@shware/workflow 5.0.0 → 6.0.0

package/dist/store/postgres-reporting.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.cjs","names":["beginReadCommitted","lockUser","lockUserTransaction","uuidv7","UserErasedError"],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import { UserErasedError } from './erasure';\nimport type { ClickContext, Engagement, JourneyReporting, MessageRecord } from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\nimport { beginReadCommitted, lockUser, lockUserTransaction } from './user-lock';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n *\n * The instance and message rows are written like the store's rows about a user (postgres.ts,\n * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's\n * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after\n * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts\n * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not\n * retryable) so it is never sent.\n *\n * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is\n * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the\n * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone\n * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only\n * then locks the copy's row (where the path locks it) and writes. User lock before row lock,\n * always: the erasure deletes under the user lock, so the two never wait on each other in\n * opposite orders. The unsubscribe is the compliance exception: its suppression is written\n * whatever the user's state, under the same lock order for consistency.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>,\n    private readonly schema: string\n  ) {}\n\n  /** The condition every row about a user carries: no erasure tombstone for `$user`. */\n  private notErased(user: string): string {\n    return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;\n  }\n\n  /**\n   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the\n   * owner's user lock, then the copy re-read under it — present and its owner without a\n   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).\n   * `forUpdate` locks the copy's row on that re-read, after the user lock.\n   */\n  private async lockMessage(\n    tx: SqlClientLike,\n    messageId: string,\n    forUpdate = false\n  ): Promise<{ userId: string; deliveredAt: number } | undefined> {\n    await beginReadCommitted(tx);\n    const owners = await tx.query<{ user_id: string }>(\n      `SELECT user_id FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const owner = owners.at(0);\n    if (owner === undefined) return undefined;\n    await lockUser(tx, this.schema, owner.user_id);\n    const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n      `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n       FROM ${this.t.message} WHERE id = $1\n         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)\n       ${forUpdate ? 'FOR UPDATE' : ''}`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    if (row === undefined) return undefined;\n    return { userId: row.user_id, deliveredAt: Number(row.delivered_at) };\n  }\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO NOTHING`,\n        [input.instanceId, input.workflow, input.userId, input.at]\n      );\n    });\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n        [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n      );\n    });\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row —\n    // unless the user is erased, where a late finish must not put one back\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance}\n           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n         SELECT $1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')} ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n        [\n          input.instanceId,\n          input.workflow,\n          input.userId,\n          input.status,\n          input.at,\n          input.convertedAt ?? null,\n        ]\n      );\n    });\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one. With a\n    // tombstone the statement yields nothing, a retry's row included: the copy is not sent\n    return this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, message.userId);\n      const rows = await tx.query<{ id: string }>(\n        `INSERT INTO ${this.t.message}\n           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)\n         SELECT $1, $2, $3, $4, $5, $6, $7, $8, ${TS('$9')} ${this.notErased('$8')}\n         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n         RETURNING id`,\n        [\n          uuidv7(message.sentAt),\n          message.idempotencyKey,\n          message.workflow,\n          message.instanceId,\n          message.nodeId,\n          message.template,\n          message.channel,\n          message.userId,\n          message.sentAt,\n        ]\n      );\n      const id = rows.at(0)?.id;\n      if (id !== undefined) return id;\n      // Nothing recorded: the tombstone refused it, and the sender must stop here\n      const erased = await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [\n        message.userId,\n      ]);\n      if (erased.length > 0) throw new UserErasedError(message.userId);\n      throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    });\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.transaction(async (tx) => {\n      // No copy (or one being erased): nothing to record the links under\n      if ((await this.lockMessage(tx, messageId)) === undefined) return;\n      await tx.query(\n        `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n        [messageId, ...urls]\n      );\n    });\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const message = await this.lockMessage(tx, messageId);\n      if (message === undefined) return false;\n      const open = judge(message);\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock (taken after the user lock): concurrent clicks on it are\n      // judged one at a time\n      const message = await this.lockMessage(tx, messageId, true);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: message.deliveredAt,\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      if ((await this.lockMessage(tx, messageId)) === undefined) return false;\n      const rows = await tx.query<{ id: string }>(\n        `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n         WHERE id = $1 RETURNING id`,\n        [messageId, at]\n      );\n      return rows.length > 0;\n    });\n  }\n\n  async recordUnsubscribe(messageId: string, at: number): Promise<{ userId: string } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The lock order of the other message-id paths (user lock, then the copy's row), so an\n      // unsubscribe and an erasure never wait on each other crosswise. Not the tombstone check:\n      // an opt-out is recorded whatever the user's state, on the copy as long as it is there\n      await beginReadCommitted(tx);\n      const owners = await tx.query<{ user_id: string }>(\n        `SELECT user_id FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`,\n        [messageId]\n      );\n      const owner = owners.at(0);\n      if (owner === undefined) return undefined;\n      await lockUser(tx, this.schema, owner.user_id);\n      // The first unsubscribe sets the time; a later one keeps it and still names the recipient\n      const rows = await tx.query<{ user_id: string }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id`,\n        [messageId, at]\n      );\n      const userId = rows.at(0)?.user_id;\n      if (userId === undefined) return undefined;\n      // The opt-out itself: the engine sends this user no more email\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS('$2')})\n         ON CONFLICT DO NOTHING`,\n        [userId, at]\n      );\n      return { userId };\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;;;;;;;;;;;;;;;;;AAwB7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CACA;CAHnB,YACE,KACA,GACA,QACA;EAHiB,KAAA,MAAA;EACA,KAAA,IAAA;EACA,KAAA,SAAA;CAChB;;CAGH,UAAkB,MAAsB;EACtC,OAAO,mCAAmC,KAAK,EAAE,QAAQ,mBAAmB,KAAK;CACnF;;;;;;;CAQA,MAAc,YACZ,IACA,WACA,YAAY,OACkD;EAC9D,MAAMA,wBAAAA,mBAAmB,EAAE;EAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,iBACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;EACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;EAQ7C,MAAM,OAAM,MAPO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;cACjD,KAAK,EAAE,QAAQ;yCACY,KAAK,EAAE,QAAQ,mBAAmB,KAAK,EAAE,QAAQ;SACjF,YAAY,eAAe,MAC9B,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,OAAO;GAAE,QAAQ,IAAI;GAAS,aAAa,OAAO,IAAI,YAAY;EAAE;CACtE;CAEA,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMC,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;gDAElE;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;GAAE,CAC3D;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;0GAEnF;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;IAAI,MAAM;GAAM,CACzE;EACF,CAAC;CACH;CAEA,MAAM,iBAAiB,OAOL;EAGhB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;;8BAET,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;sFAGrF;IACE,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM,eAAe;GACvB,CACF;EACF,CAAC;CACH;CAEA,MAAM,cAAc,SAAyC;EAG3D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,QAAQ,MAAM;GAmBzD,MAAM,MAAK,MAlBQ,GAAG,MACpB,eAAe,KAAK,EAAE,QAAQ;;kDAEY,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;wBAG3E;IACEC,kBAAAA,OAAO,QAAQ,MAAM;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;GACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;GACvB,IAAI,OAAO,KAAA,GAAW,OAAO;GAK7B,KAAI,MAHiB,GAAG,MAAM,sBAAsB,KAAK,EAAE,QAAQ,sBAAsB,CACvF,QAAQ,MACV,CAAC,EAAA,CACU,SAAS,GAAG,MAAM,IAAIC,sBAAAA,gBAAgB,QAAQ,MAAM;GAC/D,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EACtE,CAAC;CACH;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GAEvC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW;GAC3D,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;EACF,CAAC;CACH;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,SAAS;GACpD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,MAAM,OAAO,MAAM,OAAO;GAC1B,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACED,kBAAAA,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAGxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,WAAW,IAAI;GAC1D,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,QAAQ;IACrB,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACEA,kBAAAA,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAC3E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW,OAAO;GAMlE,QAAO,MALY,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;sCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;EACvB,CAAC;CACH;CAEA,MAAM,kBAAkB,WAAmB,IAAqD;EAC9F,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAIxC,MAAMH,wBAAAA,mBAAmB,EAAE;GAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,uCACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;GACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;GAO7C,MAAM,UAAS,MALI,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;iEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACoB,GAAG,CAAC,CAAC,EAAE;GAC3B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;GAEjC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,+CAA+C,GAAG,IAAI,EAAE;kCAE1F,CAAC,QAAQ,EAAE,CACb;GACA,OAAO,EAAE,OAAO;EAClB,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}
+{"version":3,"file":"postgres-reporting.cjs","names":["beginReadCommitted","lockUser","lockUserTransaction","uuidv7","UserErasedError"],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import { UserErasedError } from './erasure';\nimport type {\n  ClickContext,\n  Engagement,\n  JourneyReporting,\n  MessageRecord,\n  MessageSummary,\n} from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\nimport { beginReadCommitted, lockUser, lockUserTransaction } from './user-lock';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n *\n * The instance and message rows are written like the store's rows about a user (postgres.ts,\n * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's\n * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after\n * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts\n * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not\n * retryable) so it is never sent.\n *\n * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is\n * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the\n * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone\n * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only\n * then locks the copy's row (where the path locks it) and writes. User lock before row lock,\n * always: the erasure deletes under the user lock, so the two never wait on each other in\n * opposite orders. The unsubscribe is the compliance exception: its suppression is written\n * whatever the user's state, under the same lock order for consistency.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>,\n    private readonly schema: string\n  ) {}\n\n  /** The condition every row about a user carries: no erasure tombstone for `$user`. */\n  private notErased(user: string): string {\n    return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;\n  }\n\n  /**\n   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the\n   * owner's user lock, then the copy re-read under it — present and its owner without a\n   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).\n   * `forUpdate` locks the copy's row on that re-read, after the user lock.\n   */\n  private async lockMessage(\n    tx: SqlClientLike,\n    messageId: string,\n    forUpdate = false\n  ): Promise<{ userId: string; deliveredAt: number } | undefined> {\n    await beginReadCommitted(tx);\n    const owners = await tx.query<{ user_id: string }>(\n      `SELECT user_id FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const owner = owners.at(0);\n    if (owner === undefined) return undefined;\n    await lockUser(tx, this.schema, owner.user_id);\n    const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n      `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n       FROM ${this.t.message} WHERE id = $1\n         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)\n       ${forUpdate ? 'FOR UPDATE' : ''}`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    if (row === undefined) return undefined;\n    return { userId: row.user_id, deliveredAt: Number(row.delivered_at) };\n  }\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO NOTHING`,\n        [input.instanceId, input.workflow, input.userId, input.at]\n      );\n    });\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n        [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n      );\n    });\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row —\n    // unless the user is erased, where a late finish must not put one back\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance}\n           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n         SELECT $1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')} ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n        [\n          input.instanceId,\n          input.workflow,\n          input.userId,\n          input.status,\n          input.at,\n          input.convertedAt ?? null,\n        ]\n      );\n    });\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one. With a\n    // tombstone the statement yields nothing, a retry's row included: the copy is not sent\n    return this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, message.userId);\n      const rows = await tx.query<{ id: string }>(\n        `INSERT INTO ${this.t.message}\n           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, topic, sent_at)\n         SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9::text, ${TS('$10')} ${this.notErased('$8')}\n         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n         RETURNING id`,\n        [\n          uuidv7(message.sentAt),\n          message.idempotencyKey,\n          message.workflow,\n          message.instanceId,\n          message.nodeId,\n          message.template,\n          message.channel,\n          message.userId,\n          message.topic,\n          message.sentAt,\n        ]\n      );\n      const id = rows.at(0)?.id;\n      if (id !== undefined) return id;\n      // Nothing recorded: the tombstone refused it, and the sender must stop here\n      const erased = await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [\n        message.userId,\n      ]);\n      if (erased.length > 0) throw new UserErasedError(message.userId);\n      throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    });\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.transaction(async (tx) => {\n      // No copy (or one being erased): nothing to record the links under\n      if ((await this.lockMessage(tx, messageId)) === undefined) return;\n      await tx.query(\n        `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n        [messageId, ...urls]\n      );\n    });\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const message = await this.lockMessage(tx, messageId);\n      if (message === undefined) return false;\n      const open = judge(message);\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock (taken after the user lock): concurrent clicks on it are\n      // judged one at a time\n      const message = await this.lockMessage(tx, messageId, true);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: message.deliveredAt,\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      if ((await this.lockMessage(tx, messageId)) === undefined) return false;\n      const rows = await tx.query<{ id: string }>(\n        `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n         WHERE id = $1 RETURNING id`,\n        [messageId, at]\n      );\n      return rows.length > 0;\n    });\n  }\n\n  async lookupMessage(messageId: string): Promise<MessageSummary | undefined> {\n    const rows = await this.sql.query<{ user_id: string; channel: string; topic: string | null }>(\n      `SELECT user_id, channel, topic FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    return row === undefined\n      ? undefined\n      : { userId: row.user_id, channel: row.channel, topic: row.topic };\n  }\n\n  async recordUnsubscribe(\n    messageId: string,\n    at: number,\n    scope: 'topic' | 'all' = 'topic'\n  ): Promise<{ userId: string; topic: string | null } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The lock order of the other message-id paths (user lock, then the copy's row), so an\n      // unsubscribe and an erasure never wait on each other crosswise. Not the tombstone check:\n      // an opt-out is recorded whatever the user's state, on the copy as long as it is there\n      await beginReadCommitted(tx);\n      const owners = await tx.query<{ user_id: string; topic: string | null }>(\n        `SELECT user_id, topic FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`,\n        [messageId]\n      );\n      const owner = owners.at(0);\n      if (owner === undefined) return undefined;\n      // A transactional copy carries no unsubscribe link: nothing to record, and the caller\n      // answers as for a link that does not exist\n      if (owner.topic === null) return { userId: owner.user_id, topic: null };\n      await lockUser(tx, this.schema, owner.user_id);\n      // The first unsubscribe sets the time; a later one keeps it and still names the recipient\n      const rows = await tx.query<{ user_id: string; topic: string | null }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id, topic`,\n        [messageId, at]\n      );\n      const row = rows.at(0);\n      if (row === undefined) return undefined;\n      // The opt-out itself: the copy's topic, or every email (the channel-wide null-topic row)\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, topic, ts)\n         VALUES ($1, 'email', $2::text, ${TS('$3')}) ON CONFLICT DO NOTHING`,\n        [row.user_id, scope === 'all' ? null : row.topic, at]\n      );\n      return { userId: row.user_id, topic: row.topic };\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAgBA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;;;;;;;;;;;;;;;;;AAwB7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CACA;CAHnB,YACE,KACA,GACA,QACA;EAHiB,KAAA,MAAA;EACA,KAAA,IAAA;EACA,KAAA,SAAA;CAChB;;CAGH,UAAkB,MAAsB;EACtC,OAAO,mCAAmC,KAAK,EAAE,QAAQ,mBAAmB,KAAK;CACnF;;;;;;;CAQA,MAAc,YACZ,IACA,WACA,YAAY,OACkD;EAC9D,MAAMA,wBAAAA,mBAAmB,EAAE;EAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,iBACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;EACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;EAQ7C,MAAM,OAAM,MAPO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;cACjD,KAAK,EAAE,QAAQ;yCACY,KAAK,EAAE,QAAQ,mBAAmB,KAAK,EAAE,QAAQ;SACjF,YAAY,eAAe,MAC9B,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,OAAO;GAAE,QAAQ,IAAI;GAAS,aAAa,OAAO,IAAI,YAAY;EAAE;CACtE;CAEA,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMC,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;gDAElE;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;GAAE,CAC3D;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;0GAEnF;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;IAAI,MAAM;GAAM,CACzE;EACF,CAAC;CACH;CAEA,MAAM,iBAAiB,OAOL;EAGhB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;;8BAET,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;sFAGrF;IACE,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM,eAAe;GACvB,CACF;EACF,CAAC;CACH;CAEA,MAAM,cAAc,SAAyC;EAG3D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAMA,wBAAAA,oBAAoB,IAAI,KAAK,QAAQ,QAAQ,MAAM;GAoBzD,MAAM,MAAK,MAnBQ,GAAG,MACpB,eAAe,KAAK,EAAE,QAAQ;;4DAEsB,GAAG,KAAK,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;wBAGtF;IACEC,kBAAAA,OAAO,QAAQ,MAAM;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;GACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;GACvB,IAAI,OAAO,KAAA,GAAW,OAAO;GAK7B,KAAI,MAHiB,GAAG,MAAM,sBAAsB,KAAK,EAAE,QAAQ,sBAAsB,CACvF,QAAQ,MACV,CAAC,EAAA,CACU,SAAS,GAAG,MAAM,IAAIC,sBAAAA,gBAAgB,QAAQ,MAAM;GAC/D,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EACtE,CAAC;CACH;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GAEvC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW;GAC3D,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;EACF,CAAC;CACH;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,SAAS;GACpD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,MAAM,OAAO,MAAM,OAAO;GAC1B,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACED,kBAAAA,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAGxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,WAAW,IAAI;GAC1D,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,QAAQ;IACrB,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACEA,kBAAAA,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAC3E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW,OAAO;GAMlE,QAAO,MALY,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;sCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;EACvB,CAAC;CACH;CAEA,MAAM,cAAc,WAAwD;EAK1E,MAAM,OAAM,MAJO,KAAK,IAAI,MAC1B,uCAAuC,KAAK,EAAE,QAAQ,iBACtD,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,OAAO,QAAQ,KAAA,IACX,KAAA,IACA;GAAE,QAAQ,IAAI;GAAS,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM;CACpE;CAEA,MAAM,kBACJ,WACA,IACA,QAAyB,SACsC;EAC/D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAIxC,MAAMH,wBAAAA,mBAAmB,EAAE;GAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,8BAA8B,KAAK,EAAE,QAAQ,uCAC7C,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;GACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAGhC,IAAI,MAAM,UAAU,MAAM,OAAO;IAAE,QAAQ,MAAM;IAAS,OAAO;GAAK;GACtE,MAAMC,wBAAAA,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;GAO7C,MAAM,OAAM,MALO,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;wEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACiB,GAAG,CAAC;GACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAE9B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;0CACA,GAAG,IAAI,EAAE,2BAC3C;IAAC,IAAI;IAAS,UAAU,QAAQ,OAAO,IAAI;IAAO;GAAE,CACtD;GACA,OAAO;IAAE,QAAQ,IAAI;IAAS,OAAO,IAAI;GAAM;EACjD,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}

package/dist/store/postgres-reporting.d.cts

@@ -1,7 +1,6 @@
 import { SqlClientLike } from "./sql.cjs";
 import { TableKey } from "./tables.cjs";
-import { ClickContext, Engagement, JourneyReporting, MessageRecord } from "./index.cjs";
-//#region src/store/postgres-reporting.d.ts
+import { ClickContext, Engagement, JourneyReporting, MessageRecord, MessageSummary } from "./index.cjs";
 /**
  * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,
  * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
@@ -79,13 +78,14 @@ export declare class PostgresReporting implements JourneyReporting {
     engagement: Engagement;
   } | undefined>;
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
-  recordUnsubscribe(messageId: string, at: number): Promise<{
+  lookupMessage(messageId: string): Promise<MessageSummary | undefined>;
+  recordUnsubscribe(messageId: string, at: number, scope?: 'topic' | 'all'): Promise<{
     userId: string;
+    topic: string | null;
   } | undefined>;
   snapshotSegments(at: number): Promise<{
     segment: string;
     size: number;
   }[]>;
 }
-//#endregion
 //# sourceMappingURL=postgres-reporting.d.cts.map

package/dist/store/postgres-reporting.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.d.cts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;qBAmCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAkCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,kBAAkB,mBAAmB,aAAa;IAAU;;EA+B5D,iBAAiB,aAAa;IAAU;IAAiB"}
+{"version":3,"file":"postgres-reporting.d.cts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;qBAyCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAmCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,cAAc,oBAAoB,QAAQ;EAW1C,kBACJ,mBACA,YACA,0BACC;IAAU;IAAgB;;EAkCvB,iBAAiB,aAAa;IAAU;IAAiB"}

package/dist/store/postgres-reporting.d.mts

@@ -1,7 +1,6 @@
 import { SqlClientLike } from "./sql.mjs";
 import { TableKey } from "./tables.mjs";
-import { ClickContext, Engagement, JourneyReporting, MessageRecord } from "./index.mjs";
-//#region src/store/postgres-reporting.d.ts
+import { ClickContext, Engagement, JourneyReporting, MessageRecord, MessageSummary } from "./index.mjs";
 /**
  * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,
  * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp
@@ -79,13 +78,14 @@ export declare class PostgresReporting implements JourneyReporting {
     engagement: Engagement;
   } | undefined>;
   recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;
-  recordUnsubscribe(messageId: string, at: number): Promise<{
+  lookupMessage(messageId: string): Promise<MessageSummary | undefined>;
+  recordUnsubscribe(messageId: string, at: number, scope?: 'topic' | 'all'): Promise<{
     userId: string;
+    topic: string | null;
   } | undefined>;
   snapshotSegments(at: number): Promise<{
     segment: string;
     size: number;
   }[]>;
 }
-//#endregion
 //# sourceMappingURL=postgres-reporting.d.mts.map

package/dist/store/postgres-reporting.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.d.mts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;qBAmCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAkCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,kBAAkB,mBAAmB,aAAa;IAAU;;EA+B5D,iBAAiB,aAAa;IAAU;IAAiB"}
+{"version":3,"file":"postgres-reporting.d.mts","names":[],"sources":["../../src/store/postgres-reporting.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;qBAyCa,6BAA6B;mBAErB;mBACA;mBACA;EAHnB,YACmB,KAAK,eACL,GAAG,OAAO,mBACV;;UAIX;;;;;;;UAUM;EAyBR,gBAAgB;IACpB;IACA;IACA;IACA;MACE;EAYE,YAAY;IAChB;IACA;IACA;IACA;IACA;MACE;EAYE,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;MACE;EAuBE,cAAc,SAAS,gBAAgB;EAmCvC,cACJ,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;EAcG,YAAY,mBAAmB,0BAA0B;EAazD,WACJ,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;EAmCG,YACJ,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;EAwEhC,sBAAsB,mBAAmB,aAAa;EAYtD,cAAc,oBAAoB,QAAQ;EAW1C,kBACJ,mBACA,YACA,0BACC;IAAU;IAAgB;;EAkCvB,iBAAiB,aAAa;IAAU;IAAiB"}

package/dist/store/postgres-reporting.mjs

@@ -1,7 +1,7 @@
 import { UserErasedError } from "./erasure.mjs";
 import { uuidv7 } from "./sql.mjs";
 import { beginReadCommitted, lockUser, lockUserTransaction } from "./user-lock.mjs";
-//#region src/store/postgres-reporting.ts
+// src/store/postgres-reporting.ts
 /**
 * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a
 * driver may hand a double or a bigint count back as a string).
@@ -112,8 +112,8 @@ var PostgresReporting = class {
 		return this.sql.transaction(async (tx) => {
 			await lockUserTransaction(tx, this.schema, message.userId);
 			const id = (await tx.query(`INSERT INTO ${this.t.message}
-           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)
-         SELECT $1, $2, $3, $4, $5, $6, $7, $8, ${TS("$9")} ${this.notErased("$8")}
+           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, topic, sent_at)
+         SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9::text, ${TS("$10")} ${this.notErased("$8")}
          ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key
          RETURNING id`, [
 				uuidv7(message.sentAt),
@@ -124,6 +124,7 @@ var PostgresReporting = class {
 				message.template,
 				message.channel,
 				message.userId,
+				message.topic,
 				message.sentAt
 			])).at(0)?.id;
 			if (id !== void 0) return id;
@@ -240,18 +241,37 @@ var PostgresReporting = class {
          WHERE id = $1 RETURNING id`, [messageId, at])).length > 0;
 		});
 	}
-	async recordUnsubscribe(messageId, at) {
+	async lookupMessage(messageId) {
+		const row = (await this.sql.query(`SELECT user_id, channel, topic FROM ${this.t.message} WHERE id = $1`, [messageId])).at(0);
+		return row === void 0 ? void 0 : {
+			userId: row.user_id,
+			channel: row.channel,
+			topic: row.topic
+		};
+	}
+	async recordUnsubscribe(messageId, at, scope = "topic") {
 		return this.sql.transaction(async (tx) => {
 			await beginReadCommitted(tx);
-			const owner = (await tx.query(`SELECT user_id FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`, [messageId])).at(0);
+			const owner = (await tx.query(`SELECT user_id, topic FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`, [messageId])).at(0);
 			if (owner === void 0) return void 0;
+			if (owner.topic === null) return {
+				userId: owner.user_id,
+				topic: null
+			};
 			await lockUser(tx, this.schema, owner.user_id);
-			const userId = (await tx.query(`UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS("$2")})
-         WHERE id = $1 AND channel = 'email' RETURNING user_id`, [messageId, at])).at(0)?.user_id;
-			if (userId === void 0) return void 0;
-			await tx.query(`INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS("$2")})
-         ON CONFLICT DO NOTHING`, [userId, at]);
-			return { userId };
+			const row = (await tx.query(`UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS("$2")})
+         WHERE id = $1 AND channel = 'email' RETURNING user_id, topic`, [messageId, at])).at(0);
+			if (row === void 0) return void 0;
+			await tx.query(`INSERT INTO ${this.t.suppression} (user_id, channel, topic, ts)
+         VALUES ($1, 'email', $2::text, ${TS("$3")}) ON CONFLICT DO NOTHING`, [
+				row.user_id,
+				scope === "all" ? null : row.topic,
+				at
+			]);
+			return {
+				userId: row.user_id,
+				topic: row.topic
+			};
 		});
 	}
 	async snapshotSegments(at) {
@@ -269,7 +289,6 @@ var PostgresReporting = class {
 		});
 	}
 };
-//#endregion
 export { PostgresReporting };
 
 //# sourceMappingURL=postgres-reporting.mjs.map

package/dist/store/postgres-reporting.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-reporting.mjs","names":[],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import { UserErasedError } from './erasure';\nimport type { ClickContext, Engagement, JourneyReporting, MessageRecord } from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\nimport { beginReadCommitted, lockUser, lockUserTransaction } from './user-lock';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n *\n * The instance and message rows are written like the store's rows about a user (postgres.ts,\n * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's\n * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after\n * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts\n * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not\n * retryable) so it is never sent.\n *\n * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is\n * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the\n * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone\n * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only\n * then locks the copy's row (where the path locks it) and writes. User lock before row lock,\n * always: the erasure deletes under the user lock, so the two never wait on each other in\n * opposite orders. The unsubscribe is the compliance exception: its suppression is written\n * whatever the user's state, under the same lock order for consistency.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>,\n    private readonly schema: string\n  ) {}\n\n  /** The condition every row about a user carries: no erasure tombstone for `$user`. */\n  private notErased(user: string): string {\n    return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;\n  }\n\n  /**\n   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the\n   * owner's user lock, then the copy re-read under it — present and its owner without a\n   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).\n   * `forUpdate` locks the copy's row on that re-read, after the user lock.\n   */\n  private async lockMessage(\n    tx: SqlClientLike,\n    messageId: string,\n    forUpdate = false\n  ): Promise<{ userId: string; deliveredAt: number } | undefined> {\n    await beginReadCommitted(tx);\n    const owners = await tx.query<{ user_id: string }>(\n      `SELECT user_id FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const owner = owners.at(0);\n    if (owner === undefined) return undefined;\n    await lockUser(tx, this.schema, owner.user_id);\n    const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n      `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n       FROM ${this.t.message} WHERE id = $1\n         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)\n       ${forUpdate ? 'FOR UPDATE' : ''}`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    if (row === undefined) return undefined;\n    return { userId: row.user_id, deliveredAt: Number(row.delivered_at) };\n  }\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO NOTHING`,\n        [input.instanceId, input.workflow, input.userId, input.at]\n      );\n    });\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n        [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n      );\n    });\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row —\n    // unless the user is erased, where a late finish must not put one back\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance}\n           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n         SELECT $1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')} ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n        [\n          input.instanceId,\n          input.workflow,\n          input.userId,\n          input.status,\n          input.at,\n          input.convertedAt ?? null,\n        ]\n      );\n    });\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one. With a\n    // tombstone the statement yields nothing, a retry's row included: the copy is not sent\n    return this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, message.userId);\n      const rows = await tx.query<{ id: string }>(\n        `INSERT INTO ${this.t.message}\n           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, sent_at)\n         SELECT $1, $2, $3, $4, $5, $6, $7, $8, ${TS('$9')} ${this.notErased('$8')}\n         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n         RETURNING id`,\n        [\n          uuidv7(message.sentAt),\n          message.idempotencyKey,\n          message.workflow,\n          message.instanceId,\n          message.nodeId,\n          message.template,\n          message.channel,\n          message.userId,\n          message.sentAt,\n        ]\n      );\n      const id = rows.at(0)?.id;\n      if (id !== undefined) return id;\n      // Nothing recorded: the tombstone refused it, and the sender must stop here\n      const erased = await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [\n        message.userId,\n      ]);\n      if (erased.length > 0) throw new UserErasedError(message.userId);\n      throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    });\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.transaction(async (tx) => {\n      // No copy (or one being erased): nothing to record the links under\n      if ((await this.lockMessage(tx, messageId)) === undefined) return;\n      await tx.query(\n        `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n        [messageId, ...urls]\n      );\n    });\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const message = await this.lockMessage(tx, messageId);\n      if (message === undefined) return false;\n      const open = judge(message);\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock (taken after the user lock): concurrent clicks on it are\n      // judged one at a time\n      const message = await this.lockMessage(tx, messageId, true);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: message.deliveredAt,\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      if ((await this.lockMessage(tx, messageId)) === undefined) return false;\n      const rows = await tx.query<{ id: string }>(\n        `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n         WHERE id = $1 RETURNING id`,\n        [messageId, at]\n      );\n      return rows.length > 0;\n    });\n  }\n\n  async recordUnsubscribe(messageId: string, at: number): Promise<{ userId: string } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The lock order of the other message-id paths (user lock, then the copy's row), so an\n      // unsubscribe and an erasure never wait on each other crosswise. Not the tombstone check:\n      // an opt-out is recorded whatever the user's state, on the copy as long as it is there\n      await beginReadCommitted(tx);\n      const owners = await tx.query<{ user_id: string }>(\n        `SELECT user_id FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`,\n        [messageId]\n      );\n      const owner = owners.at(0);\n      if (owner === undefined) return undefined;\n      await lockUser(tx, this.schema, owner.user_id);\n      // The first unsubscribe sets the time; a later one keeps it and still names the recipient\n      const rows = await tx.query<{ user_id: string }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id`,\n        [messageId, at]\n      );\n      const userId = rows.at(0)?.user_id;\n      if (userId === undefined) return undefined;\n      // The opt-out itself: the engine sends this user no more email\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, ts) VALUES ($1, 'email', ${TS('$2')})\n         ON CONFLICT DO NOTHING`,\n        [userId, at]\n      );\n      return { userId };\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAUA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;;;;;;;;;;;;;;;;;AAwB7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CACA;CAHnB,YACE,KACA,GACA,QACA;EAHiB,KAAA,MAAA;EACA,KAAA,IAAA;EACA,KAAA,SAAA;CAChB;;CAGH,UAAkB,MAAsB;EACtC,OAAO,mCAAmC,KAAK,EAAE,QAAQ,mBAAmB,KAAK;CACnF;;;;;;;CAQA,MAAc,YACZ,IACA,WACA,YAAY,OACkD;EAC9D,MAAM,mBAAmB,EAAE;EAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,iBACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;EACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;EAQ7C,MAAM,OAAM,MAPO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;cACjD,KAAK,EAAE,QAAQ;yCACY,KAAK,EAAE,QAAQ,mBAAmB,KAAK,EAAE,QAAQ;SACjF,YAAY,eAAe,MAC9B,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,OAAO;GAAE,QAAQ,IAAI;GAAS,aAAa,OAAO,IAAI,YAAY;EAAE;CACtE;CAEA,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;gDAElE;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;GAAE,CAC3D;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;0GAEnF;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;IAAI,MAAM;GAAM,CACzE;EACF,CAAC;CACH;CAEA,MAAM,iBAAiB,OAOL;EAGhB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;;8BAET,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;sFAGrF;IACE,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM,eAAe;GACvB,CACF;EACF,CAAC;CACH;CAEA,MAAM,cAAc,SAAyC;EAG3D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,QAAQ,MAAM;GAmBzD,MAAM,MAAK,MAlBQ,GAAG,MACpB,eAAe,KAAK,EAAE,QAAQ;;kDAEY,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;wBAG3E;IACE,OAAO,QAAQ,MAAM;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;GACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;GACvB,IAAI,OAAO,KAAA,GAAW,OAAO;GAK7B,KAAI,MAHiB,GAAG,MAAM,sBAAsB,KAAK,EAAE,QAAQ,sBAAsB,CACvF,QAAQ,MACV,CAAC,EAAA,CACU,SAAS,GAAG,MAAM,IAAI,gBAAgB,QAAQ,MAAM;GAC/D,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EACtE,CAAC;CACH;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GAEvC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW;GAC3D,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;EACF,CAAC;CACH;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,SAAS;GACpD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,MAAM,OAAO,MAAM,OAAO;GAC1B,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACE,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAGxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,WAAW,IAAI;GAC1D,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,QAAQ;IACrB,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACE,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAC3E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW,OAAO;GAMlE,QAAO,MALY,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;sCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;EACvB,CAAC;CACH;CAEA,MAAM,kBAAkB,WAAmB,IAAqD;EAC9F,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAIxC,MAAM,mBAAmB,EAAE;GAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,uCACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;GACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAM,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;GAO7C,MAAM,UAAS,MALI,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;iEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACoB,GAAG,CAAC,CAAC,EAAE;GAC3B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;GAEjC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,+CAA+C,GAAG,IAAI,EAAE;kCAE1F,CAAC,QAAQ,EAAE,CACb;GACA,OAAO,EAAE,OAAO;EAClB,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}
+{"version":3,"file":"postgres-reporting.mjs","names":[],"sources":["../../src/store/postgres-reporting.ts"],"sourcesContent":["import { UserErasedError } from './erasure';\nimport type {\n  ClickContext,\n  Engagement,\n  JourneyReporting,\n  MessageRecord,\n  MessageSummary,\n} from './index';\nimport { type SqlClientLike, uuidv7 } from './sql';\nimport type { TableKey } from './tables';\nimport { beginReadCommitted, lockUser, lockUserTransaction } from './user-lock';\n\n/**\n * Epoch milliseconds → timestamptz, and back: numbers in and out, whatever the driver maps (a\n * driver may hand a double or a bigint count back as a string).\n */\nconst TS = (param: string) => `to_timestamp(${param}::double precision / 1000)`;\nconst MS = (column: string) => `(extract(epoch from ${column}) * 1000)::double precision`;\n\n/**\n * Journey reporting on the engine's Postgres schema (tables.ts: instance, message,\n * message_link, message_open, message_click, segment_member, segment_snapshot). Every timestamp\n * is written here, never defaulted, and every write is idempotent: the engine reports again when\n * a step is retried.\n *\n * The instance and message rows are written like the store's rows about a user (postgres.ts,\n * user-lock.ts): in a transaction holding the user's advisory lock, conditional on the user's\n * erasure tombstone (`INSERT ... SELECT ... WHERE NOT EXISTS`). A notification arriving after\n * the user was erased — a late start, node or finish — is a no-op, never an upsert that puts\n * the instance back; a copy to be recorded for them is refused (`UserErasedError`, not\n * retryable) so it is never sent.\n *\n * Links, opens, clicks and device deliveries know only the copy's id. Their transaction is\n * pinned to READ COMMITTED first, looks the copy's owner up without a row lock, takes the\n * owner's user lock, then re-checks that the copy still exists and the owner has no tombstone\n * — a copy deleted while waiting is a no-op, nothing is recorded under a stale owner — and only\n * then locks the copy's row (where the path locks it) and writes. User lock before row lock,\n * always: the erasure deletes under the user lock, so the two never wait on each other in\n * opposite orders. The unsubscribe is the compliance exception: its suppression is written\n * whatever the user's state, under the same lock order for consistency.\n */\nexport class PostgresReporting implements JourneyReporting {\n  constructor(\n    private readonly sql: SqlClientLike,\n    private readonly t: Record<TableKey, string>,\n    private readonly schema: string\n  ) {}\n\n  /** The condition every row about a user carries: no erasure tombstone for `$user`. */\n  private notErased(user: string): string {\n    return `WHERE NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${user})`;\n  }\n\n  /**\n   * The message-id paths' opening: READ COMMITTED, the copy's owner without a row lock, the\n   * owner's user lock, then the copy re-read under it — present and its owner without a\n   * tombstone, or `undefined` (the copy went, or its owner is being erased: nothing to record).\n   * `forUpdate` locks the copy's row on that re-read, after the user lock.\n   */\n  private async lockMessage(\n    tx: SqlClientLike,\n    messageId: string,\n    forUpdate = false\n  ): Promise<{ userId: string; deliveredAt: number } | undefined> {\n    await beginReadCommitted(tx);\n    const owners = await tx.query<{ user_id: string }>(\n      `SELECT user_id FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const owner = owners.at(0);\n    if (owner === undefined) return undefined;\n    await lockUser(tx, this.schema, owner.user_id);\n    const rows = await tx.query<{ user_id: string; delivered_at: number | string }>(\n      `SELECT user_id, ${MS('coalesce(delivered_at, sent_at)')} AS delivered_at\n       FROM ${this.t.message} WHERE id = $1\n         AND NOT EXISTS (SELECT 1 FROM ${this.t.erasure} WHERE user_id = ${this.t.message}.user_id)\n       ${forUpdate ? 'FOR UPDATE' : ''}`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    if (row === undefined) return undefined;\n    return { userId: row.user_id, deliveredAt: Number(row.delivered_at) };\n  }\n\n  async instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO NOTHING`,\n        [input.instanceId, input.workflow, input.userId, input.at]\n      );\n    });\n  }\n\n  async nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void> {\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance} (instance_id, workflow, user_id, entered_at, node_id, node_at, status)\n         SELECT $1, $2, $3, ${TS('$4')}, $5, ${TS('$4')}, 'running' ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET node_id = EXCLUDED.node_id, node_at = EXCLUDED.node_at`,\n        [input.instanceId, input.workflow, input.userId, input.at, input.nodeId]\n      );\n    });\n  }\n\n  async instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void> {\n    // An upsert: an instance that started before its start was reported still gets its row —\n    // unless the user is erased, where a late finish must not put one back\n    await this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, input.userId);\n      await tx.query(\n        `INSERT INTO ${this.t.instance}\n           (instance_id, workflow, user_id, entered_at, status, finished_at, converted_at)\n         SELECT $1, $2, $3, ${TS('$5')}, $4, ${TS('$5')}, ${TS('$6')} ${this.notErased('$3')}\n         ON CONFLICT (instance_id) DO UPDATE SET status = EXCLUDED.status,\n           finished_at = EXCLUDED.finished_at, converted_at = EXCLUDED.converted_at`,\n        [\n          input.instanceId,\n          input.workflow,\n          input.userId,\n          input.status,\n          input.at,\n          input.convertedAt ?? null,\n        ]\n      );\n    });\n  }\n\n  async recordMessage(message: MessageRecord): Promise<string> {\n    // A retried step records the same copy again: the row it already wrote is the one. With a\n    // tombstone the statement yields nothing, a retry's row included: the copy is not sent\n    return this.sql.transaction(async (tx) => {\n      await lockUserTransaction(tx, this.schema, message.userId);\n      const rows = await tx.query<{ id: string }>(\n        `INSERT INTO ${this.t.message}\n           (id, idempotency_key, workflow, instance_id, node_id, template, channel, user_id, topic, sent_at)\n         SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9::text, ${TS('$10')} ${this.notErased('$8')}\n         ON CONFLICT (idempotency_key) DO UPDATE SET idempotency_key = EXCLUDED.idempotency_key\n         RETURNING id`,\n        [\n          uuidv7(message.sentAt),\n          message.idempotencyKey,\n          message.workflow,\n          message.instanceId,\n          message.nodeId,\n          message.template,\n          message.channel,\n          message.userId,\n          message.topic,\n          message.sentAt,\n        ]\n      );\n      const id = rows.at(0)?.id;\n      if (id !== undefined) return id;\n      // Nothing recorded: the tombstone refused it, and the sender must stop here\n      const erased = await tx.query(`SELECT 1 AS x FROM ${this.t.erasure} WHERE user_id = $1`, [\n        message.userId,\n      ]);\n      if (erased.length > 0) throw new UserErasedError(message.userId);\n      throw new Error(`message ${message.idempotencyKey} was not recorded`);\n    });\n  }\n\n  async settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void> {\n    if (result.delivered) {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET delivered_at = coalesce(delivered_at, ${TS('$2')}) WHERE idempotency_key = $1`,\n        [idempotencyKey, at]\n      );\n    } else {\n      await this.sql.query(\n        `UPDATE ${this.t.message} SET undelivered_reason = $2 WHERE idempotency_key = $1`,\n        [idempotencyKey, result.reason]\n      );\n    }\n  }\n\n  async recordLinks(messageId: string, urls: readonly string[]): Promise<void> {\n    if (urls.length === 0) return;\n    const values = urls.map((_, i) => `($1, ${i}, $${i + 2})`).join(', ');\n    await this.sql.transaction(async (tx) => {\n      // No copy (or one being erased): nothing to record the links under\n      if ((await this.lockMessage(tx, messageId)) === undefined) return;\n      await tx.query(\n        `INSERT INTO ${this.t.messageLink} (message_id, position, url) VALUES ${values} ON CONFLICT DO NOTHING`,\n        [messageId, ...urls]\n      );\n    });\n  }\n\n  async recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean> {\n    // In a transaction: read through Hyperdrive, a bare read may come from its cache, from before\n    // the copy existed\n    return this.sql.transaction(async (tx) => {\n      const message = await this.lockMessage(tx, messageId);\n      if (message === undefined) return false;\n      const open = judge(message);\n      if (open === undefined) return true;\n      await tx.query(\n        `INSERT INTO ${this.t.messageOpen}\n           (id, message_id, opened_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, ${TS('$3')}, $4, $5, $6, $7, $8, $9)`,\n        [\n          uuidv7(open.at),\n          messageId,\n          open.at,\n          open.machine,\n          open.reason,\n          open.userAgent,\n          open.asn,\n          open.organization,\n          open.country,\n        ]\n      );\n      await tx.query(\n        `UPDATE ${this.t.message} SET\n           opened_at = coalesce(opened_at, ${TS('$2')}),\n           human_opened_at = CASE WHEN $3 THEN human_opened_at ELSE coalesce(human_opened_at, ${TS('$2')}) END\n         WHERE id = $1`,\n        [messageId, open.at, open.machine]\n      );\n      return true;\n    });\n  }\n\n  async recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The copy's row is the lock (taken after the user lock): concurrent clicks on it are\n      // judged one at a time\n      const message = await this.lockMessage(tx, messageId, true);\n      if (message === undefined) return undefined;\n      const links = await tx.query<{ url: string; link_count: number | string }>(\n        `SELECT l.url,\n           (SELECT count(*) FROM ${this.t.messageLink} a WHERE a.message_id = l.message_id) AS link_count\n         FROM ${this.t.messageLink} l WHERE l.message_id = $1 AND l.position = $2`,\n        [messageId, position]\n      );\n      const link = links.at(0);\n      if (link === undefined) return undefined;\n      const since = at - windowMs;\n      const recent = await tx.query<{ position: number; at: number | string }>(\n        `SELECT position, ${MS('clicked_at')} AS at FROM ${this.t.messageClick}\n         WHERE message_id = $1 AND clicked_at >= ${TS('$2')} ORDER BY clicked_at`,\n        [messageId, since]\n      );\n      const { engagement: click, backdate } = judge({\n        url: link.url,\n        deliveredAt: message.deliveredAt,\n        linkCount: Number(link.link_count),\n        recent: recent.map((row) => ({ position: row.position, at: Number(row.at) })),\n      });\n      await tx.query(\n        `INSERT INTO ${this.t.messageClick}\n           (id, message_id, position, url, clicked_at, machine, reason, user_agent, asn, as_organization, country)\n         VALUES ($1, $2, $3, $4, ${TS('$5')}, $6, $7, $8, $9, $10, $11)`,\n        [\n          uuidv7(click.at),\n          messageId,\n          position,\n          link.url,\n          click.at,\n          click.machine,\n          click.reason,\n          click.userAgent,\n          click.asn,\n          click.organization,\n          click.country,\n        ]\n      );\n      if (backdate) {\n        // A walk across the copy is found on its later clicks: the earlier ones were part of it\n        await tx.query(\n          `UPDATE ${this.t.messageClick} SET machine = true, reason = $4\n           WHERE message_id = $1 AND NOT machine\n             AND clicked_at BETWEEN ${TS('$2')} AND ${TS('$3')}`,\n          [messageId, since, at, click.reason]\n        );\n      }\n      // First opens and clicks, from the classified rows (a click implies an open)\n      await tx.query(\n        `UPDATE ${this.t.message} m SET\n           clicked_at = coalesce(m.clicked_at, ${TS('$2')}),\n           opened_at = coalesce(m.opened_at, ${TS('$2')}),\n           human_clicked_at = (SELECT min(c.clicked_at) FROM ${this.t.messageClick} c\n             WHERE c.message_id = m.id AND NOT c.machine),\n           human_opened_at = (SELECT min(t) FROM (\n             SELECT o.opened_at AS t FROM ${this.t.messageOpen} o WHERE o.message_id = m.id AND NOT o.machine\n             UNION ALL\n             SELECT c.clicked_at FROM ${this.t.messageClick} c WHERE c.message_id = m.id AND NOT c.machine\n           ) human)\n         WHERE m.id = $1`,\n        [messageId, at]\n      );\n      return { url: link.url, engagement: click };\n    });\n  }\n\n  async recordDeviceDelivered(messageId: string, at: number): Promise<boolean> {\n    return this.sql.transaction(async (tx) => {\n      if ((await this.lockMessage(tx, messageId)) === undefined) return false;\n      const rows = await tx.query<{ id: string }>(\n        `UPDATE ${this.t.message} SET device_delivered_at = coalesce(device_delivered_at, ${TS('$2')})\n         WHERE id = $1 RETURNING id`,\n        [messageId, at]\n      );\n      return rows.length > 0;\n    });\n  }\n\n  async lookupMessage(messageId: string): Promise<MessageSummary | undefined> {\n    const rows = await this.sql.query<{ user_id: string; channel: string; topic: string | null }>(\n      `SELECT user_id, channel, topic FROM ${this.t.message} WHERE id = $1`,\n      [messageId]\n    );\n    const row = rows.at(0);\n    return row === undefined\n      ? undefined\n      : { userId: row.user_id, channel: row.channel, topic: row.topic };\n  }\n\n  async recordUnsubscribe(\n    messageId: string,\n    at: number,\n    scope: 'topic' | 'all' = 'topic'\n  ): Promise<{ userId: string; topic: string | null } | undefined> {\n    return this.sql.transaction(async (tx) => {\n      // The lock order of the other message-id paths (user lock, then the copy's row), so an\n      // unsubscribe and an erasure never wait on each other crosswise. Not the tombstone check:\n      // an opt-out is recorded whatever the user's state, on the copy as long as it is there\n      await beginReadCommitted(tx);\n      const owners = await tx.query<{ user_id: string; topic: string | null }>(\n        `SELECT user_id, topic FROM ${this.t.message} WHERE id = $1 AND channel = 'email'`,\n        [messageId]\n      );\n      const owner = owners.at(0);\n      if (owner === undefined) return undefined;\n      // A transactional copy carries no unsubscribe link: nothing to record, and the caller\n      // answers as for a link that does not exist\n      if (owner.topic === null) return { userId: owner.user_id, topic: null };\n      await lockUser(tx, this.schema, owner.user_id);\n      // The first unsubscribe sets the time; a later one keeps it and still names the recipient\n      const rows = await tx.query<{ user_id: string; topic: string | null }>(\n        `UPDATE ${this.t.message} SET unsubscribed_at = coalesce(unsubscribed_at, ${TS('$2')})\n         WHERE id = $1 AND channel = 'email' RETURNING user_id, topic`,\n        [messageId, at]\n      );\n      const row = rows.at(0);\n      if (row === undefined) return undefined;\n      // The opt-out itself: the copy's topic, or every email (the channel-wide null-topic row)\n      await tx.query(\n        `INSERT INTO ${this.t.suppression} (user_id, channel, topic, ts)\n         VALUES ($1, 'email', $2::text, ${TS('$3')}) ON CONFLICT DO NOTHING`,\n        [row.user_id, scope === 'all' ? null : row.topic, at]\n      );\n      return { userId: row.user_id, topic: row.topic };\n    });\n  }\n\n  async snapshotSegments(at: number): Promise<{ segment: string; size: number }[]> {\n    return this.sql.transaction(async (tx) => {\n      // Segments no longer deployed take their members with them\n      await tx.query(\n        `DELETE FROM ${this.t.segmentMember} m\n         WHERE NOT EXISTS (SELECT 1 FROM ${this.t.segment} s WHERE s.id = m.segment)`\n      );\n      const rows = await tx.query<{ segment: string; size: number | string }>(\n        `INSERT INTO ${this.t.segmentSnapshot} (segment, taken_at, size)\n         SELECT s.id, ${TS('$1')}, (SELECT count(*) FROM ${this.t.segmentMember} m WHERE m.segment = s.id)\n         FROM ${this.t.segment} s\n         ON CONFLICT DO NOTHING\n         RETURNING segment, size`,\n        [at]\n      );\n      return rows\n        .map((row) => ({ segment: row.segment, size: Number(row.size) }))\n        .sort((a, b) => a.segment.localeCompare(b.segment));\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAgBA,MAAM,MAAM,UAAkB,gBAAgB,MAAM;AACpD,MAAM,MAAM,WAAmB,uBAAuB,OAAO;;;;;;;;;;;;;;;;;;;;;;;AAwB7D,IAAa,oBAAb,MAA2D;CAEtC;CACA;CACA;CAHnB,YACE,KACA,GACA,QACA;EAHiB,KAAA,MAAA;EACA,KAAA,IAAA;EACA,KAAA,SAAA;CAChB;;CAGH,UAAkB,MAAsB;EACtC,OAAO,mCAAmC,KAAK,EAAE,QAAQ,mBAAmB,KAAK;CACnF;;;;;;;CAQA,MAAc,YACZ,IACA,WACA,YAAY,OACkD;EAC9D,MAAM,mBAAmB,EAAE;EAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,uBAAuB,KAAK,EAAE,QAAQ,iBACtC,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;EACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;EAQ7C,MAAM,OAAM,MAPO,GAAG,MACpB,mBAAmB,GAAG,iCAAiC,EAAE;cACjD,KAAK,EAAE,QAAQ;yCACY,KAAK,EAAE,QAAQ,mBAAmB,KAAK,EAAE,QAAQ;SACjF,YAAY,eAAe,MAC9B,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,OAAO;GAAE,QAAQ,IAAI;GAAS,aAAa,OAAO,IAAI,YAAY;EAAE;CACtE;CAEA,MAAM,gBAAgB,OAKJ;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;gDAElE;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;GAAE,CAC3D;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAMA;EAChB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;8BACT,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,cAAc,KAAK,UAAU,IAAI,EAAE;0GAEnF;IAAC,MAAM;IAAY,MAAM;IAAU,MAAM;IAAQ,MAAM;IAAI,MAAM;GAAM,CACzE;EACF,CAAC;CACH;CAEA,MAAM,iBAAiB,OAOL;EAGhB,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GACvC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,MAAM,MAAM;GACvD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,SAAS;;8BAET,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;sFAGrF;IACE,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM,eAAe;GACvB,CACF;EACF,CAAC;CACH;CAEA,MAAM,cAAc,SAAyC;EAG3D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,oBAAoB,IAAI,KAAK,QAAQ,QAAQ,MAAM;GAoBzD,MAAM,MAAK,MAnBQ,GAAG,MACpB,eAAe,KAAK,EAAE,QAAQ;;4DAEsB,GAAG,KAAK,EAAE,GAAG,KAAK,UAAU,IAAI,EAAE;;wBAGtF;IACE,OAAO,QAAQ,MAAM;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;GACV,CACF,EAAA,CACgB,GAAG,CAAC,CAAC,EAAE;GACvB,IAAI,OAAO,KAAA,GAAW,OAAO;GAK7B,KAAI,MAHiB,GAAG,MAAM,sBAAsB,KAAK,EAAE,QAAQ,sBAAsB,CACvF,QAAQ,MACV,CAAC,EAAA,CACU,SAAS,GAAG,MAAM,IAAI,gBAAgB,QAAQ,MAAM;GAC/D,MAAM,IAAI,MAAM,WAAW,QAAQ,eAAe,kBAAkB;EACtE,CAAC;CACH;CAEA,MAAM,cACJ,gBACA,QACA,IACe;EACf,IAAI,OAAO,WACT,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,6CAA6C,GAAG,IAAI,EAAE,+BAC/E,CAAC,gBAAgB,EAAE,CACrB;OAEA,MAAM,KAAK,IAAI,MACb,UAAU,KAAK,EAAE,QAAQ,0DACzB,CAAC,gBAAgB,OAAO,MAAM,CAChC;CAEJ;CAEA,MAAM,YAAY,WAAmB,MAAwC;EAC3E,IAAI,KAAK,WAAW,GAAG;EACvB,MAAM,SAAS,KAAK,KAAK,GAAG,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;EACpE,MAAM,KAAK,IAAI,YAAY,OAAO,OAAO;GAEvC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW;GAC3D,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY,sCAAsC,OAAO,0BAC/E,CAAC,WAAW,GAAG,IAAI,CACrB;EACF,CAAC;CACH;CAEA,MAAM,WACJ,WACA,OACkB;EAGlB,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,SAAS;GACpD,IAAI,YAAY,KAAA,GAAW,OAAO;GAClC,MAAM,OAAO,MAAM,OAAO;GAC1B,IAAI,SAAS,KAAA,GAAW,OAAO;GAC/B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;;2BAEf,GAAG,IAAI,EAAE,4BAC5B;IACE,OAAO,KAAK,EAAE;IACd;IACA,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP,CACF;GACA,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;6CACY,GAAG,IAAI,EAAE;gGAC0C,GAAG,IAAI,EAAE;yBAEjG;IAAC;IAAW,KAAK;IAAI,KAAK;GAAO,CACnC;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAM,YACJ,WACA,UACA,IACA,UACA,OAC8D;EAC9D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAGxC,MAAM,UAAU,MAAM,KAAK,YAAY,IAAI,WAAW,IAAI;GAC1D,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAOlC,MAAM,QAAO,MANO,GAAG,MACrB;mCAC2B,KAAK,EAAE,YAAY;gBACtC,KAAK,EAAE,YAAY,iDAC3B,CAAC,WAAW,QAAQ,CACtB,EAAA,CACmB,GAAG,CAAC;GACvB,IAAI,SAAS,KAAA,GAAW,OAAO,KAAA;GAC/B,MAAM,QAAQ,KAAK;GACnB,MAAM,SAAS,MAAM,GAAG,MACtB,oBAAoB,GAAG,YAAY,EAAE,cAAc,KAAK,EAAE,aAAa;mDAC5B,GAAG,IAAI,EAAE,uBACpD,CAAC,WAAW,KAAK,CACnB;GACA,MAAM,EAAE,YAAY,OAAO,aAAa,MAAM;IAC5C,KAAK,KAAK;IACV,aAAa,QAAQ;IACrB,WAAW,OAAO,KAAK,UAAU;IACjC,QAAQ,OAAO,KAAK,SAAS;KAAE,UAAU,IAAI;KAAU,IAAI,OAAO,IAAI,EAAE;IAAE,EAAE;GAC9E,CAAC;GACD,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,aAAa;;mCAER,GAAG,IAAI,EAAE,8BACpC;IACE,OAAO,MAAM,EAAE;IACf;IACA;IACA,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;GACR,CACF;GACA,IAAI,UAEF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,aAAa;;sCAEF,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,KACnD;IAAC;IAAW;IAAO;IAAI,MAAM;GAAM,CACrC;GAGF,MAAM,GAAG,MACP,UAAU,KAAK,EAAE,QAAQ;iDACgB,GAAG,IAAI,EAAE;+CACX,GAAG,IAAI,EAAE;+DACO,KAAK,EAAE,aAAa;;;4CAGvC,KAAK,EAAE,YAAY;;wCAEvB,KAAK,EAAE,aAAa;;2BAGpD,CAAC,WAAW,EAAE,CAChB;GACA,OAAO;IAAE,KAAK,KAAK;IAAK,YAAY;GAAM;EAC5C,CAAC;CACH;CAEA,MAAM,sBAAsB,WAAmB,IAA8B;EAC3E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GACxC,IAAK,MAAM,KAAK,YAAY,IAAI,SAAS,MAAO,KAAA,GAAW,OAAO;GAMlE,QAAO,MALY,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,2DAA2D,GAAG,IAAI,EAAE;sCAE7F,CAAC,WAAW,EAAE,CAChB,EAAA,CACY,SAAS;EACvB,CAAC;CACH;CAEA,MAAM,cAAc,WAAwD;EAK1E,MAAM,OAAM,MAJO,KAAK,IAAI,MAC1B,uCAAuC,KAAK,EAAE,QAAQ,iBACtD,CAAC,SAAS,CACZ,EAAA,CACiB,GAAG,CAAC;EACrB,OAAO,QAAQ,KAAA,IACX,KAAA,IACA;GAAE,QAAQ,IAAI;GAAS,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM;CACpE;CAEA,MAAM,kBACJ,WACA,IACA,QAAyB,SACsC;EAC/D,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAIxC,MAAM,mBAAmB,EAAE;GAK3B,MAAM,SAAQ,MAJO,GAAG,MACtB,8BAA8B,KAAK,EAAE,QAAQ,uCAC7C,CAAC,SAAS,CACZ,EAAA,CACqB,GAAG,CAAC;GACzB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAGhC,IAAI,MAAM,UAAU,MAAM,OAAO;IAAE,QAAQ,MAAM;IAAS,OAAO;GAAK;GACtE,MAAM,SAAS,IAAI,KAAK,QAAQ,MAAM,OAAO;GAO7C,MAAM,OAAM,MALO,GAAG,MACpB,UAAU,KAAK,EAAE,QAAQ,mDAAmD,GAAG,IAAI,EAAE;wEAErF,CAAC,WAAW,EAAE,CAChB,EAAA,CACiB,GAAG,CAAC;GACrB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAE9B,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,YAAY;0CACA,GAAG,IAAI,EAAE,2BAC3C;IAAC,IAAI;IAAS,UAAU,QAAQ,OAAO,IAAI;IAAO;GAAE,CACtD;GACA,OAAO;IAAE,QAAQ,IAAI;IAAS,OAAO,IAAI;GAAM;EACjD,CAAC;CACH;CAEA,MAAM,iBAAiB,IAA0D;EAC/E,OAAO,KAAK,IAAI,YAAY,OAAO,OAAO;GAExC,MAAM,GAAG,MACP,eAAe,KAAK,EAAE,cAAc;2CACD,KAAK,EAAE,QAAQ,2BACpD;GASA,QAAO,MARY,GAAG,MACpB,eAAe,KAAK,EAAE,gBAAgB;wBACtB,GAAG,IAAI,EAAE,0BAA0B,KAAK,EAAE,cAAc;gBAChE,KAAK,EAAE,QAAQ;;mCAGvB,CAAC,EAAE,CACL,EAAA,CAEG,KAAK,SAAS;IAAE,SAAS,IAAI;IAAS,MAAM,OAAO,IAAI,IAAI;GAAE,EAAE,CAAC,CAChE,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;EACtD,CAAC;CACH;AACF"}

package/dist/store/postgres.cjs

@@ -5,7 +5,7 @@ const require_store_sql = require("./sql.cjs");
 const require_store_user_lock = require("./user-lock.cjs");
 const require_store_postgres_reporting = require("./postgres-reporting.cjs");
 const require_store_tables = require("./tables.cjs");
-//#region src/store/postgres.ts
+// src/store/postgres.ts
 /** information_schema's udt_name per column type. */
 const UDT = {
 	uuid: "uuid",
@@ -87,11 +87,18 @@ var PostgresJourneyStore = class {
 				else if (row.is_nullable === "YES" !== (column.nullable === true)) problems.push(`column ${where}."${name}" should be ${column.nullable ? "nullable" : "NOT NULL"}`);
 			}
 			for (const keys of spec.uniqueIndexes ?? []) {
-				const name = `${spec.name}_${keys.map(require_store_tables.columnName).join("_")}_index`;
+				const name = require_store_tables.indexName(spec, keys);
 				const row = liveIndexes.get(`${spec.name}.${name}`);
 				if (row === void 0) problems.push(`missing unique index "${this.schema}"."${name}"`);
 				else if (!/^CREATE UNIQUE INDEX/i.test(row.indexdef)) problems.push(`index "${this.schema}"."${name}" is not unique`);
 			}
+			for (const unique of spec.uniqueConstraints ?? []) {
+				const name = require_store_tables.uniqueConstraintName(spec, unique);
+				const row = liveIndexes.get(`${spec.name}.${name}`);
+				if (row === void 0) problems.push(`missing unique constraint "${this.schema}"."${name}"`);
+				else if (!/^CREATE UNIQUE INDEX/i.test(row.indexdef)) problems.push(`index "${this.schema}"."${name}" is not unique`);
+				else if (!/NULLS NOT DISTINCT/i.test(row.indexdef)) problems.push(`unique constraint "${this.schema}"."${name}" must be NULLS NOT DISTINCT`);
+			}
 		}
 		return problems;
 	}
@@ -259,6 +266,7 @@ var PostgresJourneyStore = class {
 				this.t.subscription,
 				this.t.segmentStart,
 				this.t.segmentMember,
+				this.t.suppression,
 				this.t.device,
 				this.t.event,
 				this.t.profile
@@ -266,8 +274,36 @@ var PostgresJourneyStore = class {
 			await tx.query(`UPDATE ${this.t.erasure} SET erased_at = COALESCE(erased_at, ${TS("$2")}) WHERE user_id = $1`, [userId, at]);
 		});
 	}
-	async isSuppressed(userId, channel) {
-		return (await this.sql.query(`SELECT 1 AS x FROM ${this.t.suppression} WHERE user_id = $1 AND channel = $2`, [userId, channel])).length > 0;
+	async isSuppressed(userId, channel, topic) {
+		return (await this.sql.query(`SELECT 1 AS x FROM ${this.t.suppression}
+       WHERE user_id = $1 AND channel = $2 AND (topic IS NULL OR topic = $3::text)`, [
+			userId,
+			channel,
+			topic ?? null
+		])).length > 0;
+	}
+	async listSuppressions(userId, channel) {
+		return (await this.sql.query(`SELECT topic FROM ${this.t.suppression} WHERE user_id = $1 AND channel = $2
+       ORDER BY topic NULLS FIRST`, [userId, channel])).map((row) => row.topic);
+	}
+	async updateSuppressions(userId, channel, changes, at) {
+		if (changes.length === 0) return;
+		await this.sql.transaction(async (tx) => {
+			await this.lockUser(tx, userId);
+			for (const { topic, suppressed } of changes) if (suppressed) await tx.query(`INSERT INTO ${this.t.suppression} (user_id, channel, topic, ts)
+             VALUES ($1, $2, $3::text, ${TS("$4")}) ON CONFLICT DO NOTHING`, [
+				userId,
+				channel,
+				topic,
+				at
+			]);
+			else await tx.query(`DELETE FROM ${this.t.suppression}
+             WHERE user_id = $1 AND channel = $2 AND topic IS NOT DISTINCT FROM $3::text`, [
+				userId,
+				channel,
+				topic
+			]);
+		});
 	}
 	async removeDevice(token) {
 		return (await this.sql.query(`DELETE FROM ${this.t.device} WHERE token = $1 RETURNING user_id`, [token]))[0]?.user_id ?? void 0;
@@ -609,7 +645,6 @@ var PostgresExecutions = class {
 		await this.sql.query(`UPDATE ${this.table} SET checked_at = ${TS("$2")} WHERE instance_id = $1`, [instanceId, at]);
 	}
 };
-//#endregion
 exports.DEFAULT_SCHEMA = require_store_tables.DEFAULT_SCHEMA;
 exports.PostgresJourneyStore = PostgresJourneyStore;
 exports.uuidv7 = require_store_sql.uuidv7;