@shware/workflow 3.3.0 → 4.1.0

package/dist/dsl/action.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"action.cjs","names":["sha256Hex"],"sources":["../../src/dsl/action.ts"],"sourcesContent":["import { sha256Hex } from '../hash';\n\n/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.\n * The runtime resolves the name against a registry (see engine/actions.ts) and\n * compares codeHash to detect version skew between a pinned IR and the\n * currently deployed implementation.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * implementation for the runtime registry and the codeHash for the IR pin.\n */\nexport interface ActionRef<A extends object = object> {\n  readonly name: string;\n  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */\n  readonly codeHash: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * codeHash comes from `handler.toString()`, so it changes when the code\n * changes and stays put when it does not. Different build pipelines can print\n * the same function differently (minification), which is why the default\n * runtime policy on mismatch is warn, not fail.\n */\nexport function action<A extends object = Record<string, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, codeHash: sha256Hex(handler.toString()).slice(0, 32), handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM,UAAUA,aAAAA,UAAU,QAAQ,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAAG;CAAQ;AAC/E"}
+{"version":3,"file":"action.cjs","names":[],"sources":["../../src/dsl/action.ts"],"sourcesContent":["/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args }`. The runtime\n * resolves the name against a registry (see engine/actions.ts).\n *\n * The IR carries no hash of `handler.toString()`: the printed source depends\n * on the bundler (minification, helper injection, source maps), so every\n * toolchain would produce a different \"version\" of unchanged code and `plan`\n * would report changes nobody made. Code identity is the deployed bundle's,\n * not the IR's.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * name the IR records and the implementation for the runtime registry.\n */\nexport interface ActionRef<A extends object = object> {\n  readonly name: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * The returned object is the action's identity at compile time: compileBundle\n * checks that the one a workflow runs is the very one listed in `actions`, so\n * two definitions cannot share a name by accident.\n */\nexport function action<A extends object = Record<string, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM;CAAQ;AACzB"}

package/dist/dsl/action.d.cts

@@ -5,10 +5,14 @@
  *
  * Dual-plane model: the *code* solidifies into the Worker bundle at deploy
  * time (it ships with the app, like any other module), while the *identity*
- * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.
- * The runtime resolves the name against a registry (see engine/actions.ts) and
- * compares codeHash to detect version skew between a pinned IR and the
- * currently deployed implementation.
+ * solidifies into IR as `{ type: 'action', action: name, args }`. The runtime
+ * resolves the name against a registry (see engine/actions.ts).
+ *
+ * The IR carries no hash of `handler.toString()`: the printed source depends
+ * on the bundler (minification, helper injection, source maps), so every
+ * toolchain would produce a different "version" of unchanged code and `plan`
+ * would report changes nobody made. Code identity is the deployed bundle's,
+ * not the IR's.
  *
  * Deliberately NOT supported: custom *conditions*. Branching stays declarative
  * so the canvas can always explain why a user took a path — an action that
@@ -35,12 +39,10 @@ export interface ActionContext {
 export type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;
 /**
  * A registered custom action: the named asset `.run()` refers to. Carries the
- * implementation for the runtime registry and the codeHash for the IR pin.
+ * name the IR records and the implementation for the runtime registry.
  */
 export interface ActionRef<A extends object = object> {
   readonly name: string;
-  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */
-  readonly codeHash: string;
   /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */
   handler(args: A, ctx: ActionContext): Promise<void> | void;
 }
@@ -54,10 +56,9 @@ export interface ActionRef<A extends object = object> {
  *
  *   workflow(...).run(syncCrm, { plan: u.subscription_plan })
  *
- * codeHash comes from `handler.toString()`, so it changes when the code
- * changes and stays put when it does not. Different build pipelines can print
- * the same function differently (minification), which is why the default
- * runtime policy on mismatch is warn, not fail.
+ * The returned object is the action's identity at compile time: compileBundle
+ * checks that the one a workflow runs is the very one listed in `actions`, so
+ * two definitions cannot share a name by accident.
  */
 export declare function action<A extends object = Record<string, never>>(name: string, handler: ActionHandler<A>): ActionRef<A>;
 //#endregion

package/dist/dsl/action.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.cts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;iBAoBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU;WAChB;;WAEA;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;;wBAkBxB,OAAO,mBAAmB,uBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}
+{"version":3,"file":"action.d.cts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;iBAsBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU;WAChB;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;wBAiBxB,OAAO,mBAAmB,uBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}

package/dist/dsl/action.d.mts

@@ -5,10 +5,14 @@
  *
  * Dual-plane model: the *code* solidifies into the Worker bundle at deploy
  * time (it ships with the app, like any other module), while the *identity*
- * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.
- * The runtime resolves the name against a registry (see engine/actions.ts) and
- * compares codeHash to detect version skew between a pinned IR and the
- * currently deployed implementation.
+ * solidifies into IR as `{ type: 'action', action: name, args }`. The runtime
+ * resolves the name against a registry (see engine/actions.ts).
+ *
+ * The IR carries no hash of `handler.toString()`: the printed source depends
+ * on the bundler (minification, helper injection, source maps), so every
+ * toolchain would produce a different "version" of unchanged code and `plan`
+ * would report changes nobody made. Code identity is the deployed bundle's,
+ * not the IR's.
  *
  * Deliberately NOT supported: custom *conditions*. Branching stays declarative
  * so the canvas can always explain why a user took a path — an action that
@@ -35,12 +39,10 @@ export interface ActionContext {
 export type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;
 /**
  * A registered custom action: the named asset `.run()` refers to. Carries the
- * implementation for the runtime registry and the codeHash for the IR pin.
+ * name the IR records and the implementation for the runtime registry.
  */
 export interface ActionRef<A extends object = object> {
   readonly name: string;
-  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */
-  readonly codeHash: string;
   /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */
   handler(args: A, ctx: ActionContext): Promise<void> | void;
 }
@@ -54,10 +56,9 @@ export interface ActionRef<A extends object = object> {
  *
  *   workflow(...).run(syncCrm, { plan: u.subscription_plan })
  *
- * codeHash comes from `handler.toString()`, so it changes when the code
- * changes and stays put when it does not. Different build pipelines can print
- * the same function differently (minification), which is why the default
- * runtime policy on mismatch is warn, not fail.
+ * The returned object is the action's identity at compile time: compileBundle
+ * checks that the one a workflow runs is the very one listed in `actions`, so
+ * two definitions cannot share a name by accident.
  */
 export declare function action<A extends object = Record<string, never>>(name: string, handler: ActionHandler<A>): ActionRef<A>;
 //#endregion

package/dist/dsl/action.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.mts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;iBAoBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU;WAChB;;WAEA;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;;wBAkBxB,OAAO,mBAAmB,uBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}
+{"version":3,"file":"action.d.mts","names":[],"sources":["../../src/dsl/action.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;iBAsBiB;EACf;;;;;;;EAOA;;;;;;;;YASU,cAAc,qBAAqB,MAAM,GAAG,KAAK,kBAAkB;;;;;iBAM9D,UAAU;WAChB;;EAET,QAAQ,MAAM,GAAG,KAAK,gBAAgB;;;;;;;;;;;;;;;;wBAiBxB,OAAO,mBAAmB,uBACxC,cACA,SAAS,cAAc,KACtB,UAAU"}

package/dist/dsl/action.mjs

@@ -1,4 +1,3 @@
-import { sha256Hex } from "../hash.mjs";
 //#region src/dsl/action.ts
 /**
 * Define a custom action. The generic `A` types the args `.run()` accepts —
@@ -10,15 +9,13 @@ import { sha256Hex } from "../hash.mjs";
 *
 *   workflow(...).run(syncCrm, { plan: u.subscription_plan })
 *
-* codeHash comes from `handler.toString()`, so it changes when the code
-* changes and stays put when it does not. Different build pipelines can print
-* the same function differently (minification), which is why the default
-* runtime policy on mismatch is warn, not fail.
+* The returned object is the action's identity at compile time: compileBundle
+* checks that the one a workflow runs is the very one listed in `actions`, so
+* two definitions cannot share a name by accident.
 */
 function action(name, handler) {
 	return {
 		name,
-		codeHash: sha256Hex(handler.toString()).slice(0, 32),
 		handler
 	};
 }

package/dist/dsl/action.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"action.mjs","names":[],"sources":["../../src/dsl/action.ts"],"sourcesContent":["import { sha256Hex } from '../hash';\n\n/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args, codeHash }`.\n * The runtime resolves the name against a registry (see engine/actions.ts) and\n * compares codeHash to detect version skew between a pinned IR and the\n * currently deployed implementation.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * implementation for the runtime registry and the codeHash for the IR pin.\n */\nexport interface ActionRef<A extends object = object> {\n  readonly name: string;\n  /** Hash of the handler's source text at definition time — the code-identity pin recorded in IR. */\n  readonly codeHash: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * codeHash comes from `handler.toString()`, so it changes when the code\n * changes and stays put when it does not. Different build pipelines can print\n * the same function differently (minification), which is why the default\n * runtime policy on mismatch is warn, not fail.\n */\nexport function action<A extends object = Record<string, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, codeHash: sha256Hex(handler.toString()).slice(0, 32), handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM,UAAU,UAAU,QAAQ,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAAG;CAAQ;AAC/E"}
+{"version":3,"file":"action.mjs","names":[],"sources":["../../src/dsl/action.ts"],"sourcesContent":["/**\n * Custom actions — the escape hatch for side effects the built-in nodes do not\n * cover (CRM sync, coupon issuing, outbound webhooks with custom auth, …).\n *\n * Dual-plane model: the *code* solidifies into the Worker bundle at deploy\n * time (it ships with the app, like any other module), while the *identity*\n * solidifies into IR as `{ type: 'action', action: name, args }`. The runtime\n * resolves the name against a registry (see engine/actions.ts).\n *\n * The IR carries no hash of `handler.toString()`: the printed source depends\n * on the bundler (minification, helper injection, source maps), so every\n * toolchain would produce a different \"version\" of unchanged code and `plan`\n * would report changes nobody made. Code identity is the deployed bundle's,\n * not the IR's.\n *\n * Deliberately NOT supported: custom *conditions*. Branching stays declarative\n * so the canvas can always explain why a user took a path — an action that\n * needs to influence routing writes a property or emits an event, and the\n * decision is expressed as a normal predicate on that data.\n */\n\n/** Runtime context handed to the handler; deliberately small — facts and messaging have their own nodes. */\nexport interface ActionContext {\n  userId: string;\n  /**\n   * `${instanceId}:${nodeId}` — stable across replays and retries of this one\n   * action node. A handler with an external side effect (charging, issuing,\n   * POSTing) must pass it along so the far side collapses the duplicate: the\n   * step body can re-run after the handler already resolved.\n   */\n  idempotencyKey: string;\n}\n\n/**\n * The handler: plain code, executed inside a durable step (`step.do`), so a\n * throw is retried by the runtime and a success is checkpointed — it should be\n * idempotent under retry, which is what `ctx.idempotencyKey` is for. Args\n * arrive with user_property references already resolved to values.\n */\nexport type ActionHandler<A extends object> = (args: A, ctx: ActionContext) => Promise<void> | void;\n\n/**\n * A registered custom action: the named asset `.run()` refers to. Carries the\n * name the IR records and the implementation for the runtime registry.\n */\nexport interface ActionRef<A extends object = object> {\n  readonly name: string;\n  /** Method syntax on purpose: bivariant args let refs with different arg shapes share one list (compileBundle, registries). */\n  handler(args: A, ctx: ActionContext): Promise<void> | void;\n}\n\n/**\n * Define a custom action. The generic `A` types the args `.run()` accepts —\n * the only type injection point, mirroring `template.sms<P>()`:\n *\n *   const syncCrm = action<{ plan: string }>('sync_crm', async ({ plan }, { userId }) => {\n *     await fetch('https://crm.example.com/sync', { method: 'POST', body: JSON.stringify({ userId, plan }) });\n *   });\n *\n *   workflow(...).run(syncCrm, { plan: u.subscription_plan })\n *\n * The returned object is the action's identity at compile time: compileBundle\n * checks that the one a workflow runs is the very one listed in `actions`, so\n * two definitions cannot share a name by accident.\n */\nexport function action<A extends object = Record<string, never>>(\n  name: string,\n  handler: ActionHandler<A>\n): ActionRef<A> {\n  return { name, handler };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiEA,SAAgB,OACd,MACA,SACc;CACd,OAAO;EAAE;EAAM;CAAQ;AACzB"}

package/dist/dsl/bundle.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_hash = require("../hash.cjs");
 const require_templates = require("../templates.cjs");
+const require_dsl_flow = require("./flow.cjs");
+const require_hash = require("../hash.cjs");
 const require_ir = require("../ir.cjs");
 //#region src/dsl/bundle.ts
 /**
@@ -32,8 +33,7 @@ function compileBundle(input) {
 	}));
 	const actions = (input.actions ?? []).map((a) => ({
 		irVersion: 2,
-		name: a.name,
-		codeHash: a.codeHash
+		name: a.name
 	}));
 	const workflows = input.workflows.map((builder) => builder.toIR());
 	assertUniqueNames(workflows.map((w) => w.id), "workflow");
@@ -41,8 +41,9 @@ function compileBundle(input) {
 	assertUniqueNames(templates.map((t) => `${t.channel}:${t.key}`), "template");
 	assertUniqueNames(actions.map((a) => a.name), "action");
 	assertSegmentRefsResolve(workflows, segments);
+	assertNoSegmentCycles(segments);
 	assertConditionPlacement(workflows, segments);
-	assertActionRefsResolve(workflows, actions);
+	assertActionRefsResolve(workflows, input.workflows, input.actions ?? []);
 	return require_ir.BundleIR.parse({
 		irVersion: 2,
 		workflows,
@@ -110,36 +111,39 @@ function collectNodeRefs(nodes, into) {
 		case "cohort": for (const arm of node.arms) collectNodeRefs(arm.flow, into);
 	}
 }
-function assertActionRefsResolve(workflows, actions) {
-	const defined = new Map(actions.map((a) => [a.name, a.codeHash]));
-	for (const workflow of workflows) {
-		const used = /* @__PURE__ */ new Map();
-		collectActionRefs(workflow.flow, used);
-		for (const [name, codeHashes] of used) {
-			const manifestHash = defined.get(name);
-			if (manifestHash === void 0) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${name}' that is not in the bundle — pass it in 'actions'`);
-			for (const codeHash of codeHashes) if (codeHash !== void 0 && codeHash !== manifestHash) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${name}' whose code differs from the one in 'actions' — two definitions are sharing that name`);
+function assertActionRefsResolve(workflows, builders, actions) {
+	const listed = new Map(actions.map((a) => [a.name, a]));
+	workflows.forEach((workflow, i) => {
+		for (const used of require_dsl_flow.actionUses(builders[i])) {
+			const manifest = listed.get(used.name);
+			if (manifest === void 0) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not in the bundle — pass it in 'actions'`);
+			if (manifest !== used && manifest.handler !== used.handler) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not the definition listed in 'actions' — two definitions are sharing that name`);
 		}
-	}
+	});
 }
-/** name → every codeHash seen under it; a name with two is exactly the case worth failing on. */
-function collectActionRefs(nodes, into) {
-	for (const node of nodes) switch (node.type) {
-		case "action": {
-			const seen = into.get(node.action) ?? /* @__PURE__ */ new Set();
-			seen.add(node.codeHash);
-			into.set(node.action, seen);
-			break;
-		}
-		case "wait_until":
-			if (Array.isArray(node.onTimeout)) collectActionRefs(node.onTimeout, into);
-			break;
-		case "branch":
-			for (const branchCase of node.cases) collectActionRefs(branchCase.flow, into);
-			if (node.otherwise) collectActionRefs(node.otherwise, into);
-			break;
-		case "cohort": for (const arm of node.arms) collectActionRefs(arm.flow, into);
+/** Walk segment → segment references depth-first; the first back edge is reported as the cycle path. */
+function assertNoSegmentCycles(segments) {
+	const refsOf = /* @__PURE__ */ new Map();
+	for (const segment of segments) {
+		const refs = /* @__PURE__ */ new Set();
+		collectConditionRefs(segment.condition, refs);
+		refsOf.set(segment.id, refs);
 	}
+	const done = /* @__PURE__ */ new Set();
+	const path = [];
+	const visit = (id) => {
+		const at = path.indexOf(id);
+		if (at !== -1) {
+			const cycle = [...path.slice(at), id].join(" → ");
+			throw new Error(`compileBundle: segments reference each other in a cycle: ${cycle}`);
+		}
+		if (done.has(id)) return;
+		path.push(id);
+		for (const ref of refsOf.get(id) ?? []) visit(ref);
+		path.pop();
+		done.add(id);
+	};
+	for (const id of refsOf.keys()) visit(id);
 }
 function assertConditionPlacement(workflows, segments) {
 	for (const workflow of workflows) {

package/dist/dsl/bundle.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.cjs","names":["semanticHash","CHANNEL_OF","BundleIRSchema"],"sources":["../../src/dsl/bundle.ts"],"sourcesContent":["import { semanticHash } from '../hash';\nimport {\n  type BundleIR,\n  BundleIR as BundleIRSchema,\n  type ConditionIR,\n  IR_VERSION,\n  type NodeIR,\n  type SegmentIR,\n  type WorkflowIR,\n} from '../ir';\nimport { type AnyTemplate, CHANNEL_OF } from '../templates';\nimport type { ActionRef } from './action';\nimport type { SegmentInternal, SegmentRef } from './condition';\nimport type { WorkflowBuilder } from './workflow';\n\n/**\n * The deployment unit — compileBundle gathers workflows, segments and the\n * template manifest into one BundleIR snapshot (terraform-apply mental model);\n * the server diffs each definition by contentHash (see plan.ts).\n */\nexport function compileBundle(input: {\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  /** The template manifest: these definitions, by channel and id. */\n  templates?: readonly AnyTemplate[];\n  actions?: readonly ActionRef[];\n}): BundleIR {\n  const segments = (input.segments ?? []).map((segment) => {\n    const { id, definition, loc, meta } = segment as SegmentInternal;\n    const compiled: SegmentIR = {\n      irVersion: IR_VERSION,\n      id,\n      // Labels and provenance both live in meta, which stripMeta drops before hashing\n      contentHash: semanticHash(definition),\n      condition: definition,\n    };\n    const merged = {\n      ...(meta?.name !== undefined ? { name: meta.name } : {}),\n      ...(meta?.description !== undefined ? { description: meta.description } : {}),\n      ...(loc !== undefined ? { loc } : {}),\n    };\n    if (Object.keys(merged).length > 0) compiled.meta = merged;\n    return compiled;\n  });\n\n  const templates = (input.templates ?? []).map((template) => ({\n    irVersion: IR_VERSION,\n    key: template.id,\n    channel: CHANNEL_OF[template.kind],\n  }));\n\n  // Manifest only — name and code-identity hash; the implementation ships in the Worker bundle, never in IR\n  const actions = (input.actions ?? []).map((a) => ({\n    irVersion: IR_VERSION,\n    name: a.name,\n    codeHash: a.codeHash,\n  }));\n\n  const workflows = input.workflows.map((builder) => builder.toIR());\n\n  // Names are wire identity (routing tables, entry ledger, by-name refs):\n  // duplicates would silently last-write-win on deploy, so fail the compile.\n  assertUniqueNames(\n    workflows.map((w) => w.id),\n    'workflow'\n  );\n  assertUniqueNames(\n    segments.map((s) => s.id),\n    'segment'\n  );\n  // A message node names its template by channel and key, so the key is unique per channel:\n  // an email and a push of one nudge may share it\n  assertUniqueNames(\n    templates.map((t) => `${t.channel}:${t.key}`),\n    'template'\n  );\n  assertUniqueNames(\n    actions.map((a) => a.name),\n    'action'\n  );\n\n  // Deploy replaces the whole segment table, so every by-name reference must\n  // resolve inside this bundle — catching it here turns a runtime \"Unknown\n  // segment\" in some user's journey into a compile error.\n  assertSegmentRefsResolve(workflows, segments);\n\n  // Payload predicates and profile predicates share the Condition type, so\n  // placement is checked here: payload only inside where-trees, and where-trees\n  // contain nothing but payload predicates and combinators.\n  assertConditionPlacement(workflows, segments);\n\n  // Same rationale as segments: the runtime registry is looked up by name, so\n  // an action a workflow runs must be in the bundle — and its codeHash must\n  // agree, or two same-named definitions are competing for one identity.\n  assertActionRefsResolve(workflows, actions);\n\n  return BundleIRSchema.parse({ irVersion: IR_VERSION, workflows, segments, templates, actions });\n}\n\nfunction assertUniqueNames(names: readonly string[], kind: string): void {\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) throw new Error(`compileBundle: duplicate ${kind} name '${name}'`);\n    seen.add(name);\n  }\n}\n\nfunction assertSegmentRefsResolve(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  const defined = new Set(segments.map((s) => s.id));\n  const check = (refs: ReadonlySet<string>, owner: string): void => {\n    for (const ref of refs) {\n      if (!defined.has(ref)) {\n        throw new Error(\n          `compileBundle: ${owner} references segment '${ref}' that is not in the bundle — pass it in 'segments'`\n        );\n      }\n    }\n  };\n  for (const workflow of workflows) {\n    check(referencedSegments(workflow), `workflow '${workflow.id}'`);\n  }\n  // Segments may reference other segments; those must resolve too\n  for (const segment of segments) {\n    const refs = new Set<string>();\n    collectConditionRefs(segment.condition, refs);\n    check(refs, `segment '${segment.id}'`);\n  }\n}\n\nfunction referencedSegments(workflow: WorkflowIR): Set<string> {\n  const refs = new Set<string>();\n  if (workflow.trigger.type === 'segment') refs.add(workflow.trigger.segment);\n  if (workflow.trigger.type === 'event' && workflow.trigger.filter !== undefined) {\n    collectConditionRefs(workflow.trigger.filter, refs);\n  }\n  if (workflow.goal !== undefined) collectConditionRefs(workflow.goal.condition, refs);\n  if (workflow.exitWhen !== undefined) collectConditionRefs(workflow.exitWhen, refs);\n  collectNodeRefs(workflow.flow, refs);\n  return refs;\n}\n\nfunction collectConditionRefs(condition: ConditionIR, into: Set<string>): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) collectConditionRefs(child, into);\n      break;\n    case 'not':\n      collectConditionRefs(condition.condition, into);\n      break;\n    case 'segment':\n      into.add(condition.segment);\n      break;\n    default:\n      break;\n  }\n}\n\nfunction collectNodeRefs(nodes: readonly NodeIR[], into: Set<string>): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        collectConditionRefs(node.condition, into);\n        if (Array.isArray(node.onTimeout)) collectNodeRefs(node.onTimeout, into);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          collectConditionRefs(branchCase.condition, into);\n          collectNodeRefs(branchCase.flow, into);\n        }\n        if (node.otherwise) collectNodeRefs(node.otherwise, into);\n        break;\n      case 'filter':\n        collectConditionRefs(node.condition, into);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) collectNodeRefs(arm.flow, into);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction assertActionRefsResolve(\n  workflows: readonly WorkflowIR[],\n  actions: readonly { name: string; codeHash: string }[]\n): void {\n  const defined = new Map(actions.map((a) => [a.name, a.codeHash]));\n  for (const workflow of workflows) {\n    const used = new Map<string, Set<string | undefined>>();\n    collectActionRefs(workflow.flow, used);\n    for (const [name, codeHashes] of used) {\n      const manifestHash = defined.get(name);\n      if (manifestHash === undefined) {\n        throw new Error(\n          `compileBundle: workflow '${workflow.id}' runs action '${name}' that is not in the bundle — pass it in 'actions'`\n        );\n      }\n      // Every node's hash is checked, not just one per name: with two\n      // definitions under one name, whichever the manifest holds, the *other*\n      // node is the one that would meet a mismatched implementation at run time.\n      for (const codeHash of codeHashes) {\n        if (codeHash !== undefined && codeHash !== manifestHash) {\n          throw new Error(\n            `compileBundle: workflow '${workflow.id}' runs action '${name}' whose code differs from the one in 'actions' — two definitions are sharing that name`\n          );\n        }\n      }\n    }\n  }\n}\n\n/** name → every codeHash seen under it; a name with two is exactly the case worth failing on. */\nfunction collectActionRefs(\n  nodes: readonly NodeIR[],\n  into: Map<string, Set<string | undefined>>\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'action': {\n        const seen = into.get(node.action) ?? new Set<string | undefined>();\n        seen.add(node.codeHash);\n        into.set(node.action, seen);\n        break;\n      }\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) collectActionRefs(node.onTimeout, into);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) collectActionRefs(branchCase.flow, into);\n        if (node.otherwise) collectActionRefs(node.otherwise, into);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) collectActionRefs(arm.flow, into);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\n/* --------------------- payload / profile placement checks --------------------- */\n\nfunction assertConditionPlacement(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  for (const workflow of workflows) {\n    if (workflow.trigger.type === 'event') {\n      if (workflow.trigger.where !== undefined) {\n        assertWhereTree(workflow.trigger.where, `workflow '${workflow.id}' trigger where`);\n      }\n      if (workflow.trigger.filter !== undefined) {\n        assertProfileTree(workflow.trigger.filter, `workflow '${workflow.id}' trigger filter`);\n      }\n    }\n    if (workflow.goal !== undefined) {\n      assertProfileTree(workflow.goal.condition, `workflow '${workflow.id}' goal`);\n    }\n    if (workflow.exitWhen !== undefined) {\n      assertProfileTree(workflow.exitWhen, `workflow '${workflow.id}' exitWhen`);\n    }\n    assertNodeTrees(workflow.flow, `workflow '${workflow.id}'`);\n  }\n  for (const segment of segments) {\n    assertProfileTree(segment.condition, `segment '${segment.id}'`);\n  }\n}\n\n/** A profile-context tree: payload predicates may appear only under a performed.where. */\nfunction assertProfileTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertProfileTree(child, owner);\n      break;\n    case 'not':\n      assertProfileTree(condition.condition, owner);\n      break;\n    case 'performed':\n      if (condition.where !== undefined) assertWhereTree(condition.where, owner);\n      break;\n    case 'payload':\n      throw new Error(\n        `compileBundle: ${owner} uses a payload predicate outside a where clause — payload refs are only valid inside performed({ where }) or trigger.event({ where })`\n      );\n    default:\n      break; // property / segment\n  }\n}\n\n/** A where tree: payload predicates and combinators only — no profile facts in event scope. */\nfunction assertWhereTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertWhereTree(child, owner);\n      break;\n    case 'not':\n      assertWhereTree(condition.condition, owner);\n      break;\n    case 'payload':\n      break;\n    default:\n      throw new Error(\n        `compileBundle: ${owner} where clause may only contain payload predicates and and/or/not, found '${condition.type}'`\n      );\n  }\n}\n\nfunction assertNodeTrees(nodes: readonly NodeIR[], owner: string): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        assertProfileTree(node.condition, owner);\n        if (Array.isArray(node.onTimeout)) assertNodeTrees(node.onTimeout, owner);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          assertProfileTree(branchCase.condition, owner);\n          assertNodeTrees(branchCase.flow, owner);\n        }\n        if (node.otherwise) assertNodeTrees(node.otherwise, owner);\n        break;\n      case 'filter':\n        assertProfileTree(node.condition, owner);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) assertNodeTrees(arm.flow, owner);\n        break;\n      default:\n        break;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAoBA,SAAgB,cAAc,OAMjB;CACX,MAAM,YAAY,MAAM,YAAY,CAAC,EAAA,CAAG,KAAK,YAAY;EACvD,MAAM,EAAE,IAAI,YAAY,KAAK,SAAS;EACtC,MAAM,WAAsB;GAC1B,WAAA;GACA;GAEA,aAAaA,aAAAA,aAAa,UAAU;GACpC,WAAW;EACb;EACA,MAAM,SAAS;GACb,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;GACtD,GAAI,MAAM,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;GAC3E,GAAI,QAAQ,KAAA,IAAY,EAAE,IAAI,IAAI,CAAC;EACrC;EACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,GAAG,SAAS,OAAO;EACpD,OAAO;CACT,CAAC;CAED,MAAM,aAAa,MAAM,aAAa,CAAC,EAAA,CAAG,KAAK,cAAc;EAC3D,WAAA;EACA,KAAK,SAAS;EACd,SAASC,kBAAAA,WAAW,SAAS;CAC/B,EAAE;CAGF,MAAM,WAAW,MAAM,WAAW,CAAC,EAAA,CAAG,KAAK,OAAO;EAChD,WAAA;EACA,MAAM,EAAE;EACR,UAAU,EAAE;CACd,EAAE;CAEF,MAAM,YAAY,MAAM,UAAU,KAAK,YAAY,QAAQ,KAAK,CAAC;CAIjE,kBACE,UAAU,KAAK,MAAM,EAAE,EAAE,GACzB,UACF;CACA,kBACE,SAAS,KAAK,MAAM,EAAE,EAAE,GACxB,SACF;CAGA,kBACE,UAAU,KAAK,MAAM,GAAG,EAAE,QAAQ,GAAG,EAAE,KAAK,GAC5C,UACF;CACA,kBACE,QAAQ,KAAK,MAAM,EAAE,IAAI,GACzB,QACF;CAKA,yBAAyB,WAAW,QAAQ;CAK5C,yBAAyB,WAAW,QAAQ;CAK5C,wBAAwB,WAAW,OAAO;CAE1C,OAAOC,WAAAA,SAAe,MAAM;EAAE,WAAA;EAAuB;EAAW;EAAU;EAAW;CAAQ,CAAC;AAChG;AAEA,SAAS,kBAAkB,OAA0B,MAAoB;CACvE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,4BAA4B,KAAK,SAAS,KAAK,EAAE;EACrF,KAAK,IAAI,IAAI;CACf;AACF;AAEA,SAAS,yBACP,WACA,UACM;CACN,MAAM,UAAU,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,EAAE,CAAC;CACjD,MAAM,SAAS,MAA2B,UAAwB;EAChE,KAAK,MAAM,OAAO,MAChB,IAAI,CAAC,QAAQ,IAAI,GAAG,GAClB,MAAM,IAAI,MACR,kBAAkB,MAAM,uBAAuB,IAAI,oDACrD;CAGN;CACA,KAAK,MAAM,YAAY,WACrB,MAAM,mBAAmB,QAAQ,GAAG,aAAa,SAAS,GAAG,EAAE;CAGjE,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,uBAAO,IAAI,IAAY;EAC7B,qBAAqB,QAAQ,WAAW,IAAI;EAC5C,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE;CACvC;AACF;AAEA,SAAS,mBAAmB,UAAmC;CAC7D,MAAM,uBAAO,IAAI,IAAY;CAC7B,IAAI,SAAS,QAAQ,SAAS,WAAW,KAAK,IAAI,SAAS,QAAQ,OAAO;CAC1E,IAAI,SAAS,QAAQ,SAAS,WAAW,SAAS,QAAQ,WAAW,KAAA,GACnE,qBAAqB,SAAS,QAAQ,QAAQ,IAAI;CAEpD,IAAI,SAAS,SAAS,KAAA,GAAW,qBAAqB,SAAS,KAAK,WAAW,IAAI;CACnF,IAAI,SAAS,aAAa,KAAA,GAAW,qBAAqB,SAAS,UAAU,IAAI;CACjF,gBAAgB,SAAS,MAAM,IAAI;CACnC,OAAO;AACT;AAEA,SAAS,qBAAqB,WAAwB,MAAyB;CAC7E,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,qBAAqB,OAAO,IAAI;GAC1E;EACF,KAAK;GACH,qBAAqB,UAAU,WAAW,IAAI;GAC9C;EACF,KAAK,WACH,KAAK,IAAI,UAAU,OAAO;CAI9B;AACF;AAEA,SAAS,gBAAgB,OAA0B,MAAyB;CAC1E,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,IAAI;GACvE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,qBAAqB,WAAW,WAAW,IAAI;IAC/C,gBAAgB,WAAW,MAAM,IAAI;GACvC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,IAAI;GACxD;EACF,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,IAAI;CAI/D;AAEJ;AAEA,SAAS,wBACP,WACA,SACM;CACN,MAAM,UAAU,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CAChE,KAAK,MAAM,YAAY,WAAW;EAChC,MAAM,uBAAO,IAAI,IAAqC;EACtD,kBAAkB,SAAS,MAAM,IAAI;EACrC,KAAK,MAAM,CAAC,MAAM,eAAe,MAAM;GACrC,MAAM,eAAe,QAAQ,IAAI,IAAI;GACrC,IAAI,iBAAiB,KAAA,GACnB,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,mDAChE;GAKF,KAAK,MAAM,YAAY,YACrB,IAAI,aAAa,KAAA,KAAa,aAAa,cACzC,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,uFAChE;EAGN;CACF;AACF;;AAGA,SAAS,kBACP,OACA,MACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK,UAAU;GACb,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,qBAAK,IAAI,IAAwB;GAClE,KAAK,IAAI,KAAK,QAAQ;GACtB,KAAK,IAAI,KAAK,QAAQ,IAAI;GAC1B;EACF;EACA,KAAK;GACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,kBAAkB,KAAK,WAAW,IAAI;GACzE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO,kBAAkB,WAAW,MAAM,IAAI;GAC5E,IAAI,KAAK,WAAW,kBAAkB,KAAK,WAAW,IAAI;GAC1D;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,kBAAkB,IAAI,MAAM,IAAI;CAIjE;AAEJ;AAIA,SAAS,yBACP,WACA,UACM;CACN,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI,SAAS,QAAQ,SAAS,SAAS;GACrC,IAAI,SAAS,QAAQ,UAAU,KAAA,GAC7B,gBAAgB,SAAS,QAAQ,OAAO,aAAa,SAAS,GAAG,gBAAgB;GAEnF,IAAI,SAAS,QAAQ,WAAW,KAAA,GAC9B,kBAAkB,SAAS,QAAQ,QAAQ,aAAa,SAAS,GAAG,iBAAiB;EAEzF;EACA,IAAI,SAAS,SAAS,KAAA,GACpB,kBAAkB,SAAS,KAAK,WAAW,aAAa,SAAS,GAAG,OAAO;EAE7E,IAAI,SAAS,aAAa,KAAA,GACxB,kBAAkB,SAAS,UAAU,aAAa,SAAS,GAAG,WAAW;EAE3E,gBAAgB,SAAS,MAAM,aAAa,SAAS,GAAG,EAAE;CAC5D;CACA,KAAK,MAAM,WAAW,UACpB,kBAAkB,QAAQ,WAAW,YAAY,QAAQ,GAAG,EAAE;AAElE;;AAGA,SAAS,kBAAkB,WAAwB,OAAqB;CACtE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,kBAAkB,OAAO,KAAK;GACxE;EACF,KAAK;GACH,kBAAkB,UAAU,WAAW,KAAK;GAC5C;EACF,KAAK;GACH,IAAI,UAAU,UAAU,KAAA,GAAW,gBAAgB,UAAU,OAAO,KAAK;GACzE;EACF,KAAK,WACH,MAAM,IAAI,MACR,kBAAkB,MAAM,uIAC1B;CAGJ;AACF;;AAGA,SAAS,gBAAgB,WAAwB,OAAqB;CACpE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,gBAAgB,OAAO,KAAK;GACtE;EACF,KAAK;GACH,gBAAgB,UAAU,WAAW,KAAK;GAC1C;EACF,KAAK,WACH;EACF,SACE,MAAM,IAAI,MACR,kBAAkB,MAAM,2EAA2E,UAAU,KAAK,EACpH;CACJ;AACF;AAEA,SAAS,gBAAgB,OAA0B,OAAqB;CACtE,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,KAAK;GACxE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,kBAAkB,WAAW,WAAW,KAAK;IAC7C,gBAAgB,WAAW,MAAM,KAAK;GACxC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,KAAK;GACzD;EACF,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,KAAK;CAIhE;AAEJ"}
+{"version":3,"file":"bundle.cjs","names":["semanticHash","CHANNEL_OF","BundleIRSchema","actionUses"],"sources":["../../src/dsl/bundle.ts"],"sourcesContent":["import { semanticHash } from '../hash';\nimport {\n  type BundleIR,\n  BundleIR as BundleIRSchema,\n  type ConditionIR,\n  IR_VERSION,\n  type NodeIR,\n  type SegmentIR,\n  type WorkflowIR,\n} from '../ir';\nimport { type AnyTemplate, CHANNEL_OF } from '../templates';\nimport type { ActionRef } from './action';\nimport type { SegmentInternal, SegmentRef } from './condition';\nimport { actionUses } from './flow';\nimport type { WorkflowBuilder } from './workflow';\n\n/**\n * The deployment unit — compileBundle gathers workflows, segments and the\n * template manifest into one BundleIR snapshot (terraform-apply mental model);\n * the server diffs each definition by contentHash (see plan.ts).\n */\nexport function compileBundle(input: {\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  /** The template manifest: these definitions, by channel and id. */\n  templates?: readonly AnyTemplate[];\n  actions?: readonly ActionRef[];\n}): BundleIR {\n  const segments = (input.segments ?? []).map((segment) => {\n    const { id, definition, loc, meta } = segment as SegmentInternal;\n    const compiled: SegmentIR = {\n      irVersion: IR_VERSION,\n      id,\n      // Labels and provenance both live in meta, which stripMeta drops before hashing\n      contentHash: semanticHash(definition),\n      condition: definition,\n    };\n    const merged = {\n      ...(meta?.name !== undefined ? { name: meta.name } : {}),\n      ...(meta?.description !== undefined ? { description: meta.description } : {}),\n      ...(loc !== undefined ? { loc } : {}),\n    };\n    if (Object.keys(merged).length > 0) compiled.meta = merged;\n    return compiled;\n  });\n\n  const templates = (input.templates ?? []).map((template) => ({\n    irVersion: IR_VERSION,\n    key: template.id,\n    channel: CHANNEL_OF[template.kind],\n  }));\n\n  // Manifest only — names; the implementation ships in the Worker bundle, never in IR\n  const actions = (input.actions ?? []).map((a) => ({ irVersion: IR_VERSION, name: a.name }));\n\n  const workflows = input.workflows.map((builder) => builder.toIR());\n\n  // Names are wire identity (routing tables, entry ledger, by-name refs):\n  // duplicates would silently last-write-win on deploy, so fail the compile.\n  assertUniqueNames(\n    workflows.map((w) => w.id),\n    'workflow'\n  );\n  assertUniqueNames(\n    segments.map((s) => s.id),\n    'segment'\n  );\n  // A message node names its template by channel and key, so the key is unique per channel:\n  // an email and a push of one nudge may share it\n  assertUniqueNames(\n    templates.map((t) => `${t.channel}:${t.key}`),\n    'template'\n  );\n  assertUniqueNames(\n    actions.map((a) => a.name),\n    'action'\n  );\n\n  // Deploy replaces the whole segment table, so every by-name reference must\n  // resolve inside this bundle — catching it here turns a runtime \"Unknown\n  // segment\" in some user's journey into a compile error.\n  assertSegmentRefsResolve(workflows, segments);\n\n  // A segment is evaluated by evaluating the segments it names; a cycle among\n  // them has no evaluation order and would recurse until the stack ran out —\n  // at run time, in some user's journey. Caught here, with the cycle spelled out.\n  assertNoSegmentCycles(segments);\n\n  // Payload predicates and profile predicates share the Condition type, so\n  // placement is checked here: payload only inside where-trees, and where-trees\n  // contain nothing but payload predicates and combinators.\n  assertConditionPlacement(workflows, segments);\n\n  // Same rationale as segments: the runtime registry is looked up by name, so\n  // an action a workflow runs must be in the bundle — and it must be the very\n  // definition listed there, or two same-named definitions are competing for\n  // one identity (the IR names it; only the compile can tell them apart).\n  assertActionRefsResolve(workflows, input.workflows, input.actions ?? []);\n\n  return BundleIRSchema.parse({ irVersion: IR_VERSION, workflows, segments, templates, actions });\n}\n\nfunction assertUniqueNames(names: readonly string[], kind: string): void {\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) throw new Error(`compileBundle: duplicate ${kind} name '${name}'`);\n    seen.add(name);\n  }\n}\n\nfunction assertSegmentRefsResolve(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  const defined = new Set(segments.map((s) => s.id));\n  const check = (refs: ReadonlySet<string>, owner: string): void => {\n    for (const ref of refs) {\n      if (!defined.has(ref)) {\n        throw new Error(\n          `compileBundle: ${owner} references segment '${ref}' that is not in the bundle — pass it in 'segments'`\n        );\n      }\n    }\n  };\n  for (const workflow of workflows) {\n    check(referencedSegments(workflow), `workflow '${workflow.id}'`);\n  }\n  // Segments may reference other segments; those must resolve too\n  for (const segment of segments) {\n    const refs = new Set<string>();\n    collectConditionRefs(segment.condition, refs);\n    check(refs, `segment '${segment.id}'`);\n  }\n}\n\nfunction referencedSegments(workflow: WorkflowIR): Set<string> {\n  const refs = new Set<string>();\n  if (workflow.trigger.type === 'segment') refs.add(workflow.trigger.segment);\n  if (workflow.trigger.type === 'event' && workflow.trigger.filter !== undefined) {\n    collectConditionRefs(workflow.trigger.filter, refs);\n  }\n  if (workflow.goal !== undefined) collectConditionRefs(workflow.goal.condition, refs);\n  if (workflow.exitWhen !== undefined) collectConditionRefs(workflow.exitWhen, refs);\n  collectNodeRefs(workflow.flow, refs);\n  return refs;\n}\n\nfunction collectConditionRefs(condition: ConditionIR, into: Set<string>): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) collectConditionRefs(child, into);\n      break;\n    case 'not':\n      collectConditionRefs(condition.condition, into);\n      break;\n    case 'segment':\n      into.add(condition.segment);\n      break;\n    default:\n      break;\n  }\n}\n\nfunction collectNodeRefs(nodes: readonly NodeIR[], into: Set<string>): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        collectConditionRefs(node.condition, into);\n        if (Array.isArray(node.onTimeout)) collectNodeRefs(node.onTimeout, into);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          collectConditionRefs(branchCase.condition, into);\n          collectNodeRefs(branchCase.flow, into);\n        }\n        if (node.otherwise) collectNodeRefs(node.otherwise, into);\n        break;\n      case 'filter':\n        collectConditionRefs(node.condition, into);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) collectNodeRefs(arm.flow, into);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction assertActionRefsResolve(\n  workflows: readonly WorkflowIR[],\n  builders: readonly WorkflowBuilder[],\n  actions: readonly ActionRef[]\n): void {\n  const listed = new Map(actions.map((a) => [a.name, a]));\n  workflows.forEach((workflow, i) => {\n    for (const used of actionUses(builders[i])) {\n      const manifest = listed.get(used.name);\n      if (manifest === undefined) {\n        throw new Error(\n          `compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not in the bundle — pass it in 'actions'`\n        );\n      }\n      // Identity, not source text: the printed handler depends on the bundler.\n      // Every use is checked, not one per name — with two definitions under one\n      // name, whichever is listed, the *other* node would run the wrong code.\n      if (manifest !== used && manifest.handler !== used.handler) {\n        throw new Error(\n          `compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not the definition listed in 'actions' — two definitions are sharing that name`\n        );\n      }\n    }\n  });\n}\n\n/** Walk segment → segment references depth-first; the first back edge is reported as the cycle path. */\nfunction assertNoSegmentCycles(segments: readonly SegmentIR[]): void {\n  const refsOf = new Map<string, Set<string>>();\n  for (const segment of segments) {\n    const refs = new Set<string>();\n    collectConditionRefs(segment.condition, refs);\n    refsOf.set(segment.id, refs);\n  }\n  const done = new Set<string>();\n  const path: string[] = [];\n  const visit = (id: string): void => {\n    const at = path.indexOf(id);\n    if (at !== -1) {\n      const cycle = [...path.slice(at), id].join(' → ');\n      throw new Error(`compileBundle: segments reference each other in a cycle: ${cycle}`);\n    }\n    if (done.has(id)) return;\n    path.push(id);\n    for (const ref of refsOf.get(id) ?? []) visit(ref);\n    path.pop();\n    done.add(id);\n  };\n  for (const id of refsOf.keys()) visit(id);\n}\n\n/* --------------------- payload / profile placement checks --------------------- */\n\nfunction assertConditionPlacement(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  for (const workflow of workflows) {\n    if (workflow.trigger.type === 'event') {\n      if (workflow.trigger.where !== undefined) {\n        assertWhereTree(workflow.trigger.where, `workflow '${workflow.id}' trigger where`);\n      }\n      if (workflow.trigger.filter !== undefined) {\n        assertProfileTree(workflow.trigger.filter, `workflow '${workflow.id}' trigger filter`);\n      }\n    }\n    if (workflow.goal !== undefined) {\n      assertProfileTree(workflow.goal.condition, `workflow '${workflow.id}' goal`);\n    }\n    if (workflow.exitWhen !== undefined) {\n      assertProfileTree(workflow.exitWhen, `workflow '${workflow.id}' exitWhen`);\n    }\n    assertNodeTrees(workflow.flow, `workflow '${workflow.id}'`);\n  }\n  for (const segment of segments) {\n    assertProfileTree(segment.condition, `segment '${segment.id}'`);\n  }\n}\n\n/** A profile-context tree: payload predicates may appear only under a performed.where. */\nfunction assertProfileTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertProfileTree(child, owner);\n      break;\n    case 'not':\n      assertProfileTree(condition.condition, owner);\n      break;\n    case 'performed':\n      if (condition.where !== undefined) assertWhereTree(condition.where, owner);\n      break;\n    case 'payload':\n      throw new Error(\n        `compileBundle: ${owner} uses a payload predicate outside a where clause — payload refs are only valid inside performed({ where }) or trigger.event({ where })`\n      );\n    default:\n      break; // property / segment\n  }\n}\n\n/** A where tree: payload predicates and combinators only — no profile facts in event scope. */\nfunction assertWhereTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertWhereTree(child, owner);\n      break;\n    case 'not':\n      assertWhereTree(condition.condition, owner);\n      break;\n    case 'payload':\n      break;\n    default:\n      throw new Error(\n        `compileBundle: ${owner} where clause may only contain payload predicates and and/or/not, found '${condition.type}'`\n      );\n  }\n}\n\nfunction assertNodeTrees(nodes: readonly NodeIR[], owner: string): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        assertProfileTree(node.condition, owner);\n        if (Array.isArray(node.onTimeout)) assertNodeTrees(node.onTimeout, owner);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          assertProfileTree(branchCase.condition, owner);\n          assertNodeTrees(branchCase.flow, owner);\n        }\n        if (node.otherwise) assertNodeTrees(node.otherwise, owner);\n        break;\n      case 'filter':\n        assertProfileTree(node.condition, owner);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) assertNodeTrees(arm.flow, owner);\n        break;\n      default:\n        break;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAqBA,SAAgB,cAAc,OAMjB;CACX,MAAM,YAAY,MAAM,YAAY,CAAC,EAAA,CAAG,KAAK,YAAY;EACvD,MAAM,EAAE,IAAI,YAAY,KAAK,SAAS;EACtC,MAAM,WAAsB;GAC1B,WAAA;GACA;GAEA,aAAaA,aAAAA,aAAa,UAAU;GACpC,WAAW;EACb;EACA,MAAM,SAAS;GACb,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;GACtD,GAAI,MAAM,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;GAC3E,GAAI,QAAQ,KAAA,IAAY,EAAE,IAAI,IAAI,CAAC;EACrC;EACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,GAAG,SAAS,OAAO;EACpD,OAAO;CACT,CAAC;CAED,MAAM,aAAa,MAAM,aAAa,CAAC,EAAA,CAAG,KAAK,cAAc;EAC3D,WAAA;EACA,KAAK,SAAS;EACd,SAASC,kBAAAA,WAAW,SAAS;CAC/B,EAAE;CAGF,MAAM,WAAW,MAAM,WAAW,CAAC,EAAA,CAAG,KAAK,OAAO;EAAE,WAAA;EAAuB,MAAM,EAAE;CAAK,EAAE;CAE1F,MAAM,YAAY,MAAM,UAAU,KAAK,YAAY,QAAQ,KAAK,CAAC;CAIjE,kBACE,UAAU,KAAK,MAAM,EAAE,EAAE,GACzB,UACF;CACA,kBACE,SAAS,KAAK,MAAM,EAAE,EAAE,GACxB,SACF;CAGA,kBACE,UAAU,KAAK,MAAM,GAAG,EAAE,QAAQ,GAAG,EAAE,KAAK,GAC5C,UACF;CACA,kBACE,QAAQ,KAAK,MAAM,EAAE,IAAI,GACzB,QACF;CAKA,yBAAyB,WAAW,QAAQ;CAK5C,sBAAsB,QAAQ;CAK9B,yBAAyB,WAAW,QAAQ;CAM5C,wBAAwB,WAAW,MAAM,WAAW,MAAM,WAAW,CAAC,CAAC;CAEvE,OAAOC,WAAAA,SAAe,MAAM;EAAE,WAAA;EAAuB;EAAW;EAAU;EAAW;CAAQ,CAAC;AAChG;AAEA,SAAS,kBAAkB,OAA0B,MAAoB;CACvE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,4BAA4B,KAAK,SAAS,KAAK,EAAE;EACrF,KAAK,IAAI,IAAI;CACf;AACF;AAEA,SAAS,yBACP,WACA,UACM;CACN,MAAM,UAAU,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,EAAE,CAAC;CACjD,MAAM,SAAS,MAA2B,UAAwB;EAChE,KAAK,MAAM,OAAO,MAChB,IAAI,CAAC,QAAQ,IAAI,GAAG,GAClB,MAAM,IAAI,MACR,kBAAkB,MAAM,uBAAuB,IAAI,oDACrD;CAGN;CACA,KAAK,MAAM,YAAY,WACrB,MAAM,mBAAmB,QAAQ,GAAG,aAAa,SAAS,GAAG,EAAE;CAGjE,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,uBAAO,IAAI,IAAY;EAC7B,qBAAqB,QAAQ,WAAW,IAAI;EAC5C,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE;CACvC;AACF;AAEA,SAAS,mBAAmB,UAAmC;CAC7D,MAAM,uBAAO,IAAI,IAAY;CAC7B,IAAI,SAAS,QAAQ,SAAS,WAAW,KAAK,IAAI,SAAS,QAAQ,OAAO;CAC1E,IAAI,SAAS,QAAQ,SAAS,WAAW,SAAS,QAAQ,WAAW,KAAA,GACnE,qBAAqB,SAAS,QAAQ,QAAQ,IAAI;CAEpD,IAAI,SAAS,SAAS,KAAA,GAAW,qBAAqB,SAAS,KAAK,WAAW,IAAI;CACnF,IAAI,SAAS,aAAa,KAAA,GAAW,qBAAqB,SAAS,UAAU,IAAI;CACjF,gBAAgB,SAAS,MAAM,IAAI;CACnC,OAAO;AACT;AAEA,SAAS,qBAAqB,WAAwB,MAAyB;CAC7E,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,qBAAqB,OAAO,IAAI;GAC1E;EACF,KAAK;GACH,qBAAqB,UAAU,WAAW,IAAI;GAC9C;EACF,KAAK,WACH,KAAK,IAAI,UAAU,OAAO;CAI9B;AACF;AAEA,SAAS,gBAAgB,OAA0B,MAAyB;CAC1E,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,IAAI;GACvE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,qBAAqB,WAAW,WAAW,IAAI;IAC/C,gBAAgB,WAAW,MAAM,IAAI;GACvC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,IAAI;GACxD;EACF,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,IAAI;CAI/D;AAEJ;AAEA,SAAS,wBACP,WACA,UACA,SACM;CACN,MAAM,SAAS,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD,UAAU,SAAS,UAAU,MAAM;EACjC,KAAK,MAAM,QAAQC,iBAAAA,WAAW,SAAS,EAAE,GAAG;GAC1C,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;GACrC,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,KAAK,mDACrE;GAKF,IAAI,aAAa,QAAQ,SAAS,YAAY,KAAK,SACjD,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,KAAK,yFACrE;EAEJ;CACF,CAAC;AACH;;AAGA,SAAS,sBAAsB,UAAsC;CACnE,MAAM,yBAAS,IAAI,IAAyB;CAC5C,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,uBAAO,IAAI,IAAY;EAC7B,qBAAqB,QAAQ,WAAW,IAAI;EAC5C,OAAO,IAAI,QAAQ,IAAI,IAAI;CAC7B;CACA,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,OAAiB,CAAC;CACxB,MAAM,SAAS,OAAqB;EAClC,MAAM,KAAK,KAAK,QAAQ,EAAE;EAC1B,IAAI,OAAO,IAAI;GACb,MAAM,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK;GAChD,MAAM,IAAI,MAAM,4DAA4D,OAAO;EACrF;EACA,IAAI,KAAK,IAAI,EAAE,GAAG;EAClB,KAAK,KAAK,EAAE;EACZ,KAAK,MAAM,OAAO,OAAO,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG;EACjD,KAAK,IAAI;EACT,KAAK,IAAI,EAAE;CACb;CACA,KAAK,MAAM,MAAM,OAAO,KAAK,GAAG,MAAM,EAAE;AAC1C;AAIA,SAAS,yBACP,WACA,UACM;CACN,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI,SAAS,QAAQ,SAAS,SAAS;GACrC,IAAI,SAAS,QAAQ,UAAU,KAAA,GAC7B,gBAAgB,SAAS,QAAQ,OAAO,aAAa,SAAS,GAAG,gBAAgB;GAEnF,IAAI,SAAS,QAAQ,WAAW,KAAA,GAC9B,kBAAkB,SAAS,QAAQ,QAAQ,aAAa,SAAS,GAAG,iBAAiB;EAEzF;EACA,IAAI,SAAS,SAAS,KAAA,GACpB,kBAAkB,SAAS,KAAK,WAAW,aAAa,SAAS,GAAG,OAAO;EAE7E,IAAI,SAAS,aAAa,KAAA,GACxB,kBAAkB,SAAS,UAAU,aAAa,SAAS,GAAG,WAAW;EAE3E,gBAAgB,SAAS,MAAM,aAAa,SAAS,GAAG,EAAE;CAC5D;CACA,KAAK,MAAM,WAAW,UACpB,kBAAkB,QAAQ,WAAW,YAAY,QAAQ,GAAG,EAAE;AAElE;;AAGA,SAAS,kBAAkB,WAAwB,OAAqB;CACtE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,kBAAkB,OAAO,KAAK;GACxE;EACF,KAAK;GACH,kBAAkB,UAAU,WAAW,KAAK;GAC5C;EACF,KAAK;GACH,IAAI,UAAU,UAAU,KAAA,GAAW,gBAAgB,UAAU,OAAO,KAAK;GACzE;EACF,KAAK,WACH,MAAM,IAAI,MACR,kBAAkB,MAAM,uIAC1B;CAGJ;AACF;;AAGA,SAAS,gBAAgB,WAAwB,OAAqB;CACpE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,gBAAgB,OAAO,KAAK;GACtE;EACF,KAAK;GACH,gBAAgB,UAAU,WAAW,KAAK;GAC1C;EACF,KAAK,WACH;EACF,SACE,MAAM,IAAI,MACR,kBAAkB,MAAM,2EAA2E,UAAU,KAAK,EACpH;CACJ;AACF;AAEA,SAAS,gBAAgB,OAA0B,OAAqB;CACtE,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,KAAK;GACxE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,kBAAkB,WAAW,WAAW,KAAK;IAC7C,gBAAgB,WAAW,MAAM,KAAK;GACxC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,KAAK;GACzD;EACF,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,KAAK;CAIhE;AAEJ"}

package/dist/dsl/bundle.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.cts","names":[],"sources":["../../src/dsl/bundle.ts"],"mappings":";;;;;;;;;;;wBAoBgB,cAAc;EAC5B,oBAAoB;EACpB,oBAAoB;;EAEpB,qBAAqB;EACrB,mBAAmB;IACjB"}
+{"version":3,"file":"bundle.d.cts","names":[],"sources":["../../src/dsl/bundle.ts"],"mappings":";;;;;;;;;;;wBAqBgB,cAAc;EAC5B,oBAAoB;EACpB,oBAAoB;;EAEpB,qBAAqB;EACrB,mBAAmB;IACjB"}

package/dist/dsl/bundle.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.mts","names":[],"sources":["../../src/dsl/bundle.ts"],"mappings":";;;;;;;;;;;wBAoBgB,cAAc;EAC5B,oBAAoB;EACpB,oBAAoB;;EAEpB,qBAAqB;EACrB,mBAAmB;IACjB"}
+{"version":3,"file":"bundle.d.mts","names":[],"sources":["../../src/dsl/bundle.ts"],"mappings":";;;;;;;;;;;wBAqBgB,cAAc;EAC5B,oBAAoB;EACpB,oBAAoB;;EAEpB,qBAAqB;EACrB,mBAAmB;IACjB"}

package/dist/dsl/bundle.mjs

@@ -1,5 +1,6 @@
-import { semanticHash } from "../hash.mjs";
 import { CHANNEL_OF } from "../templates.mjs";
+import { actionUses } from "./flow.mjs";
+import { semanticHash } from "../hash.mjs";
 import { BundleIR } from "../ir.mjs";
 //#region src/dsl/bundle.ts
 /**
@@ -31,8 +32,7 @@ function compileBundle(input) {
 	}));
 	const actions = (input.actions ?? []).map((a) => ({
 		irVersion: 2,
-		name: a.name,
-		codeHash: a.codeHash
+		name: a.name
 	}));
 	const workflows = input.workflows.map((builder) => builder.toIR());
 	assertUniqueNames(workflows.map((w) => w.id), "workflow");
@@ -40,8 +40,9 @@ function compileBundle(input) {
 	assertUniqueNames(templates.map((t) => `${t.channel}:${t.key}`), "template");
 	assertUniqueNames(actions.map((a) => a.name), "action");
 	assertSegmentRefsResolve(workflows, segments);
+	assertNoSegmentCycles(segments);
 	assertConditionPlacement(workflows, segments);
-	assertActionRefsResolve(workflows, actions);
+	assertActionRefsResolve(workflows, input.workflows, input.actions ?? []);
 	return BundleIR.parse({
 		irVersion: 2,
 		workflows,
@@ -109,36 +110,39 @@ function collectNodeRefs(nodes, into) {
 		case "cohort": for (const arm of node.arms) collectNodeRefs(arm.flow, into);
 	}
 }
-function assertActionRefsResolve(workflows, actions) {
-	const defined = new Map(actions.map((a) => [a.name, a.codeHash]));
-	for (const workflow of workflows) {
-		const used = /* @__PURE__ */ new Map();
-		collectActionRefs(workflow.flow, used);
-		for (const [name, codeHashes] of used) {
-			const manifestHash = defined.get(name);
-			if (manifestHash === void 0) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${name}' that is not in the bundle — pass it in 'actions'`);
-			for (const codeHash of codeHashes) if (codeHash !== void 0 && codeHash !== manifestHash) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${name}' whose code differs from the one in 'actions' — two definitions are sharing that name`);
+function assertActionRefsResolve(workflows, builders, actions) {
+	const listed = new Map(actions.map((a) => [a.name, a]));
+	workflows.forEach((workflow, i) => {
+		for (const used of actionUses(builders[i])) {
+			const manifest = listed.get(used.name);
+			if (manifest === void 0) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not in the bundle — pass it in 'actions'`);
+			if (manifest !== used && manifest.handler !== used.handler) throw new Error(`compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not the definition listed in 'actions' — two definitions are sharing that name`);
 		}
-	}
+	});
 }
-/** name → every codeHash seen under it; a name with two is exactly the case worth failing on. */
-function collectActionRefs(nodes, into) {
-	for (const node of nodes) switch (node.type) {
-		case "action": {
-			const seen = into.get(node.action) ?? /* @__PURE__ */ new Set();
-			seen.add(node.codeHash);
-			into.set(node.action, seen);
-			break;
-		}
-		case "wait_until":
-			if (Array.isArray(node.onTimeout)) collectActionRefs(node.onTimeout, into);
-			break;
-		case "branch":
-			for (const branchCase of node.cases) collectActionRefs(branchCase.flow, into);
-			if (node.otherwise) collectActionRefs(node.otherwise, into);
-			break;
-		case "cohort": for (const arm of node.arms) collectActionRefs(arm.flow, into);
+/** Walk segment → segment references depth-first; the first back edge is reported as the cycle path. */
+function assertNoSegmentCycles(segments) {
+	const refsOf = /* @__PURE__ */ new Map();
+	for (const segment of segments) {
+		const refs = /* @__PURE__ */ new Set();
+		collectConditionRefs(segment.condition, refs);
+		refsOf.set(segment.id, refs);
 	}
+	const done = /* @__PURE__ */ new Set();
+	const path = [];
+	const visit = (id) => {
+		const at = path.indexOf(id);
+		if (at !== -1) {
+			const cycle = [...path.slice(at), id].join(" → ");
+			throw new Error(`compileBundle: segments reference each other in a cycle: ${cycle}`);
+		}
+		if (done.has(id)) return;
+		path.push(id);
+		for (const ref of refsOf.get(id) ?? []) visit(ref);
+		path.pop();
+		done.add(id);
+	};
+	for (const id of refsOf.keys()) visit(id);
 }
 function assertConditionPlacement(workflows, segments) {
 	for (const workflow of workflows) {

package/dist/dsl/bundle.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.mjs","names":["BundleIRSchema"],"sources":["../../src/dsl/bundle.ts"],"sourcesContent":["import { semanticHash } from '../hash';\nimport {\n  type BundleIR,\n  BundleIR as BundleIRSchema,\n  type ConditionIR,\n  IR_VERSION,\n  type NodeIR,\n  type SegmentIR,\n  type WorkflowIR,\n} from '../ir';\nimport { type AnyTemplate, CHANNEL_OF } from '../templates';\nimport type { ActionRef } from './action';\nimport type { SegmentInternal, SegmentRef } from './condition';\nimport type { WorkflowBuilder } from './workflow';\n\n/**\n * The deployment unit — compileBundle gathers workflows, segments and the\n * template manifest into one BundleIR snapshot (terraform-apply mental model);\n * the server diffs each definition by contentHash (see plan.ts).\n */\nexport function compileBundle(input: {\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  /** The template manifest: these definitions, by channel and id. */\n  templates?: readonly AnyTemplate[];\n  actions?: readonly ActionRef[];\n}): BundleIR {\n  const segments = (input.segments ?? []).map((segment) => {\n    const { id, definition, loc, meta } = segment as SegmentInternal;\n    const compiled: SegmentIR = {\n      irVersion: IR_VERSION,\n      id,\n      // Labels and provenance both live in meta, which stripMeta drops before hashing\n      contentHash: semanticHash(definition),\n      condition: definition,\n    };\n    const merged = {\n      ...(meta?.name !== undefined ? { name: meta.name } : {}),\n      ...(meta?.description !== undefined ? { description: meta.description } : {}),\n      ...(loc !== undefined ? { loc } : {}),\n    };\n    if (Object.keys(merged).length > 0) compiled.meta = merged;\n    return compiled;\n  });\n\n  const templates = (input.templates ?? []).map((template) => ({\n    irVersion: IR_VERSION,\n    key: template.id,\n    channel: CHANNEL_OF[template.kind],\n  }));\n\n  // Manifest only — name and code-identity hash; the implementation ships in the Worker bundle, never in IR\n  const actions = (input.actions ?? []).map((a) => ({\n    irVersion: IR_VERSION,\n    name: a.name,\n    codeHash: a.codeHash,\n  }));\n\n  const workflows = input.workflows.map((builder) => builder.toIR());\n\n  // Names are wire identity (routing tables, entry ledger, by-name refs):\n  // duplicates would silently last-write-win on deploy, so fail the compile.\n  assertUniqueNames(\n    workflows.map((w) => w.id),\n    'workflow'\n  );\n  assertUniqueNames(\n    segments.map((s) => s.id),\n    'segment'\n  );\n  // A message node names its template by channel and key, so the key is unique per channel:\n  // an email and a push of one nudge may share it\n  assertUniqueNames(\n    templates.map((t) => `${t.channel}:${t.key}`),\n    'template'\n  );\n  assertUniqueNames(\n    actions.map((a) => a.name),\n    'action'\n  );\n\n  // Deploy replaces the whole segment table, so every by-name reference must\n  // resolve inside this bundle — catching it here turns a runtime \"Unknown\n  // segment\" in some user's journey into a compile error.\n  assertSegmentRefsResolve(workflows, segments);\n\n  // Payload predicates and profile predicates share the Condition type, so\n  // placement is checked here: payload only inside where-trees, and where-trees\n  // contain nothing but payload predicates and combinators.\n  assertConditionPlacement(workflows, segments);\n\n  // Same rationale as segments: the runtime registry is looked up by name, so\n  // an action a workflow runs must be in the bundle — and its codeHash must\n  // agree, or two same-named definitions are competing for one identity.\n  assertActionRefsResolve(workflows, actions);\n\n  return BundleIRSchema.parse({ irVersion: IR_VERSION, workflows, segments, templates, actions });\n}\n\nfunction assertUniqueNames(names: readonly string[], kind: string): void {\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) throw new Error(`compileBundle: duplicate ${kind} name '${name}'`);\n    seen.add(name);\n  }\n}\n\nfunction assertSegmentRefsResolve(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  const defined = new Set(segments.map((s) => s.id));\n  const check = (refs: ReadonlySet<string>, owner: string): void => {\n    for (const ref of refs) {\n      if (!defined.has(ref)) {\n        throw new Error(\n          `compileBundle: ${owner} references segment '${ref}' that is not in the bundle — pass it in 'segments'`\n        );\n      }\n    }\n  };\n  for (const workflow of workflows) {\n    check(referencedSegments(workflow), `workflow '${workflow.id}'`);\n  }\n  // Segments may reference other segments; those must resolve too\n  for (const segment of segments) {\n    const refs = new Set<string>();\n    collectConditionRefs(segment.condition, refs);\n    check(refs, `segment '${segment.id}'`);\n  }\n}\n\nfunction referencedSegments(workflow: WorkflowIR): Set<string> {\n  const refs = new Set<string>();\n  if (workflow.trigger.type === 'segment') refs.add(workflow.trigger.segment);\n  if (workflow.trigger.type === 'event' && workflow.trigger.filter !== undefined) {\n    collectConditionRefs(workflow.trigger.filter, refs);\n  }\n  if (workflow.goal !== undefined) collectConditionRefs(workflow.goal.condition, refs);\n  if (workflow.exitWhen !== undefined) collectConditionRefs(workflow.exitWhen, refs);\n  collectNodeRefs(workflow.flow, refs);\n  return refs;\n}\n\nfunction collectConditionRefs(condition: ConditionIR, into: Set<string>): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) collectConditionRefs(child, into);\n      break;\n    case 'not':\n      collectConditionRefs(condition.condition, into);\n      break;\n    case 'segment':\n      into.add(condition.segment);\n      break;\n    default:\n      break;\n  }\n}\n\nfunction collectNodeRefs(nodes: readonly NodeIR[], into: Set<string>): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        collectConditionRefs(node.condition, into);\n        if (Array.isArray(node.onTimeout)) collectNodeRefs(node.onTimeout, into);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          collectConditionRefs(branchCase.condition, into);\n          collectNodeRefs(branchCase.flow, into);\n        }\n        if (node.otherwise) collectNodeRefs(node.otherwise, into);\n        break;\n      case 'filter':\n        collectConditionRefs(node.condition, into);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) collectNodeRefs(arm.flow, into);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction assertActionRefsResolve(\n  workflows: readonly WorkflowIR[],\n  actions: readonly { name: string; codeHash: string }[]\n): void {\n  const defined = new Map(actions.map((a) => [a.name, a.codeHash]));\n  for (const workflow of workflows) {\n    const used = new Map<string, Set<string | undefined>>();\n    collectActionRefs(workflow.flow, used);\n    for (const [name, codeHashes] of used) {\n      const manifestHash = defined.get(name);\n      if (manifestHash === undefined) {\n        throw new Error(\n          `compileBundle: workflow '${workflow.id}' runs action '${name}' that is not in the bundle — pass it in 'actions'`\n        );\n      }\n      // Every node's hash is checked, not just one per name: with two\n      // definitions under one name, whichever the manifest holds, the *other*\n      // node is the one that would meet a mismatched implementation at run time.\n      for (const codeHash of codeHashes) {\n        if (codeHash !== undefined && codeHash !== manifestHash) {\n          throw new Error(\n            `compileBundle: workflow '${workflow.id}' runs action '${name}' whose code differs from the one in 'actions' — two definitions are sharing that name`\n          );\n        }\n      }\n    }\n  }\n}\n\n/** name → every codeHash seen under it; a name with two is exactly the case worth failing on. */\nfunction collectActionRefs(\n  nodes: readonly NodeIR[],\n  into: Map<string, Set<string | undefined>>\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'action': {\n        const seen = into.get(node.action) ?? new Set<string | undefined>();\n        seen.add(node.codeHash);\n        into.set(node.action, seen);\n        break;\n      }\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) collectActionRefs(node.onTimeout, into);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) collectActionRefs(branchCase.flow, into);\n        if (node.otherwise) collectActionRefs(node.otherwise, into);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) collectActionRefs(arm.flow, into);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\n/* --------------------- payload / profile placement checks --------------------- */\n\nfunction assertConditionPlacement(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  for (const workflow of workflows) {\n    if (workflow.trigger.type === 'event') {\n      if (workflow.trigger.where !== undefined) {\n        assertWhereTree(workflow.trigger.where, `workflow '${workflow.id}' trigger where`);\n      }\n      if (workflow.trigger.filter !== undefined) {\n        assertProfileTree(workflow.trigger.filter, `workflow '${workflow.id}' trigger filter`);\n      }\n    }\n    if (workflow.goal !== undefined) {\n      assertProfileTree(workflow.goal.condition, `workflow '${workflow.id}' goal`);\n    }\n    if (workflow.exitWhen !== undefined) {\n      assertProfileTree(workflow.exitWhen, `workflow '${workflow.id}' exitWhen`);\n    }\n    assertNodeTrees(workflow.flow, `workflow '${workflow.id}'`);\n  }\n  for (const segment of segments) {\n    assertProfileTree(segment.condition, `segment '${segment.id}'`);\n  }\n}\n\n/** A profile-context tree: payload predicates may appear only under a performed.where. */\nfunction assertProfileTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertProfileTree(child, owner);\n      break;\n    case 'not':\n      assertProfileTree(condition.condition, owner);\n      break;\n    case 'performed':\n      if (condition.where !== undefined) assertWhereTree(condition.where, owner);\n      break;\n    case 'payload':\n      throw new Error(\n        `compileBundle: ${owner} uses a payload predicate outside a where clause — payload refs are only valid inside performed({ where }) or trigger.event({ where })`\n      );\n    default:\n      break; // property / segment\n  }\n}\n\n/** A where tree: payload predicates and combinators only — no profile facts in event scope. */\nfunction assertWhereTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertWhereTree(child, owner);\n      break;\n    case 'not':\n      assertWhereTree(condition.condition, owner);\n      break;\n    case 'payload':\n      break;\n    default:\n      throw new Error(\n        `compileBundle: ${owner} where clause may only contain payload predicates and and/or/not, found '${condition.type}'`\n      );\n  }\n}\n\nfunction assertNodeTrees(nodes: readonly NodeIR[], owner: string): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        assertProfileTree(node.condition, owner);\n        if (Array.isArray(node.onTimeout)) assertNodeTrees(node.onTimeout, owner);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          assertProfileTree(branchCase.condition, owner);\n          assertNodeTrees(branchCase.flow, owner);\n        }\n        if (node.otherwise) assertNodeTrees(node.otherwise, owner);\n        break;\n      case 'filter':\n        assertProfileTree(node.condition, owner);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) assertNodeTrees(arm.flow, owner);\n        break;\n      default:\n        break;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AAoBA,SAAgB,cAAc,OAMjB;CACX,MAAM,YAAY,MAAM,YAAY,CAAC,EAAA,CAAG,KAAK,YAAY;EACvD,MAAM,EAAE,IAAI,YAAY,KAAK,SAAS;EACtC,MAAM,WAAsB;GAC1B,WAAA;GACA;GAEA,aAAa,aAAa,UAAU;GACpC,WAAW;EACb;EACA,MAAM,SAAS;GACb,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;GACtD,GAAI,MAAM,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;GAC3E,GAAI,QAAQ,KAAA,IAAY,EAAE,IAAI,IAAI,CAAC;EACrC;EACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,GAAG,SAAS,OAAO;EACpD,OAAO;CACT,CAAC;CAED,MAAM,aAAa,MAAM,aAAa,CAAC,EAAA,CAAG,KAAK,cAAc;EAC3D,WAAA;EACA,KAAK,SAAS;EACd,SAAS,WAAW,SAAS;CAC/B,EAAE;CAGF,MAAM,WAAW,MAAM,WAAW,CAAC,EAAA,CAAG,KAAK,OAAO;EAChD,WAAA;EACA,MAAM,EAAE;EACR,UAAU,EAAE;CACd,EAAE;CAEF,MAAM,YAAY,MAAM,UAAU,KAAK,YAAY,QAAQ,KAAK,CAAC;CAIjE,kBACE,UAAU,KAAK,MAAM,EAAE,EAAE,GACzB,UACF;CACA,kBACE,SAAS,KAAK,MAAM,EAAE,EAAE,GACxB,SACF;CAGA,kBACE,UAAU,KAAK,MAAM,GAAG,EAAE,QAAQ,GAAG,EAAE,KAAK,GAC5C,UACF;CACA,kBACE,QAAQ,KAAK,MAAM,EAAE,IAAI,GACzB,QACF;CAKA,yBAAyB,WAAW,QAAQ;CAK5C,yBAAyB,WAAW,QAAQ;CAK5C,wBAAwB,WAAW,OAAO;CAE1C,OAAOA,SAAe,MAAM;EAAE,WAAA;EAAuB;EAAW;EAAU;EAAW;CAAQ,CAAC;AAChG;AAEA,SAAS,kBAAkB,OAA0B,MAAoB;CACvE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,4BAA4B,KAAK,SAAS,KAAK,EAAE;EACrF,KAAK,IAAI,IAAI;CACf;AACF;AAEA,SAAS,yBACP,WACA,UACM;CACN,MAAM,UAAU,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,EAAE,CAAC;CACjD,MAAM,SAAS,MAA2B,UAAwB;EAChE,KAAK,MAAM,OAAO,MAChB,IAAI,CAAC,QAAQ,IAAI,GAAG,GAClB,MAAM,IAAI,MACR,kBAAkB,MAAM,uBAAuB,IAAI,oDACrD;CAGN;CACA,KAAK,MAAM,YAAY,WACrB,MAAM,mBAAmB,QAAQ,GAAG,aAAa,SAAS,GAAG,EAAE;CAGjE,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,uBAAO,IAAI,IAAY;EAC7B,qBAAqB,QAAQ,WAAW,IAAI;EAC5C,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE;CACvC;AACF;AAEA,SAAS,mBAAmB,UAAmC;CAC7D,MAAM,uBAAO,IAAI,IAAY;CAC7B,IAAI,SAAS,QAAQ,SAAS,WAAW,KAAK,IAAI,SAAS,QAAQ,OAAO;CAC1E,IAAI,SAAS,QAAQ,SAAS,WAAW,SAAS,QAAQ,WAAW,KAAA,GACnE,qBAAqB,SAAS,QAAQ,QAAQ,IAAI;CAEpD,IAAI,SAAS,SAAS,KAAA,GAAW,qBAAqB,SAAS,KAAK,WAAW,IAAI;CACnF,IAAI,SAAS,aAAa,KAAA,GAAW,qBAAqB,SAAS,UAAU,IAAI;CACjF,gBAAgB,SAAS,MAAM,IAAI;CACnC,OAAO;AACT;AAEA,SAAS,qBAAqB,WAAwB,MAAyB;CAC7E,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,qBAAqB,OAAO,IAAI;GAC1E;EACF,KAAK;GACH,qBAAqB,UAAU,WAAW,IAAI;GAC9C;EACF,KAAK,WACH,KAAK,IAAI,UAAU,OAAO;CAI9B;AACF;AAEA,SAAS,gBAAgB,OAA0B,MAAyB;CAC1E,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,IAAI;GACvE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,qBAAqB,WAAW,WAAW,IAAI;IAC/C,gBAAgB,WAAW,MAAM,IAAI;GACvC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,IAAI;GACxD;EACF,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,IAAI;CAI/D;AAEJ;AAEA,SAAS,wBACP,WACA,SACM;CACN,MAAM,UAAU,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CAChE,KAAK,MAAM,YAAY,WAAW;EAChC,MAAM,uBAAO,IAAI,IAAqC;EACtD,kBAAkB,SAAS,MAAM,IAAI;EACrC,KAAK,MAAM,CAAC,MAAM,eAAe,MAAM;GACrC,MAAM,eAAe,QAAQ,IAAI,IAAI;GACrC,IAAI,iBAAiB,KAAA,GACnB,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,mDAChE;GAKF,KAAK,MAAM,YAAY,YACrB,IAAI,aAAa,KAAA,KAAa,aAAa,cACzC,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,uFAChE;EAGN;CACF;AACF;;AAGA,SAAS,kBACP,OACA,MACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK,UAAU;GACb,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,qBAAK,IAAI,IAAwB;GAClE,KAAK,IAAI,KAAK,QAAQ;GACtB,KAAK,IAAI,KAAK,QAAQ,IAAI;GAC1B;EACF;EACA,KAAK;GACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,kBAAkB,KAAK,WAAW,IAAI;GACzE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO,kBAAkB,WAAW,MAAM,IAAI;GAC5E,IAAI,KAAK,WAAW,kBAAkB,KAAK,WAAW,IAAI;GAC1D;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,kBAAkB,IAAI,MAAM,IAAI;CAIjE;AAEJ;AAIA,SAAS,yBACP,WACA,UACM;CACN,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI,SAAS,QAAQ,SAAS,SAAS;GACrC,IAAI,SAAS,QAAQ,UAAU,KAAA,GAC7B,gBAAgB,SAAS,QAAQ,OAAO,aAAa,SAAS,GAAG,gBAAgB;GAEnF,IAAI,SAAS,QAAQ,WAAW,KAAA,GAC9B,kBAAkB,SAAS,QAAQ,QAAQ,aAAa,SAAS,GAAG,iBAAiB;EAEzF;EACA,IAAI,SAAS,SAAS,KAAA,GACpB,kBAAkB,SAAS,KAAK,WAAW,aAAa,SAAS,GAAG,OAAO;EAE7E,IAAI,SAAS,aAAa,KAAA,GACxB,kBAAkB,SAAS,UAAU,aAAa,SAAS,GAAG,WAAW;EAE3E,gBAAgB,SAAS,MAAM,aAAa,SAAS,GAAG,EAAE;CAC5D;CACA,KAAK,MAAM,WAAW,UACpB,kBAAkB,QAAQ,WAAW,YAAY,QAAQ,GAAG,EAAE;AAElE;;AAGA,SAAS,kBAAkB,WAAwB,OAAqB;CACtE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,kBAAkB,OAAO,KAAK;GACxE;EACF,KAAK;GACH,kBAAkB,UAAU,WAAW,KAAK;GAC5C;EACF,KAAK;GACH,IAAI,UAAU,UAAU,KAAA,GAAW,gBAAgB,UAAU,OAAO,KAAK;GACzE;EACF,KAAK,WACH,MAAM,IAAI,MACR,kBAAkB,MAAM,uIAC1B;CAGJ;AACF;;AAGA,SAAS,gBAAgB,WAAwB,OAAqB;CACpE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,gBAAgB,OAAO,KAAK;GACtE;EACF,KAAK;GACH,gBAAgB,UAAU,WAAW,KAAK;GAC1C;EACF,KAAK,WACH;EACF,SACE,MAAM,IAAI,MACR,kBAAkB,MAAM,2EAA2E,UAAU,KAAK,EACpH;CACJ;AACF;AAEA,SAAS,gBAAgB,OAA0B,OAAqB;CACtE,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,KAAK;GACxE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,kBAAkB,WAAW,WAAW,KAAK;IAC7C,gBAAgB,WAAW,MAAM,KAAK;GACxC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,KAAK;GACzD;EACF,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,KAAK;CAIhE;AAEJ"}
+{"version":3,"file":"bundle.mjs","names":["BundleIRSchema"],"sources":["../../src/dsl/bundle.ts"],"sourcesContent":["import { semanticHash } from '../hash';\nimport {\n  type BundleIR,\n  BundleIR as BundleIRSchema,\n  type ConditionIR,\n  IR_VERSION,\n  type NodeIR,\n  type SegmentIR,\n  type WorkflowIR,\n} from '../ir';\nimport { type AnyTemplate, CHANNEL_OF } from '../templates';\nimport type { ActionRef } from './action';\nimport type { SegmentInternal, SegmentRef } from './condition';\nimport { actionUses } from './flow';\nimport type { WorkflowBuilder } from './workflow';\n\n/**\n * The deployment unit — compileBundle gathers workflows, segments and the\n * template manifest into one BundleIR snapshot (terraform-apply mental model);\n * the server diffs each definition by contentHash (see plan.ts).\n */\nexport function compileBundle(input: {\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  /** The template manifest: these definitions, by channel and id. */\n  templates?: readonly AnyTemplate[];\n  actions?: readonly ActionRef[];\n}): BundleIR {\n  const segments = (input.segments ?? []).map((segment) => {\n    const { id, definition, loc, meta } = segment as SegmentInternal;\n    const compiled: SegmentIR = {\n      irVersion: IR_VERSION,\n      id,\n      // Labels and provenance both live in meta, which stripMeta drops before hashing\n      contentHash: semanticHash(definition),\n      condition: definition,\n    };\n    const merged = {\n      ...(meta?.name !== undefined ? { name: meta.name } : {}),\n      ...(meta?.description !== undefined ? { description: meta.description } : {}),\n      ...(loc !== undefined ? { loc } : {}),\n    };\n    if (Object.keys(merged).length > 0) compiled.meta = merged;\n    return compiled;\n  });\n\n  const templates = (input.templates ?? []).map((template) => ({\n    irVersion: IR_VERSION,\n    key: template.id,\n    channel: CHANNEL_OF[template.kind],\n  }));\n\n  // Manifest only — names; the implementation ships in the Worker bundle, never in IR\n  const actions = (input.actions ?? []).map((a) => ({ irVersion: IR_VERSION, name: a.name }));\n\n  const workflows = input.workflows.map((builder) => builder.toIR());\n\n  // Names are wire identity (routing tables, entry ledger, by-name refs):\n  // duplicates would silently last-write-win on deploy, so fail the compile.\n  assertUniqueNames(\n    workflows.map((w) => w.id),\n    'workflow'\n  );\n  assertUniqueNames(\n    segments.map((s) => s.id),\n    'segment'\n  );\n  // A message node names its template by channel and key, so the key is unique per channel:\n  // an email and a push of one nudge may share it\n  assertUniqueNames(\n    templates.map((t) => `${t.channel}:${t.key}`),\n    'template'\n  );\n  assertUniqueNames(\n    actions.map((a) => a.name),\n    'action'\n  );\n\n  // Deploy replaces the whole segment table, so every by-name reference must\n  // resolve inside this bundle — catching it here turns a runtime \"Unknown\n  // segment\" in some user's journey into a compile error.\n  assertSegmentRefsResolve(workflows, segments);\n\n  // A segment is evaluated by evaluating the segments it names; a cycle among\n  // them has no evaluation order and would recurse until the stack ran out —\n  // at run time, in some user's journey. Caught here, with the cycle spelled out.\n  assertNoSegmentCycles(segments);\n\n  // Payload predicates and profile predicates share the Condition type, so\n  // placement is checked here: payload only inside where-trees, and where-trees\n  // contain nothing but payload predicates and combinators.\n  assertConditionPlacement(workflows, segments);\n\n  // Same rationale as segments: the runtime registry is looked up by name, so\n  // an action a workflow runs must be in the bundle — and it must be the very\n  // definition listed there, or two same-named definitions are competing for\n  // one identity (the IR names it; only the compile can tell them apart).\n  assertActionRefsResolve(workflows, input.workflows, input.actions ?? []);\n\n  return BundleIRSchema.parse({ irVersion: IR_VERSION, workflows, segments, templates, actions });\n}\n\nfunction assertUniqueNames(names: readonly string[], kind: string): void {\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) throw new Error(`compileBundle: duplicate ${kind} name '${name}'`);\n    seen.add(name);\n  }\n}\n\nfunction assertSegmentRefsResolve(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  const defined = new Set(segments.map((s) => s.id));\n  const check = (refs: ReadonlySet<string>, owner: string): void => {\n    for (const ref of refs) {\n      if (!defined.has(ref)) {\n        throw new Error(\n          `compileBundle: ${owner} references segment '${ref}' that is not in the bundle — pass it in 'segments'`\n        );\n      }\n    }\n  };\n  for (const workflow of workflows) {\n    check(referencedSegments(workflow), `workflow '${workflow.id}'`);\n  }\n  // Segments may reference other segments; those must resolve too\n  for (const segment of segments) {\n    const refs = new Set<string>();\n    collectConditionRefs(segment.condition, refs);\n    check(refs, `segment '${segment.id}'`);\n  }\n}\n\nfunction referencedSegments(workflow: WorkflowIR): Set<string> {\n  const refs = new Set<string>();\n  if (workflow.trigger.type === 'segment') refs.add(workflow.trigger.segment);\n  if (workflow.trigger.type === 'event' && workflow.trigger.filter !== undefined) {\n    collectConditionRefs(workflow.trigger.filter, refs);\n  }\n  if (workflow.goal !== undefined) collectConditionRefs(workflow.goal.condition, refs);\n  if (workflow.exitWhen !== undefined) collectConditionRefs(workflow.exitWhen, refs);\n  collectNodeRefs(workflow.flow, refs);\n  return refs;\n}\n\nfunction collectConditionRefs(condition: ConditionIR, into: Set<string>): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) collectConditionRefs(child, into);\n      break;\n    case 'not':\n      collectConditionRefs(condition.condition, into);\n      break;\n    case 'segment':\n      into.add(condition.segment);\n      break;\n    default:\n      break;\n  }\n}\n\nfunction collectNodeRefs(nodes: readonly NodeIR[], into: Set<string>): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        collectConditionRefs(node.condition, into);\n        if (Array.isArray(node.onTimeout)) collectNodeRefs(node.onTimeout, into);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          collectConditionRefs(branchCase.condition, into);\n          collectNodeRefs(branchCase.flow, into);\n        }\n        if (node.otherwise) collectNodeRefs(node.otherwise, into);\n        break;\n      case 'filter':\n        collectConditionRefs(node.condition, into);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) collectNodeRefs(arm.flow, into);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction assertActionRefsResolve(\n  workflows: readonly WorkflowIR[],\n  builders: readonly WorkflowBuilder[],\n  actions: readonly ActionRef[]\n): void {\n  const listed = new Map(actions.map((a) => [a.name, a]));\n  workflows.forEach((workflow, i) => {\n    for (const used of actionUses(builders[i])) {\n      const manifest = listed.get(used.name);\n      if (manifest === undefined) {\n        throw new Error(\n          `compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not in the bundle — pass it in 'actions'`\n        );\n      }\n      // Identity, not source text: the printed handler depends on the bundler.\n      // Every use is checked, not one per name — with two definitions under one\n      // name, whichever is listed, the *other* node would run the wrong code.\n      if (manifest !== used && manifest.handler !== used.handler) {\n        throw new Error(\n          `compileBundle: workflow '${workflow.id}' runs action '${used.name}' that is not the definition listed in 'actions' — two definitions are sharing that name`\n        );\n      }\n    }\n  });\n}\n\n/** Walk segment → segment references depth-first; the first back edge is reported as the cycle path. */\nfunction assertNoSegmentCycles(segments: readonly SegmentIR[]): void {\n  const refsOf = new Map<string, Set<string>>();\n  for (const segment of segments) {\n    const refs = new Set<string>();\n    collectConditionRefs(segment.condition, refs);\n    refsOf.set(segment.id, refs);\n  }\n  const done = new Set<string>();\n  const path: string[] = [];\n  const visit = (id: string): void => {\n    const at = path.indexOf(id);\n    if (at !== -1) {\n      const cycle = [...path.slice(at), id].join(' → ');\n      throw new Error(`compileBundle: segments reference each other in a cycle: ${cycle}`);\n    }\n    if (done.has(id)) return;\n    path.push(id);\n    for (const ref of refsOf.get(id) ?? []) visit(ref);\n    path.pop();\n    done.add(id);\n  };\n  for (const id of refsOf.keys()) visit(id);\n}\n\n/* --------------------- payload / profile placement checks --------------------- */\n\nfunction assertConditionPlacement(\n  workflows: readonly WorkflowIR[],\n  segments: readonly SegmentIR[]\n): void {\n  for (const workflow of workflows) {\n    if (workflow.trigger.type === 'event') {\n      if (workflow.trigger.where !== undefined) {\n        assertWhereTree(workflow.trigger.where, `workflow '${workflow.id}' trigger where`);\n      }\n      if (workflow.trigger.filter !== undefined) {\n        assertProfileTree(workflow.trigger.filter, `workflow '${workflow.id}' trigger filter`);\n      }\n    }\n    if (workflow.goal !== undefined) {\n      assertProfileTree(workflow.goal.condition, `workflow '${workflow.id}' goal`);\n    }\n    if (workflow.exitWhen !== undefined) {\n      assertProfileTree(workflow.exitWhen, `workflow '${workflow.id}' exitWhen`);\n    }\n    assertNodeTrees(workflow.flow, `workflow '${workflow.id}'`);\n  }\n  for (const segment of segments) {\n    assertProfileTree(segment.condition, `segment '${segment.id}'`);\n  }\n}\n\n/** A profile-context tree: payload predicates may appear only under a performed.where. */\nfunction assertProfileTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertProfileTree(child, owner);\n      break;\n    case 'not':\n      assertProfileTree(condition.condition, owner);\n      break;\n    case 'performed':\n      if (condition.where !== undefined) assertWhereTree(condition.where, owner);\n      break;\n    case 'payload':\n      throw new Error(\n        `compileBundle: ${owner} uses a payload predicate outside a where clause — payload refs are only valid inside performed({ where }) or trigger.event({ where })`\n      );\n    default:\n      break; // property / segment\n  }\n}\n\n/** A where tree: payload predicates and combinators only — no profile facts in event scope. */\nfunction assertWhereTree(condition: ConditionIR, owner: string): void {\n  switch (condition.type) {\n    case 'and':\n    case 'or':\n      for (const child of condition.conditions) assertWhereTree(child, owner);\n      break;\n    case 'not':\n      assertWhereTree(condition.condition, owner);\n      break;\n    case 'payload':\n      break;\n    default:\n      throw new Error(\n        `compileBundle: ${owner} where clause may only contain payload predicates and and/or/not, found '${condition.type}'`\n      );\n  }\n}\n\nfunction assertNodeTrees(nodes: readonly NodeIR[], owner: string): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'wait_until':\n        assertProfileTree(node.condition, owner);\n        if (Array.isArray(node.onTimeout)) assertNodeTrees(node.onTimeout, owner);\n        break;\n      case 'branch':\n        for (const branchCase of node.cases) {\n          assertProfileTree(branchCase.condition, owner);\n          assertNodeTrees(branchCase.flow, owner);\n        }\n        if (node.otherwise) assertNodeTrees(node.otherwise, owner);\n        break;\n      case 'filter':\n        assertProfileTree(node.condition, owner);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) assertNodeTrees(arm.flow, owner);\n        break;\n      default:\n        break;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAqBA,SAAgB,cAAc,OAMjB;CACX,MAAM,YAAY,MAAM,YAAY,CAAC,EAAA,CAAG,KAAK,YAAY;EACvD,MAAM,EAAE,IAAI,YAAY,KAAK,SAAS;EACtC,MAAM,WAAsB;GAC1B,WAAA;GACA;GAEA,aAAa,aAAa,UAAU;GACpC,WAAW;EACb;EACA,MAAM,SAAS;GACb,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;GACtD,GAAI,MAAM,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;GAC3E,GAAI,QAAQ,KAAA,IAAY,EAAE,IAAI,IAAI,CAAC;EACrC;EACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,GAAG,SAAS,OAAO;EACpD,OAAO;CACT,CAAC;CAED,MAAM,aAAa,MAAM,aAAa,CAAC,EAAA,CAAG,KAAK,cAAc;EAC3D,WAAA;EACA,KAAK,SAAS;EACd,SAAS,WAAW,SAAS;CAC/B,EAAE;CAGF,MAAM,WAAW,MAAM,WAAW,CAAC,EAAA,CAAG,KAAK,OAAO;EAAE,WAAA;EAAuB,MAAM,EAAE;CAAK,EAAE;CAE1F,MAAM,YAAY,MAAM,UAAU,KAAK,YAAY,QAAQ,KAAK,CAAC;CAIjE,kBACE,UAAU,KAAK,MAAM,EAAE,EAAE,GACzB,UACF;CACA,kBACE,SAAS,KAAK,MAAM,EAAE,EAAE,GACxB,SACF;CAGA,kBACE,UAAU,KAAK,MAAM,GAAG,EAAE,QAAQ,GAAG,EAAE,KAAK,GAC5C,UACF;CACA,kBACE,QAAQ,KAAK,MAAM,EAAE,IAAI,GACzB,QACF;CAKA,yBAAyB,WAAW,QAAQ;CAK5C,sBAAsB,QAAQ;CAK9B,yBAAyB,WAAW,QAAQ;CAM5C,wBAAwB,WAAW,MAAM,WAAW,MAAM,WAAW,CAAC,CAAC;CAEvE,OAAOA,SAAe,MAAM;EAAE,WAAA;EAAuB;EAAW;EAAU;EAAW;CAAQ,CAAC;AAChG;AAEA,SAAS,kBAAkB,OAA0B,MAAoB;CACvE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,4BAA4B,KAAK,SAAS,KAAK,EAAE;EACrF,KAAK,IAAI,IAAI;CACf;AACF;AAEA,SAAS,yBACP,WACA,UACM;CACN,MAAM,UAAU,IAAI,IAAI,SAAS,KAAK,MAAM,EAAE,EAAE,CAAC;CACjD,MAAM,SAAS,MAA2B,UAAwB;EAChE,KAAK,MAAM,OAAO,MAChB,IAAI,CAAC,QAAQ,IAAI,GAAG,GAClB,MAAM,IAAI,MACR,kBAAkB,MAAM,uBAAuB,IAAI,oDACrD;CAGN;CACA,KAAK,MAAM,YAAY,WACrB,MAAM,mBAAmB,QAAQ,GAAG,aAAa,SAAS,GAAG,EAAE;CAGjE,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,uBAAO,IAAI,IAAY;EAC7B,qBAAqB,QAAQ,WAAW,IAAI;EAC5C,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE;CACvC;AACF;AAEA,SAAS,mBAAmB,UAAmC;CAC7D,MAAM,uBAAO,IAAI,IAAY;CAC7B,IAAI,SAAS,QAAQ,SAAS,WAAW,KAAK,IAAI,SAAS,QAAQ,OAAO;CAC1E,IAAI,SAAS,QAAQ,SAAS,WAAW,SAAS,QAAQ,WAAW,KAAA,GACnE,qBAAqB,SAAS,QAAQ,QAAQ,IAAI;CAEpD,IAAI,SAAS,SAAS,KAAA,GAAW,qBAAqB,SAAS,KAAK,WAAW,IAAI;CACnF,IAAI,SAAS,aAAa,KAAA,GAAW,qBAAqB,SAAS,UAAU,IAAI;CACjF,gBAAgB,SAAS,MAAM,IAAI;CACnC,OAAO;AACT;AAEA,SAAS,qBAAqB,WAAwB,MAAyB;CAC7E,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,qBAAqB,OAAO,IAAI;GAC1E;EACF,KAAK;GACH,qBAAqB,UAAU,WAAW,IAAI;GAC9C;EACF,KAAK,WACH,KAAK,IAAI,UAAU,OAAO;CAI9B;AACF;AAEA,SAAS,gBAAgB,OAA0B,MAAyB;CAC1E,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,IAAI;GACvE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,qBAAqB,WAAW,WAAW,IAAI;IAC/C,gBAAgB,WAAW,MAAM,IAAI;GACvC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,IAAI;GACxD;EACF,KAAK;GACH,qBAAqB,KAAK,WAAW,IAAI;GACzC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,IAAI;CAI/D;AAEJ;AAEA,SAAS,wBACP,WACA,UACA,SACM;CACN,MAAM,SAAS,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD,UAAU,SAAS,UAAU,MAAM;EACjC,KAAK,MAAM,QAAQ,WAAW,SAAS,EAAE,GAAG;GAC1C,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;GACrC,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,KAAK,mDACrE;GAKF,IAAI,aAAa,QAAQ,SAAS,YAAY,KAAK,SACjD,MAAM,IAAI,MACR,4BAA4B,SAAS,GAAG,iBAAiB,KAAK,KAAK,yFACrE;EAEJ;CACF,CAAC;AACH;;AAGA,SAAS,sBAAsB,UAAsC;CACnE,MAAM,yBAAS,IAAI,IAAyB;CAC5C,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,uBAAO,IAAI,IAAY;EAC7B,qBAAqB,QAAQ,WAAW,IAAI;EAC5C,OAAO,IAAI,QAAQ,IAAI,IAAI;CAC7B;CACA,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,OAAiB,CAAC;CACxB,MAAM,SAAS,OAAqB;EAClC,MAAM,KAAK,KAAK,QAAQ,EAAE;EAC1B,IAAI,OAAO,IAAI;GACb,MAAM,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK;GAChD,MAAM,IAAI,MAAM,4DAA4D,OAAO;EACrF;EACA,IAAI,KAAK,IAAI,EAAE,GAAG;EAClB,KAAK,KAAK,EAAE;EACZ,KAAK,MAAM,OAAO,OAAO,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG;EACjD,KAAK,IAAI;EACT,KAAK,IAAI,EAAE;CACb;CACA,KAAK,MAAM,MAAM,OAAO,KAAK,GAAG,MAAM,EAAE;AAC1C;AAIA,SAAS,yBACP,WACA,UACM;CACN,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI,SAAS,QAAQ,SAAS,SAAS;GACrC,IAAI,SAAS,QAAQ,UAAU,KAAA,GAC7B,gBAAgB,SAAS,QAAQ,OAAO,aAAa,SAAS,GAAG,gBAAgB;GAEnF,IAAI,SAAS,QAAQ,WAAW,KAAA,GAC9B,kBAAkB,SAAS,QAAQ,QAAQ,aAAa,SAAS,GAAG,iBAAiB;EAEzF;EACA,IAAI,SAAS,SAAS,KAAA,GACpB,kBAAkB,SAAS,KAAK,WAAW,aAAa,SAAS,GAAG,OAAO;EAE7E,IAAI,SAAS,aAAa,KAAA,GACxB,kBAAkB,SAAS,UAAU,aAAa,SAAS,GAAG,WAAW;EAE3E,gBAAgB,SAAS,MAAM,aAAa,SAAS,GAAG,EAAE;CAC5D;CACA,KAAK,MAAM,WAAW,UACpB,kBAAkB,QAAQ,WAAW,YAAY,QAAQ,GAAG,EAAE;AAElE;;AAGA,SAAS,kBAAkB,WAAwB,OAAqB;CACtE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,kBAAkB,OAAO,KAAK;GACxE;EACF,KAAK;GACH,kBAAkB,UAAU,WAAW,KAAK;GAC5C;EACF,KAAK;GACH,IAAI,UAAU,UAAU,KAAA,GAAW,gBAAgB,UAAU,OAAO,KAAK;GACzE;EACF,KAAK,WACH,MAAM,IAAI,MACR,kBAAkB,MAAM,uIAC1B;CAGJ;AACF;;AAGA,SAAS,gBAAgB,WAAwB,OAAqB;CACpE,QAAQ,UAAU,MAAlB;EACE,KAAK;EACL,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAAY,gBAAgB,OAAO,KAAK;GACtE;EACF,KAAK;GACH,gBAAgB,UAAU,WAAW,KAAK;GAC1C;EACF,KAAK,WACH;EACF,SACE,MAAM,IAAI,MACR,kBAAkB,MAAM,2EAA2E,UAAU,KAAK,EACpH;CACJ;AACF;AAEA,SAAS,gBAAgB,OAA0B,OAAqB;CACtE,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,gBAAgB,KAAK,WAAW,KAAK;GACxE;EACF,KAAK;GACH,KAAK,MAAM,cAAc,KAAK,OAAO;IACnC,kBAAkB,WAAW,WAAW,KAAK;IAC7C,gBAAgB,WAAW,MAAM,KAAK;GACxC;GACA,IAAI,KAAK,WAAW,gBAAgB,KAAK,WAAW,KAAK;GACzD;EACF,KAAK;GACH,kBAAkB,KAAK,WAAW,KAAK;GACvC;EACF,KAAK,UACH,KAAK,MAAM,OAAO,KAAK,MAAM,gBAAgB,IAAI,MAAM,KAAK;CAIhE;AAEJ"}

package/dist/dsl/condition.cjs

@@ -77,14 +77,25 @@ function contains(ref, value) {
 function notContains(ref, value) {
 	return prop(ref, "not_contains", value, void 0, require_provenance.captureLoc(notContains));
 }
+/**
+* @internal A duration that has to elapse — a wait's timeout, a goal's window, a performed
+* window. Zero parses as a valid duration but means "never" or "always" depending on the node,
+* and either way it is not what the author meant.
+*/
+function positiveDurationIR(value, what) {
+	const ir = require_dsl_base.durationIR(value);
+	if (ir.ms <= 0) throw new Error(`${what} must be positive, got '${value}'`);
+	return ir;
+}
 function performed(event, whereOrOpts, maybeOpts) {
 	const where = typeof whereOrOpts === "function" ? whereOrOpts : void 0;
 	const opts = typeof whereOrOpts === "function" ? maybeOpts : whereOrOpts;
+	if (opts?.count !== void 0 && (!Number.isInteger(opts.count) || opts.count < 1)) throw new Error(`performed(): count must be a positive integer, got ${String(opts.count)}`);
 	return cond({
 		type: "performed",
 		event: event.name,
 		...where !== void 0 ? { where: condIR(where(require_dsl_refs.payloadRefs())) } : {},
-		...opts?.within !== void 0 ? { within: require_dsl_base.durationIR(opts.within) } : {},
+		...opts?.within !== void 0 ? { within: positiveDurationIR(opts.within, "performed(): within") } : {},
 		...opts?.count !== void 0 ? { count: opts.count } : {}
 	}, require_provenance.captureLoc(performed));
 }
@@ -173,6 +184,7 @@ exports.notExists = notExists;
 exports.notInArray = notInArray;
 exports.or = or;
 exports.performed = performed;
+exports.positiveDurationIR = positiveDurationIR;
 exports.reachable = reachable;
 exports.segment = segment;