@shware/workflow 5.0.1 → 6.1.0

package/dist/client.d.cts

@@ -1,6 +1,6 @@
+import { Contract, ContractIssue, ProfilePatch, Topic } from "./contract.cjs";
 import { ProfileProps } from "./store/index.cjs";
-import { Contract, ContractIssue, ProfilePatch } from "./contract.cjs";
-import { DeployResult, IdentifyResult, IngestResult } from "./host/ingest.cjs";
+import { ChannelSubscriptions, ChannelSubscriptionsPatch, DeployResult, IdentifyResult, IngestResult, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch } from "./host/ingest.cjs";
 import * as core from "zod/v4/core";
 /**
  * `@shware/workflow/client` — the producer side of the ingest API, for the
@@ -39,6 +39,8 @@ type EventsOf<C> = C extends Contract<infer E> ? E : never;
 export type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;
 type TrackArgs<C, K> = [C] extends [undefined] ? [payload?: Record<string, unknown>, options?: TrackOptions] : K extends keyof EventsOf<C> ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions] : never;
 type IdentifyProps<C> = [C] extends [undefined] ? ProfileProps : C extends Contract<Record<string, core.$ZodObject>, infer P> ? ProfilePatch<P> : never;
+/** The topics the client's contract declares; any string without a contract. */
+export type ClientTopic<C> = [C] extends [undefined] ? string : Topic<C>;
 export interface TrackOptions {
   /** The occurrence's identity: a retry with the same id is recorded once. */
   id?: string;
@@ -99,9 +101,43 @@ export declare class JourneyClient<C extends Contract | undefined = undefined> {
     ok: true;
     woke: number;
   }>;
+  /**
+   * Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they
+   * opted out of the whole channel) and each declared topic (false once they opted out of it on
+   * that channel) — the engine's record, which a preference page shows as it is. The two are
+   * independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`
+   * masks every topic however they read (nothing is sent on the channel until it is true again).
+   * Rejects with a 410 for an erased user.
+   */
+  getSubscriptions(userId: string): Promise<Subscriptions<ClientTopic<C>>>;
+  /**
+   * Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {
+   * newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every
+   * push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the
+   * channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,
+   * so a preference page's "subscribe to all" sends `all: true` plus every topic `true`. Answers
+   * the subscriptions as they now stand. With a contract, a topic it does not declare is refused
+   * here, before the request; the engine refuses it too.
+   */
+  setSubscriptions(userId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<Subscriptions<ClientTopic<C>>>;
+  /**
+   * `getSubscriptions` for the recipient of one copy, by the message id an email's preferences
+   * link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a
+   * sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,
+   * so it can highlight that topic. Rejects with a 404 for an id that names no copy — never
+   * sent, or erased with its user — and for a transactional one; the page should show the link
+   * as expired. The message id is the capability, so the app proxies this behind its own API
+   * and rate-limits it.
+   */
+  getSubscriptionsByMessage(messageId: string): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */
+  setSubscriptionsByMessage(messageId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */
+  private undeclaredTopics;
   /** Deploy a compiled bundle (BundleIR). */
   deploy(bundle: unknown): Promise<DeployResult>;
   private post;
+  private request;
 }
-export {};
+export type { ChannelSubscriptions, ChannelSubscriptionsPatch, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch };
 //# sourceMappingURL=client.d.cts.map

package/dist/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAYiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;iBAGF;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,OAAO,kBAAkB,QAAQ;UAInB"}
+{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAoBiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;;YAIP,YAAY,MAAM,kCAAkC,MAAM;iBAYrD;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;;;;;;;;EAYjD,iBAAiB,iBAAiB,QAAQ,cAAc,YAAY;;;;;;;;;;EAapE,iBACE,gBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,cAAc,YAAY;;;;;;;;;;EAerC,0BAA0B,oBAAoB,QAAQ,qBAAqB,YAAY;;EAKvF,0BACE,mBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,qBAAqB,YAAY;;UAOpC;;EAmBR,OAAO,kBAAkB,QAAQ;UAIzB;UAIM"}

package/dist/client.d.mts

@@ -1,6 +1,6 @@
+import { Contract, ContractIssue, ProfilePatch, Topic } from "./contract.mjs";
 import { ProfileProps } from "./store/index.mjs";
-import { Contract, ContractIssue, ProfilePatch } from "./contract.mjs";
-import { DeployResult, IdentifyResult, IngestResult } from "./host/ingest.mjs";
+import { ChannelSubscriptions, ChannelSubscriptionsPatch, DeployResult, IdentifyResult, IngestResult, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch } from "./host/ingest.mjs";
 import * as core from "zod/v4/core";
 /**
  * `@shware/workflow/client` — the producer side of the ingest API, for the
@@ -39,6 +39,8 @@ type EventsOf<C> = C extends Contract<infer E> ? E : never;
 export type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;
 type TrackArgs<C, K> = [C] extends [undefined] ? [payload?: Record<string, unknown>, options?: TrackOptions] : K extends keyof EventsOf<C> ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions] : never;
 type IdentifyProps<C> = [C] extends [undefined] ? ProfileProps : C extends Contract<Record<string, core.$ZodObject>, infer P> ? ProfilePatch<P> : never;
+/** The topics the client's contract declares; any string without a contract. */
+export type ClientTopic<C> = [C] extends [undefined] ? string : Topic<C>;
 export interface TrackOptions {
   /** The occurrence's identity: a retry with the same id is recorded once. */
   id?: string;
@@ -99,9 +101,43 @@ export declare class JourneyClient<C extends Contract | undefined = undefined> {
     ok: true;
     woke: number;
   }>;
+  /**
+   * Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they
+   * opted out of the whole channel) and each declared topic (false once they opted out of it on
+   * that channel) — the engine's record, which a preference page shows as it is. The two are
+   * independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`
+   * masks every topic however they read (nothing is sent on the channel until it is true again).
+   * Rejects with a 410 for an erased user.
+   */
+  getSubscriptions(userId: string): Promise<Subscriptions<ClientTopic<C>>>;
+  /**
+   * Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {
+   * newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every
+   * push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the
+   * channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,
+   * so a preference page's "subscribe to all" sends `all: true` plus every topic `true`. Answers
+   * the subscriptions as they now stand. With a contract, a topic it does not declare is refused
+   * here, before the request; the engine refuses it too.
+   */
+  setSubscriptions(userId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<Subscriptions<ClientTopic<C>>>;
+  /**
+   * `getSubscriptions` for the recipient of one copy, by the message id an email's preferences
+   * link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a
+   * sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,
+   * so it can highlight that topic. Rejects with a 404 for an id that names no copy — never
+   * sent, or erased with its user — and for a transactional one; the page should show the link
+   * as expired. The message id is the capability, so the app proxies this behind its own API
+   * and rate-limits it.
+   */
+  getSubscriptionsByMessage(messageId: string): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */
+  setSubscriptionsByMessage(messageId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */
+  private undeclaredTopics;
   /** Deploy a compiled bundle (BundleIR). */
   deploy(bundle: unknown): Promise<DeployResult>;
   private post;
+  private request;
 }
-export {};
+export type { ChannelSubscriptions, ChannelSubscriptionsPatch, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch };
 //# sourceMappingURL=client.d.mts.map

package/dist/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAYiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;iBAGF;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,OAAO,kBAAkB,QAAQ;UAInB"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAoBiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;;YAIP,YAAY,MAAM,kCAAkC,MAAM;iBAYrD;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;;;;;;;;EAYjD,iBAAiB,iBAAiB,QAAQ,cAAc,YAAY;;;;;;;;;;EAapE,iBACE,gBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,cAAc,YAAY;;;;;;;;;;EAerC,0BAA0B,oBAAoB,QAAQ,qBAAqB,YAAY;;EAKvF,0BACE,mBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,qBAAqB,YAAY;;UAOpC;;EAmBR,OAAO,kBAAkB,QAAQ;UAIzB;UAIM"}

package/dist/client.mjs

@@ -1,3 +1,4 @@
+import { SUBSCRIPTION_CHANNELS } from "./host/ingest.mjs";
 // src/client.ts
 var JourneyClientError = class extends Error {
 	path;
@@ -103,22 +104,85 @@ var JourneyClient = class {
 	removeDevice(token) {
 		return this.post("/devices/remove", { token });
 	}
+	/**
+	* Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they
+	* opted out of the whole channel) and each declared topic (false once they opted out of it on
+	* that channel) — the engine's record, which a preference page shows as it is. The two are
+	* independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`
+	* masks every topic however they read (nothing is sent on the channel until it is true again).
+	* Rejects with a 410 for an erased user.
+	*/
+	getSubscriptions(userId) {
+		return this.request("GET", subscriptionsPath(userId));
+	}
+	/**
+	* Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {
+	* newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every
+	* push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the
+	* channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,
+	* so a preference page's "subscribe to all" sends `all: true` plus every topic `true`. Answers
+	* the subscriptions as they now stand. With a contract, a topic it does not declare is refused
+	* here, before the request; the engine refuses it too.
+	*/
+	setSubscriptions(userId, patch) {
+		const refused = this.undeclaredTopics(patch);
+		if (refused !== void 0) return Promise.reject(refused);
+		return this.request("PUT", subscriptionsPath(userId), patch);
+	}
+	/**
+	* `getSubscriptions` for the recipient of one copy, by the message id an email's preferences
+	* link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a
+	* sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,
+	* so it can highlight that topic. Rejects with a 404 for an id that names no copy — never
+	* sent, or erased with its user — and for a transactional one; the page should show the link
+	* as expired. The message id is the capability, so the app proxies this behind its own API
+	* and rate-limits it.
+	*/
+	getSubscriptionsByMessage(messageId) {
+		return this.request("GET", subscriptionsByMessagePath(messageId));
+	}
+	/** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */
+	setSubscriptionsByMessage(messageId, patch) {
+		const refused = this.undeclaredTopics(patch);
+		if (refused !== void 0) return Promise.reject(refused);
+		return this.request("PUT", subscriptionsByMessagePath(messageId), patch);
+	}
+	/** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */
+	undeclaredTopics(patch) {
+		const contract = this.options.contract;
+		if (contract === void 0) return void 0;
+		const issues = [];
+		for (const channel of SUBSCRIPTION_CHANNELS) for (const topic of Object.keys(patch[channel]?.topics ?? {})) {
+			if (contract.topics.includes(topic)) continue;
+			issues.push({
+				path: `${channel}.topics.${topic}`,
+				message: "not a declared topic"
+			});
+		}
+		return issues.length > 0 ? new JourneyValidationError("/subscriptions", void 0, issues) : void 0;
+	}
 	/** Deploy a compiled bundle (BundleIR). */
 	deploy(bundle) {
 		return this.post("/deploy", bundle);
 	}
-	async post(path, body) {
-		const headers = { "content-type": "application/json" };
+	post(path, body) {
+		return this.request("POST", path, body);
+	}
+	async request(method, path, body) {
+		const headers = {};
+		if (body !== void 0) headers["content-type"] = "application/json";
 		if (this.options.token !== void 0) headers.authorization = `Bearer ${this.options.token}`;
 		const response = await (this.options.fetch ?? fetch)(`${this.options.origin.replace(/\/$/, "")}${path}`, {
-			method: "POST",
+			method,
 			headers,
-			body: JSON.stringify(body)
+			...body === void 0 ? {} : { body: JSON.stringify(body) }
 		});
 		if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());
 		return await response.json();
 	}
 };
+const subscriptionsPath = (userId) => `/subscriptions/${encodeURIComponent(userId)}`;
+const subscriptionsByMessagePath = (messageId) => `/subscriptions/by-message/${encodeURIComponent(messageId)}`;
 export { JourneyClient, JourneyClientError, JourneyValidationError };
 
 //# sourceMappingURL=client.mjs.map

package/dist/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch } from './contract';\nimport type { DeployResult, IdentifyResult, IngestResult } from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private async post<T>(path: string, body: unknown): Promise<T> {\n    const headers: Record<string, string> = { 'content-type': 'application/json' };\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method: 'POST',\n      headers,\n      body: JSON.stringify(body),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n"],"mappings":";AA0BA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAuBA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,MAAc,KAAQ,MAAc,MAA2B;EAC7D,MAAM,UAAkC,EAAE,gBAAgB,mBAAmB;EAC7E,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch, Topic } from './contract';\nimport {\n  type DeployResult,\n  type IdentifyResult,\n  type IngestResult,\n  type MessageSubscriptions,\n  SUBSCRIPTION_CHANNELS,\n  type Subscriptions,\n  type SubscriptionsPatch,\n} from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\n/** The topics the client's contract declares; any string without a contract. */\nexport type ClientTopic<C> = [C] extends [undefined] ? string : Topic<C>;\n\nexport type {\n  ChannelSubscriptions,\n  ChannelSubscriptionsPatch,\n  MessageOrigin,\n  MessageSubscriptions,\n  SubscriptionChannel,\n  Subscriptions,\n  SubscriptionsPatch,\n} from './host/ingest';\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /**\n   * Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they\n   * opted out of the whole channel) and each declared topic (false once they opted out of it on\n   * that channel) — the engine's record, which a preference page shows as it is. The two are\n   * independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`\n   * masks every topic however they read (nothing is sent on the channel until it is true again).\n   * Rejects with a 410 for an erased user.\n   */\n  getSubscriptions(userId: string): Promise<Subscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsPath(userId));\n  }\n\n  /**\n   * Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {\n   * newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every\n   * push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the\n   * channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,\n   * so a preference page's \"subscribe to all\" sends `all: true` plus every topic `true`. Answers\n   * the subscriptions as they now stand. With a contract, a topic it does not declare is refused\n   * here, before the request; the engine refuses it too.\n   */\n  setSubscriptions(\n    userId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<Subscriptions<ClientTopic<C>>> {\n    const refused = this.undeclaredTopics(patch);\n    if (refused !== undefined) return Promise.reject(refused);\n    return this.request('PUT', subscriptionsPath(userId), patch);\n  }\n\n  /**\n   * `getSubscriptions` for the recipient of one copy, by the message id an email's preferences\n   * link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a\n   * sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,\n   * so it can highlight that topic. Rejects with a 404 for an id that names no copy — never\n   * sent, or erased with its user — and for a transactional one; the page should show the link\n   * as expired. The message id is the capability, so the app proxies this behind its own API\n   * and rate-limits it.\n   */\n  getSubscriptionsByMessage(messageId: string): Promise<MessageSubscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsByMessagePath(messageId));\n  }\n\n  /** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */\n  setSubscriptionsByMessage(\n    messageId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<MessageSubscriptions<ClientTopic<C>>> {\n    const refused = this.undeclaredTopics(patch);\n    if (refused !== undefined) return Promise.reject(refused);\n    return this.request('PUT', subscriptionsByMessagePath(messageId), patch);\n  }\n\n  /** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */\n  private undeclaredTopics(\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): JourneyValidationError | undefined {\n    const contract = this.options.contract;\n    if (contract === undefined) return undefined;\n    const issues: ContractIssue[] = [];\n    for (const channel of SUBSCRIPTION_CHANNELS) {\n      for (const topic of Object.keys(patch[channel]?.topics ?? {})) {\n        // `includes`, not the predicate: narrowing `string` by a `topic is string` leaves `never`\n        if (contract.topics.includes(topic)) continue;\n        issues.push({ path: `${channel}.topics.${topic}`, message: 'not a declared topic' });\n      }\n    }\n    return issues.length > 0\n      ? new JourneyValidationError('/subscriptions', undefined, issues)\n      : undefined;\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private post<T>(path: string, body: unknown): Promise<T> {\n    return this.request<T>('POST', path, body);\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'PUT',\n    path: string,\n    body?: unknown\n  ): Promise<T> {\n    const headers: Record<string, string> = {};\n    if (body !== undefined) headers['content-type'] = 'application/json';\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method,\n      headers,\n      ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n\nconst subscriptionsPath = (userId: string) => `/subscriptions/${encodeURIComponent(userId)}`;\nconst subscriptionsByMessagePath = (messageId: string) =>\n  `/subscriptions/by-message/${encodeURIComponent(messageId)}`;\n"],"mappings":";;AAkCA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAoCA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;;;;;;;;CAUA,iBAAiB,QAAwD;EACvE,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,CAAC;CACtD;;;;;;;;;;CAWA,iBACE,QACA,OACwC;EACxC,MAAM,UAAU,KAAK,iBAAiB,KAAK;EAC3C,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;EACxD,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,GAAG,KAAK;CAC7D;;;;;;;;;;CAWA,0BAA0B,WAAkE;EAC1F,OAAO,KAAK,QAAQ,OAAO,2BAA2B,SAAS,CAAC;CAClE;;CAGA,0BACE,WACA,OAC+C;EAC/C,MAAM,UAAU,KAAK,iBAAiB,KAAK;EAC3C,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;EACxD,OAAO,KAAK,QAAQ,OAAO,2BAA2B,SAAS,GAAG,KAAK;CACzE;;CAGA,iBACE,OACoC;EACpC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;EACnC,MAAM,SAA0B,CAAC;EACjC,KAAK,MAAM,WAAW,uBACpB,KAAK,MAAM,SAAS,OAAO,KAAK,MAAM,QAAQ,EAAE,UAAU,CAAC,CAAC,GAAG;GAE7D,IAAI,SAAS,OAAO,SAAS,KAAK,GAAG;GACrC,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ,UAAU;IAAS,SAAS;GAAuB,CAAC;EACrF;EAEF,OAAO,OAAO,SAAS,IACnB,IAAI,uBAAuB,kBAAkB,KAAA,GAAW,MAAM,IAC9D,KAAA;CACN;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,KAAgB,MAAc,MAA2B;EACvD,OAAO,KAAK,QAAW,QAAQ,MAAM,IAAI;CAC3C;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC,CAAC;EACzC,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAClD,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;EAC7D,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF;AAEA,MAAM,qBAAqB,WAAmB,kBAAkB,mBAAmB,MAAM;AACzF,MAAM,8BAA8B,cAClC,6BAA6B,mBAAmB,SAAS"}

package/dist/cloudflare/index.cjs

@@ -1,17 +1,17 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_email_sender = require("../email-sender.cjs");
+const require_reporting_classify = require("../reporting/classify.cjs");
+const require_reporting_tracking = require("../reporting/tracking.cjs");
+const require_store_facts = require("../store/facts.cjs");
 const require_store_erasure = require("../store/erasure.cjs");
 const require_store_postgres_reporting = require("../store/postgres-reporting.cjs");
 const require_store_postgres = require("../store/postgres.cjs");
-const require_store_facts = require("../store/facts.cjs");
 const require_store_index = require("../store/index.cjs");
 const require_host_platform = require("../host/platform.cjs");
 const require_host_ingest = require("../host/ingest.cjs");
+const require_email_sender = require("../email-sender.cjs");
 const require_reporting_observer = require("../reporting/observer.cjs");
 const require_host_senders = require("../host/senders.cjs");
 const require_host_channels = require("../host/channels.cjs");
-const require_reporting_classify = require("../reporting/classify.cjs");
-const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_host_auth = require("../host/auth.cjs");
 const require_host_http = require("../host/http.cjs");
 const require_host_journey_host = require("../host/journey-host.cjs");

package/dist/cloudflare/index.mjs

@@ -1,16 +1,16 @@
-import { EmailSender, trackEmail } from "../email-sender.mjs";
+import { BURST_WINDOW_MS, DEFAULT_QUICK_MS, classifyClick, classifyOpen } from "../reporting/classify.mjs";
+import { handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
+import { JourneyFactSource } from "../store/facts.mjs";
 import { UserErasedError } from "../store/erasure.mjs";
 import { PostgresReporting } from "../store/postgres-reporting.mjs";
 import { PostgresJourneyStore } from "../store/postgres.mjs";
-import { JourneyFactSource } from "../store/facts.mjs";
 import { SchemaMismatchError } from "../store/index.mjs";
 import { InstanceNotFoundError, WAKE_EVENT_TYPE } from "../host/platform.mjs";
 import { BundleIntegrityError, SWEEP_PAGE_SIZE, deployBundle, forgetUser, identifyUser, ingestEvent, registerDevice, removeDevice, sweepMaintenance, sweepSegments, sweepSegmentsPaged, unbindDevice } from "../host/ingest.mjs";
+import { EmailSender, trackEmail } from "../email-sender.mjs";
 import { reportingObserver } from "../reporting/observer.mjs";
 import { LogMessageSender, WebhookMessageSender, routeByChannel, routeByPlatform } from "../host/senders.mjs";
 import { channelsFromConfig, journeyMode, runtimeFromConfig } from "../host/channels.mjs";
-import { BURST_WINDOW_MS, DEFAULT_QUICK_MS, classifyClick, classifyOpen } from "../reporting/classify.mjs";
-import { handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
 import { authorized, bearerMatches, timingSafeEqual } from "../host/auth.mjs";
 import { handleRequest } from "../host/http.mjs";
 import { EnvValidationError } from "../host/journey-host.mjs";

package/dist/cloudflare/runner.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_engine_retry = require("../engine/retry.cjs");
-const require_runtime = require("../runtime.cjs");
 const require_host_platform = require("../host/platform.cjs");
+const require_runtime = require("../runtime.cjs");
 const require_host_execute = require("../host/execute.cjs");
 const require_engine_actions = require("../engine/actions.cjs");
 const require_host_senders = require("../host/senders.cjs");

package/dist/cloudflare/runner.d.cts

@@ -1,7 +1,7 @@
 import { ActionInvoker, JourneyObserver, JourneyOutcome, MessageSender, MessageValidator } from "../engine/ports.cjs";
 import { RegisteredAction } from "../engine/actions.cjs";
-import { JourneyStore } from "../store/index.cjs";
 import { Contract } from "../contract.cjs";
+import { JourneyStore } from "../store/index.cjs";
 import { JourneyRuntimeOptions } from "../runtime.cjs";
 import { JourneyEnv, JourneyParams } from "../host/platform.cjs";
 import { JourneyRunParts } from "../host/execute.cjs";

package/dist/cloudflare/runner.d.mts

@@ -1,7 +1,7 @@
 import { ActionInvoker, JourneyObserver, JourneyOutcome, MessageSender, MessageValidator } from "../engine/ports.mjs";
 import { RegisteredAction } from "../engine/actions.mjs";
-import { JourneyStore } from "../store/index.mjs";
 import { Contract } from "../contract.mjs";
+import { JourneyStore } from "../store/index.mjs";
 import { JourneyRuntimeOptions } from "../runtime.mjs";
 import { JourneyEnv, JourneyParams } from "../host/platform.mjs";
 import { JourneyRunParts } from "../host/execute.mjs";

package/dist/cloudflare/runner.mjs

@@ -1,6 +1,6 @@
 import { isRetryable } from "../engine/retry.mjs";
-import { resolveRuntime } from "../runtime.mjs";
 import { WAKE_EVENT_TYPE } from "../host/platform.mjs";
+import { resolveRuntime } from "../runtime.mjs";
 import { executeJourney } from "../host/execute.mjs";
 import { RegistryActionInvoker } from "../engine/actions.mjs";
 import { LogMessageSender, WebhookMessageSender } from "../host/senders.mjs";

package/dist/config.cjs

@@ -31,7 +31,9 @@ var ConfigCompileError = class extends Error {
 * by id, not a hand-kept list). The registry is checked first, used or not:
 * every entry is a template of its channel with an id, an id is registered
 * once per channel, and every email template's metadata is valid, as is the
-* config's `email` (which replaced `emails`: a config still carrying it fails).
+* config's `email` (which replaced `emails`: a config still carrying it fails),
+* and every email and push template's `topic` is one the contract declares (a
+* template with a topic under a config whose contract declares none fails too).
 * Then every message node is checked against it — an
 * unregistered or cross-channel template fails with the workflow, node and
 * channel named, and so does a literal prop the template's schema refuses (a
@@ -45,10 +47,15 @@ function compileConfig(config) {
 	let index;
 	try {
 		const email = require_templates.indexTemplates("email", config.templates?.email);
+		const push = require_templates.indexTemplates("push", config.templates?.push);
 		require_email.assertEmailConfig(config, email.values());
+		for (const template of push.values()) require_email.assertTemplateTopic(template, `push template '${template.id}'`, "push", true);
+		const declared = config.contract?.topics ?? [];
+		assertTopicsDeclared("email", email.values(), declared);
+		assertTopicsDeclared("push", push.values(), declared);
 		index = {
 			email,
-			push: require_templates.indexTemplates("push", config.templates?.push),
+			push,
 			discord: require_templates.indexTemplates("discord", config.templates?.discord),
 			slack: require_templates.indexTemplates("slack", config.templates?.slack)
 		};
@@ -59,7 +66,8 @@ function compileConfig(config) {
 		workflows: config.workflows,
 		...config.segments === void 0 ? {} : { segments: config.segments },
 		...config.actions === void 0 ? {} : { actions: config.actions },
-		templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()])
+		templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),
+		subscriptions: { topics: config.contract?.topics ?? [] }
 	});
 	bundle.workflows.forEach((workflow, i) => {
 		checkMessages(workflow, workflow.flow, index, config);
@@ -73,6 +81,19 @@ const TEMPLATE_CHANNELS = [
 	"discord",
 	"slack"
 ];
+/**
+* Every topic template names a topic the contract declares: the engine checks opt-outs by topic,
+* so one the producer cannot set (`JourneyClient.setSubscriptions`) would be a topic nobody
+* can opt out of through the app.
+*/
+function assertTopicsDeclared(channel, templates, declared) {
+	const known = new Set(declared);
+	for (const template of templates) {
+		if (template.topic === null || known.has(template.topic)) continue;
+		const list = declared.length === 0 ? "the contract declares no topics (defineContract({ subscriptions: { topics: [...] } }))" : `the contract declares ${declared.map((topic) => `'${topic}'`).join(", ")}`;
+		throw new TypeError(`${channel} template '${template.id}': topic '${template.topic}' is not declared — ${list}`);
+	}
+}
 /** The channel's templates by id; undefined for a channel templates cannot be declared for. */
 function indexOf(index, channel) {
 	return TEMPLATE_CHANNELS.includes(channel) ? index[channel] : void 0;

package/dist/config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.cjs","names":["indexTemplates","compileBundle","templateUses","CHANNEL_OF","z"],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport { type EmailConfig, assertEmailConfig } from './email';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, what the email templates share, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: Contract;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef[];\n  /** The template definitions, per channel; each is identified by its own `id`. */\n  templates?: TemplateRegistry;\n  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */\n  email?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** The schema the store keeps the engine's tables in. */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig(definition: JourneyConfigDefinition): JourneyConfig {\n  return { kind: 'journey-config', ...definition };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, an id is registered\n * once per channel, and every email template's metadata is valid, as is the\n * config's `email` (which replaced `emails`: a config still carrying it fails).\n * Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    const email = indexTemplates('email', config.templates?.email);\n    assertEmailConfig(config, email.values());\n    index = {\n      email,\n      push: indexTemplates('push', config.templates?.push),\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * Whether an object schema refuses keys it does not declare: `z.strictObject`\n * sets its catchall to `never`; `z.object` strips unknown keys and\n * `z.looseObject` passes them through, and neither refuses.\n */\nfunction refusesUnknownKeys(schema: core.$ZodType): boolean {\n  return (schema._zod.def as core.$ZodObjectDef).catchall?._zod.def.type === 'never';\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, no\n * required field is missing, and — when the event's schema is strict — no\n * literal field is undeclared (the Worker would refuse the whole event at\n * emit time, failing the journey where the compile could have failed the\n * build). Values read from the profile are checked when the event is emitted,\n * by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const strict = refusesUnknownKeys(schema);\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) {\n      // A loose or stripping payload may carry extra fields; a strict one refuses them\n      if (strict) problems.push(`'${field}' is not a field the contract declares for the event`);\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;;;;AAoHA,SAAgB,aAAa,YAAoD;CAC/E,OAAO;EAAE,MAAM;EAAkB,GAAG;CAAW;AACjD;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;;;AAkBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,MAAM,QAAQA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EAC7D,cAAA,kBAAkB,QAAQ,MAAM,OAAO,CAAC;EACxC,QAAQ;GACN;GACA,MAAMA,kBAAAA,eAAe,QAAQ,OAAO,WAAW,IAAI;GACnD,SAASA,kBAAAA,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAOA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAASC,mBAAAA,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;CAChF,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;AAM9D,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAASC,iBAAAA,aAAa,OAAO,GAAG;EACrD,MAAM,UAAUC,kBAAAA,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;GAEhD,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADWC,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;AAOA,SAAS,mBAAmB,QAAgC;CAC1D,OAAQ,OAAO,KAAK,IAA2B,UAAU,KAAK,IAAI,SAAS;AAC7E;;;;;;;;;;AAWA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAEF,MAAM,SAAS,SAAS,QAAQ,OAAO,KAAK;CAC5C,MAAM,QAAS,OAAO,KAAK,IAA2B;CACtD,MAAM,SAAS,mBAAmB,MAAM;CACxC,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;EAClD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAEhC,IAAI,QAAQ,SAAS,KAAK,IAAI,MAAM,qDAAqD;GACzF;EACF;EAEA,IAAI,CADWA,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}
+{"version":3,"file":"config.cjs","names":["indexTemplates","compileBundle","templateUses","CHANNEL_OF","z"],"sources":["../src/config.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type * as core from 'zod/v4/core';\nimport type { Contract, Topic } from './contract';\nimport { type ActionRef, type SegmentRef, type WorkflowBuilder, compileBundle } from './dsl';\nimport { templateUses } from './dsl/flow';\nimport { type EmailConfig, assertEmailConfig, assertTemplateTopic } from './email';\nimport type { BundleIR, ChannelIR, NodeIR, WorkflowIR } from './ir';\nimport type { JourneyMode, JourneyRuntimeConfig } from './runtime';\nimport {\n  type AnyTemplate,\n  CHANNEL_OF,\n  type EmailTemplate,\n  type PushTemplate,\n  type TemplateChannel,\n  type TemplateRegistry,\n  indexTemplates,\n} from './templates';\n\n/**\n * `workflow.config.ts` — the project's journey configuration, typed, flat and\n * committed with the code: what it deploys (workflows, segments, actions),\n * the template registries behind them, the contract every inbound event is\n * checked against, what the email templates share, and how the engine runs per\n * environment (time scale, APNs, FCM). The compiler (`compileConfig`), the\n * Worker (`journeyWorker({ config })`) and the Workflow Studio all read this\n * one object, so everything is registered exactly once:\n *\n *   export default defineConfig({\n *     title: 'Workflow Studio · Acme',\n *     contract,\n *     workflows, // [onboarding, notificationTest]\n *     templates, // { email, push }: the definitions the workflows send\n *     email: { unsubscribeUrl: 'https://acme.test/unsubscribe' },\n *     runtime: { development: { timeScale: 600, logMessages: true } },\n *     apns: { topic: 'io.acme.app', keyId: 'ABC123DEFG', teamId: 'TEAM123456' },\n *   });\n *\n * Secrets are the one thing that stay out: a `.p8`, a service account, the\n * ingest bearer. The host reads them from its environment under fixed names\n * (see `JourneyEnv`), so the config says *which* key without carrying it. The\n * config is a source object (schemas, components, functions); only its\n * compiled bundle and preview-safe template data may cross to a browser.\n */\n\n/** Token-based APNs, the `.p8` auth key; the key itself is `APNS_PRIVATE_KEY_BASE64` in the environment. */\nexport interface ApnsConfig {\n  /** The app's bundle id (`apns-topic`). */\n  topic: string;\n  /** The key's 10-character id. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /**\n   * Which APNs host each mode's device tokens belong to: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. Unlisted modes default\n   * to `production` for the production mode and `sandbox` for every other.\n   */\n  environment?: Partial<Record<JourneyMode, 'sandbox' | 'production'>>;\n}\n\n/**\n * Standard Web Push for browsers (VAPID); the key pair is `VAPID_PUBLIC_KEY` /\n * `VAPID_PRIVATE_KEY` in the environment, and the site subscribes with the same public key.\n */\nexport interface WebPushConfig {\n  /** Who push services may contact about this sender: `mailto:` or an `https:` URL. */\n  subject: string;\n  /**\n   * The contract event a notification tap the browser reports (`opened_url`) is also recorded\n   * as, with `{ message_id }`: the app reports its own taps as an event, and a service worker has\n   * no session to do so — without this, browser opens reach the reports but not the conditions\n   * (a `performed(e.push_opened)` segment). One event per copy, however often it is tapped.\n   */\n  openedEvent?: string;\n}\n\n/** FCM HTTP v1 for Android; the service account is `GOOGLE_APPLICATION_CREDENTIALS_BASE64` in the environment. */\nexport interface FcmConfig {\n  /** Android notification channel the pushes land in (`android.notification.channel_id`). */\n  androidChannelId?: string;\n}\n\n/**\n * The engine's tables live in a Postgres schema of their own, so their short names (`event`,\n * `profile`, `message`, …) never meet the app's. `workflow-ui generate` writes them as one drizzle\n * file on this schema; the host migrates it with its own tooling.\n */\nexport interface DatabaseConfig {\n  /** The Postgres schema; `workflow` by default. */\n  schema?: string;\n}\n\nexport interface JourneyConfigDefinition<C extends Contract | undefined = Contract | undefined> {\n  /** Studio title (the browser tab names the project). */\n  title?: string;\n  /** The shared `defineContract(...)` the Worker validates ingest against. */\n  contract?: C;\n  workflows: readonly WorkflowBuilder[];\n  segments?: readonly SegmentRef[];\n  actions?: readonly ActionRef[];\n  /**\n   * The template definitions, per channel; each is identified by its own `id`. With a\n   * `contract`, an email or push template's `topic` must be one it declares — in the editor\n   * here, and at compile for anything the types did not see.\n   */\n  templates?: TemplateRegistry<Topic<C>>;\n  /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */\n  email?: EmailConfig;\n  /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */\n  runtime?: JourneyRuntimeConfig;\n  apns?: ApnsConfig;\n  fcm?: FcmConfig;\n  webPush?: WebPushConfig;\n  /** The schema the store keeps the engine's tables in. */\n  database?: DatabaseConfig;\n}\n\nexport interface JourneyConfig extends JourneyConfigDefinition {\n  readonly kind: 'journey-config';\n}\n\nexport function defineConfig<C extends Contract | undefined = undefined>(\n  definition: JourneyConfigDefinition<C>\n): JourneyConfig {\n  return { kind: 'journey-config', ...(definition as JourneyConfigDefinition) };\n}\n\nexport function isConfig(value: unknown): value is JourneyConfig {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { kind?: unknown }).kind === 'journey-config'\n  );\n}\n\n/** The APNs environment for `mode`: the configured one, else production only for production. */\nexport function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production' {\n  return config.environment?.[mode] ?? (mode === 'production' ? 'production' : 'sandbox');\n}\n\n/** A message node the config's registries cannot serve, or whose literal props its template refuses. */\nexport class ConfigCompileError extends Error {\n  override readonly name = 'ConfigCompileError';\n}\n\n/**\n * Compile the config: the bundle `compileBundle` would produce, with the\n * template manifest generated from the registry (every registered template,\n * by id, not a hand-kept list). The registry is checked first, used or not:\n * every entry is a template of its channel with an id, an id is registered\n * once per channel, and every email template's metadata is valid, as is the\n * config's `email` (which replaced `emails`: a config still carrying it fails),\n * and every email and push template's `topic` is one the contract declares (a\n * template with a topic under a config whose contract declares none fails too).\n * Then every message node is checked against it — an\n * unregistered or cross-channel template fails with the workflow, node and\n * channel named, and so does a literal prop the template's schema refuses (a\n * missing required prop, an undeclared one, a wrong literal) — and every\n * definition a workflow sends must be the very object registered under its id,\n * not merely one with the same id. User-property references cannot be parsed\n * here (their values exist only at send time) — they are checked by name only,\n * and parsed before sending.\n */\nexport function compileConfig(config: JourneyConfig): BundleIR {\n  let index: RegistryIndex;\n  try {\n    const email = indexTemplates('email', config.templates?.email);\n    const push = indexTemplates('push', config.templates?.push);\n    assertEmailConfig(config, email.values());\n    for (const template of push.values()) {\n      assertTemplateTopic(template, `push template '${template.id}'`, 'push', true);\n    }\n    const declared = config.contract?.topics ?? [];\n    assertTopicsDeclared('email', email.values(), declared);\n    assertTopicsDeclared('push', push.values(), declared);\n    index = {\n      email,\n      push,\n      discord: indexTemplates('discord', config.templates?.discord),\n      slack: indexTemplates('slack', config.templates?.slack),\n    };\n  } catch (error) {\n    throw new ConfigCompileError((error as Error).message);\n  }\n  const bundle = compileBundle({\n    workflows: config.workflows,\n    ...(config.segments === undefined ? {} : { segments: config.segments }),\n    ...(config.actions === undefined ? {} : { actions: config.actions }),\n    templates: TEMPLATE_CHANNELS.flatMap((channel) => [...index[channel].values()]),\n    subscriptions: { topics: config.contract?.topics ?? [] },\n  });\n  bundle.workflows.forEach((workflow, i) => {\n    checkMessages(workflow, workflow.flow, index, config);\n    checkUses(workflow, config.workflows[i], index, config);\n  });\n  return bundle;\n}\n\nconst TEMPLATE_CHANNELS = ['email', 'push', 'discord', 'slack'] as const;\n\n/**\n * Every topic template names a topic the contract declares: the engine checks opt-outs by topic,\n * so one the producer cannot set (`JourneyClient.setSubscriptions`) would be a topic nobody\n * can opt out of through the app.\n */\nfunction assertTopicsDeclared(\n  channel: 'email' | 'push',\n  templates: Iterable<EmailTemplate | PushTemplate>,\n  declared: readonly string[]\n) {\n  const known = new Set(declared);\n  for (const template of templates) {\n    if (template.topic === null || known.has(template.topic)) continue;\n    const list =\n      declared.length === 0\n        ? 'the contract declares no topics (defineContract({ subscriptions: { topics: [...] } }))'\n        : `the contract declares ${declared.map((topic) => `'${topic}'`).join(', ')}`;\n    throw new TypeError(\n      `${channel} template '${template.id}': topic '${template.topic}' is not declared — ${list}`\n    );\n  }\n}\n\n/** The registry by id, per channel. */\ntype RegistryIndex = Record<TemplateChannel, ReadonlyMap<string, AnyTemplate>>;\n\n/** The channel's templates by id; undefined for a channel templates cannot be declared for. */\nfunction indexOf(\n  index: RegistryIndex,\n  channel: ChannelIR\n): ReadonlyMap<string, AnyTemplate> | undefined {\n  return (TEMPLATE_CHANNELS as readonly ChannelIR[]).includes(channel)\n    ? index[channel as TemplateChannel]\n    : undefined;\n}\n\n/**\n * The definitions a workflow sends against the registered ones: same id is not enough — a\n * workflow typed by one definition and a registry holding another under that id would render\n * with a schema the call was never checked against.\n */\nfunction checkUses(\n  workflow: WorkflowIR,\n  builder: WorkflowBuilder,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const { template, loc } of templateUses(builder)) {\n    const channel = CHANNEL_OF[template.kind];\n    const registered = index[channel].get(template.id);\n    if (registered === template) continue;\n    const at = loc === undefined ? '' : ` (${loc.file}:${loc.line})`;\n    const where = `workflow '${workflow.id}'${at}: ${channel} template '${template.id}'`;\n    if (registered === undefined) throw new ConfigCompileError(`${where} is not registered`);\n    const name = Object.entries(config.templates?.[channel] ?? {}).find(\n      ([, entry]) => entry === registered\n    )?.[0];\n    throw new ConfigCompileError(\n      `${where} is not the definition registered under that id (templates.${channel}.${name}) — two definitions share the id`\n    );\n  }\n}\n\n/** A field that may be left out: optional, or with a default the schema fills in. */\nfunction canBeOmitted(schema: core.$ZodType): boolean {\n  const type = schema._zod.def.type;\n  return type === 'optional' || type === 'default' || type === 'prefault';\n}\n\nfunction checkMessages(\n  workflow: WorkflowIR,\n  nodes: readonly NodeIR[],\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  for (const node of nodes) {\n    switch (node.type) {\n      case 'message':\n        checkMessage(workflow, node, index, config);\n        break;\n      case 'send_event':\n        checkEmit(workflow, node, config);\n        break;\n      case 'branch':\n        for (const c of node.cases) checkMessages(workflow, c.flow, index, config);\n        if (node.otherwise) checkMessages(workflow, node.otherwise, index, config);\n        break;\n      case 'cohort':\n        for (const arm of node.arms) checkMessages(workflow, arm.flow, index, config);\n        break;\n      case 'wait_until':\n        if (Array.isArray(node.onTimeout)) checkMessages(workflow, node.onTimeout, index, config);\n        break;\n      default:\n        break;\n    }\n  }\n}\n\nfunction checkMessage(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'message' }>,\n  index: RegistryIndex,\n  config: JourneyConfig\n): void {\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  const registry = indexOf(index, node.channel);\n  // Channels without template definitions (sms, …) are rendered by app-supplied senders\n  if (registry === undefined) return;\n  const entry = registry.get(node.template);\n  if (entry === undefined) {\n    const other = TEMPLATE_CHANNELS.find(\n      (channel) => channel !== node.channel && index[channel].has(node.template)\n    );\n    const hint = other === undefined ? '' : ` (it is registered as a ${other} template)`;\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} template '${node.template}' is not registered${hint}`\n    );\n  }\n  const shape = (entry.props._zod.def as core.$ZodObjectDef).shape;\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.props)) {\n    if (!Object.hasOwn(shape, field)) {\n      problems.push(`'${field}' is not a prop of the template`);\n      continue;\n    }\n    if (typeof value === 'object' && 'type' in value) {\n      // A user ref's value exists only at send time (parsed then); here its name can be checked\n      const profile = config.contract?.schemas.profile._zod.def;\n      if (\n        profile !== undefined &&\n        value.path !== 'userId' &&\n        !Object.hasOwn(profile.shape, value.path)\n      ) {\n        problems.push(\n          `'${field}' reads u.${value.path}, which the contract's profile does not declare`\n        );\n      }\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the schema`);\n  }\n  for (const [field, schema] of Object.entries(shape)) {\n    const optional = canBeOmitted(schema);\n    if (!optional && !Object.hasOwn(node.props, field))\n      problems.push(`required prop '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(\n      `${where}: ${node.channel} '${node.template}': ${problems.join('; ')}`\n    );\n  }\n}\n\n/**\n * Whether an object schema refuses keys it does not declare: `z.strictObject`\n * sets its catchall to `never`; `z.object` strips unknown keys and\n * `z.looseObject` passes them through, and neither refuses.\n */\nfunction refusesUnknownKeys(schema: core.$ZodType): boolean {\n  return (schema._zod.def as core.$ZodObjectDef).catchall?._zod.def.type === 'never';\n}\n\n/**\n * An emitted event against the contract, as far as compile time can see: the\n * event is declared, literal payload values parse against their field, no\n * required field is missing, and — when the event's schema is strict — no\n * literal field is undeclared (the Worker would refuse the whole event at\n * emit time, failing the journey where the compile could have failed the\n * build). Values read from the profile are checked when the event is emitted,\n * by the same contract.\n */\nfunction checkEmit(\n  workflow: WorkflowIR,\n  node: Extract<NodeIR, { type: 'send_event' }>,\n  config: JourneyConfig\n): void {\n  const contract = config.contract;\n  if (contract === undefined) return;\n  const where = `workflow '${workflow.id}' node ${node.id}`;\n  if (!contract.isEvent(node.event)) {\n    throw new ConfigCompileError(\n      `${where}: emits '${String(node.event)}', which is not in the contract`\n    );\n  }\n  const schema = contract.schemas.events[node.event];\n  const shape = (schema._zod.def as core.$ZodObjectDef).shape;\n  const strict = refusesUnknownKeys(schema);\n  const problems: string[] = [];\n  for (const [field, value] of Object.entries(node.payload)) {\n    if (typeof value === 'object' && 'type' in value) continue; // read at emit time\n    if (!Object.hasOwn(shape, field)) {\n      // A loose or stripping payload may carry extra fields; a strict one refuses them\n      if (strict) problems.push(`'${field}' is not a field the contract declares for the event`);\n      continue;\n    }\n    const result = z.safeParse(shape[field], value);\n    if (!result.success)\n      problems.push(`'${field}' = ${JSON.stringify(value)} is refused by the contract`);\n  }\n  for (const [field, fieldSchema] of Object.entries(shape)) {\n    const optional = canBeOmitted(fieldSchema);\n    if (!optional && !Object.hasOwn(node.payload, field))\n      problems.push(`required field '${field}' is missing`);\n  }\n  if (problems.length > 0) {\n    throw new ConfigCompileError(`${where}: event '${node.event}': ${problems.join('; ')}`);\n  }\n}\n"],"mappings":";;;;;;;;;;AA0HA,SAAgB,aACd,YACe;CACf,OAAO;EAAE,MAAM;EAAkB,GAAI;CAAuC;AAC9E;AAEA,SAAgB,SAAS,OAAwC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;AAE3C;;AAGA,SAAgB,gBAAgB,QAAoB,MAA6C;CAC/F,OAAO,OAAO,cAAc,UAAU,SAAS,eAAe,eAAe;AAC/E;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAyB;AAC3B;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,cAAc,QAAiC;CAC7D,IAAI;CACJ,IAAI;EACF,MAAM,QAAQA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EAC7D,MAAM,OAAOA,kBAAAA,eAAe,QAAQ,OAAO,WAAW,IAAI;EAC1D,cAAA,kBAAkB,QAAQ,MAAM,OAAO,CAAC;EACxC,KAAK,MAAM,YAAY,KAAK,OAAO,GACjC,cAAA,oBAAoB,UAAU,kBAAkB,SAAS,GAAG,IAAI,QAAQ,IAAI;EAE9E,MAAM,WAAW,OAAO,UAAU,UAAU,CAAC;EAC7C,qBAAqB,SAAS,MAAM,OAAO,GAAG,QAAQ;EACtD,qBAAqB,QAAQ,KAAK,OAAO,GAAG,QAAQ;EACpD,QAAQ;GACN;GACA;GACA,SAASA,kBAAAA,eAAe,WAAW,OAAO,WAAW,OAAO;GAC5D,OAAOA,kBAAAA,eAAe,SAAS,OAAO,WAAW,KAAK;EACxD;CACF,SAAS,OAAO;EACd,MAAM,IAAI,mBAAoB,MAAgB,OAAO;CACvD;CACA,MAAM,SAASC,mBAAAA,cAAc;EAC3B,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EACrE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EAClE,WAAW,kBAAkB,SAAS,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;EAC9E,eAAe,EAAE,QAAQ,OAAO,UAAU,UAAU,CAAC,EAAE;CACzD,CAAC;CACD,OAAO,UAAU,SAAS,UAAU,MAAM;EACxC,cAAc,UAAU,SAAS,MAAM,OAAO,MAAM;EACpD,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,MAAM;CACxD,CAAC;CACD,OAAO;AACT;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAQ;CAAW;AAAO;;;;;;AAO9D,SAAS,qBACP,SACA,WACA,UACA;CACA,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI,SAAS,UAAU,QAAQ,MAAM,IAAI,SAAS,KAAK,GAAG;EAC1D,MAAM,OACJ,SAAS,WAAW,IAChB,2FACA,yBAAyB,SAAS,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI;EAC9E,MAAM,IAAI,UACR,GAAG,QAAQ,aAAa,SAAS,GAAG,YAAY,SAAS,MAAM,sBAAsB,MACvF;CACF;AACF;;AAMA,SAAS,QACP,OACA,SAC8C;CAC9C,OAAQ,kBAA2C,SAAS,OAAO,IAC/D,MAAM,WACN,KAAA;AACN;;;;;;AAOA,SAAS,UACP,UACA,SACA,OACA,QACM;CACN,KAAK,MAAM,EAAE,UAAU,SAASC,iBAAAA,aAAa,OAAO,GAAG;EACrD,MAAM,UAAUC,kBAAAA,WAAW,SAAS;EACpC,MAAM,aAAa,MAAM,QAAQ,CAAC,IAAI,SAAS,EAAE;EACjD,IAAI,eAAe,UAAU;EAC7B,MAAM,KAAK,QAAQ,KAAA,IAAY,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,KAAK;EAC9D,MAAM,QAAQ,aAAa,SAAS,GAAG,GAAG,GAAG,IAAI,QAAQ,aAAa,SAAS,GAAG;EAClF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,mBAAmB,GAAG,MAAM,mBAAmB;EACvF,MAAM,OAAO,OAAO,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,MAC5D,GAAG,WAAW,UAAU,UAC3B,CAAC,GAAG;EACJ,MAAM,IAAI,mBACR,GAAG,MAAM,6DAA6D,QAAQ,GAAG,KAAK,iCACxF;CACF;AACF;;AAGA,SAAS,aAAa,QAAgC;CACpD,MAAM,OAAO,OAAO,KAAK,IAAI;CAC7B,OAAO,SAAS,cAAc,SAAS,aAAa,SAAS;AAC/D;AAEA,SAAS,cACP,UACA,OACA,OACA,QACM;CACN,KAAK,MAAM,QAAQ,OACjB,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,aAAa,UAAU,MAAM,OAAO,MAAM;GAC1C;EACF,KAAK;GACH,UAAU,UAAU,MAAM,MAAM;GAChC;EACF,KAAK;GACH,KAAK,MAAM,KAAK,KAAK,OAAO,cAAc,UAAU,EAAE,MAAM,OAAO,MAAM;GACzE,IAAI,KAAK,WAAW,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;GACzE;EACF,KAAK;GACH,KAAK,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,IAAI,MAAM,OAAO,MAAM;GAC5E;EACF,KAAK,cACH,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG,cAAc,UAAU,KAAK,WAAW,OAAO,MAAM;CAI5F;AAEJ;AAEA,SAAS,aACP,UACA,MACA,OACA,QACM;CACN,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,MAAM,WAAW,QAAQ,OAAO,KAAK,OAAO;CAE5C,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ;CACxC,IAAI,UAAU,KAAA,GAAW;EACvB,MAAM,QAAQ,kBAAkB,MAC7B,YAAY,YAAY,KAAK,WAAW,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAC3E;EACA,MAAM,OAAO,UAAU,KAAA,IAAY,KAAK,2BAA2B,MAAM;EACzE,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,aAAa,KAAK,SAAS,qBAAqB,MAC5E;CACF;CACA,MAAM,QAAS,MAAM,MAAM,KAAK,IAA2B;CAC3D,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAChC,SAAS,KAAK,IAAI,MAAM,gCAAgC;GACxD;EACF;EACA,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;GAEhD,MAAM,UAAU,OAAO,UAAU,QAAQ,QAAQ,KAAK;GACtD,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,YACf,CAAC,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI,GAExC,SAAS,KACP,IAAI,MAAM,YAAY,MAAM,KAAK,gDACnC;GAEF;EACF;EAEA,IAAI,CADWC,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,0BAA0B;CAClF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,KAAK,GAEhD,IAAI,CADa,aAAa,MAClB,KAAK,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,GAC/C,SAAS,KAAK,kBAAkB,MAAM,aAAa;CAEvD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBACR,GAAG,MAAM,IAAI,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI,GACrE;AAEJ;;;;;;AAOA,SAAS,mBAAmB,QAAgC;CAC1D,OAAQ,OAAO,KAAK,IAA2B,UAAU,KAAK,IAAI,SAAS;AAC7E;;;;;;;;;;AAWA,SAAS,UACP,UACA,MACA,QACM;CACN,MAAM,WAAW,OAAO;CACxB,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,aAAa,SAAS,GAAG,SAAS,KAAK;CACrD,IAAI,CAAC,SAAS,QAAQ,KAAK,KAAK,GAC9B,MAAM,IAAI,mBACR,GAAG,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE,gCACzC;CAEF,MAAM,SAAS,SAAS,QAAQ,OAAO,KAAK;CAC5C,MAAM,QAAS,OAAO,KAAK,IAA2B;CACtD,MAAM,SAAS,mBAAmB,MAAM;CACxC,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,GAAG;EACzD,IAAI,OAAO,UAAU,YAAY,UAAU,OAAO;EAClD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;GAEhC,IAAI,QAAQ,SAAS,KAAK,IAAI,MAAM,qDAAqD;GACzF;EACF;EAEA,IAAI,CADWA,SAAE,UAAU,MAAM,QAAQ,KAC/B,CAAC,CAAC,SACV,SAAS,KAAK,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,EAAE,4BAA4B;CACpF;CACA,KAAK,MAAM,CAAC,OAAO,gBAAgB,OAAO,QAAQ,KAAK,GAErD,IAAI,CADa,aAAa,WAClB,KAAK,CAAC,OAAO,OAAO,KAAK,SAAS,KAAK,GACjD,SAAS,KAAK,mBAAmB,MAAM,aAAa;CAExD,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,mBAAmB,GAAG,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,GAAG;AAE1F"}

package/dist/config.d.cts

@@ -1,11 +1,11 @@
 import { BundleIR } from "./ir.cjs";
-import { EmailConfig } from "./email.cjs";
-import { TemplateRegistry } from "./templates.cjs";
 import { ActionRef } from "./dsl/action.cjs";
 import { SegmentRef } from "./dsl/condition.cjs";
 import { WorkflowBuilder } from "./dsl/workflow.cjs";
 import "./dsl/index.cjs";
-import { Contract } from "./contract.cjs";
+import { Contract, Topic } from "./contract.cjs";
+import { EmailConfig } from "./email.cjs";
+import { TemplateRegistry } from "./templates.cjs";
 import { JourneyMode, JourneyRuntimeConfig } from "./runtime.cjs";
 /**
  * `workflow.config.ts` — the project's journey configuration, typed, flat and
@@ -77,16 +77,20 @@ export interface DatabaseConfig {
   /** The Postgres schema; `workflow` by default. */
   schema?: string;
 }
-export interface JourneyConfigDefinition {
+export interface JourneyConfigDefinition<C extends Contract | undefined = Contract | undefined> {
   /** Studio title (the browser tab names the project). */
   title?: string;
   /** The shared `defineContract(...)` the Worker validates ingest against. */
-  contract?: Contract;
+  contract?: C;
   workflows: readonly WorkflowBuilder[];
   segments?: readonly SegmentRef[];
   actions?: readonly ActionRef[];
-  /** The template definitions, per channel; each is identified by its own `id`. */
-  templates?: TemplateRegistry;
+  /**
+   * The template definitions, per channel; each is identified by its own `id`. With a
+   * `contract`, an email or push template's `topic` must be one it declares — in the editor
+   * here, and at compile for anything the types did not see.
+   */
+  templates?: TemplateRegistry<Topic<C>>;
   /** What every email template shares: the default unsubscribe link, how opens and clicks are judged. */
   email?: EmailConfig;
   /** How the engine behaves per mode (`development`, `production`, …): time scale, message logging. */
@@ -100,7 +104,7 @@ export interface JourneyConfigDefinition {
 export interface JourneyConfig extends JourneyConfigDefinition {
   readonly kind: 'journey-config';
 }
-export declare function defineConfig(definition: JourneyConfigDefinition): JourneyConfig;
+export declare function defineConfig<C extends Contract | undefined = undefined>(definition: JourneyConfigDefinition<C>): JourneyConfig;
 export declare function isConfig(value: unknown): value is JourneyConfig;
 /** The APNs environment for `mode`: the configured one, else production only for production. */
 export declare function apnsEnvironment(config: ApnsConfig, mode: JourneyMode): 'sandbox' | 'production';
@@ -114,7 +118,9 @@ export declare class ConfigCompileError extends Error {
  * by id, not a hand-kept list). The registry is checked first, used or not:
  * every entry is a template of its channel with an id, an id is registered
  * once per channel, and every email template's metadata is valid, as is the
- * config's `email` (which replaced `emails`: a config still carrying it fails).
+ * config's `email` (which replaced `emails`: a config still carrying it fails),
+ * and every email and push template's `topic` is one the contract declares (a
+ * template with a topic under a config whose contract declares none fails too).
  * Then every message node is checked against it — an
  * unregistered or cross-channel template fails with the workflow, node and
  * channel named, and so does a literal prop the template's schema refuses (a