@shware/workflow 3.3.0 → 4.1.0

package/dist/store/postgres-reporting.cjs

@@ -1,5 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_store_erasure = require("./erasure.cjs");
 const require_store_sql = require("./sql.cjs");
+const require_store_user_lock = require("./user-lock.cjs");
 //#region src/store/postgres-reporting.ts
 /**
 * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a
@@ -12,67 +14,123 @@ const MS = (column) => `(extract(epoch from ${column}) * 1000)::double precision
 * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
 * is written here, never defaulted, and every write is idempotent: the engine reports again when
 * a step is retried.
+*
+* The instance and message rows are written like the store's rows about a user (postgres.ts,
+* user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's
+* erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after
+* the user was erased — a late start, node or finish — is a no-op, never an upsert that puts
+* the instance back; a copy to be recorded for them is refused (`UserErasedError`, not
+* retryable) so it is never sent.
+*
+* Links, opens, clicks and device deliveries know only the copy's id. Their transaction is
+* pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the
+* owner's user lock, then re-checks that the copy still exists and the owner has no tombstone
+* — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only
+* then locks the copy's row (where the path locks it) and writes. User lock before row lock,
+* always: the erasure deletes under the user lock, so the two never wait on each other in
+* opposite orders. The unsubscribe is the compliance exception: its suppression is written
+* whatever the user's state, under the same lock order for consistency.
 */
 var PostgresReporting = class {
 	sql;
 	t;
-	constructor(sql, t) {
+	schema;
+	constructor(sql, t, schema) {
 		this.sql = sql;
 		this.t = t;
+		this.schema = schema;
+	}
+	/** The condition every row about a user carries: no erasure tombstone for `$user`. */
+	notErased(user) {
+		return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;
+	}
+	/**
+	* The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the
+	* owner's user lock, then the copy re-read under it — present and its owner without a
+	* tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).
+	* `forUpdate` locks the copy's row on that re-read, after the user lock.
+	*/
+	async lockMessage(tx, messageId, forUpdate = false) {
+		await require_store_user_lock.beginReadCommitted(tx);
+		const owner = (await tx.query(`SELECT user_id FROM ${this.t.message} WHERE id = $1`, [messageId])).at(0);
+		if (owner === void 0) return void 0;
+		await require_store_user_lock.lockUser(tx, this.schema, owner.user_id);
+		const row = (await tx.query(`SELECT user_id, ${MS("coalesce(delivered_at, sent_at)")} AS delivered_at
+       FROM ${this.t.message} WHERE id = $1
+         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)
+       ${forUpdate ? "FOR UPDATE" : ""}`, [messageId])).at(0);
+		if (row === void 0) return void 0;
+		return {
+			userId: row.user_id,
+			deliveredAt: Number(row.delivered_at)
+		};
 	}
 	async instanceStarted(input) {
-		await this.sql.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)
-       VALUES ($1, $2, $3, ${TS("$4")}, 'running')
-       ON CONFLICT (instance_id) DO NOTHING`, [
-			input.instanceId,
-			input.workflow,
-			input.userId,
-			input.at
-		]);
+		await this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, input.userId);
+			await tx.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)
+         SELECT $1, $2, $3, ${TS("$4")}, 'running' ${this.notErased("$3")}
+         ON CONFLICT (instance_id) DO NOTHING`, [
+				input.instanceId,
+				input.workflow,
+				input.userId,
+				input.at
+			]);
+		});
 	}
 	async nodeReached(input) {
-		await this.sql.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)
-       VALUES ($1, $2, $3, ${TS("$4")}, $5, ${TS("$4")}, 'running')
-       ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`, [
-			input.instanceId,
-			input.workflow,
-			input.userId,
-			input.at,
-			input.nodeId
-		]);
+		await this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, input.userId);
+			await tx.query(`INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)
+         SELECT $1, $2, $3, ${TS("$4")}, $5, ${TS("$4")}, 'running' ${this.notErased("$3")}
+         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`, [
+				input.instanceId,
+				input.workflow,
+				input.userId,
+				input.at,
+				input.nodeId
+			]);
+		});
 	}
 	async instanceFinished(input) {
-		await this.sql.query(`INSERT INTO ${this.t.instance}
-         (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)
-       VALUES ($1, $2, $3, ${TS("$5")}, $4, ${TS("$5")}, ${TS("$6")})
-       ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,
-         finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`, [
-			input.instanceId,
-			input.workflow,
-			input.userId,
-			input.status,
-			input.at,
-			input.convertedAt ?? null
-		]);
+		await this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, input.userId);
+			await tx.query(`INSERT INTO ${this.t.instance}
+           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)
+         SELECT $1, $2, $3, ${TS("$5")}, $4, ${TS("$5")}, ${TS("$6")} ${this.notErased("$3")}
+         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,
+           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`, [
+				input.instanceId,
+				input.workflow,
+				input.userId,
+				input.status,
+				input.at,
+				input.convertedAt ?? null
+			]);
+		});
 	}
 	async recordMessage(message) {
-		const id = (await this.sql.query(`INSERT INTO ${this.t.message}
-         (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, ${TS("$9")})
-       ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key
-       RETURNING id`, [
-			require_store_sql.uuidv7(message.sentAt),
-			message.idempotencyKey,
-			message.workflow,
-			message.instanceId,
-			message.nodeId,
-			message.template,
-			message.channel,
-			message.userId,
-			message.sentAt
-		])).at(0)?.id;
-		if (id === void 0) throw new Error(`message ${message.idempotencyKey} was not recorded`);
-		return id;
+		return this.sql.transaction(async (tx) => {
+			await require_store_user_lock.lockUserTransaction(tx, this.schema, message.userId);
+			const id = (await tx.query(`INSERT INTO ${this.t.message}
+           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)
+         SELECT $1, $2, $3, $4, $5, $6, $7, $8, ${TS("$9")} ${this.notErased("$8")}
+         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key
+         RETURNING id`, [
+				require_store_sql.uuidv7(message.sentAt),
+				message.idempotencyKey,
+				message.workflow,
+				message.instanceId,
+				message.nodeId,
+				message.template,
+				message.channel,
+				message.userId,
+				message.sentAt
+			])).at(0)?.id;
+			if (id !== void 0) return id;
+			if ((await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [message.userId])).length > 0) throw new require_store_erasure.UserErasedError(message.userId);
+			throw new Error(`message ${message.idempotencyKey} was not recorded`);
+		});
 	}
 	async settleMessage(idempotencyKey, result, at) {
 		if (result.delivered) await this.sql.query(`UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS("$2")}) WHERE idempotency_key = $1`, [idempotencyKey, at]);
@@ -81,17 +139,16 @@ var PostgresReporting = class {
 	async recordLinks(messageId, urls) {
 		if (urls.length === 0) return;
 		const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(", ");
-		await this.sql.query(`INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`, [messageId, ...urls]);
+		await this.sql.transaction(async (tx) => {
+			if (await this.lockMessage(tx, messageId) === void 0) return;
+			await tx.query(`INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`, [messageId, ...urls]);
+		});
 	}
 	async recordOpen(messageId, judge) {
 		return this.sql.transaction(async (tx) => {
-			const row = (await tx.query(`SELECT user_id, ${MS("coalesce(delivered_at, sent_at)")} AS delivered_at
-         FROM ${this.t.message} WHERE id = $1`, [messageId])).at(0);
-			if (row === void 0) return false;
-			const open = judge({
-				userId: row.user_id,
-				deliveredAt: Number(row.delivered_at)
-			});
+			const message = await this.lockMessage(tx, messageId);
+			if (message === void 0) return false;
+			const open = judge(message);
 			if (open === void 0) return true;
 			await tx.query(`INSERT INTO ${this.t.messageOpen}
            (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)
@@ -119,8 +176,7 @@ var PostgresReporting = class {
 	}
 	async recordClick(messageId, position, at, windowMs, judge) {
 		return this.sql.transaction(async (tx) => {
-			const message = (await tx.query(`SELECT ${MS("coalesce(delivered_at, sent_at)")} AS delivered_at
-         FROM ${this.t.message} WHERE id = $1 FOR UPDATE`, [messageId])).at(0);
+			const message = await this.lockMessage(tx, messageId, true);
 			if (message === void 0) return void 0;
 			const link = (await tx.query(`SELECT l.url,
            (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count
@@ -131,7 +187,7 @@ var PostgresReporting = class {
          WHERE message_id = $1 AND clicked_at >= ${TS("$2")} ORDER BY clicked_at`, [messageId, since]);
 			const { engagement: click, backdate } = judge({
 				url: link.url,
-				deliveredAt: Number(message.delivered_at),
+				deliveredAt: message.deliveredAt,
 				linkCount: Number(link.link_count),
 				recent: recent.map((row) => ({
 					position: row.position,
@@ -179,17 +235,24 @@ var PostgresReporting = class {
 		});
 	}
 	async recordDeviceDelivered(messageId, at) {
-		return (await this.sql.query(`UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS("$2")})
-       WHERE id = $1 RETURNING id`, [messageId, at])).length > 0;
+		return this.sql.transaction(async (tx) => {
+			if (await this.lockMessage(tx, messageId) === void 0) return false;
+			return (await tx.query(`UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS("$2")})
+         WHERE id = $1 RETURNING id`, [messageId, at])).length > 0;
+		});
 	}
 	async recordUnsubscribe(messageId, at) {
 		return this.sql.transaction(async (tx) => {
+			await require_store_user_lock.beginReadCommitted(tx);
+			const owner = (await tx.query(`SELECT user_id FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`, [messageId])).at(0);
+			if (owner === void 0) return void 0;
+			await require_store_user_lock.lockUser(tx, this.schema, owner.user_id);
 			const userId = (await tx.query(`UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS("$2")})
          WHERE id = $1 AND channel = 'email' RETURNING user_id`, [messageId, at])).at(0)?.user_id;
-			if (userId === void 0) return false;
+			if (userId === void 0) return void 0;
 			await tx.query(`INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS("$2")})
          ON CONFLICT DO NOTHING`, [userId, at]);
-			return true;
+			return { userId };
 		});
 	}
 	async snapshotSegments(at) {

package/dist/store/postgres-reporting.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.cjs","names":["uuidv7"],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import type { ClickContext, Engagement, JourneyReporting, MessageRecord } from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>\n  ) {}\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.query(\n      `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n       VALUES ($1, $2, $3, ${TS('$4')}, 'running')\n       ON CONFLICT (instance_id) DO NOTHING`,\n      [input.instanceId, input.workflow, input.userId, input.at]\n    );\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.query(\n      `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n       VALUES ($1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running')\n       ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n      [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n    );\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row\n    await this.sql.query(\n      `INSERT INTO ${this.t.instance}\n         (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n       VALUES ($1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')})\n       ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n         finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n      [\n        input.instanceId,\n        input.workflow,\n        input.userId,\n        input.status,\n        input.at,\n        input.convertedAt ?? null,\n      ]\n    );\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one\n    const rows = await this.sql.query<{ id: string }>(\n      `INSERT INTO ${this.t.message}\n         (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)\n       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, ${TS('$9')})\n       ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n       RETURNING id`,\n      [\n        uuidv7(message.sentAt),\n        message.idempotencyKey,\n        message.workflow,\n        message.instanceId,\n        message.nodeId,\n        message.template,\n        message.channel,\n        message.userId,\n        message.sentAt,\n      ]\n    );\n    const id = rows.at(0)?.id;\n    if (id === undefined) throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    return id;\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.query(\n      `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n      [messageId, ...urls]\n    );\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n        `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n         FROM ${this.t.message} WHERE id = $1`,\n        [messageId]\n      );\n      const row = rows.at(0);\n      if (row === undefined) return false;\n      const open = judge({ userId: row.user_id, deliveredAt: Number(row.delivered_at) });\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock: concurrent clicks on it are judged one at a time\n      const messages = await tx.query<{ delivered_at: number | string }>(\n        `SELECT ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n         FROM ${this.t.message} WHERE id = $1 FOR UPDATE`,\n        [messageId]\n      );\n      const message = messages.at(0);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: Number(message.delivered_at),\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    const rows = await this.sql.query<{ id: string }>(\n      `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n       WHERE id = $1 RETURNING id`,\n      [messageId, at]\n    );\n    return rows.length > 0;\n  }\n\n  async recordUnsubscribe(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      const rows = await tx.query<{ user_id: string }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id`,\n        [messageId, at]\n      );\n      const userId = rows.at(0)?.user_id;\n      if (userId === undefined) return false;\n      // The opt-out itself: the engine sends this user no more email\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS('$2')})\n         ON CONFLICT DO NOTHING`,\n        [userId, at]\n      );\n      return true;\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;AAQA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;AAQ7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CAFnB,YACE,KACA,GACA;EAFiB,KAAA,MAAA;EACA,KAAA,IAAA;CAChB;CAEH,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,SAAS;6BACR,GAAG,IAAI,EAAE;8CAEhC;GAAC,MAAM;GAAY,MAAM;GAAU,MAAM;GAAQ,MAAM;EAAE,CAC3D;CACF;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,SAAS;6BACR,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE;wGAEjD;GAAC,MAAM;GAAY,MAAM;GAAU,MAAM;GAAQ,MAAM;GAAI,MAAM;EAAM,CACzE;CACF;CAEA,MAAM,iBAAiB,OAOL;EAEhB,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,SAAS;;6BAER,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE;;oFAG9D;GACE,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM,eAAe;EACvB,CACF;CACF;CAEA,MAAM,cAAc,SAAyC;EAoB3D,MAAM,MAAK,MAlBQ,KAAK,IAAI,MAC1B,eAAe,KAAK,EAAE,QAAQ;;iDAEa,GAAG,IAAI,EAAE;;sBAGpD;GACEA,kBAAAA,OAAO,QAAQ,MAAM;GACrB,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;EACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;EACvB,IAAI,OAAO,KAAA,GAAW,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EAC1F,OAAO;CACT;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,MACb,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;CACF;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAMxC,MAAM,OAAM,MALO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;gBACjD,KAAK,EAAE,QAAQ,iBACvB,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;GACrB,IAAI,QAAQ,KAAA,GAAW,OAAO;GAC9B,MAAM,OAAO,MAAM;IAAE,QAAQ,IAAI;IAAS,aAAa,OAAO,IAAI,YAAY;GAAE,CAAC;GACjF,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACEA,kBAAAA,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAOxC,MAAM,WAAU,MALO,GAAG,MACxB,UAAU,GAAG,iCAAiC,EAAE;gBACxC,KAAK,EAAE,QAAQ,4BACvB,CAAC,SAAS,CACZ,EAAA,CACyB,GAAG,CAAC;GAC7B,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,OAAO,QAAQ,YAAY;IACxC,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACEA,kBAAAA,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAM3E,QAAO,MALY,KAAK,IAAI,MAC1B,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;oCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;CACvB;CAEA,MAAM,kBAAkB,WAAmB,IAA8B;EACvE,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAMxC,MAAM,UAAS,MALI,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;iEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACoB,GAAG,CAAC,CAAC,EAAE;GAC3B,IAAI,WAAW,KAAA,GAAW,OAAO;GAEjC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,+CAA+C,GAAG,IAAI,EAAE;kCAE1F,CAAC,QAAQ,EAAE,CACb;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}
+{"version":3,"file":"postgres-reporting.cjs","names":["beginReadCommitted","lockUser","lockUserTransaction","uuidv7","UserErasedError"],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import { UserErasedError } from './erasure';\nimport type { ClickContext, Engagement, JourneyReporting, MessageRecord } from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\nimport { beginReadCommitted, lockUser, lockUserTransaction } from './user-lock';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n *\n * The instance and message rows are written like the store's rows about a user (postgres.ts,\n * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's\n * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after\n * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts\n * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not\n * retryable) so it is never sent.\n *\n * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is\n * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the\n * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone\n * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only\n * then locks the copy's row (where the path locks it) and writes. User lock before row lock,\n * always: the erasure deletes under the user lock, so the two never wait on each other in\n * opposite orders. The unsubscribe is the compliance exception: its suppression is written\n * whatever the user's state, under the same lock order for consistency.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>,\n    private readonly schema: string\n  ) {}\n\n  /** The condition every row about a user carries: no erasure tombstone for `$user`. */\n  private notErased(user: string): string {\n    return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;\n  }\n\n  /**\n   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the\n   * owner's user lock, then the copy re-read under it — present and its owner without a\n   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).\n   * `forUpdate` locks the copy's row on that re-read, after the user lock.\n   */\n  private async lockMessage(\n    tx: SqlClientLike,\n    messageId: string,\n    forUpdate = false\n  ): Promise<{ userId: string; deliveredAt: number } | undefined> {\n    await beginReadCommitted(tx);\n    const owners = await tx.query<{ user_id: string }>(\n      `SELECT user_id FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const owner = owners.at(0);\n    if (owner === undefined) return undefined;\n    await lockUser(tx, this.schema, owner.user_id);\n    const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n      `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n       FROM ${this.t.message} WHERE id = $1\n         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)\n       ${forUpdate ? 'FOR UPDATE' : ''}`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    if (row === undefined) return undefined;\n    return { userId: row.user_id, deliveredAt: Number(row.delivered_at) };\n  }\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO NOTHING`,\n        [input.instanceId, input.workflow, input.userId, input.at]\n      );\n    });\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n        [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n      );\n    });\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row —\n    // unless the user is erased, where a late finish must not put one back\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance}\n           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n         SELECT $1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')} ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n        [\n          input.instanceId,\n          input.workflow,\n          input.userId,\n          input.status,\n          input.at,\n          input.convertedAt ?? null,\n        ]\n      );\n    });\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one. With a\n    // tombstone the statement yields nothing, a retry's row included: the copy is not sent\n    return this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, message.userId);\n      const rows = await tx.query<{ id: string }>(\n        `INSERT INTO ${this.t.message}\n           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)\n         SELECT $1, $2, $3, $4, $5, $6, $7, $8, ${TS('$9')} ${this.notErased('$8')}\n         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n         RETURNING id`,\n        [\n          uuidv7(message.sentAt),\n          message.idempotencyKey,\n          message.workflow,\n          message.instanceId,\n          message.nodeId,\n          message.template,\n          message.channel,\n          message.userId,\n          message.sentAt,\n        ]\n      );\n      const id = rows.at(0)?.id;\n      if (id !== undefined) return id;\n      // Nothing recorded: the tombstone refused it, and the sender must stop here\n      const erased = await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [\n        message.userId,\n      ]);\n      if (erased.length > 0) throw new UserErasedError(message.userId);\n      throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    });\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.transaction(async (tx) => {\n      // No copy (or one being erased): nothing to record the links under\n      if ((await this.lockMessage(tx, messageId)) === undefined) return;\n      await tx.query(\n        `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n        [messageId, ...urls]\n      );\n    });\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const message = await this.lockMessage(tx, messageId);\n      if (message === undefined) return false;\n      const open = judge(message);\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock (taken after the user lock): concurrent clicks on it are\n      // judged one at a time\n      const message = await this.lockMessage(tx, messageId, true);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: message.deliveredAt,\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      if ((await this.lockMessage(tx, messageId)) === undefined) return false;\n      const rows = await tx.query<{ id: string }>(\n        `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n         WHERE id = $1 RETURNING id`,\n        [messageId, at]\n      );\n      return rows.length > 0;\n    });\n  }\n\n  async recordUnsubscribe(messageId: string, at: number): Promise<{ userId: string } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The lock order of the other message-id paths (user lock, then the copy's row), so an\n      // unsubscribe and an erasure never wait on each other crosswise. Not the tombstone check:\n      // an opt-out is recorded whatever the user's state, on the copy as long as it is there\n      await beginReadCommitted(tx);\n      const owners = await tx.query<{ user_id: string }>(\n        `SELECT user_id FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`,\n        [messageId]\n      );\n      const owner = owners.at(0);\n      if (owner === undefined) return undefined;\n      await lockUser(tx, this.schema, owner.user_id);\n      // The first unsubscribe sets the time; a later one keeps it and still names the recipient\n      const rows = await tx.query<{ user_id: string }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id`,\n        [messageId, at]\n      );\n      const userId = rows.at(0)?.user_id;\n      if (userId === undefined) return undefined;\n      // The opt-out itself: the engine sends this user no more email\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS('$2')})\n         ON CONFLICT DO NOTHING`,\n        [userId, at]\n      );\n      return { userId };\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;;;;;;;;;;;;;;;;;AAwB7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CACA;CAHnB,YACE,KACA,GACA,QACA;EAHiB,KAAA,MAAA;EACA,KAAA,IAAA;EACA,KAAA,SAAA;CAChB;;CAGH,UAAkB,MAAsB;EACtC,OAAO,mCAAmC,KAAK,EAAE,QAAQ,mBAAmB,KAAK;CACnF;;;;;;;CAQA,MAAc,YACZ,IACA,WACA,YAAY,OACkD;EAC9D,MAAMA,wBAAAA,mBAAmB,EAAE;EAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,iBACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;EACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;EAQ7C,MAAM,OAAM,MAPO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;cACjD,KAAK,EAAE,QAAQ;yCACY,KAAK,EAAE,QAAQ,mBAAmB,KAAK,EAAE,QAAQ;SACjF,YAAY,eAAe,MAC9B,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,OAAO;GAAE,QAAQ,IAAI;GAAS,aAAa,OAAO,IAAI,YAAY;EAAE;CACtE;CAEA,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMC,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;gDAElE;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;GAAE,CAC3D;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;0GAEnF;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;IAAI,MAAM;GAAM,CACzE;EACF,CAAC;CACH;CAEA,MAAM,iBAAiB,OAOL;EAGhB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;;8BAET,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;sFAGrF;IACE,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM,eAAe;GACvB,CACF;EACF,CAAC;CACH;CAEA,MAAM,cAAc,SAAyC;EAG3D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,QAAQ,MAAM;GAmBzD,MAAM,MAAK,MAlBQ,GAAG,MACpB,eAAe,KAAK,EAAE,QAAQ;;kDAEY,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;wBAG3E;IACEC,kBAAAA,OAAO,QAAQ,MAAM;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;GACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;GACvB,IAAI,OAAO,KAAA,GAAW,OAAO;GAK7B,KAAI,MAHiB,GAAG,MAAM,sBAAsB,KAAK,EAAE,QAAQ,sBAAsB,CACvF,QAAQ,MACV,CAAC,EAAA,CACU,SAAS,GAAG,MAAM,IAAIC,sBAAAA,gBAAgB,QAAQ,MAAM;GAC/D,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EACtE,CAAC;CACH;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GAEvC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW;GAC3D,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;EACF,CAAC;CACH;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,SAAS;GACpD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,MAAM,OAAO,MAAM,OAAO;GAC1B,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACED,kBAAAA,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAGxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,WAAW,IAAI;GAC1D,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,QAAQ;IACrB,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACEA,kBAAAA,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAC3E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW,OAAO;GAMlE,QAAO,MALY,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;sCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;EACvB,CAAC;CACH;CAEA,MAAM,kBAAkB,WAAmB,IAAqD;EAC9F,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAIxC,MAAMH,wBAAAA,mBAAmB,EAAE;GAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,uCACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;GACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;GAO7C,MAAM,UAAS,MALI,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;iEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACoB,GAAG,CAAC,CAAC,EAAE;GAC3B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;GAEjC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,+CAA+C,GAAG,IAAI,EAAE;kCAE1F,CAAC,QAAQ,EAAE,CACb;GACA,OAAO,EAAE,OAAO;EAClB,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}

package/dist/store/postgres-reporting.d.cts

@@ -7,11 +7,37 @@ import { ClickContext, Engagement, JourneyReporting, MessageRecord } from "./ind
  * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
  * is written here, never defaulted, and every write is idempotent: the engine reports again when
  * a step is retried.
+ *
+ * The instance and message rows are written like the store's rows about a user (postgres.ts,
+ * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's
+ * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after
+ * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts
+ * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not
+ * retryable) so it is never sent.
+ *
+ * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is
+ * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the
+ * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone
+ * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only
+ * then locks the copy's row (where the path locks it) and writes. User lock before row lock,
+ * always: the erasure deletes under the user lock, so the two never wait on each other in
+ * opposite orders. The unsubscribe is the compliance exception: its suppression is written
+ * whatever the user's state, under the same lock order for consistency.
  */
 export declare class PostgresReporting implements JourneyReporting {
   private readonly sql;
   private readonly t;
-  constructor(sql: SqlClientLike, t: Record<TableKey, string>);
+  private readonly schema;
+  constructor(sql: SqlClientLike, t: Record<TableKey, string>, schema: string);
+  /** The condition every row about a user carries: no erasure tombstone for `$user`. */
+  private notErased;
+  /**
+   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the
+   * owner's user lock, then the copy re-read under it — present and its owner without a
+   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).
+   * `forUpdate` locks the copy's row on that re-read, after the user lock.
+   */
+  private lockMessage;
   instanceStarted(input: {
     workflow: string;
     instanceId: string;
@@ -53,7 +79,9 @@ export declare class PostgresReporting implements JourneyReporting {
     engagement: Engagement;
   } | undefined>;
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
-  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;
+  recordUnsubscribe(messageId: string, at: number): Promise<{
+    userId: string;
+  } | undefined>;
   snapshotSegments(at: number): Promise<{
     segment: string;
     size: number;

package/dist/store/postgres-reporting.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.d.cts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;qBAiBa,6BAA6B;mBAErB;mBACA;EAFnB,YACmB,KAAK,eACL,GAAG,OAAO;EAGvB,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EASE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EASE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAmBE,cAAc,SAAS,gBAAgB;EAyBvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EASzD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAwCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EA4EhC,sBAAsB,mBAAmB,aAAa;EAStD,kBAAkB,mBAAmB,aAAa;EAmBlD,iBAAiB,aAAa;IAAU;IAAiB"}
+{"version":3,"file":"postgres-reporting.d.cts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;qBAmCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAkCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,kBAAkB,mBAAmB,aAAa;IAAU;;EA+B5D,iBAAiB,aAAa;IAAU;IAAiB"}

package/dist/store/postgres-reporting.d.mts

@@ -7,11 +7,37 @@ import { ClickContext, Engagement, JourneyReporting, MessageRecord } from "./ind
  * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
  * is written here, never defaulted, and every write is idempotent: the engine reports again when
  * a step is retried.
+ *
+ * The instance and message rows are written like the store's rows about a user (postgres.ts,
+ * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's
+ * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after
+ * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts
+ * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not
+ * retryable) so it is never sent.
+ *
+ * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is
+ * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the
+ * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone
+ * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only
+ * then locks the copy's row (where the path locks it) and writes. User lock before row lock,
+ * always: the erasure deletes under the user lock, so the two never wait on each other in
+ * opposite orders. The unsubscribe is the compliance exception: its suppression is written
+ * whatever the user's state, under the same lock order for consistency.
  */
 export declare class PostgresReporting implements JourneyReporting {
   private readonly sql;
   private readonly t;
-  constructor(sql: SqlClientLike, t: Record<TableKey, string>);
+  private readonly schema;
+  constructor(sql: SqlClientLike, t: Record<TableKey, string>, schema: string);
+  /** The condition every row about a user carries: no erasure tombstone for `$user`. */
+  private notErased;
+  /**
+   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the
+   * owner's user lock, then the copy re-read under it — present and its owner without a
+   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).
+   * `forUpdate` locks the copy's row on that re-read, after the user lock.
+   */
+  private lockMessage;
   instanceStarted(input: {
     workflow: string;
     instanceId: string;
@@ -53,7 +79,9 @@ export declare class PostgresReporting implements JourneyReporting {
     engagement: Engagement;
   } | undefined>;
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
-  recordUnsubscribe(messageId: string, at: number): Promise<boolean>;
+  recordUnsubscribe(messageId: string, at: number): Promise<{
+    userId: string;
+  } | undefined>;
   snapshotSegments(at: number): Promise<{
     segment: string;
     size: number;

package/dist/store/postgres-reporting.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.d.mts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;qBAiBa,6BAA6B;mBAErB;mBACA;EAFnB,YACmB,KAAK,eACL,GAAG,OAAO;EAGvB,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EASE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EASE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAmBE,cAAc,SAAS,gBAAgB;EAyBvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EASzD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAwCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EA4EhC,sBAAsB,mBAAmB,aAAa;EAStD,kBAAkB,mBAAmB,aAAa;EAmBlD,iBAAiB,aAAa;IAAU;IAAiB"}
+{"version":3,"file":"postgres-reporting.d.mts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;qBAmCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAkCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,kBAAkB,mBAAmB,aAAa;IAAU;;EA+B5D,iBAAiB,aAAa;IAAU;IAAiB"}