\n    const headers: Record<string, string> = { 'content-type': 'application/json' };\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n"],"mappings":";AA0BA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAuBA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,MAAc,KAAQ,MAAc,MAA2B;EAC7D,MAAM,UAAkC,EAAE,gBAAgB,mBAAmB;EAC7E,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF"}

package/dist/cloudflare/bindings.cjs

@@ -1,24 +1,26 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_host_platform = require("../host/platform.cjs");
 //#region src/cloudflare/bindings.ts
-/** The runtime does not know the instance: the only failure that lets the router drop its wakes. */
-var InstanceNotFoundError = class extends Error {
-	instanceId;
-	name = "InstanceNotFoundError";
-	constructor(instanceId) {
-		super(`no such instance: ${instanceId}`);
-		this.instanceId = instanceId;
-	}
-};
+/** How Cloudflare's `get` reports an unknown instance id. */
+const CF_NOT_FOUND = "instance.not_found";
 /**
-* Does this lookup failure say the instance is gone, rather than that the lookup failed?
-* Cloudflare reports an unknown id as `instance.not_found`.
+* The Workflow binding as the host's runtime port: `get` answers an unknown id with
+* `InstanceNotFoundError`, as the port promises, instead of Cloudflare's own error. Everything
+* else is forwarded as is.
 */
-function isInstanceNotFound(error) {
-	if (error instanceof InstanceNotFoundError) return true;
-	return /not[_ ]found|no such instance/i.test(String(error));
+function cloudflareJourneyBinding(binding) {
+	return {
+		create: (options) => binding.create(options),
+		async get(id) {
+			try {
+				return await binding.get(id);
+			} catch (error) {
+				if (String(error).includes(CF_NOT_FOUND)) throw new require_host_platform.InstanceNotFoundError(id, { cause: error });
+				throw error;
+			}
+		}
+	};
 }
-/** The event type the router uses to wake waiting instances (sendEvent's `type`). */
-const WAKE_EVENT_TYPE = "wake";
 /**
 * Slack on the deadline when deciding whether a thrown wait was a timeout: the
 * platform may surface the expiry a moment early, and a wait shorter than this
@@ -29,19 +31,20 @@ const WAKE_TIMEOUT_TOLERANCE_MS = 5e3;
 * Did a wait that threw actually reach its deadline?
 *
 * CF signals a wait timeout by throwing, and so does every other failure in
-* there — a broken binding, an evicted instance, a malformed timeout. The
-* adapter used to read them all as timeouts, which made an infrastructure
-* fault indistinguishable from "the user never did it": the journey took its
-* onTimeout branch, early and silently. Only the clock can tell them apart.
+* there — a broken binding, an evicted instance, a malformed timeout. Reading
+* them all as timeouts would make an infrastructure fault indistinguishable
+* from "the user never did it" (the journey would take its onTimeout branch,
+* early and silently). Only the clock can tell them apart, and only against
+* the absolute deadline: measured from when the wait was parked, a replay
+* after an eviction would start the measure over and read a
+* genuine expiry as a failure.
 */
-function wakeExpired(startedAt, timeoutMs, now) {
-	return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);
+function wakeExpired(deadlineMs, now) {
+	return now >= deadlineMs - WAKE_TIMEOUT_TOLERANCE_MS;
 }
 //#endregion
-exports.InstanceNotFoundError = InstanceNotFoundError;
-exports.WAKE_EVENT_TYPE = WAKE_EVENT_TYPE;
 exports.WAKE_TIMEOUT_TOLERANCE_MS = WAKE_TIMEOUT_TOLERANCE_MS;
-exports.isInstanceNotFound = isInstanceNotFound;
+exports.cloudflareJourneyBinding = cloudflareJourneyBinding;
 exports.wakeExpired = wakeExpired;
 
 //# sourceMappingURL=bindings.cjs.map

package/dist/cloudflare/bindings.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.cjs","names":[],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../email';\nimport type { ExecutionStart } from '../store/index';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\nexport interface KVNamespaceLike {\n  get(key: string): Promise<string | null>;\n  put(key: string, value: string): Promise<void>;\n}\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\nexport interface WorkflowInstanceLike {\n  id: string;\n  sendEvent(event: { type: string; payload?: unknown }): Promise<void>;\n  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */\n  terminate?(): Promise<void>;\n  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */\n  status?(): Promise<{ status: string }>;\n}\n\n/**\n * How the router starts, wakes and stops instances: Cloudflare's workflow binding, or the AWS\n * adapter's equivalent over durable executions.\n */\nexport interface WorkflowBindingLike {\n  create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike>;\n  get(id: string): Promise<WorkflowInstanceLike>;\n  /**\n   * For a runtime whose start is a submit that can be lost in flight (AWS): the start to record\n   * with the entry, in one transaction. A failed `create` then keeps the entry — its recorded\n   * start is retried by the next ingest for the pair (`resume`) or by maintenance, never rolled\n   * back and re-entered as a second execution.\n   */\n  plan?(options: {\n    id: string;\n    params: JourneyParams;\n    ts: number;\n    /** The code version whose routes named `params.contentHash` (absent after a forced deploy). */\n    version?: string | undefined;\n  }): Promise<ExecutionStart>;\n  /** Retry the recorded, unconfirmed start of the (workflow, user) entry still running, if any. */\n  resume?(entry: { workflow: string; userId: string }): Promise<void>;\n  /**\n   * Maintenance the sweep runs first: old unconfirmed starts retried (or given up on), and\n   * executions the platform ended on its own (timeout, stop, crash) reconciled into the ledger.\n   */\n  maintain?(): Promise<void>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** List-Unsubscribe and List-Unsubscribe-Post, when the email has an unsubscribe link. */\n    headers?: Readonly<Record<string, string>>;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Every binding the journey engine needs (names match the wrangler config). */\nexport interface JourneyEnv {\n  /**\n   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:\n   * a Worker on another JourneyStore (Postgres, say) does not declare it.\n   */\n  WORKFLOW_KV?: KVNamespaceLike;\n  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */\n  DB?: D1DatabaseLike;\n  /** JourneyRunner's workflow binding (creating instances and waking them). */\n  JOURNEY: WorkflowBindingLike;\n  /** Optional message-delivery webhook (defaults to the console logging sender). */\n  MESSAGE_WEBHOOK_URL?: string;\n  /**\n   * Bearer token required on every mutating HTTP endpoint (`Authorization:\n   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in\n   * particular rewrites the whole routing table, so production must set this.\n   */\n  API_TOKEN?: string;\n  /**\n   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'\n   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.\n   */\n  WORKFLOW_ORIGIN?: string;\n  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */\n  ENVIRONMENT?: string;\n  /** Cloudflare Email Sending, when the config has `emails`. */\n  EMAIL?: EmailBindingLike;\n  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */\n  APNS_PRIVATE_KEY_BASE64?: string;\n  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */\n  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;\n  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */\n  VAPID_PUBLIC_KEY?: string;\n  VAPID_PRIVATE_KEY?: string;\n  /**\n   * Cloudflare's version metadata binding (wrangler `\"version_metadata\": { \"binding\":\n   * \"CF_VERSION_METADATA\" }`). With it, and a store that records the live version (Postgres),\n   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler\n   * deploy` is the whole deploy.\n   */\n  CF_VERSION_METADATA?: { id: string; tag?: string; timestamp: string };\n  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */\n  APNS_RELAY_ORIGIN?: string;\n}\n\n/** The runtime does not know the instance: the only failure that lets the router drop its wakes. */\nexport class InstanceNotFoundError extends Error {\n  override readonly name = 'InstanceNotFoundError';\n  constructor(readonly instanceId: string) {\n    super(`no such instance: ${instanceId}`);\n  }\n}\n\n/**\n * Does this lookup failure say the instance is gone, rather than that the lookup failed?\n * Cloudflare reports an unknown id as `instance.not_found`.\n */\nexport function isInstanceNotFound(error: unknown): boolean {\n  if (error instanceof InstanceNotFoundError) return true;\n  return /not[_ ]found|no such instance/i.test(String(error));\n}\n\n/** The event type the router uses to wake waiting instances (sendEvent's `type`). */\nexport const WAKE_EVENT_TYPE = 'wake';\n\n/** Journey instance parameters, passed by the ingest router when it creates one. */\nexport interface JourneyParams {\n  workflowId: string;\n  /** The IR version pinned at entry. */\n  contentHash: string;\n  userId: string;\n  trigger: { event: string; payload: Record<string, unknown> };\n  [key: string]: unknown;\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. The\n * adapter used to read them all as timeouts, which made an infrastructure\n * fault indistinguishable from \"the user never did it\": the journey took its\n * onTimeout branch, early and silently. Only the clock can tell them apart.\n */\nexport function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean {\n  return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);\n}\n"],"mappings":";;;AAgJA,IAAa,wBAAb,cAA2C,MAAM;CAE1B;CADrB,OAAyB;CACzB,YAAY,YAA6B;EACvC,MAAM,qBAAqB,YAAY;EADpB,KAAA,aAAA;CAErB;AACF;;;;;AAMA,SAAgB,mBAAmB,OAAyB;CAC1D,IAAI,iBAAiB,uBAAuB,OAAO;CACnD,OAAO,iCAAiC,KAAK,OAAO,KAAK,CAAC;AAC5D;;AAGA,MAAa,kBAAkB;;;;;;AAiB/B,MAAa,4BAA4B;;;;;;;;;;AAWzC,SAAgB,YAAY,WAAmB,WAAmB,KAAsB;CACtF,OAAO,MAAM,aAAa,KAAK,IAAI,GAAG,YAAY,yBAAyB;AAC7E"}
+{"version":3,"file":"bindings.cjs","names":["InstanceNotFoundError"],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../email';\nimport { InstanceNotFoundError, type WorkflowBindingLike } from '../host/platform';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** List-Unsubscribe and List-Unsubscribe-Post, when the email has an unsubscribe link. */\n    headers?: Readonly<Record<string, string>>;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Cloudflare's Workflow binding, as far as the host uses it. */\nexport type CfWorkflowBinding = Pick<WorkflowBindingLike, 'create' | 'get'>;\n\n/** How Cloudflare's `get` reports an unknown instance id. */\nconst CF_NOT_FOUND = 'instance.not_found';\n\n/**\n * The Workflow binding as the host's runtime port: `get` answers an unknown id with\n * `InstanceNotFoundError`, as the port promises, instead of Cloudflare's own error. Everything\n * else is forwarded as is.\n */\nexport function cloudflareJourneyBinding(binding: CfWorkflowBinding): WorkflowBindingLike {\n  return {\n    create: (options) => binding.create(options),\n    async get(id) {\n      try {\n        return await binding.get(id);\n      } catch (error) {\n        if (String(error).includes(CF_NOT_FOUND)) {\n          throw new InstanceNotFoundError(id, { cause: error });\n        }\n        throw error;\n      }\n    },\n  };\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. Reading\n * them all as timeouts would make an infrastructure fault indistinguishable\n * from \"the user never did it\" (the journey would take its onTimeout branch,\n * early and silently). Only the clock can tell them apart, and only against\n * the absolute deadline: measured from when the wait was parked, a replay\n * after an eviction would start the measure over and read a\n * genuine expiry as a failure.\n */\nexport function wakeExpired(deadlineMs: number, now: number): boolean {\n  return now >= deadlineMs - WAKE_TIMEOUT_TOLERANCE_MS;\n}\n"],"mappings":";;;;AA0DA,MAAM,eAAe;;;;;;AAOrB,SAAgB,yBAAyB,SAAiD;CACxF,OAAO;EACL,SAAS,YAAY,QAAQ,OAAO,OAAO;EAC3C,MAAM,IAAI,IAAI;GACZ,IAAI;IACF,OAAO,MAAM,QAAQ,IAAI,EAAE;GAC7B,SAAS,OAAO;IACd,IAAI,OAAO,KAAK,CAAC,CAAC,SAAS,YAAY,GACrC,MAAM,IAAIA,sBAAAA,sBAAsB,IAAI,EAAE,OAAO,MAAM,CAAC;IAEtD,MAAM;GACR;EACF;CACF;AACF;;;;;;AAOA,MAAa,4BAA4B;;;;;;;;;;;;;AAczC,SAAgB,YAAY,YAAoB,KAAsB;CACpE,OAAO,OAAO,aAAa;AAC7B"}

package/dist/cloudflare/bindings.d.cts

@@ -1,5 +1,5 @@
 import { EmailAddress } from "../email.cjs";
-import { ExecutionStart } from "../store/index.cjs";
+import { WorkflowBindingLike } from "../host/platform.cjs";
 //#region src/cloudflare/bindings.d.ts
 /**
  * A minimal structural interface over the Cloudflare bindings.
@@ -9,10 +9,6 @@ import { ExecutionStart } from "../store/index.cjs";
  * subset plus the ambient cloudflare:workers declaration is enough to compile,
  * and the real bindings satisfy it structurally at runtime.
  */
-export interface KVNamespaceLike {
-  get(key: string): Promise<string | null>;
-  put(key: string, value: string): Promise<void>;
-}
 /** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */
 export interface D1RunResultLike {
   meta?: {
@@ -32,53 +28,6 @@ export interface D1DatabaseLike {
   /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */
   batch(statements: D1PreparedStatementLike[]): Promise<unknown>;
 }
-export interface WorkflowInstanceLike {
-  id: string;
-  sendEvent(event: {
-    type: string;
-    payload?: unknown;
-  }): Promise<void>;
-  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */
-  terminate?(): Promise<void>;
-  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */
-  status?(): Promise<{
-    status: string;
-  }>;
-}
-/**
- * How the router starts, wakes and stops instances: Cloudflare's workflow binding, or the AWS
- * adapter's equivalent over durable executions.
- */
-export interface WorkflowBindingLike {
-  create(options: {
-    id: string;
-    params: unknown;
-  }): Promise<WorkflowInstanceLike>;
-  get(id: string): Promise<WorkflowInstanceLike>;
-  /**
-   * For a runtime whose start is a submit that can be lost in flight (AWS): the start to record
-   * with the entry, in one transaction. A failed `create` then keeps the entry — its recorded
-   * start is retried by the next ingest for the pair (`resume`) or by maintenance, never rolled
-   * back and re-entered as a second execution.
-   */
-  plan?(options: {
-    id: string;
-    params: JourneyParams;
-    ts: number;
-    /** The code version whose routes named `params.contentHash` (absent after a forced deploy). */
-    version?: string | undefined;
-  }): Promise<ExecutionStart>;
-  /** Retry the recorded, unconfirmed start of the (workflow, user) entry still running, if any. */
-  resume?(entry: {
-    workflow: string;
-    userId: string;
-  }): Promise<void>;
-  /**
-   * Maintenance the sweep runs first: old unconfirmed starts retried (or given up on), and
-   * executions the platform ended on its own (timeout, stop, crash) reconciled into the ledger.
-   */
-  maintain?(): Promise<void>;
-}
 /**
  * Cloudflare Email Service's send_email binding (structural subset).
  *
@@ -102,80 +51,14 @@ export interface EmailBindingLike {
     idempotencyKey: string;
   }): Promise<unknown>;
 }
-/** Every binding the journey engine needs (names match the wrangler config). */
-export interface JourneyEnv {
-  /**
-   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:
-   * a Worker on another JourneyStore (Postgres, say) does not declare it.
-   */
-  WORKFLOW_KV?: KVNamespaceLike;
-  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */
-  DB?: D1DatabaseLike;
-  /** JourneyRunner's workflow binding (creating instances and waking them). */
-  JOURNEY: WorkflowBindingLike;
-  /** Optional message-delivery webhook (defaults to the console logging sender). */
-  MESSAGE_WEBHOOK_URL?: string;
-  /**
-   * Bearer token required on every mutating HTTP endpoint (`Authorization:
-   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in
-   * particular rewrites the whole routing table, so production must set this.
-   */
-  API_TOKEN?: string;
-  /**
-   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'
-   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.
-   */
-  WORKFLOW_ORIGIN?: string;
-  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */
-  ENVIRONMENT?: string;
-  /** Cloudflare Email Sending, when the config has `emails`. */
-  EMAIL?: EmailBindingLike;
-  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */
-  APNS_PRIVATE_KEY_BASE64?: string;
-  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */
-  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;
-  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */
-  VAPID_PUBLIC_KEY?: string;
-  VAPID_PRIVATE_KEY?: string;
-  /**
-   * Cloudflare's version metadata binding (wrangler `"version_metadata": { "binding":
-   * "CF_VERSION_METADATA" }`). With it, and a store that records the live version (Postgres),
-   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler
-   * deploy` is the whole deploy.
-   */
-  CF_VERSION_METADATA?: {
-    id: string;
-    tag?: string;
-    timestamp: string;
-  };
-  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */
-  APNS_RELAY_ORIGIN?: string;
-}
-/** The runtime does not know the instance: the only failure that lets the router drop its wakes. */
-export declare class InstanceNotFoundError extends Error {
-  readonly instanceId: string;
-  readonly name = "InstanceNotFoundError";
-  constructor(instanceId: string);
-}
+/** Cloudflare's Workflow binding, as far as the host uses it. */
+export type CfWorkflowBinding = Pick<WorkflowBindingLike, 'create' | 'get'>;
 /**
- * Does this lookup failure say the instance is gone, rather than that the lookup failed?
- * Cloudflare reports an unknown id as `instance.not_found`.
+ * The Workflow binding as the host's runtime port: `get` answers an unknown id with
+ * `InstanceNotFoundError`, as the port promises, instead of Cloudflare's own error. Everything
+ * else is forwarded as is.
  */
-export declare function isInstanceNotFound(error: unknown): boolean;
-/** The event type the router uses to wake waiting instances (sendEvent's `type`). */
-export declare const WAKE_EVENT_TYPE = "wake";
-/** Journey instance parameters, passed by the ingest router when it creates one. */
-export interface JourneyParams {
-  workflowId: string;
-  /** The IR version pinned at entry. */
-  contentHash: string;
-  userId: string;
-  trigger: {
-    event: string;
-    payload: Record<string, unknown>;
-  };
-  [key: string]: unknown;
-}
+export declare function cloudflareJourneyBinding(binding: CfWorkflowBinding): WorkflowBindingLike;
 /**
  * Slack on the deadline when deciding whether a thrown wait was a timeout: the
  * platform may surface the expiry a moment early, and a wait shorter than this
@@ -186,11 +69,14 @@ export declare const WAKE_TIMEOUT_TOLERANCE_MS = 5000;
  * Did a wait that threw actually reach its deadline?
  *
  * CF signals a wait timeout by throwing, and so does every other failure in
- * there — a broken binding, an evicted instance, a malformed timeout. The
- * adapter used to read them all as timeouts, which made an infrastructure
- * fault indistinguishable from "the user never did it": the journey took its
- * onTimeout branch, early and silently. Only the clock can tell them apart.
+ * there — a broken binding, an evicted instance, a malformed timeout. Reading
+ * them all as timeouts would make an infrastructure fault indistinguishable
+ * from "the user never did it" (the journey would take its onTimeout branch,
+ * early and silently). Only the clock can tell them apart, and only against
+ * the absolute deadline: measured from when the wait was parked, a replay
+ * after an eviction would start the measure over and read a
+ * genuine expiry as a failure.
  */
-export declare function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean;
+export declare function wakeExpired(deadlineMs: number, now: number): boolean;
 //#endregion
 //# sourceMappingURL=bindings.d.cts.map

package/dist/cloudflare/bindings.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.cts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;;iBAYiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;;;;;iBAON;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;EAOzB,MAAM;IACJ;IACA,QAAQ;IACR;;IAEA;MACE,QAAQ;;EAEZ,QAAQ;IAAS;IAAkB;MAAmB;;;;;EAKtD,aAAa;;;;;;;;;;;;iBAaE;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA,UAAU,SAAS;;IAEnB;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;;;;;;EAOA;IAAwB;IAAY;IAAc;;;EAElD;;;qBAIW,8BAA8B;WAEpB;WADH;EAClB,YAAqB;;;;;;wBASP,mBAAmB;;qBAMtB;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}
+{"version":3,"file":"bindings.d.cts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;;;iBAaiB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;;;;;;;;;;;iBAa/B;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA,UAAU,SAAS;;IAEnB;MACE;;;YAIM,oBAAoB,KAAK;;;;;;wBAUrB,yBAAyB,SAAS,oBAAoB;;;;;;qBAqBzD;;;;;;;;;;;;;wBAcG,YAAY,oBAAoB"}