@shware/workflow 3.3.0 → 4.1.0

package/dist/store/postgres.d.cts

@@ -1,8 +1,9 @@
 import { BundleIR, ConditionIR, WorkflowIR } from "../ir.cjs";
 import { PushDevice } from "../engine/ports.cjs";
+import { ErasureState } from "./erasure.cjs";
 import { SqlClientLike, uuidv7 } from "./sql.cjs";
 import { DEFAULT_SCHEMA } from "./tables.cjs";
-import { BundleVersion, DeviceInput, EntryInput, EntryOutcome, EventInput, EventWindow, ExecutionRegistry, JourneyReporting, JourneyStore, ProfileProps, SegmentTriggerRoute, TriggerRoute } from "./index.cjs";
+import { BundleVersion, DeviceInput, EntryInput, EntryOutcome, EventInput, EventWindow, ExecutionRegistry, JourneyReporting, JourneyStore, ProfileProps, RunningInstance, SegmentTriggerRoute, TriggerRoute } from "./index.cjs";
 //#region src/store/postgres.d.ts
 export interface PostgresJourneyStoreOptions {
   /**
@@ -19,6 +20,23 @@ export interface PostgresJourneyStoreOptions {
  * guarantees come from the database: ON CONFLICT for the once policy and
  * idempotent subscriptions, a transaction for the route swap, a jsonb merge
  * for /identify. The tables are declared in tables.ts.
+ *
+ * Every write about a user is conditional on their erasure tombstone not existing
+ * (`INSERT ... SELECT ... WHERE NOT EXISTS`, see `notErased`), and runs in a transaction that
+ * holds the user's advisory lock (`lockUser`, the protocol in user-lock.ts): an event, a
+ * profile merge, a device, a subscription, a segment membership with its starts, an entry, an
+ * admission, and the reporting's instance and message rows (postgres-reporting.ts). The
+ * erasure's two steps, `requestErasure` and `forgetUser`, take the same lock. Under READ
+ * COMMITTED a conditional write sees only what was committed when its statement began, and an
+ * erasure sees only rows committed when it looked — so without the lock a write's transaction
+ * could commit its rows after the erase deleted everything (the user comes back), and a runner
+ * could admit itself after the tombstone (the instance runs on). With it, every write and the
+ * erasure of one user run one after another: a write either commits before the tombstone,
+ * where the erasure finds and deletes it, or waits for the lock, reads the tombstone and is
+ * refused (`UserErasedError`). Nothing lands after the erase, so there is no second pass. The
+ * conditional statement stays the in-transaction check; a write that wrote nothing reads the
+ * tombstone on that path only, to tell a refusal from a plain no-op (`refuseIfErased`).
+ * Suppressions are the one exception: an opt-out is written whatever the user's state.
  */
 export declare class PostgresJourneyStore implements JourneyStore {
   private readonly sql;
@@ -29,25 +47,44 @@ export declare class PostgresJourneyStore implements JourneyStore {
   constructor(sql: SqlClientLike, options?: PostgresJourneyStoreOptions);
   /**
    * What the live database lacks against tables.ts: missing tables, missing columns, a column
-   * of another type or nullability. Read-only — the engine never migrates the host's database; a
-   * deploy fails with these problems listed, and the fix is to regenerate the drizzle file and
-   * run the host's migrations.
+   * of another type or nullability, and missing unique indexes (the store's ON CONFLICT targets
+   * — without one the first ingest fails, not the deploy). Read-only — the engine never migrates
+   * the host's database; a deploy fails with these problems listed, and the fix is to regenerate
+   * the drizzle file and run the host's migrations.
    */
   checkSchema(): Promise<string[]>;
   insertEvent(input: EventInput): Promise<boolean>;
+  /** The condition every write about a user carries: no erasure tombstone for `$user`. */
+  private notErased;
+  /**
+   * A conditional write wrote nothing: on that path only, read why. Throws when the tombstone
+   * refused it; returns when the statement had another reason (a duplicate, an entry taken).
+   */
+  private refuseIfErased;
+  /**
+   * The first two statements of every transaction that writes about the user (user-lock.ts):
+   * READ COMMITTED, then the user's advisory lock, held until the transaction ends. Any read
+   * about the user comes after, on a snapshot taken once the lock is held.
+   */
+  private lockUser;
   /** The event rows of one user and name, within the window's bounds (both inclusive). */
   private eventWindow;
   countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;
   listEventPayloads(userId: string, event: string, window?: EventWindow): Promise<Record<string, unknown>[]>;
   getProfile(userId: string): Promise<ProfileProps | undefined>;
   mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;
-  listUserIds(): Promise<string[]>;
+  listUserIds(page?: {
+    after?: string | undefined;
+    limit?: number | undefined;
+  }): Promise<string[]>;
   listDevices(userId: string): Promise<PushDevice[]>;
   upsertDevice(device: DeviceInput): Promise<void>;
   requestErasure(userId: string, at: number): Promise<void>;
   pendingErasures(): Promise<string[]>;
-  runningInstances(userId: string): Promise<string[]>;
-  forgetUser(userId: string): Promise<void>;
+  erasureState(userId: string): Promise<ErasureState>;
+  runningInstances(userId: string): Promise<RunningInstance[]>;
+  admitInstance(instanceId: string, userId: string): Promise<boolean>;
+  forgetUser(userId: string, at: number): Promise<void>;
   isSuppressed(userId: string, channel: string): Promise<boolean>;
   removeDevice(token: string): Promise<string | undefined>;
   unbindDevice(token: string): Promise<string | undefined>;

package/dist/store/postgres.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.cts","names":[],"sources":["../../src/store/postgres.ts"],"mappings":";;;;;;iBAyBiB;;;;;;;EAOf;;;;;;;;;qBA2BW,gCAAgC;mBAOxB;mBANF;mBACA;WACR,WAAW;WACX,YAAY;EAErB,YACmB,KAAK,eACtB,UAAS;;;;;;;EAiBL,eAAe;EAwCf,YAAY,OAAO,aAAa;;UAsB9B;EAcF,YAAY,gBAAgB,eAAe,SAAS,cAAc;EASlE,kBACJ,gBACA,eACA,SAAS,cACR,QAAQ;EASL,WAAW,iBAAiB,QAAQ;EASpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;EAe3D,eAAe;EAOrB,YAAY,iBAAiB,QAAQ;EAO/B,aAAa,QAAQ,cAAc;EAQnC,eAAe,gBAAgB,aAAa;EAQ5C,mBAAmB;EAOnB,iBAAiB,iBAAiB;EAQlC,WAAW,iBAAiB;EA6B5B,aAAa,gBAAgB,kBAAkB;EAQ/C,aAAa,gBAAgB;EAQ7B,aAAa,gBAAgB;EAW7B,gBAAgB;IAAU;IAAY,WAAW;;EAUjD,oBAAoB,aAAa,QAAQ;EASzC,aAAa,gBAAgB,QAAQ;EAoBrC,uBAAuB,QAAQ;EAe/B,cAAc,UAAU,aAAa;EAQrC,cAAc,sBAAsB,QAAQ;EASlD,cAAc,QAAQ,WAAW;EAI3B,qBAAqB,QAAQ;EAcnC,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;;UAoBlD;EAgCR,gBAAgB,iBAAiB,iBAAiB;EAQlD,iBACJ,iBACA,gBACA,YACA,+BACC;EAgBG,qBAAqB,iBAAiB,iBAAiB;EAQvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;EAOzE,oBAAoB,iBAAiB,iBAAiB;EAatD,aAAa,OAAO,aAAa,QAAQ;UAYjC;;;;;;UA4BA;EA0BR,YAAY,qBAAqB;EAIjC,eAAe,oBAAoB,iBAAiB;EAOpD,gBAAgB,gBAAgB,gBAAgB;EAQhD,UACJ,gBACA,gBACA,2BACA,aACC;EASG,YAAY,iBAAiB"}
+{"version":3,"file":"postgres.d.cts","names":[],"sources":["../../src/store/postgres.ts"],"mappings":";;;;;;;iBA4BiB;;;;;;;EAOf;;;;;;;;;;;;;;;;;;;;;;;;;;qBA4CW,gCAAgC;mBAOxB;mBANF;mBACA;WACR,WAAW;WACX,YAAY;EAErB,YACmB,KAAK,eACtB,UAAS;;;;;;;;EAkBL,eAAe;EAqDf,YAAY,OAAO,aAAa;;UA4B9B;;;;;UAQM;;;;;;UAYN;;UAKA;EAcF,YAAY,gBAAgB,eAAe,SAAS,cAAc;EASlE,kBACJ,gBACA,eACA,SAAS,cACR,QAAQ;EASL,WAAW,iBAAiB,QAAQ;EASpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;EAqB3D,YAAY;IAChB;IACA;MACE;EAoBJ,YAAY,iBAAiB,QAAQ;EAO/B,aAAa,QAAQ,cAAc;EAcnC,eAAe,gBAAgB,aAAa;EAa5C,mBAAmB;EAOnB,aAAa,iBAAiB,QAAQ;EAUtC,iBAAiB,iBAAiB,QAAQ;EAS1C,cAAc,oBAAoB,iBAAiB;EAmBnD,WAAW,gBAAgB,aAAa;EAoCxC,aAAa,gBAAgB,kBAAkB;EAQ/C,aAAa,gBAAgB;EAQ7B,aAAa,gBAAgB;EAW7B,gBAAgB;IAAU;IAAY,WAAW;;EAUjD,oBAAoB,aAAa,QAAQ;EASzC,aAAa,gBAAgB,QAAQ;EAoBrC,uBAAuB,QAAQ;EAe/B,cAAc,UAAU,aAAa;EAQrC,cAAc,sBAAsB,QAAQ;EASlD,cAAc,QAAQ,WAAW;EAI3B,qBAAqB,QAAQ;EAcnC,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;;UAoBlD;EAgCR,gBAAgB,iBAAiB,iBAAiB;EAQlD,iBACJ,iBACA,gBACA,YACA,+BACC;EAuBG,qBAAqB,iBAAiB,iBAAiB;EAQvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;EAOzE,oBAAoB,iBAAiB,iBAAiB;EAatD,aAAa,OAAO,aAAa,QAAQ;UAejC;;;;;;UAqCA;EA6BR,YAAY,qBAAqB;EAIjC,eAAe,oBAAoB,iBAAiB;EAOpD,gBAAgB,gBAAgB,gBAAgB;EAQhD,UACJ,gBACA,gBACA,2BACA,aACC;EAmBG,YAAY,iBAAiB"}

package/dist/store/postgres.d.mts

@@ -1,8 +1,9 @@
 import { BundleIR, ConditionIR, WorkflowIR } from "../ir.mjs";
 import { PushDevice } from "../engine/ports.mjs";
+import { ErasureState } from "./erasure.mjs";
 import { SqlClientLike, uuidv7 } from "./sql.mjs";
 import { DEFAULT_SCHEMA } from "./tables.mjs";
-import { BundleVersion, DeviceInput, EntryInput, EntryOutcome, EventInput, EventWindow, ExecutionRegistry, JourneyReporting, JourneyStore, ProfileProps, SegmentTriggerRoute, TriggerRoute } from "./index.mjs";
+import { BundleVersion, DeviceInput, EntryInput, EntryOutcome, EventInput, EventWindow, ExecutionRegistry, JourneyReporting, JourneyStore, ProfileProps, RunningInstance, SegmentTriggerRoute, TriggerRoute } from "./index.mjs";
 //#region src/store/postgres.d.ts
 export interface PostgresJourneyStoreOptions {
   /**
@@ -19,6 +20,23 @@ export interface PostgresJourneyStoreOptions {
  * guarantees come from the database: ON CONFLICT for the once policy and
  * idempotent subscriptions, a transaction for the route swap, a jsonb merge
  * for /identify. The tables are declared in tables.ts.
+ *
+ * Every write about a user is conditional on their erasure tombstone not existing
+ * (`INSERT ... SELECT ... WHERE NOT EXISTS`, see `notErased`), and runs in a transaction that
+ * holds the user's advisory lock (`lockUser`, the protocol in user-lock.ts): an event, a
+ * profile merge, a device, a subscription, a segment membership with its starts, an entry, an
+ * admission, and the reporting's instance and message rows (postgres-reporting.ts). The
+ * erasure's two steps, `requestErasure` and `forgetUser`, take the same lock. Under READ
+ * COMMITTED a conditional write sees only what was committed when its statement began, and an
+ * erasure sees only rows committed when it looked — so without the lock a write's transaction
+ * could commit its rows after the erase deleted everything (the user comes back), and a runner
+ * could admit itself after the tombstone (the instance runs on). With it, every write and the
+ * erasure of one user run one after another: a write either commits before the tombstone,
+ * where the erasure finds and deletes it, or waits for the lock, reads the tombstone and is
+ * refused (`UserErasedError`). Nothing lands after the erase, so there is no second pass. The
+ * conditional statement stays the in-transaction check; a write that wrote nothing reads the
+ * tombstone on that path only, to tell a refusal from a plain no-op (`refuseIfErased`).
+ * Suppressions are the one exception: an opt-out is written whatever the user's state.
  */
 export declare class PostgresJourneyStore implements JourneyStore {
   private readonly sql;
@@ -29,25 +47,44 @@ export declare class PostgresJourneyStore implements JourneyStore {
   constructor(sql: SqlClientLike, options?: PostgresJourneyStoreOptions);
   /**
    * What the live database lacks against tables.ts: missing tables, missing columns, a column
-   * of another type or nullability. Read-only — the engine never migrates the host's database; a
-   * deploy fails with these problems listed, and the fix is to regenerate the drizzle file and
-   * run the host's migrations.
+   * of another type or nullability, and missing unique indexes (the store's ON CONFLICT targets
+   * — without one the first ingest fails, not the deploy). Read-only — the engine never migrates
+   * the host's database; a deploy fails with these problems listed, and the fix is to regenerate
+   * the drizzle file and run the host's migrations.
    */
   checkSchema(): Promise<string[]>;
   insertEvent(input: EventInput): Promise<boolean>;
+  /** The condition every write about a user carries: no erasure tombstone for `$user`. */
+  private notErased;
+  /**
+   * A conditional write wrote nothing: on that path only, read why. Throws when the tombstone
+   * refused it; returns when the statement had another reason (a duplicate, an entry taken).
+   */
+  private refuseIfErased;
+  /**
+   * The first two statements of every transaction that writes about the user (user-lock.ts):
+   * READ COMMITTED, then the user's advisory lock, held until the transaction ends. Any read
+   * about the user comes after, on a snapshot taken once the lock is held.
+   */
+  private lockUser;
   /** The event rows of one user and name, within the window's bounds (both inclusive). */
   private eventWindow;
   countEvents(userId: string, event: string, window?: EventWindow): Promise<number>;
   listEventPayloads(userId: string, event: string, window?: EventWindow): Promise<Record<string, unknown>[]>;
   getProfile(userId: string): Promise<ProfileProps | undefined>;
   mergeProfile(userId: string, props: ProfileProps): Promise<ProfileProps>;
-  listUserIds(): Promise<string[]>;
+  listUserIds(page?: {
+    after?: string | undefined;
+    limit?: number | undefined;
+  }): Promise<string[]>;
   listDevices(userId: string): Promise<PushDevice[]>;
   upsertDevice(device: DeviceInput): Promise<void>;
   requestErasure(userId: string, at: number): Promise<void>;
   pendingErasures(): Promise<string[]>;
-  runningInstances(userId: string): Promise<string[]>;
-  forgetUser(userId: string): Promise<void>;
+  erasureState(userId: string): Promise<ErasureState>;
+  runningInstances(userId: string): Promise<RunningInstance[]>;
+  admitInstance(instanceId: string, userId: string): Promise<boolean>;
+  forgetUser(userId: string, at: number): Promise<void>;
   isSuppressed(userId: string, channel: string): Promise<boolean>;
   removeDevice(token: string): Promise<string | undefined>;
   unbindDevice(token: string): Promise<string | undefined>;

package/dist/store/postgres.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.mts","names":[],"sources":["../../src/store/postgres.ts"],"mappings":";;;;;;iBAyBiB;;;;;;;EAOf;;;;;;;;;qBA2BW,gCAAgC;mBAOxB;mBANF;mBACA;WACR,WAAW;WACX,YAAY;EAErB,YACmB,KAAK,eACtB,UAAS;;;;;;;EAiBL,eAAe;EAwCf,YAAY,OAAO,aAAa;;UAsB9B;EAcF,YAAY,gBAAgB,eAAe,SAAS,cAAc;EASlE,kBACJ,gBACA,eACA,SAAS,cACR,QAAQ;EASL,WAAW,iBAAiB,QAAQ;EASpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;EAe3D,eAAe;EAOrB,YAAY,iBAAiB,QAAQ;EAO/B,aAAa,QAAQ,cAAc;EAQnC,eAAe,gBAAgB,aAAa;EAQ5C,mBAAmB;EAOnB,iBAAiB,iBAAiB;EAQlC,WAAW,iBAAiB;EA6B5B,aAAa,gBAAgB,kBAAkB;EAQ/C,aAAa,gBAAgB;EAQ7B,aAAa,gBAAgB;EAW7B,gBAAgB;IAAU;IAAY,WAAW;;EAUjD,oBAAoB,aAAa,QAAQ;EASzC,aAAa,gBAAgB,QAAQ;EAoBrC,uBAAuB,QAAQ;EAe/B,cAAc,UAAU,aAAa;EAQrC,cAAc,sBAAsB,QAAQ;EASlD,cAAc,QAAQ,WAAW;EAI3B,qBAAqB,QAAQ;EAcnC,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;;UAoBlD;EAgCR,gBAAgB,iBAAiB,iBAAiB;EAQlD,iBACJ,iBACA,gBACA,YACA,+BACC;EAgBG,qBAAqB,iBAAiB,iBAAiB;EAQvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;EAOzE,oBAAoB,iBAAiB,iBAAiB;EAatD,aAAa,OAAO,aAAa,QAAQ;UAYjC;;;;;;UA4BA;EA0BR,YAAY,qBAAqB;EAIjC,eAAe,oBAAoB,iBAAiB;EAOpD,gBAAgB,gBAAgB,gBAAgB;EAQhD,UACJ,gBACA,gBACA,2BACA,aACC;EASG,YAAY,iBAAiB"}
+{"version":3,"file":"postgres.d.mts","names":[],"sources":["../../src/store/postgres.ts"],"mappings":";;;;;;;iBA4BiB;;;;;;;EAOf;;;;;;;;;;;;;;;;;;;;;;;;;;qBA4CW,gCAAgC;mBAOxB;mBANF;mBACA;WACR,WAAW;WACX,YAAY;EAErB,YACmB,KAAK,eACtB,UAAS;;;;;;;;EAkBL,eAAe;EAqDf,YAAY,OAAO,aAAa;;UA4B9B;;;;;UAQM;;;;;;UAYN;;UAKA;EAcF,YAAY,gBAAgB,eAAe,SAAS,cAAc;EASlE,kBACJ,gBACA,eACA,SAAS,cACR,QAAQ;EASL,WAAW,iBAAiB,QAAQ;EASpC,aAAa,gBAAgB,OAAO,eAAe,QAAQ;EAqB3D,YAAY;IAChB;IACA;MACE;EAoBJ,YAAY,iBAAiB,QAAQ;EAO/B,aAAa,QAAQ,cAAc;EAcnC,eAAe,gBAAgB,aAAa;EAa5C,mBAAmB;EAOnB,aAAa,iBAAiB,QAAQ;EAUtC,iBAAiB,iBAAiB,QAAQ;EAS1C,cAAc,oBAAoB,iBAAiB;EAmBnD,WAAW,gBAAgB,aAAa;EAoCxC,aAAa,gBAAgB,kBAAkB;EAQ/C,aAAa,gBAAgB;EAQ7B,aAAa,gBAAgB;EAW7B,gBAAgB;IAAU;IAAY,WAAW;;EAUjD,oBAAoB,aAAa,QAAQ;EASzC,aAAa,gBAAgB,QAAQ;EAoBrC,uBAAuB,QAAQ;EAe/B,cAAc,UAAU,aAAa;EAQrC,cAAc,sBAAsB,QAAQ;EASlD,cAAc,QAAQ,WAAW;EAI3B,qBAAqB,QAAQ;EAcnC,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;;UAoBlD;EAgCR,gBAAgB,iBAAiB,iBAAiB;EAQlD,iBACJ,iBACA,gBACA,YACA,+BACC;EAuBG,qBAAqB,iBAAiB,iBAAiB;EAQvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;EAOzE,oBAAoB,iBAAiB,iBAAiB;EAatD,aAAa,OAAO,aAAa,QAAQ;UAejC;;;;;;UAqCA;EA6BR,YAAY,qBAAqB;EAIjC,eAAe,oBAAoB,iBAAiB;EAOpD,gBAAgB,gBAAgB,gBAAgB;EAQhD,UACJ,gBACA,gBACA,2BACA,aACC;EAmBG,YAAY,iBAAiB"}

package/dist/store/postgres.mjs

@@ -1,5 +1,7 @@
 import { ConditionIR, WorkflowIR } from "../ir.mjs";
+import { UserErasedError } from "./erasure.mjs";
 import { uuidv7 } from "./sql.mjs";
+import { lockUserTransaction } from "./user-lock.mjs";
 import { PostgresReporting } from "./postgres-reporting.mjs";
 import { DEFAULT_SCHEMA, TABLES, columnName } from "./tables.mjs";
 //#region src/store/postgres.ts
@@ -23,6 +25,23 @@ function asJson(value) {
 * guarantees come from the database: ON CONFLICT for the once policy and
 * idempotent subscriptions, a transaction for the route swap, a jsonb merge
 * for /identify. The tables are declared in tables.ts.
+*
+* Every write about a user is conditional on their erasure tombstone not existing
+* (`INSERT ... SELECT ... WHERE NOT EXISTS`, see `notErased`), and runs in a transaction that
+* holds the user's advisory lock (`lockUser`, the protocol in user-lock.ts): an event, a
+* profile merge, a device, a subscription, a segment membership with its starts, an entry, an
+* admission, and the reporting's instance and message rows (postgres-reporting.ts). The
+* erasure's two steps, `requestErasure` and `forgetUser`, take the same lock. Under READ
+* COMMITTED a conditional write sees only what was committed when its statement began, and an
+* erasure sees only rows committed when it looked — so without the lock a write's transaction
+* could commit its rows after the erase deleted everything (the user comes back), and a runner
+* could admit itself after the tombstone (the instance runs on). With it, every write and the
+* erasure of one user run one after another: a write either commits before the tombstone,
+* where the erasure finds and deletes it, or waits for the lock, reads the tombstone and is
+* refused (`UserErasedError`). Nothing lands after the erase, so there is no second pass. The
+* conditional statement stays the in-transaction check; a write that wrote nothing reads the
+* tombstone on that path only, to tell a refusal from a plain no-op (`refuseIfErased`).
+* Suppressions are the one exception: an opt-out is written whatever the user's state.
 */
 var PostgresJourneyStore = class {
 	sql;
@@ -35,19 +54,24 @@ var PostgresJourneyStore = class {
 		this.schema = options.schema ?? "workflow";
 		const qualify = (name) => `"${this.schema}"."${name}"`;
 		this.t = Object.fromEntries(Object.keys(TABLES).map((key) => [key, qualify(TABLES[key].name)]));
-		this.reporting = new PostgresReporting(sql, this.t);
+		this.reporting = new PostgresReporting(sql, this.t, this.schema);
 		this.executions = new PostgresExecutions(sql, this.t.execution, this.t.entry);
 	}
 	/**
 	* What the live database lacks against tables.ts: missing tables, missing columns, a column
-	* of another type or nullability. Read-only — the engine never migrates the host's database; a
-	* deploy fails with these problems listed, and the fix is to regenerate the drizzle file and
-	* run the host's migrations.
+	* of another type or nullability, and missing unique indexes (the store's ON CONFLICT targets
+	* — without one the first ingest fails, not the deploy). Read-only — the engine never migrates
+	* the host's database; a deploy fails with these problems listed, and the fix is to regenerate
+	* the drizzle file and run the host's migrations.
 	*/
 	async checkSchema() {
-		const rows = await this.sql.transaction((tx) => tx.query(`SELECT table_name, column_name, udt_name, is_nullable FROM information_schema.columns WHERE table_schema = $1`, [this.schema]));
-		const live = new Map(rows.map((row) => [`${row.table_name}.${row.column_name}`, row]));
-		const tables = new Set(rows.map((row) => row.table_name));
+		const { columns, indexes } = await this.sql.transaction(async (tx) => ({
+			columns: await tx.query(`SELECT table_name, column_name, udt_name, is_nullable FROM information_schema.columns WHERE table_schema = $1`, [this.schema]),
+			indexes: await tx.query(`SELECT tablename, indexname, indexdef FROM pg_indexes WHERE schemaname = $1`, [this.schema])
+		}));
+		const live = new Map(columns.map((row) => [`${row.table_name}.${row.column_name}`, row]));
+		const tables = new Set(columns.map((row) => row.table_name));
+		const liveIndexes = new Map(indexes.map((row) => [`${row.tablename}.${row.indexname}`, row]));
 		const problems = [];
 		for (const spec of Object.values(TABLES)) {
 			const where = `"${this.schema}"."${spec.name}"`;
@@ -62,20 +86,50 @@ var PostgresJourneyStore = class {
 				else if (row.udt_name !== UDT[column.type]) problems.push(`column ${where}."${name}" is ${row.udt_name}, expected ${UDT[column.type]}`);
 				else if (row.is_nullable === "YES" !== (column.nullable === true)) problems.push(`column ${where}."${name}" should be ${column.nullable ? "nullable" : "NOT NULL"}`);
 			}
+			for (const keys of spec.uniqueIndexes ?? []) {
+				const name = `${spec.name}_${keys.map(columnName).join("_")}_index`;
+				const row = liveIndexes.get(`${spec.name}.${name}`);
+				if (row === void 0) problems.push(`missing unique index "${this.schema}"."${name}"`);
+				else if (!/^CREATE UNIQUE INDEX/i.test(row.indexdef)) problems.push(`index "${this.schema}"."${name}" is not unique`);
+			}
 		}
 		return problems;
 	}
 	async insertEvent(input) {
-		return (await this.sql.query(`INSERT INTO ${this.t.event} (id, event_id, user_id, name, ts, payload)
-       VALUES ($1, $2, $3, $4, ${TS("$5")}, $6::text::jsonb)
-       ON CONFLICT (event_id) DO NOTHING RETURNING id`, [
-			uuidv7(input.ts),
-			input.id,
-			input.userId,
-			input.event,
-			input.ts,
-			JSON.stringify(input.payload)
-		])).length > 0;
+		return this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, input.userId);
+			if ((await tx.query(`INSERT INTO ${this.t.event} (id, event_id, user_id, name, ts, payload)
+         SELECT $1::uuid, $2, $3, $4, ${TS("$5")}, $6::text::jsonb ${this.notErased("$3")}
+         ON CONFLICT (user_id, event_id) DO NOTHING RETURNING id`, [
+				uuidv7(input.ts),
+				input.id,
+				input.userId,
+				input.event,
+				input.ts,
+				JSON.stringify(input.payload)
+			])).length > 0) return true;
+			await this.refuseIfErased(tx, input.userId);
+			return false;
+		});
+	}
+	/** The condition every write about a user carries: no erasure tombstone for `$user`. */
+	notErased(user) {
+		return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;
+	}
+	/**
+	* A conditional write wrote nothing: on that path only, read why. Throws when the tombstone
+	* refused it; returns when the statement had another reason (a duplicate, an entry taken).
+	*/
+	async refuseIfErased(sql, userId) {
+		if ((await sql.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [userId])).length > 0) throw new UserErasedError(userId);
+	}
+	/**
+	* The first two statements of every transaction that writes about the user (user-lock.ts):
+	* READ COMMITTED, then the user's advisory lock, held until the transaction ends. Any read
+	* about the user comes after, on a snapshot taken once the lock is held.
+	*/
+	lockUser(tx, userId) {
+		return lockUserTransaction(tx, this.schema, userId);
 	}
 	/** The event rows of one user and name, within the window's bounds (both inclusive). */
 	eventWindow(userId, event, window) {
@@ -108,41 +162,90 @@ var PostgresJourneyStore = class {
 		return row === void 0 ? void 0 : asJson(row.props);
 	}
 	async mergeProfile(userId, props) {
-		return asJson((await this.sql.query(`INSERT INTO ${this.t.profile} (user_id, props) VALUES ($1, jsonb_strip_nulls($2::text::jsonb))
-       ON CONFLICT (user_id) DO UPDATE SET props = jsonb_strip_nulls(${this.t.profile}.props || $3::text::jsonb)
-       RETURNING props`, [
-			userId,
-			JSON.stringify(props),
-			JSON.stringify(props)
-		])).at(0)?.props ?? {});
+		return this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, userId);
+			const rows = await tx.query(`INSERT INTO ${this.t.profile} (user_id, props)
+         SELECT $1, jsonb_strip_nulls($2::text::jsonb) ${this.notErased("$1")}
+         ON CONFLICT (user_id) DO UPDATE SET props = jsonb_strip_nulls(${this.t.profile}.props || $3::text::jsonb)
+         RETURNING props`, [
+				userId,
+				JSON.stringify(props),
+				JSON.stringify(props)
+			]);
+			if (rows.length === 0) throw new UserErasedError(userId);
+			return asJson(rows[0].props);
+		});
 	}
-	async listUserIds() {
-		return (await this.sql.query(`SELECT user_id FROM ${this.t.profile} UNION SELECT DISTINCT user_id FROM ${this.t.event}`)).map((row) => row.user_id);
+	async listUserIds(page) {
+		const params = [];
+		let where = "";
+		if (page?.after !== void 0) {
+			params.push(page.after);
+			where = ` WHERE user_id > $${params.length}`;
+		}
+		let limit = "";
+		if (page?.limit !== void 0) {
+			params.push(page.limit);
+			limit = ` LIMIT $${params.length}`;
+		}
+		return (await this.sql.query(`SELECT user_id FROM (SELECT user_id FROM ${this.t.profile} UNION SELECT user_id FROM ${this.t.event}) u${where} ORDER BY user_id${limit}`, params)).map((row) => row.user_id);
 	}
 	listDevices(userId) {
 		return this.sql.query(`SELECT token, platform FROM ${this.t.device} WHERE user_id = $1 ORDER BY ts DESC`, [userId]);
 	}
 	async upsertDevice(device) {
-		await this.sql.query(`INSERT INTO ${this.t.device} (token, user_id, platform, ts) VALUES ($1, $2, $3, ${TS("$4")})
-       ON CONFLICT (token) DO UPDATE SET user_id = EXCLUDED.user_id, platform = EXCLUDED.platform, ts = EXCLUDED.ts`, [
-			device.token,
-			device.userId,
-			device.platform,
-			device.ts
-		]);
+		await this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, device.userId);
+			if ((await tx.query(`INSERT INTO ${this.t.device} (token, user_id, platform, ts)
+         SELECT $1, $2, $3, ${TS("$4")} ${this.notErased("$2")}
+         ON CONFLICT (token) DO UPDATE SET user_id = EXCLUDED.user_id, platform = EXCLUDED.platform, ts = EXCLUDED.ts
+         RETURNING token`, [
+				device.token,
+				device.userId,
+				device.platform,
+				device.ts
+			])).length === 0) throw new UserErasedError(device.userId);
+		});
 	}
 	async requestErasure(userId, at) {
-		await this.sql.query(`INSERT INTO ${this.t.erasure} (user_id, requested_at) VALUES ($1, ${TS("$2")})
-       ON CONFLICT DO NOTHING`, [userId, at]);
+		await this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, userId);
+			await tx.query(`INSERT INTO ${this.t.erasure} (user_id, requested_at) VALUES ($1, ${TS("$2")})
+         ON CONFLICT DO NOTHING`, [userId, at]);
+		});
 	}
 	async pendingErasures() {
-		return (await this.sql.query(`SELECT user_id FROM ${this.t.erasure} ORDER BY requested_at`)).map((row) => row.user_id);
+		return (await this.sql.query(`SELECT user_id FROM ${this.t.erasure} WHERE erased_at IS NULL ORDER BY requested_at`)).map((row) => row.user_id);
+	}
+	async erasureState(userId) {
+		const row = (await this.sql.query(`SELECT erased_at IS NOT NULL AS erased FROM ${this.t.erasure} WHERE user_id = $1`, [userId])).at(0);
+		if (row === void 0) return "none";
+		return row.erased ? "erased" : "erasing";
 	}
 	async runningInstances(userId) {
-		return (await this.sql.query(`SELECT instance_id FROM ${this.t.entry} WHERE user_id = $1 AND status = 'running'`, [userId])).map((row) => row.instance_id);
+		return (await this.sql.query(`SELECT instance_id, admitted_at IS NOT NULL AS admitted
+       FROM ${this.t.entry} WHERE user_id = $1 AND status = 'running'`, [userId])).map((row) => ({
+			instanceId: row.instance_id,
+			admitted: row.admitted
+		}));
+	}
+	async admitInstance(instanceId, userId) {
+		return this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, userId);
+			return (await tx.query(`UPDATE ${this.t.entry} SET admitted_at = COALESCE(admitted_at, ${TS("$3")})
+         WHERE instance_id = $1 AND user_id = $2
+           AND (status = 'running' OR admitted_at IS NOT NULL)
+           AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = $2)
+         RETURNING instance_id`, [
+				instanceId,
+				userId,
+				Date.now()
+			])).length > 0;
+		});
 	}
-	async forgetUser(userId) {
+	async forgetUser(userId, at) {
 		await this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, userId);
 			for (const child of [
 				this.t.messageOpen,
 				this.t.messageClick,
@@ -156,12 +259,11 @@ var PostgresJourneyStore = class {
 				this.t.subscription,
 				this.t.segmentStart,
 				this.t.segmentMember,
-				this.t.suppression,
 				this.t.device,
 				this.t.event,
-				this.t.profile,
-				this.t.erasure
+				this.t.profile
 			]) await tx.query(`DELETE FROM ${table} WHERE user_id = $1`, [userId]);
+			await tx.query(`UPDATE ${this.t.erasure} SET erased_at = COALESCE(erased_at, ${TS("$2")}) WHERE user_id = $1`, [userId, at]);
 		});
 	}
 	async isSuppressed(userId, channel) {
@@ -267,13 +369,17 @@ var PostgresJourneyStore = class {
 	}
 	async addSegmentMember(segment, userId, ts, workflows) {
 		await this.sql.transaction(async (tx) => {
-			await tx.query(`INSERT INTO ${this.t.segmentMember} (segment, user_id, ts) VALUES ($1, $2, ${TS("$3")}) ON CONFLICT DO NOTHING`, [
+			await this.lockUser(tx, userId);
+			if ((await tx.query(`INSERT INTO ${this.t.segmentMember} (segment, user_id, ts)
+         SELECT $1, $2, ${TS("$3")} ${this.notErased("$2")}
+         ON CONFLICT DO NOTHING RETURNING segment`, [
 				segment,
 				userId,
 				ts
-			]);
+			])).length === 0) await this.refuseIfErased(tx, userId);
 			for (const workflow of workflows) await tx.query(`INSERT INTO ${this.t.segmentStart} (segment, workflow, user_id, ts)
-           VALUES ($1, $2, $3, ${TS("$4")}) ON CONFLICT DO NOTHING`, [
+           SELECT $1, $2, $3, ${TS("$4")} ${this.notErased("$3")}
+           ON CONFLICT DO NOTHING`, [
 				segment,
 				workflow,
 				userId,
@@ -299,16 +405,16 @@ var PostgresJourneyStore = class {
 	}
 	async enterJourney(entry) {
 		const { execution } = entry;
-		if (execution === void 0) return this.claimEntry(this.sql, entry);
 		return this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, entry.userId);
 			const outcome = await this.claimEntry(tx, entry);
-			if (outcome !== null) await this.recordStart(tx, entry, execution);
+			if (outcome !== null && execution !== void 0) await this.recordStart(tx, entry, execution);
 			return outcome;
 		});
 	}
 	async claimEntry(sql, entry) {
 		if ((await sql.query(`INSERT INTO ${this.t.entry} (workflow, user_id, instance_id, hash, status, ts)
-       VALUES ($1, $2, $3, $4, 'running', ${TS("$5")})
+       SELECT $1, $2, $3, $4, 'running', ${TS("$5")} ${this.notErased("$2")}
        ON CONFLICT (workflow, user_id) DO NOTHING RETURNING instance_id`, [
 			entry.workflow,
 			entry.userId,
@@ -316,14 +422,19 @@ var PostgresJourneyStore = class {
 			entry.hash,
 			entry.ts
 		])).length > 0) return "entered";
-		return (await sql.query(`UPDATE ${this.t.entry} SET instance_id = $1, hash = $2, status = 'running', ts = ${TS("$3")}
-       WHERE workflow = $4 AND user_id = $5 AND status = 'failed' RETURNING instance_id`, [
+		if ((await sql.query(`UPDATE ${this.t.entry} SET instance_id = $1, hash = $2, status = 'running', ts = ${TS("$3")},
+         admitted_at = NULL
+       WHERE workflow = $4 AND user_id = $5 AND status = 'failed'
+         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = $5)
+       RETURNING instance_id`, [
 			entry.instanceId,
 			entry.hash,
 			entry.ts,
 			entry.workflow,
 			entry.userId
-		])).length > 0 ? "reclaimed" : null;
+		])).length > 0) return "reclaimed";
+		await this.refuseIfErased(sql, entry.userId);
+		return null;
 	}
 	/**
 	* Only an entry this call claimed records a start, so a row already there is a previous
@@ -331,13 +442,14 @@ var PostgresJourneyStore = class {
 	* ts). It is replaced whole: the new attempt's name and payload, nothing submitted yet.
 	*/
 	async recordStart(tx, entry, execution) {
-		await tx.query(`INSERT INTO ${this.t.execution} (instance_id, workflow, user_id, name, target, input, created_at, generation)
-       VALUES ($1, $2, $3, $4, $5, $6, ${TS("$7")}, 0)
+		if ((await tx.query(`INSERT INTO ${this.t.execution} (instance_id, workflow, user_id, name, target, input, created_at, generation)
+       SELECT $1, $2, $3, $4, $5, $6, ${TS("$7")}, 0 ${this.notErased("$3")}
        ON CONFLICT (instance_id) DO UPDATE SET
          name = EXCLUDED.name, target = EXCLUDED.target, input = EXCLUDED.input,
          created_at = EXCLUDED.created_at, generation = 0, submitted_at = NULL, arn = NULL,
          unresolved_at = NULL, callback_id = NULL, deadline_at = NULL, checked_at = NULL,
-         stopped_at = NULL`, [
+         stopped_at = NULL
+       RETURNING instance_id`, [
 			entry.instanceId,
 			entry.workflow,
 			entry.userId,
@@ -345,7 +457,7 @@ var PostgresJourneyStore = class {
 			execution.target,
 			execution.input,
 			Date.now()
-		]);
+		])).length === 0) throw new UserErasedError(entry.userId);
 	}
 	async removeEntry(instanceId) {
 		await this.sql.query(`DELETE FROM ${this.t.entry} WHERE instance_id = $1`, [instanceId]);
@@ -357,12 +469,19 @@ var PostgresJourneyStore = class {
 		return (await this.sql.query(`SELECT DISTINCT wake_handle AS handle FROM ${this.t.subscription} WHERE user_id = $1 AND event = $2`, [userId, event])).map((row) => row.handle);
 	}
 	async subscribe(handle, userId, events, ts) {
-		for (const event of events) await this.sql.query(`INSERT INTO ${this.t.subscription} (user_id, event, wake_handle, ts) VALUES ($1, $2, $3, ${TS("$4")}) ON CONFLICT DO NOTHING`, [
-			userId,
-			event,
-			handle,
-			ts
-		]);
+		await this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, userId);
+			let skipped = false;
+			for (const event of events) if ((await tx.query(`INSERT INTO ${this.t.subscription} (user_id, event, wake_handle, ts)
+           SELECT $1, $2, $3, ${TS("$4")} ${this.notErased("$1")}
+           ON CONFLICT DO NOTHING RETURNING event`, [
+				userId,
+				event,
+				handle,
+				ts
+			])).length === 0) skipped = true;
+			if (skipped) await this.refuseIfErased(tx, userId);
+		});
 	}
 	async unsubscribe(handle) {
 		await this.sql.query(`DELETE FROM ${this.t.subscription} WHERE wake_handle = $1`, [handle]);