@shware/workflow 5.0.1 → 6.1.0

package/dist/engine/interpreter.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"interpreter.mjs","names":[],"sources":["../../src/engine/interpreter.ts"],"sourcesContent":["import type { NodeIR, PropValueIR, ScalarIR, WorkflowIR } from '../ir';\nimport { hashToBucket } from './bucket';\nimport { evaluateCondition, relevantEvents } from './condition';\nimport type {\n  FactSource,\n  JourneyContext,\n  JourneyOutcome,\n  OutboundMessage,\n  PushDevice,\n} from './ports';\nimport { RECIPIENT_PROPERTY } from './recipient';\nimport { nextWindowStart } from './time-window';\n\n/**\n * IR interpreter: the execution core for one user's journey instance.\n *\n * Pure logic — it imports nothing platform-specific; every external effect\n * arrives through the JourneyContext ports, and durable semantics\n * (checkpoint/replay) are the EngineStep adapter's job.\n *\n * Step naming: an IR node id *is* the step name (derived from the structural\n * path, so it is deterministic and unique). When one node needs several steps,\n * a suffix is appended (`${id}:guard`, `${id}:check:${n}`).\n *\n * Guard semantics: goal / exitWhen are checked at journey entry and after\n * every suspension point (delay / random_delay / time_window / wait_until) —\n * the moments where wall-clock time passed and the user's state may have\n * moved. Between two synchronous nodes no meaningful time passes, so checking\n * there would only burn step budget (each checkpoint costs a state write).\n */\n\n/**\n * Cap on wait_until re-evaluations, so a wake-up storm cannot exhaust the platform's step\n * budget. Each loop iteration costs a handful of steps, so 64 checks stay well inside the\n * platform step budgets while absorbing far more wake churn than 16 did. Past the cap the wait\n * is not given up: it sleeps to its deadline and checks once more there (see waitLoop) — the\n * answer is still right at the deadline, it just stops being event-driven in between.\n */\nconst MAX_WAIT_CHECKS = 64;\n\n/** The user property holding an IANA timezone id, read when a time_window says tz: 'user'. Same convention-table status as RECIPIENT_PROPERTY. */\nconst TIMEZONE_PROPERTY = 'timezone';\n\ntype FlowSignal =\n  | { kind: 'fall_through' }\n  | { kind: 'exit'; reason?: string }\n  | { kind: 'goal' }\n  | { kind: 'exit_when' };\n\nconst FALL_THROUGH: FlowSignal = { kind: 'fall_through' };\n\n/**\n * Whether and when the instance converted — a fact of its own, apart from how it ends: with\n * `exitOnMatch: false` a conversion lets the flow go on, and the instance still ends `completed`\n * (or `exited`, `exit_when`) carrying it. Set only from checkpointed step results, so a replay\n * rebuilds the same state.\n */\ninterface GoalState {\n  convertedAt?: number;\n}\n\nconst goalStates = new WeakMap<JourneyContext, GoalState>();\n\nfunction goalState(ctx: JourneyContext): GoalState {\n  let state = goalStates.get(ctx);\n  if (state === undefined) {\n    state = {};\n    goalStates.set(ctx, state);\n  }\n  return state;\n}\n\n/** When the goal's attribution window closes, measured from entry; none without `within`. */\nfunction goalDeadline(ir: WorkflowIR, ctx: JourneyContext): number | undefined {\n  return ir.goal?.within === undefined ? undefined : ctx.enteredAtMs + ir.goal.within.ms;\n}\n\n/**\n * Whether the goal holds for events inside its window: after entry, and not after the window\n * closed — an instance resumed past the deadline must not count a purchase made after it. The\n * conversion time is when the check saw it, capped at the deadline.\n */\nasync function goalReached(\n  ir: WorkflowIR,\n  ctx: JourneyContext,\n  now: number\n): Promise<{ at: number } | null> {\n  const goal = ir.goal;\n  if (goal === undefined) return null;\n  const deadline = goalDeadline(ir, ctx);\n  const met = await evaluateCondition(goal.condition, ctx.facts, now, {\n    anchorMs: ctx.enteredAtMs,\n    ...(deadline === undefined ? {} : { untilMs: deadline }),\n  });\n  return met ? { at: deadline === undefined ? now : Math.min(now, deadline) } : null;\n}\n\nexport async function runJourney(ir: WorkflowIR, ctx: JourneyContext): Promise<JourneyOutcome> {\n  await started(ir, ctx);\n  const entry = await checkGuards('entry', ir, ctx);\n  let signal = entry ?? (await runFlow(ir.flow, ir, ctx));\n  // The flow is done but the conversion window is not: keep watching it (see awaitTail)\n  if (signal.kind === 'fall_through') signal = (await awaitTail(ir, ctx)) ?? FALL_THROUGH;\n  const { convertedAt } = goalState(ctx);\n  const converted = convertedAt === undefined ? {} : { convertedAt };\n  switch (signal.kind) {\n    case 'fall_through':\n      return { status: 'completed', ...converted };\n    case 'exit':\n      return signal.reason !== undefined\n        ? { status: 'exited', reason: signal.reason, ...converted }\n        : { status: 'exited', ...converted };\n    case 'goal':\n      return { status: 'goal', ...converted };\n    case 'exit_when':\n      return { status: 'exit_when', ...converted };\n  }\n}\n\nasync function runFlow(nodes: NodeIR[], ir: WorkflowIR, ctx: JourneyContext): Promise<FlowSignal> {\n  for (const node of nodes) {\n    await reached(node, ir, ctx);\n    const signal = await runNode(node, ir, ctx);\n    if (signal.kind !== 'fall_through') return signal;\n  }\n  return FALL_THROUGH;\n}\n\n/**\n * Tell the observer the instance entered — before the entry guards, which can end it before the\n * first node: an instance is counted from its entry, not from its first node.\n */\nasync function started(ir: WorkflowIR, ctx: JourneyContext): Promise<void> {\n  const observer = ctx.observer;\n  if (observer?.started === undefined) return;\n  await ctx.step.do('entry:started', async () => {\n    await observer.started?.({\n      workflow: ir.id,\n      instanceId: ctx.instanceId,\n      userId: ctx.userId,\n      at: ctx.enteredAtMs,\n    });\n  });\n}\n\n/**\n * Tell the observer the instance is at `node`. A step of its own, so a replay does not report\n * the nodes it passes on the way back again, and the arrival time stays the first one.\n */\nasync function reached(node: NodeIR, ir: WorkflowIR, ctx: JourneyContext): Promise<void> {\n  const observer = ctx.observer;\n  if (observer?.nodeReached === undefined) return;\n  await ctx.step.do(`${node.id}:reached`, async () => {\n    await observer.nodeReached?.({\n      workflow: ir.id,\n      instanceId: ctx.instanceId,\n      userId: ctx.userId,\n      nodeId: node.id,\n      at: Date.now(),\n    });\n  });\n}\n\n/**\n * One copy out through the host's sender, with the observer on both sides: it may attach\n * tracking before, and hears how the transport took the copy after. A send that throws is\n * not reported — the step retries it, and reports when it settles. A report that fails after\n * the send is logged, never thrown: the step would retry and the transport — a webhook, a web\n * push, with no idempotency key of its own — would deliver the copy again.\n */\nasync function deliver(message: OutboundMessage, ctx: JourneyContext): Promise<void> {\n  const observer = ctx.observer;\n  const tracking = await observer?.messagePrepared?.(message);\n  const copy = tracking === undefined ? message : { ...message, tracking };\n  const result = await ctx.messages.send(copy);\n  try {\n    await observer?.messageSent?.(copy, result ?? { delivered: true });\n  } catch (error) {\n    console.error(`[workflow] reporting ${copy.idempotencyKey} as sent failed`, error);\n  }\n}\n\n/**\n * Goal / exitWhen guards (see the header for when they run).\n *\n * The goal condition is anchored at workflow entry: a `performed` inside it\n * only counts events after the user entered, so pre-existing history cannot\n * register as a conversion. exitWhen is deliberately unanchored — \"user\n * unsubscribed\" should exit no matter when it happened.\n */\nasync function checkGuards(\n  stepId: string,\n  ir: WorkflowIR,\n  ctx: JourneyContext\n): Promise<FlowSignal | null> {\n  const goal = ir.goal;\n  const exitWhen = ir.exitWhen;\n  if (goal === undefined && exitWhen === undefined) return null;\n\n  const state = goalState(ctx);\n  const result = await ctx.step.do(`${stepId}:guard`, async () => {\n    const now = Date.now();\n    // Already converted (exitOnMatch: false): the conversion stands, no need to look again\n    const goalHit =\n      goal !== undefined && state.convertedAt === undefined\n        ? await goalReached(ir, ctx, now)\n        : null;\n    const exitMet = exitWhen !== undefined && (await evaluateCondition(exitWhen, ctx.facts, now));\n    return { goalAt: goalHit?.at ?? null, exitMet };\n  });\n\n  if (result.goalAt !== null) {\n    state.convertedAt ??= result.goalAt;\n    if (goal?.exitOnMatch ?? true) return { kind: 'goal' };\n  }\n  if (result.exitMet) return { kind: 'exit_when' };\n  return null;\n}\n\n/**\n * The host's template check, with the instance and node added to the message:\n * a refused message must point at the journey that produced it. The error\n * keeps its class (and `name`), so adapters can stop retrying it.\n */\nfunction validate(\n  node: Extract<NodeIR, { type: 'message' }>,\n  props: Record<string, ScalarIR | undefined>,\n  ctx: JourneyContext\n): Record<string, ScalarIR | undefined> {\n  if (ctx.validator === undefined) return props;\n  try {\n    return ctx.validator.validate({ channel: node.channel, template: node.template, props });\n  } catch (error) {\n    if (error instanceof Error) {\n      error.message = `[${ctx.instanceId} ${node.id}] ${error.message}`;\n    }\n    throw error;\n  }\n}\n\ntype PushPlan = { props: Record<string, ScalarIR | undefined>; devices: PushDevice[] };\n\n/**\n * A push goes to devices, not to a profile address: one copy per device the\n * host's directory lists (or only the most recent, `devices: 'latest'`). Each\n * copy's idempotency key carries its token, so a retried step that already\n * reached some devices re-sends to the rest and the senders drop the repeats —\n * keyed by token rather than position, because the list can change between\n * attempts. A user with no device is skipped, not failed: being unreachable is\n * a state of the user, and `reachable('push')` is how a journey branches on it.\n */\n/**\n * A push: one step settles what goes out and to which devices, then each device gets a step of\n * its own — a failure on one device retries that device alone, and the copies already delivered\n * are not sent again (APNs and FCM carry the idempotency key but do not de-duplicate on it).\n */\nasync function sendPush(\n  node: Extract<NodeIR, { type: 'message' }>,\n  ir: WorkflowIR,\n  ctx: JourneyContext\n): Promise<void> {\n  const plan = await ctx.step.do<PushPlan | null>(`${node.id}:send`, async () => {\n    const props = validate(node, await resolveValues(node.props, ctx.facts), ctx);\n    if (await ctx.facts.isSuppressed?.(node.channel)) return null;\n    const listed = await ctx.facts.listDevices();\n    const devices = node.devices === 'latest' ? listed.slice(0, 1) : listed;\n    return { props, devices };\n  });\n  // null: the channel is opted out\n  if (plan === null) return;\n  if (plan.devices.length === 0) {\n    console.log(`[journey] push ${node.template} skipped: no device for user ${ctx.userId}`);\n    return;\n  }\n  for (const [index, device] of plan.devices.entries()) {\n    await ctx.step.do(`${node.id}:send:${index}`, async () => {\n      await deliver(\n        {\n          workflow: ir.id,\n          instanceId: ctx.instanceId,\n          nodeId: node.id,\n          channel: 'push',\n          template: node.template,\n          props: plan.props,\n          userId: ctx.userId,\n          recipient: device.token,\n          device,\n          idempotencyKey: `${ctx.instanceId}:${node.id}:${device.token}`,\n        },\n        ctx\n      );\n    });\n  }\n}\n\nasync function runNode(node: NodeIR, ir: WorkflowIR, ctx: JourneyContext): Promise<FlowSignal> {\n  switch (node.type) {\n    case 'message': {\n      if (node.channel === 'push') {\n        await sendPush(node, ir, ctx);\n        return FALL_THROUGH;\n      }\n      await ctx.step.do(`${node.id}:send`, async () => {\n        const props = validate(node, await resolveValues(node.props, ctx.facts), ctx);\n        // An opted-out channel (an email unsubscribe) is skipped, like a push with no device\n        if (await ctx.facts.isSuppressed?.(node.channel)) return;\n        const recipientPath = RECIPIENT_PROPERTY[node.channel];\n        const recipient =\n          recipientPath === undefined ? undefined : await ctx.facts.getProperty(recipientPath);\n        await deliver(\n          {\n            workflow: ir.id,\n            instanceId: ctx.instanceId,\n            nodeId: node.id,\n            channel: node.channel,\n            template: node.template,\n            props,\n            userId: ctx.userId,\n            recipient: recipient === undefined ? undefined : String(recipient),\n            idempotencyKey: `${ctx.instanceId}:${node.id}`,\n          },\n          ctx\n        );\n      });\n      return FALL_THROUGH;\n    }\n\n    case 'delay': {\n      await ctx.step.sleep(node.id, node.duration.ms);\n      return (await checkGuards(node.id, ir, ctx)) ?? FALL_THROUGH;\n    }\n\n    case 'random_delay': {\n      // The random value is drawn and persisted inside the step, so replay does not re-roll it\n      const ms = await ctx.step.do(`${node.id}:roll`, async () => {\n        const span = node.max.ms - node.min.ms;\n        return node.min.ms + Math.floor(Math.random() * Math.max(span, 0));\n      });\n      await ctx.step.sleep(`${node.id}:sleep`, ms);\n      return (await checkGuards(node.id, ir, ctx)) ?? FALL_THROUGH;\n    }\n\n    case 'time_window': {\n      const target = await ctx.step.do(`${node.id}:target`, async () => {\n        const tz =\n          node.tz === 'user'\n            ? String((await ctx.facts.getProperty(TIMEZONE_PROPERTY)) ?? 'UTC')\n            : node.tz;\n        return nextWindowStart(Date.now(), node.days, node.between, tz);\n      });\n      if (target === null) return FALL_THROUGH; // already inside the window: no suspension, no guard\n      // The remaining time is checkpointed: a replay must not recompute it from a later clock\n      // (the target has passed by then, and a negative sleep is an error on some runtimes)\n      const ms = await ctx.step.do(`${node.id}:remaining`, async () => target - Date.now());\n      if (ms > 0) await ctx.step.sleep(`${node.id}:sleep`, ms);\n      return (await checkGuards(node.id, ir, ctx)) ?? FALL_THROUGH;\n    }\n\n    case 'wait_until': {\n      const met = await waitUntil(node, ctx);\n      // Time passed while waiting — guard before acting on the outcome (goal wins over the wait result)\n      const guard = await checkGuards(node.id, ir, ctx);\n      if (guard) return guard;\n      if (met) return FALL_THROUGH;\n      const onTimeout = node.onTimeout;\n      if (onTimeout === 'continue') return FALL_THROUGH;\n      if (onTimeout === 'exit') return { kind: 'exit', reason: `${node.id}:timeout` };\n      return runFlow(onTimeout, ir, ctx);\n    }\n\n    case 'branch': {\n      const matched = await ctx.step.do(`${node.id}:eval`, async () => {\n        const now = Date.now();\n        for (const [i, branchCase] of node.cases.entries()) {\n          if (await evaluateCondition(branchCase.condition, ctx.facts, now)) {\n            return i;\n          }\n        }\n        return -1; // no match → default arm, or simply continue\n      });\n      const flow = matched >= 0 ? node.cases[matched]?.flow : node.otherwise;\n      if (flow === undefined) return FALL_THROUGH;\n      const signal = await runFlow(flow, ir, ctx);\n      // Structural rejoin: once an arm falls through, execution resumes after the branch\n      return signal;\n    }\n\n    case 'filter': {\n      const pass = await ctx.step.do(`${node.id}:eval`, async () =>\n        evaluateCondition(node.condition, ctx.facts, Date.now())\n      );\n      return pass ? FALL_THROUGH : { kind: 'exit', reason: node.reason ?? `${node.id}:filtered` };\n    }\n\n    case 'cohort': {\n      // Deterministic bucketing, so replay needs no checkpoint. The explicit\n      // experiment key (when set) keeps the assignment stable across workflow\n      // versions; the structural id fallback is fine for one-off splits.\n      const bucket = hashToBucket(`${ctx.userId}:${node.key ?? node.id}`);\n      // Integer basis points on both sides (the DSL guarantees weights sit on\n      // the 0.01% grid), so no float ever meets the comparison.\n      let cumulative = 0;\n      for (const arm of node.arms) {\n        cumulative += Math.round(arm.weight * 100);\n        if (bucket < cumulative) return runFlow(arm.flow, ir, ctx);\n      }\n      return FALL_THROUGH;\n    }\n\n    case 'exit':\n      return node.reason !== undefined ? { kind: 'exit', reason: node.reason } : { kind: 'exit' };\n\n    case 'send_event': {\n      await ctx.step.do(`${node.id}:emit`, async () => {\n        const payload = await resolveValues(node.payload, ctx.facts);\n        try {\n          await ctx.events.emit(node.event, payload, `${ctx.instanceId}:${node.id}`);\n        } catch (error) {\n          // A refused event must point at the journey that emitted it\n          if (error instanceof Error)\n            error.message = `[${ctx.instanceId} ${node.id}] ${error.message}`;\n          throw error;\n        }\n      });\n      return FALL_THROUGH;\n    }\n\n    case 'action': {\n      // Custom code runs inside step.do: retried on throw, checkpointed on success\n      const invoker = ctx.actions;\n      if (invoker === undefined) {\n        throw new Error(\n          `action '${node.action}': this runtime has no ActionInvoker configured — register the action on the adapter (see engine/actions.ts)`\n        );\n      }\n      await ctx.step.do(`${node.id}:run`, async () => {\n        const args = await resolveValues(node.args, ctx.facts);\n        await invoker.invoke({\n          action: node.action,\n          args,\n          userId: ctx.userId,\n          idempotencyKey: `${ctx.instanceId}:${node.id}`,\n        });\n      });\n      return FALL_THROUGH;\n    }\n  }\n}\n\nasync function waitUntil(\n  node: Extract<NodeIR, { type: 'wait_until' }>,\n  ctx: JourneyContext\n): Promise<boolean> {\n  const deadline = await ctx.step.do(\n    `${node.id}:deadline`,\n    async () => Date.now() + node.timeout.ms\n  );\n  const events = await ctx.step.do(`${node.id}:events`, async () =>\n    relevantEvents(node.condition, ctx.facts)\n  );\n  // Anchor at the moment the wait began (deadline is checkpointed, so this is\n  // replay-stable): `performed` inside the condition only counts events that\n  // happen during the wait — pre-existing history must not satisfy it.\n  const anchorMs = deadline - node.timeout.ms;\n  const met = await waitLoop(node.id, ctx, deadline, events, async (now) =>\n    (await evaluateCondition(node.condition, ctx.facts, now, { anchorMs })) ? true : null\n  );\n  await ctx.step.unsubscribe(`${node.id}:unsubscribe`);\n  return met === true;\n}\n\n/**\n * The conversion window outlives the flow: a journey whose steps are done while its goal's\n * `within` is still open keeps watching until the window closes — the purchase that follows the\n * last offer email is that email's conversion, and ending the instance at the email would report\n * it as a plain completion. `exitWhen` still applies while it waits. Nothing to wait for without\n * a window, or once the instance has converted.\n */\nasync function awaitTail(ir: WorkflowIR, ctx: JourneyContext): Promise<FlowSignal | null> {\n  const deadline = goalDeadline(ir, ctx);\n  const goal = ir.goal;\n  if (goal === undefined || deadline === undefined) return null;\n  const state = goalState(ctx);\n  if (state.convertedAt !== undefined) return null;\n  const open = await ctx.step.do('goal:open', async () => deadline > Date.now());\n  if (!open) return null;\n  const exitWhen = ir.exitWhen;\n  const events = await ctx.step.do('goal:events', async () => [\n    ...new Set([\n      ...(await relevantEvents(goal.condition, ctx.facts)),\n      ...(exitWhen === undefined ? [] : await relevantEvents(exitWhen, ctx.facts)),\n    ]),\n  ]);\n  const hit = await waitLoop('goal', ctx, deadline, events, async (now) => {\n    const reached = await goalReached(ir, ctx, now);\n    if (reached !== null) return { kind: 'goal' as const, at: reached.at };\n    if (exitWhen !== undefined && (await evaluateCondition(exitWhen, ctx.facts, now))) {\n      return { kind: 'exit_when' as const, at: now };\n    }\n    return null;\n  });\n  await ctx.step.unsubscribe('goal:unsubscribe');\n  if (hit === null) return null;\n  if (hit.kind === 'goal') {\n    state.convertedAt ??= hit.at;\n    return { kind: 'goal' };\n  }\n  return { kind: 'exit_when' };\n}\n\n/**\n * Wait until `check` finds something or the deadline passes: subscribe, check, sleep until a\n * relevant event wakes the instance or time runs out. `check` runs inside a step, so its result\n * must be serializable; null means \"not yet\". Null from here means the deadline passed with\n * nothing found — never a failure, and never a wait given up on early.\n */\nasync function waitLoop<R>(\n  id: string,\n  ctx: JourneyContext,\n  deadline: number,\n  events: string[],\n  check: (now: number) => Promise<R | null>\n): Promise<R | null> {\n  for (let attempt = 0; attempt < MAX_WAIT_CHECKS; attempt++) {\n    // Subscribe before the check, every attempt: one subscribe arms at least\n    // one wake-up (AWS callbacks are consumed on delivery, so each attempt\n    // needs a fresh arm; Cloudflare rows make the repeat call idempotent), and\n    // arming first closes the race where the event lands between the check and\n    // the registration.\n    await ctx.step.subscribe(`${id}:subscribe:${attempt}`, events, { deadlineMs: deadline });\n\n    const met = await ctx.step.do(`${id}:check:${attempt}`, async () => check(Date.now()));\n    if (met !== null) return met;\n\n    // Checkpointed: replay re-runs this control flow with wall-clock time far\n    // ahead of the original run, so the branch must come from a persisted value.\n    const remaining = await ctx.step.do(\n      `${id}:remaining:${attempt}`,\n      async () => deadline - Date.now()\n    );\n    // The condition was checked just above — expiring here needs no extra final check\n    if (remaining <= 0) return null;\n\n    const wake = await ctx.step.waitForWake(`${id}:wait:${attempt}`, {\n      timeoutMs: remaining,\n      deadlineMs: deadline,\n    });\n    // Final check after timeout: in a tight race the event may land exactly as the timer fires\n    if (wake === 'timeout') return finalCheck(id, ctx, check);\n    // Woken → back to the top of the loop to re-evaluate (at-least-once wake-up semantics)\n  }\n  // Check budget exhausted (see MAX_WAIT_CHECKS). Not a timeout: the wait keeps its deadline,\n  // only the wake-ups are given up — sleep to the deadline, then check once more there. The\n  // subscription rows stay until the caller's unsubscribe; a wake landing meanwhile is dropped\n  // by the runtime (nothing is parked on it), which is the point.\n  console.warn(\n    `[journey] ${ctx.instanceId} ${id}: ${MAX_WAIT_CHECKS} wake-ups without the condition holding — sleeping to the deadline`\n  );\n  const budgetRemaining = await ctx.step.do(\n    `${id}:budget:remaining`,\n    async () => deadline - Date.now()\n  );\n  if (budgetRemaining > 0) await ctx.step.sleep(`${id}:budget:sleep`, budgetRemaining);\n  return finalCheck(id, ctx, check);\n}\n\n/** The check once the deadline is reached — one step for all the ways of getting there. */\nasync function finalCheck<R>(\n  id: string,\n  ctx: JourneyContext,\n  check: (now: number) => Promise<R | null>\n): Promise<R | null> {\n  return ctx.step.do(`${id}:final`, async () => check(Date.now()));\n}\n\nasync function resolveValues(\n  values: Record<string, PropValueIR>,\n  facts: FactSource\n): Promise<Record<string, ScalarIR | undefined>> {\n  const resolved: Record<string, ScalarIR | undefined> = {};\n  for (const [key, value] of Object.entries(values)) {\n    resolved[key] = typeof value === 'object' ? await facts.getProperty(value.path) : value;\n  }\n  return resolved;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAM,kBAAkB;;AAGxB,MAAM,oBAAoB;AAQ1B,MAAM,eAA2B,EAAE,MAAM,eAAe;AAYxD,MAAM,6BAAa,IAAI,QAAmC;AAE1D,SAAS,UAAU,KAAgC;CACjD,IAAI,QAAQ,WAAW,IAAI,GAAG;CAC9B,IAAI,UAAU,KAAA,GAAW;EACvB,QAAQ,CAAC;EACT,WAAW,IAAI,KAAK,KAAK;CAC3B;CACA,OAAO;AACT;;AAGA,SAAS,aAAa,IAAgB,KAAyC;CAC7E,OAAO,GAAG,MAAM,WAAW,KAAA,IAAY,KAAA,IAAY,IAAI,cAAc,GAAG,KAAK,OAAO;AACtF;;;;;;AAOA,eAAe,YACb,IACA,KACA,KACgC;CAChC,MAAM,OAAO,GAAG;CAChB,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,MAAM,WAAW,aAAa,IAAI,GAAG;CAKrC,OAAO,MAJW,kBAAkB,KAAK,WAAW,IAAI,OAAO,KAAK;EAClE,UAAU,IAAI;EACd,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS;CACxD,CAAC,IACY,EAAE,IAAI,aAAa,KAAA,IAAY,MAAM,KAAK,IAAI,KAAK,QAAQ,EAAE,IAAI;AAChF;AAEA,eAAsB,WAAW,IAAgB,KAA8C;CAC7F,MAAM,QAAQ,IAAI,GAAG;CAErB,IAAI,SAAS,MADO,YAAY,SAAS,IAAI,GAAG,KACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG;CAErD,IAAI,OAAO,SAAS,gBAAgB,SAAU,MAAM,UAAU,IAAI,GAAG,KAAM;CAC3E,MAAM,EAAE,gBAAgB,UAAU,GAAG;CACrC,MAAM,YAAY,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CACjE,QAAQ,OAAO,MAAf;EACE,KAAK,gBACH,OAAO;GAAE,QAAQ;GAAa,GAAG;EAAU;EAC7C,KAAK,QACH,OAAO,OAAO,WAAW,KAAA,IACrB;GAAE,QAAQ;GAAU,QAAQ,OAAO;GAAQ,GAAG;EAAU,IACxD;GAAE,QAAQ;GAAU,GAAG;EAAU;EACvC,KAAK,QACH,OAAO;GAAE,QAAQ;GAAQ,GAAG;EAAU;EACxC,KAAK,aACH,OAAO;GAAE,QAAQ;GAAa,GAAG;EAAU;CAC/C;AACF;AAEA,eAAe,QAAQ,OAAiB,IAAgB,KAA0C;CAChG,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAQ,MAAM,IAAI,GAAG;EAC3B,MAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,GAAG;EAC1C,IAAI,OAAO,SAAS,gBAAgB,OAAO;CAC7C;CACA,OAAO;AACT;;;;;AAMA,eAAe,QAAQ,IAAgB,KAAoC;CACzE,MAAM,WAAW,IAAI;CACrB,IAAI,UAAU,YAAY,KAAA,GAAW;CACrC,MAAM,IAAI,KAAK,GAAG,iBAAiB,YAAY;EAC7C,MAAM,SAAS,UAAU;GACvB,UAAU,GAAG;GACb,YAAY,IAAI;GAChB,QAAQ,IAAI;GACZ,IAAI,IAAI;EACV,CAAC;CACH,CAAC;AACH;;;;;AAMA,eAAe,QAAQ,MAAc,IAAgB,KAAoC;CACvF,MAAM,WAAW,IAAI;CACrB,IAAI,UAAU,gBAAgB,KAAA,GAAW;CACzC,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,WAAW,YAAY;EAClD,MAAM,SAAS,cAAc;GAC3B,UAAU,GAAG;GACb,YAAY,IAAI;GAChB,QAAQ,IAAI;GACZ,QAAQ,KAAK;GACb,IAAI,KAAK,IAAI;EACf,CAAC;CACH,CAAC;AACH;;;;;;;;AASA,eAAe,QAAQ,SAA0B,KAAoC;CACnF,MAAM,WAAW,IAAI;CACrB,MAAM,WAAW,MAAM,UAAU,kBAAkB,OAAO;CAC1D,MAAM,OAAO,aAAa,KAAA,IAAY,UAAU;EAAE,GAAG;EAAS;CAAS;CACvE,MAAM,SAAS,MAAM,IAAI,SAAS,KAAK,IAAI;CAC3C,IAAI;EACF,MAAM,UAAU,cAAc,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;CACnE,SAAS,OAAO;EACd,QAAQ,MAAM,wBAAwB,KAAK,eAAe,kBAAkB,KAAK;CACnF;AACF;;;;;;;;;AAUA,eAAe,YACb,QACA,IACA,KAC4B;CAC5B,MAAM,OAAO,GAAG;CAChB,MAAM,WAAW,GAAG;CACpB,IAAI,SAAS,KAAA,KAAa,aAAa,KAAA,GAAW,OAAO;CAEzD,MAAM,QAAQ,UAAU,GAAG;CAC3B,MAAM,SAAS,MAAM,IAAI,KAAK,GAAG,GAAG,OAAO,SAAS,YAAY;EAC9D,MAAM,MAAM,KAAK,IAAI;EAErB,MAAM,UACJ,SAAS,KAAA,KAAa,MAAM,gBAAgB,KAAA,IACxC,MAAM,YAAY,IAAI,KAAK,GAAG,IAC9B;EACN,MAAM,UAAU,aAAa,KAAA,KAAc,MAAM,kBAAkB,UAAU,IAAI,OAAO,GAAG;EAC3F,OAAO;GAAE,QAAQ,SAAS,MAAM;GAAM;EAAQ;CAChD,CAAC;CAED,IAAI,OAAO,WAAW,MAAM;EAC1B,MAAM,gBAAgB,OAAO;EAC7B,IAAI,MAAM,eAAe,MAAM,OAAO,EAAE,MAAM,OAAO;CACvD;CACA,IAAI,OAAO,SAAS,OAAO,EAAE,MAAM,YAAY;CAC/C,OAAO;AACT;;;;;;AAOA,SAAS,SACP,MACA,OACA,KACsC;CACtC,IAAI,IAAI,cAAc,KAAA,GAAW,OAAO;CACxC,IAAI;EACF,OAAO,IAAI,UAAU,SAAS;GAAE,SAAS,KAAK;GAAS,UAAU,KAAK;GAAU;EAAM,CAAC;CACzF,SAAS,OAAO;EACd,IAAI,iBAAiB,OACnB,MAAM,UAAU,IAAI,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,MAAM;EAE1D,MAAM;CACR;AACF;;;;;;;;;;;;;;;AAkBA,eAAe,SACb,MACA,IACA,KACe;CACf,MAAM,OAAO,MAAM,IAAI,KAAK,GAAoB,GAAG,KAAK,GAAG,QAAQ,YAAY;EAC7E,MAAM,QAAQ,SAAS,MAAM,MAAM,cAAc,KAAK,OAAO,IAAI,KAAK,GAAG,GAAG;EAC5E,IAAI,MAAM,IAAI,MAAM,eAAe,KAAK,OAAO,GAAG,OAAO;EACzD,MAAM,SAAS,MAAM,IAAI,MAAM,YAAY;EAE3C,OAAO;GAAE;GAAO,SADA,KAAK,YAAY,WAAW,OAAO,MAAM,GAAG,CAAC,IAAI;EACzC;CAC1B,CAAC;CAED,IAAI,SAAS,MAAM;CACnB,IAAI,KAAK,QAAQ,WAAW,GAAG;EAC7B,QAAQ,IAAI,kBAAkB,KAAK,SAAS,+BAA+B,IAAI,QAAQ;EACvF;CACF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,KAAK,QAAQ,QAAQ,GACjD,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,SAAS,YAAY;EACxD,MAAM,QACJ;GACE,UAAU,GAAG;GACb,YAAY,IAAI;GAChB,QAAQ,KAAK;GACb,SAAS;GACT,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,QAAQ,IAAI;GACZ,WAAW,OAAO;GAClB;GACA,gBAAgB,GAAG,IAAI,WAAW,GAAG,KAAK,GAAG,GAAG,OAAO;EACzD,GACA,GACF;CACF,CAAC;AAEL;AAEA,eAAe,QAAQ,MAAc,IAAgB,KAA0C;CAC7F,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,IAAI,KAAK,YAAY,QAAQ;IAC3B,MAAM,SAAS,MAAM,IAAI,GAAG;IAC5B,OAAO;GACT;GACA,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC/C,MAAM,QAAQ,SAAS,MAAM,MAAM,cAAc,KAAK,OAAO,IAAI,KAAK,GAAG,GAAG;IAE5E,IAAI,MAAM,IAAI,MAAM,eAAe,KAAK,OAAO,GAAG;IAClD,MAAM,gBAAgB,mBAAmB,KAAK;IAC9C,MAAM,YACJ,kBAAkB,KAAA,IAAY,KAAA,IAAY,MAAM,IAAI,MAAM,YAAY,aAAa;IACrF,MAAM,QACJ;KACE,UAAU,GAAG;KACb,YAAY,IAAI;KAChB,QAAQ,KAAK;KACb,SAAS,KAAK;KACd,UAAU,KAAK;KACf;KACA,QAAQ,IAAI;KACZ,WAAW,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,SAAS;KACjE,gBAAgB,GAAG,IAAI,WAAW,GAAG,KAAK;IAC5C,GACA,GACF;GACF,CAAC;GACD,OAAO;EAGT,KAAK;GACH,MAAM,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,SAAS,EAAE;GAC9C,OAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG,KAAM;EAGlD,KAAK,gBAAgB;GAEnB,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC1D,MAAM,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI;IACpC,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC;GACnE,CAAC;GACD,MAAM,IAAI,KAAK,MAAM,GAAG,KAAK,GAAG,SAAS,EAAE;GAC3C,OAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG,KAAM;EAClD;EAEA,KAAK,eAAe;GAClB,MAAM,SAAS,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,UAAU,YAAY;IAChE,MAAM,KACJ,KAAK,OAAO,SACR,OAAQ,MAAM,IAAI,MAAM,YAAY,iBAAiB,KAAM,KAAK,IAChE,KAAK;IACX,OAAO,gBAAgB,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,SAAS,EAAE;GAChE,CAAC;GACD,IAAI,WAAW,MAAM,OAAO;GAG5B,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,aAAa,YAAY,SAAS,KAAK,IAAI,CAAC;GACpF,IAAI,KAAK,GAAG,MAAM,IAAI,KAAK,MAAM,GAAG,KAAK,GAAG,SAAS,EAAE;GACvD,OAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG,KAAM;EAClD;EAEA,KAAK,cAAc;GACjB,MAAM,MAAM,MAAM,UAAU,MAAM,GAAG;GAErC,MAAM,QAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG;GAChD,IAAI,OAAO,OAAO;GAClB,IAAI,KAAK,OAAO;GAChB,MAAM,YAAY,KAAK;GACvB,IAAI,cAAc,YAAY,OAAO;GACrC,IAAI,cAAc,QAAQ,OAAO;IAAE,MAAM;IAAQ,QAAQ,GAAG,KAAK,GAAG;GAAU;GAC9E,OAAO,QAAQ,WAAW,IAAI,GAAG;EACnC;EAEA,KAAK,UAAU;GACb,MAAM,UAAU,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC/D,MAAM,MAAM,KAAK,IAAI;IACrB,KAAK,MAAM,CAAC,GAAG,eAAe,KAAK,MAAM,QAAQ,GAC/C,IAAI,MAAM,kBAAkB,WAAW,WAAW,IAAI,OAAO,GAAG,GAC9D,OAAO;IAGX,OAAO;GACT,CAAC;GACD,MAAM,OAAO,WAAW,IAAI,KAAK,MAAM,QAAQ,EAAE,OAAO,KAAK;GAC7D,IAAI,SAAS,KAAA,GAAW,OAAO;GAG/B,OAAO,MAFc,QAAQ,MAAM,IAAI,GAAG;EAG5C;EAEA,KAAK,UAIH,OAAO,MAHY,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAChD,kBAAkB,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,CAAC,CACzD,IACc,eAAe;GAAE,MAAM;GAAQ,QAAQ,KAAK,UAAU,GAAG,KAAK,GAAG;EAAW;EAG5F,KAAK,UAAU;GAIb,MAAM,SAAS,aAAa,GAAG,IAAI,OAAO,GAAG,KAAK,OAAO,KAAK,IAAI;GAGlE,IAAI,aAAa;GACjB,KAAK,MAAM,OAAO,KAAK,MAAM;IAC3B,cAAc,KAAK,MAAM,IAAI,SAAS,GAAG;IACzC,IAAI,SAAS,YAAY,OAAO,QAAQ,IAAI,MAAM,IAAI,GAAG;GAC3D;GACA,OAAO;EACT;EAEA,KAAK,QACH,OAAO,KAAK,WAAW,KAAA,IAAY;GAAE,MAAM;GAAQ,QAAQ,KAAK;EAAO,IAAI,EAAE,MAAM,OAAO;EAE5F,KAAK;GACH,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC/C,MAAM,UAAU,MAAM,cAAc,KAAK,SAAS,IAAI,KAAK;IAC3D,IAAI;KACF,MAAM,IAAI,OAAO,KAAK,KAAK,OAAO,SAAS,GAAG,IAAI,WAAW,GAAG,KAAK,IAAI;IAC3E,SAAS,OAAO;KAEd,IAAI,iBAAiB,OACnB,MAAM,UAAU,IAAI,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,MAAM;KAC1D,MAAM;IACR;GACF,CAAC;GACD,OAAO;EAGT,KAAK,UAAU;GAEb,MAAM,UAAU,IAAI;GACpB,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,MACR,WAAW,KAAK,OAAO,6GACzB;GAEF,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,OAAO,YAAY;IAC9C,MAAM,OAAO,MAAM,cAAc,KAAK,MAAM,IAAI,KAAK;IACrD,MAAM,QAAQ,OAAO;KACnB,QAAQ,KAAK;KACb;KACA,QAAQ,IAAI;KACZ,gBAAgB,GAAG,IAAI,WAAW,GAAG,KAAK;IAC5C,CAAC;GACH,CAAC;GACD,OAAO;EACT;CACF;AACF;AAEA,eAAe,UACb,MACA,KACkB;CAClB,MAAM,WAAW,MAAM,IAAI,KAAK,GAC9B,GAAG,KAAK,GAAG,YACX,YAAY,KAAK,IAAI,IAAI,KAAK,QAAQ,EACxC;CACA,MAAM,SAAS,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,UAAU,YACpD,eAAe,KAAK,WAAW,IAAI,KAAK,CAC1C;CAIA,MAAM,WAAW,WAAW,KAAK,QAAQ;CACzC,MAAM,MAAM,MAAM,SAAS,KAAK,IAAI,KAAK,UAAU,QAAQ,OAAO,QAC/D,MAAM,kBAAkB,KAAK,WAAW,IAAI,OAAO,KAAK,EAAE,SAAS,CAAC,IAAK,OAAO,IACnF;CACA,MAAM,IAAI,KAAK,YAAY,GAAG,KAAK,GAAG,aAAa;CACnD,OAAO,QAAQ;AACjB;;;;;;;;AASA,eAAe,UAAU,IAAgB,KAAiD;CACxF,MAAM,WAAW,aAAa,IAAI,GAAG;CACrC,MAAM,OAAO,GAAG;CAChB,IAAI,SAAS,KAAA,KAAa,aAAa,KAAA,GAAW,OAAO;CACzD,MAAM,QAAQ,UAAU,GAAG;CAC3B,IAAI,MAAM,gBAAgB,KAAA,GAAW,OAAO;CAE5C,IAAI,CAAC,MADc,IAAI,KAAK,GAAG,aAAa,YAAY,WAAW,KAAK,IAAI,CAAC,GAClE,OAAO;CAClB,MAAM,WAAW,GAAG;CAOpB,MAAM,MAAM,MAAM,SAAS,QAAQ,KAAK,UAAU,MAN7B,IAAI,KAAK,GAAG,eAAe,YAAY,CAC1D,mBAAG,IAAI,IAAI,CACT,GAAI,MAAM,eAAe,KAAK,WAAW,IAAI,KAAK,GAClD,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,MAAM,eAAe,UAAU,IAAI,KAAK,CAC5E,CAAC,CACH,CAAC,GACyD,OAAO,QAAQ;EACvE,MAAM,UAAU,MAAM,YAAY,IAAI,KAAK,GAAG;EAC9C,IAAI,YAAY,MAAM,OAAO;GAAE,MAAM;GAAiB,IAAI,QAAQ;EAAG;EACrE,IAAI,aAAa,KAAA,KAAc,MAAM,kBAAkB,UAAU,IAAI,OAAO,GAAG,GAC7E,OAAO;GAAE,MAAM;GAAsB,IAAI;EAAI;EAE/C,OAAO;CACT,CAAC;CACD,MAAM,IAAI,KAAK,YAAY,kBAAkB;CAC7C,IAAI,QAAQ,MAAM,OAAO;CACzB,IAAI,IAAI,SAAS,QAAQ;EACvB,MAAM,gBAAgB,IAAI;EAC1B,OAAO,EAAE,MAAM,OAAO;CACxB;CACA,OAAO,EAAE,MAAM,YAAY;AAC7B;;;;;;;AAQA,eAAe,SACb,IACA,KACA,UACA,QACA,OACmB;CACnB,KAAK,IAAI,UAAU,GAAG,UAAU,iBAAiB,WAAW;EAM1D,MAAM,IAAI,KAAK,UAAU,GAAG,GAAG,aAAa,WAAW,QAAQ,EAAE,YAAY,SAAS,CAAC;EAEvF,MAAM,MAAM,MAAM,IAAI,KAAK,GAAG,GAAG,GAAG,SAAS,WAAW,YAAY,MAAM,KAAK,IAAI,CAAC,CAAC;EACrF,IAAI,QAAQ,MAAM,OAAO;EAIzB,MAAM,YAAY,MAAM,IAAI,KAAK,GAC/B,GAAG,GAAG,aAAa,WACnB,YAAY,WAAW,KAAK,IAAI,CAClC;EAEA,IAAI,aAAa,GAAG,OAAO;EAO3B,IAAI,MALe,IAAI,KAAK,YAAY,GAAG,GAAG,QAAQ,WAAW;GAC/D,WAAW;GACX,YAAY;EACd,CAAC,MAEY,WAAW,OAAO,WAAW,IAAI,KAAK,KAAK;CAE1D;CAKA,QAAQ,KACN,aAAa,IAAI,WAAW,GAAG,GAAG,IAAI,gBAAgB,mEACxD;CACA,MAAM,kBAAkB,MAAM,IAAI,KAAK,GACrC,GAAG,GAAG,oBACN,YAAY,WAAW,KAAK,IAAI,CAClC;CACA,IAAI,kBAAkB,GAAG,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,gBAAgB,eAAe;CACnF,OAAO,WAAW,IAAI,KAAK,KAAK;AAClC;;AAGA,eAAe,WACb,IACA,KACA,OACmB;CACnB,OAAO,IAAI,KAAK,GAAG,GAAG,GAAG,SAAS,YAAY,MAAM,KAAK,IAAI,CAAC,CAAC;AACjE;AAEA,eAAe,cACb,QACA,OAC+C;CAC/C,MAAM,WAAiD,CAAC;CACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAC9C,SAAS,OAAO,OAAO,UAAU,WAAW,MAAM,MAAM,YAAY,MAAM,IAAI,IAAI;CAEpF,OAAO;AACT"}
+{"version":3,"file":"interpreter.mjs","names":[],"sources":["../../src/engine/interpreter.ts"],"sourcesContent":["import type { NodeIR, PropValueIR, ScalarIR, WorkflowIR } from '../ir';\nimport { hashToBucket } from './bucket';\nimport { evaluateCondition, relevantEvents } from './condition';\nimport type {\n  FactSource,\n  JourneyContext,\n  JourneyOutcome,\n  OutboundMessage,\n  PushDevice,\n} from './ports';\nimport { RECIPIENT_PROPERTY } from './recipient';\nimport { nextWindowStart } from './time-window';\n\n/**\n * IR interpreter: the execution core for one user's journey instance.\n *\n * Pure logic — it imports nothing platform-specific; every external effect\n * arrives through the JourneyContext ports, and durable semantics\n * (checkpoint/replay) are the EngineStep adapter's job.\n *\n * Step naming: an IR node id *is* the step name (derived from the structural\n * path, so it is deterministic and unique). When one node needs several steps,\n * a suffix is appended (`${id}:guard`, `${id}:check:${n}`).\n *\n * Guard semantics: goal / exitWhen are checked at journey entry and after\n * every suspension point (delay / random_delay / time_window / wait_until) —\n * the moments where wall-clock time passed and the user's state may have\n * moved. Between two synchronous nodes no meaningful time passes, so checking\n * there would only burn step budget (each checkpoint costs a state write).\n */\n\n/**\n * Cap on wait_until re-evaluations, so a wake-up storm cannot exhaust the platform's step\n * budget. Each loop iteration costs a handful of steps, so 64 checks stay well inside the\n * platform step budgets while absorbing far more wake churn than 16 did. Past the cap the wait\n * is not given up: it sleeps to its deadline and checks once more there (see waitLoop) — the\n * answer is still right at the deadline, it just stops being event-driven in between.\n */\nconst MAX_WAIT_CHECKS = 64;\n\n/** The user property holding an IANA timezone id, read when a time_window says tz: 'user'. Same convention-table status as RECIPIENT_PROPERTY. */\nconst TIMEZONE_PROPERTY = 'timezone';\n\ntype FlowSignal =\n  | { kind: 'fall_through' }\n  | { kind: 'exit'; reason?: string }\n  | { kind: 'goal' }\n  | { kind: 'exit_when' };\n\nconst FALL_THROUGH: FlowSignal = { kind: 'fall_through' };\n\n/**\n * Whether and when the instance converted — a fact of its own, apart from how it ends: with\n * `exitOnMatch: false` a conversion lets the flow go on, and the instance still ends `completed`\n * (or `exited`, `exit_when`) carrying it. Set only from checkpointed step results, so a replay\n * rebuilds the same state.\n */\ninterface GoalState {\n  convertedAt?: number;\n}\n\nconst goalStates = new WeakMap<JourneyContext, GoalState>();\n\nfunction goalState(ctx: JourneyContext): GoalState {\n  let state = goalStates.get(ctx);\n  if (state === undefined) {\n    state = {};\n    goalStates.set(ctx, state);\n  }\n  return state;\n}\n\n/** When the goal's attribution window closes, measured from entry; none without `within`. */\nfunction goalDeadline(ir: WorkflowIR, ctx: JourneyContext): number | undefined {\n  return ir.goal?.within === undefined ? undefined : ctx.enteredAtMs + ir.goal.within.ms;\n}\n\n/**\n * Whether the goal holds for events inside its window: after entry, and not after the window\n * closed — an instance resumed past the deadline must not count a purchase made after it. The\n * conversion time is when the check saw it, capped at the deadline.\n */\nasync function goalReached(\n  ir: WorkflowIR,\n  ctx: JourneyContext,\n  now: number\n): Promise<{ at: number } | null> {\n  const goal = ir.goal;\n  if (goal === undefined) return null;\n  const deadline = goalDeadline(ir, ctx);\n  const met = await evaluateCondition(goal.condition, ctx.facts, now, {\n    anchorMs: ctx.enteredAtMs,\n    ...(deadline === undefined ? {} : { untilMs: deadline }),\n  });\n  return met ? { at: deadline === undefined ? now : Math.min(now, deadline) } : null;\n}\n\nexport async function runJourney(ir: WorkflowIR, ctx: JourneyContext): Promise<JourneyOutcome> {\n  await started(ir, ctx);\n  const entry = await checkGuards('entry', ir, ctx);\n  let signal = entry ?? (await runFlow(ir.flow, ir, ctx));\n  // The flow is done but the conversion window is not: keep watching it (see awaitTail)\n  if (signal.kind === 'fall_through') signal = (await awaitTail(ir, ctx)) ?? FALL_THROUGH;\n  const { convertedAt } = goalState(ctx);\n  const converted = convertedAt === undefined ? {} : { convertedAt };\n  switch (signal.kind) {\n    case 'fall_through':\n      return { status: 'completed', ...converted };\n    case 'exit':\n      return signal.reason !== undefined\n        ? { status: 'exited', reason: signal.reason, ...converted }\n        : { status: 'exited', ...converted };\n    case 'goal':\n      return { status: 'goal', ...converted };\n    case 'exit_when':\n      return { status: 'exit_when', ...converted };\n  }\n}\n\nasync function runFlow(nodes: NodeIR[], ir: WorkflowIR, ctx: JourneyContext): Promise<FlowSignal> {\n  for (const node of nodes) {\n    await reached(node, ir, ctx);\n    const signal = await runNode(node, ir, ctx);\n    if (signal.kind !== 'fall_through') return signal;\n  }\n  return FALL_THROUGH;\n}\n\n/**\n * Tell the observer the instance entered — before the entry guards, which can end it before the\n * first node: an instance is counted from its entry, not from its first node.\n */\nasync function started(ir: WorkflowIR, ctx: JourneyContext): Promise<void> {\n  const observer = ctx.observer;\n  if (observer?.started === undefined) return;\n  await ctx.step.do('entry:started', async () => {\n    await observer.started?.({\n      workflow: ir.id,\n      instanceId: ctx.instanceId,\n      userId: ctx.userId,\n      at: ctx.enteredAtMs,\n    });\n  });\n}\n\n/**\n * Tell the observer the instance is at `node`. A step of its own, so a replay does not report\n * the nodes it passes on the way back again, and the arrival time stays the first one.\n */\nasync function reached(node: NodeIR, ir: WorkflowIR, ctx: JourneyContext): Promise<void> {\n  const observer = ctx.observer;\n  if (observer?.nodeReached === undefined) return;\n  await ctx.step.do(`${node.id}:reached`, async () => {\n    await observer.nodeReached?.({\n      workflow: ir.id,\n      instanceId: ctx.instanceId,\n      userId: ctx.userId,\n      nodeId: node.id,\n      at: Date.now(),\n    });\n  });\n}\n\n/**\n * One copy out through the host's sender, with the observer on both sides: it may attach\n * tracking before, and hears how the transport took the copy after. A send that throws is\n * not reported — the step retries it, and reports when it settles. A report that fails after\n * the send is logged, never thrown: the step would retry and the transport — a webhook, a web\n * push, with no idempotency key of its own — would deliver the copy again.\n */\nasync function deliver(message: OutboundMessage, ctx: JourneyContext): Promise<void> {\n  const observer = ctx.observer;\n  const tracking = await observer?.messagePrepared?.(message);\n  const copy = tracking === undefined ? message : { ...message, tracking };\n  const result = await ctx.messages.send(copy);\n  try {\n    await observer?.messageSent?.(copy, result ?? { delivered: true });\n  } catch (error) {\n    console.error(`[workflow] reporting ${copy.idempotencyKey} as sent failed`, error);\n  }\n}\n\n/**\n * Goal / exitWhen guards (see the header for when they run).\n *\n * The goal condition is anchored at workflow entry: a `performed` inside it\n * only counts events after the user entered, so pre-existing history cannot\n * register as a conversion. exitWhen is deliberately unanchored — \"user\n * unsubscribed\" should exit no matter when it happened.\n */\nasync function checkGuards(\n  stepId: string,\n  ir: WorkflowIR,\n  ctx: JourneyContext\n): Promise<FlowSignal | null> {\n  const goal = ir.goal;\n  const exitWhen = ir.exitWhen;\n  if (goal === undefined && exitWhen === undefined) return null;\n\n  const state = goalState(ctx);\n  const result = await ctx.step.do(`${stepId}:guard`, async () => {\n    const now = Date.now();\n    // Already converted (exitOnMatch: false): the conversion stands, no need to look again\n    const goalHit =\n      goal !== undefined && state.convertedAt === undefined\n        ? await goalReached(ir, ctx, now)\n        : null;\n    const exitMet = exitWhen !== undefined && (await evaluateCondition(exitWhen, ctx.facts, now));\n    return { goalAt: goalHit?.at ?? null, exitMet };\n  });\n\n  if (result.goalAt !== null) {\n    state.convertedAt ??= result.goalAt;\n    if (goal?.exitOnMatch ?? true) return { kind: 'goal' };\n  }\n  if (result.exitMet) return { kind: 'exit_when' };\n  return null;\n}\n\n/**\n * The host's template check, with the instance and node added to the message:\n * a refused message must point at the journey that produced it. The error\n * keeps its class (and `name`), so adapters can stop retrying it.\n */\nfunction validate(\n  node: Extract<NodeIR, { type: 'message' }>,\n  props: Record<string, ScalarIR | undefined>,\n  ctx: JourneyContext\n): Record<string, ScalarIR | undefined> {\n  if (ctx.validator === undefined) return props;\n  try {\n    return ctx.validator.validate({ channel: node.channel, template: node.template, props });\n  } catch (error) {\n    if (error instanceof Error) {\n      error.message = `[${ctx.instanceId} ${node.id}] ${error.message}`;\n    }\n    throw error;\n  }\n}\n\n/**\n * Whether the user opted out of what this step sends. An email or push step checks its topic —\n * an opt-out of the topic on that channel or of the whole channel skips it — and a transactional\n * message (`topic: null`) is never skipped: a receipt or a code goes out whatever the user opted\n * out of. A node compiled before topics existed (no `topic`) checks the channel-wide opt-out\n * only, as it always did. Other channels check the channel.\n */\nasync function suppressed(\n  node: Extract<NodeIR, { type: 'message' }>,\n  ctx: JourneyContext\n): Promise<boolean> {\n  if (node.topic === null) return false;\n  return (await ctx.facts.isSuppressed?.(node.channel, node.topic)) === true;\n}\n\n/** The copy's topic, for the channels that have one: what the observer records and the senders may read. */\nfunction topicOf(node: Extract<NodeIR, { type: 'message' }>): { topic?: string | null } {\n  return node.channel === 'email' || node.channel === 'push' ? { topic: node.topic ?? null } : {};\n}\n\ntype PushPlan = { props: Record<string, ScalarIR | undefined>; devices: PushDevice[] };\n\n/**\n * A push goes to devices, not to a profile address: one copy per device the\n * host's directory lists (or only the most recent, `devices: 'latest'`). Each\n * copy's idempotency key carries its token, so a retried step that already\n * reached some devices re-sends to the rest and the senders drop the repeats —\n * keyed by token rather than position, because the list can change between\n * attempts. A user with no device is skipped, not failed: being unreachable is\n * a state of the user, and `reachable('push')` is how a journey branches on it.\n */\n/**\n * A push: one step settles what goes out and to which devices, then each device gets a step of\n * its own — a failure on one device retries that device alone, and the copies already delivered\n * are not sent again (APNs and FCM carry the idempotency key but do not de-duplicate on it).\n */\nasync function sendPush(\n  node: Extract<NodeIR, { type: 'message' }>,\n  ir: WorkflowIR,\n  ctx: JourneyContext\n): Promise<void> {\n  const plan = await ctx.step.do<PushPlan | null>(`${node.id}:send`, async () => {\n    const props = validate(node, await resolveValues(node.props, ctx.facts), ctx);\n    // Once per step, before any device: the topic's opt-out or the channel's (never a transactional push)\n    if (await suppressed(node, ctx)) return null;\n    const listed = await ctx.facts.listDevices();\n    const devices = node.devices === 'latest' ? listed.slice(0, 1) : listed;\n    return { props, devices };\n  });\n  // null: the topic or the channel is opted out\n  if (plan === null) return;\n  if (plan.devices.length === 0) {\n    console.log(`[journey] push ${node.template} skipped: no device for user ${ctx.userId}`);\n    return;\n  }\n  for (const [index, device] of plan.devices.entries()) {\n    await ctx.step.do(`${node.id}:send:${index}`, async () => {\n      await deliver(\n        {\n          workflow: ir.id,\n          instanceId: ctx.instanceId,\n          nodeId: node.id,\n          channel: 'push',\n          template: node.template,\n          props: plan.props,\n          userId: ctx.userId,\n          recipient: device.token,\n          device,\n          idempotencyKey: `${ctx.instanceId}:${node.id}:${device.token}`,\n          ...topicOf(node),\n        },\n        ctx\n      );\n    });\n  }\n}\n\nasync function runNode(node: NodeIR, ir: WorkflowIR, ctx: JourneyContext): Promise<FlowSignal> {\n  switch (node.type) {\n    case 'message': {\n      if (node.channel === 'push') {\n        await sendPush(node, ir, ctx);\n        return FALL_THROUGH;\n      }\n      await ctx.step.do(`${node.id}:send`, async () => {\n        const props = validate(node, await resolveValues(node.props, ctx.facts), ctx);\n        // An opted-out channel (an email unsubscribe) is skipped, like a push with no device\n        if (await suppressed(node, ctx)) return;\n        const recipientPath = RECIPIENT_PROPERTY[node.channel];\n        const recipient =\n          recipientPath === undefined ? undefined : await ctx.facts.getProperty(recipientPath);\n        await deliver(\n          {\n            workflow: ir.id,\n            instanceId: ctx.instanceId,\n            nodeId: node.id,\n            channel: node.channel,\n            template: node.template,\n            props,\n            userId: ctx.userId,\n            recipient: recipient === undefined ? undefined : String(recipient),\n            idempotencyKey: `${ctx.instanceId}:${node.id}`,\n            ...topicOf(node),\n          },\n          ctx\n        );\n      });\n      return FALL_THROUGH;\n    }\n\n    case 'delay': {\n      await ctx.step.sleep(node.id, node.duration.ms);\n      return (await checkGuards(node.id, ir, ctx)) ?? FALL_THROUGH;\n    }\n\n    case 'random_delay': {\n      // The random value is drawn and persisted inside the step, so replay does not re-roll it\n      const ms = await ctx.step.do(`${node.id}:roll`, async () => {\n        const span = node.max.ms - node.min.ms;\n        return node.min.ms + Math.floor(Math.random() * Math.max(span, 0));\n      });\n      await ctx.step.sleep(`${node.id}:sleep`, ms);\n      return (await checkGuards(node.id, ir, ctx)) ?? FALL_THROUGH;\n    }\n\n    case 'time_window': {\n      const target = await ctx.step.do(`${node.id}:target`, async () => {\n        const tz =\n          node.tz === 'user'\n            ? String((await ctx.facts.getProperty(TIMEZONE_PROPERTY)) ?? 'UTC')\n            : node.tz;\n        return nextWindowStart(Date.now(), node.days, node.between, tz);\n      });\n      if (target === null) return FALL_THROUGH; // already inside the window: no suspension, no guard\n      // The remaining time is checkpointed: a replay must not recompute it from a later clock\n      // (the target has passed by then, and a negative sleep is an error on some runtimes)\n      const ms = await ctx.step.do(`${node.id}:remaining`, async () => target - Date.now());\n      if (ms > 0) await ctx.step.sleep(`${node.id}:sleep`, ms);\n      return (await checkGuards(node.id, ir, ctx)) ?? FALL_THROUGH;\n    }\n\n    case 'wait_until': {\n      const met = await waitUntil(node, ctx);\n      // Time passed while waiting — guard before acting on the outcome (goal wins over the wait result)\n      const guard = await checkGuards(node.id, ir, ctx);\n      if (guard) return guard;\n      if (met) return FALL_THROUGH;\n      const onTimeout = node.onTimeout;\n      if (onTimeout === 'continue') return FALL_THROUGH;\n      if (onTimeout === 'exit') return { kind: 'exit', reason: `${node.id}:timeout` };\n      return runFlow(onTimeout, ir, ctx);\n    }\n\n    case 'branch': {\n      const matched = await ctx.step.do(`${node.id}:eval`, async () => {\n        const now = Date.now();\n        for (const [i, branchCase] of node.cases.entries()) {\n          if (await evaluateCondition(branchCase.condition, ctx.facts, now)) {\n            return i;\n          }\n        }\n        return -1; // no match → default arm, or simply continue\n      });\n      const flow = matched >= 0 ? node.cases[matched]?.flow : node.otherwise;\n      if (flow === undefined) return FALL_THROUGH;\n      const signal = await runFlow(flow, ir, ctx);\n      // Structural rejoin: once an arm falls through, execution resumes after the branch\n      return signal;\n    }\n\n    case 'filter': {\n      const pass = await ctx.step.do(`${node.id}:eval`, async () =>\n        evaluateCondition(node.condition, ctx.facts, Date.now())\n      );\n      return pass ? FALL_THROUGH : { kind: 'exit', reason: node.reason ?? `${node.id}:filtered` };\n    }\n\n    case 'cohort': {\n      // Deterministic bucketing, so replay needs no checkpoint. The explicit\n      // experiment key (when set) keeps the assignment stable across workflow\n      // versions; the structural id fallback is fine for one-off splits.\n      const bucket = hashToBucket(`${ctx.userId}:${node.key ?? node.id}`);\n      // Integer basis points on both sides (the DSL guarantees weights sit on\n      // the 0.01% grid), so no float ever meets the comparison.\n      let cumulative = 0;\n      for (const arm of node.arms) {\n        cumulative += Math.round(arm.weight * 100);\n        if (bucket < cumulative) return runFlow(arm.flow, ir, ctx);\n      }\n      return FALL_THROUGH;\n    }\n\n    case 'exit':\n      return node.reason !== undefined ? { kind: 'exit', reason: node.reason } : { kind: 'exit' };\n\n    case 'send_event': {\n      await ctx.step.do(`${node.id}:emit`, async () => {\n        const payload = await resolveValues(node.payload, ctx.facts);\n        try {\n          await ctx.events.emit(node.event, payload, `${ctx.instanceId}:${node.id}`);\n        } catch (error) {\n          // A refused event must point at the journey that emitted it\n          if (error instanceof Error)\n            error.message = `[${ctx.instanceId} ${node.id}] ${error.message}`;\n          throw error;\n        }\n      });\n      return FALL_THROUGH;\n    }\n\n    case 'action': {\n      // Custom code runs inside step.do: retried on throw, checkpointed on success\n      const invoker = ctx.actions;\n      if (invoker === undefined) {\n        throw new Error(\n          `action '${node.action}': this runtime has no ActionInvoker configured — register the action on the adapter (see engine/actions.ts)`\n        );\n      }\n      await ctx.step.do(`${node.id}:run`, async () => {\n        const args = await resolveValues(node.args, ctx.facts);\n        await invoker.invoke({\n          action: node.action,\n          args,\n          userId: ctx.userId,\n          idempotencyKey: `${ctx.instanceId}:${node.id}`,\n        });\n      });\n      return FALL_THROUGH;\n    }\n  }\n}\n\nasync function waitUntil(\n  node: Extract<NodeIR, { type: 'wait_until' }>,\n  ctx: JourneyContext\n): Promise<boolean> {\n  const deadline = await ctx.step.do(\n    `${node.id}:deadline`,\n    async () => Date.now() + node.timeout.ms\n  );\n  const events = await ctx.step.do(`${node.id}:events`, async () =>\n    relevantEvents(node.condition, ctx.facts)\n  );\n  // Anchor at the moment the wait began (deadline is checkpointed, so this is\n  // replay-stable): `performed` inside the condition only counts events that\n  // happen during the wait — pre-existing history must not satisfy it.\n  const anchorMs = deadline - node.timeout.ms;\n  const met = await waitLoop(node.id, ctx, deadline, events, async (now) =>\n    (await evaluateCondition(node.condition, ctx.facts, now, { anchorMs })) ? true : null\n  );\n  await ctx.step.unsubscribe(`${node.id}:unsubscribe`);\n  return met === true;\n}\n\n/**\n * The conversion window outlives the flow: a journey whose steps are done while its goal's\n * `within` is still open keeps watching until the window closes — the purchase that follows the\n * last offer email is that email's conversion, and ending the instance at the email would report\n * it as a plain completion. `exitWhen` still applies while it waits. Nothing to wait for without\n * a window, or once the instance has converted.\n */\nasync function awaitTail(ir: WorkflowIR, ctx: JourneyContext): Promise<FlowSignal | null> {\n  const deadline = goalDeadline(ir, ctx);\n  const goal = ir.goal;\n  if (goal === undefined || deadline === undefined) return null;\n  const state = goalState(ctx);\n  if (state.convertedAt !== undefined) return null;\n  const open = await ctx.step.do('goal:open', async () => deadline > Date.now());\n  if (!open) return null;\n  const exitWhen = ir.exitWhen;\n  const events = await ctx.step.do('goal:events', async () => [\n    ...new Set([\n      ...(await relevantEvents(goal.condition, ctx.facts)),\n      ...(exitWhen === undefined ? [] : await relevantEvents(exitWhen, ctx.facts)),\n    ]),\n  ]);\n  const hit = await waitLoop('goal', ctx, deadline, events, async (now) => {\n    const reached = await goalReached(ir, ctx, now);\n    if (reached !== null) return { kind: 'goal' as const, at: reached.at };\n    if (exitWhen !== undefined && (await evaluateCondition(exitWhen, ctx.facts, now))) {\n      return { kind: 'exit_when' as const, at: now };\n    }\n    return null;\n  });\n  await ctx.step.unsubscribe('goal:unsubscribe');\n  if (hit === null) return null;\n  if (hit.kind === 'goal') {\n    state.convertedAt ??= hit.at;\n    return { kind: 'goal' };\n  }\n  return { kind: 'exit_when' };\n}\n\n/**\n * Wait until `check` finds something or the deadline passes: subscribe, check, sleep until a\n * relevant event wakes the instance or time runs out. `check` runs inside a step, so its result\n * must be serializable; null means \"not yet\". Null from here means the deadline passed with\n * nothing found — never a failure, and never a wait given up on early.\n */\nasync function waitLoop<R>(\n  id: string,\n  ctx: JourneyContext,\n  deadline: number,\n  events: string[],\n  check: (now: number) => Promise<R | null>\n): Promise<R | null> {\n  for (let attempt = 0; attempt < MAX_WAIT_CHECKS; attempt++) {\n    // Subscribe before the check, every attempt: one subscribe arms at least\n    // one wake-up (AWS callbacks are consumed on delivery, so each attempt\n    // needs a fresh arm; Cloudflare rows make the repeat call idempotent), and\n    // arming first closes the race where the event lands between the check and\n    // the registration.\n    await ctx.step.subscribe(`${id}:subscribe:${attempt}`, events, { deadlineMs: deadline });\n\n    const met = await ctx.step.do(`${id}:check:${attempt}`, async () => check(Date.now()));\n    if (met !== null) return met;\n\n    // Checkpointed: replay re-runs this control flow with wall-clock time far\n    // ahead of the original run, so the branch must come from a persisted value.\n    const remaining = await ctx.step.do(\n      `${id}:remaining:${attempt}`,\n      async () => deadline - Date.now()\n    );\n    // The condition was checked just above — expiring here needs no extra final check\n    if (remaining <= 0) return null;\n\n    const wake = await ctx.step.waitForWake(`${id}:wait:${attempt}`, {\n      timeoutMs: remaining,\n      deadlineMs: deadline,\n    });\n    // Final check after timeout: in a tight race the event may land exactly as the timer fires\n    if (wake === 'timeout') return finalCheck(id, ctx, check);\n    // Woken → back to the top of the loop to re-evaluate (at-least-once wake-up semantics)\n  }\n  // Check budget exhausted (see MAX_WAIT_CHECKS). Not a timeout: the wait keeps its deadline,\n  // only the wake-ups are given up — sleep to the deadline, then check once more there. The\n  // subscription rows stay until the caller's unsubscribe; a wake landing meanwhile is dropped\n  // by the runtime (nothing is parked on it), which is the point.\n  console.warn(\n    `[journey] ${ctx.instanceId} ${id}: ${MAX_WAIT_CHECKS} wake-ups without the condition holding — sleeping to the deadline`\n  );\n  const budgetRemaining = await ctx.step.do(\n    `${id}:budget:remaining`,\n    async () => deadline - Date.now()\n  );\n  if (budgetRemaining > 0) await ctx.step.sleep(`${id}:budget:sleep`, budgetRemaining);\n  return finalCheck(id, ctx, check);\n}\n\n/** The check once the deadline is reached — one step for all the ways of getting there. */\nasync function finalCheck<R>(\n  id: string,\n  ctx: JourneyContext,\n  check: (now: number) => Promise<R | null>\n): Promise<R | null> {\n  return ctx.step.do(`${id}:final`, async () => check(Date.now()));\n}\n\nasync function resolveValues(\n  values: Record<string, PropValueIR>,\n  facts: FactSource\n): Promise<Record<string, ScalarIR | undefined>> {\n  const resolved: Record<string, ScalarIR | undefined> = {};\n  for (const [key, value] of Object.entries(values)) {\n    resolved[key] = typeof value === 'object' ? await facts.getProperty(value.path) : value;\n  }\n  return resolved;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAM,kBAAkB;;AAGxB,MAAM,oBAAoB;AAQ1B,MAAM,eAA2B,EAAE,MAAM,eAAe;AAYxD,MAAM,6BAAa,IAAI,QAAmC;AAE1D,SAAS,UAAU,KAAgC;CACjD,IAAI,QAAQ,WAAW,IAAI,GAAG;CAC9B,IAAI,UAAU,KAAA,GAAW;EACvB,QAAQ,CAAC;EACT,WAAW,IAAI,KAAK,KAAK;CAC3B;CACA,OAAO;AACT;;AAGA,SAAS,aAAa,IAAgB,KAAyC;CAC7E,OAAO,GAAG,MAAM,WAAW,KAAA,IAAY,KAAA,IAAY,IAAI,cAAc,GAAG,KAAK,OAAO;AACtF;;;;;;AAOA,eAAe,YACb,IACA,KACA,KACgC;CAChC,MAAM,OAAO,GAAG;CAChB,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,MAAM,WAAW,aAAa,IAAI,GAAG;CAKrC,OAAO,MAJW,kBAAkB,KAAK,WAAW,IAAI,OAAO,KAAK;EAClE,UAAU,IAAI;EACd,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS;CACxD,CAAC,IACY,EAAE,IAAI,aAAa,KAAA,IAAY,MAAM,KAAK,IAAI,KAAK,QAAQ,EAAE,IAAI;AAChF;AAEA,eAAsB,WAAW,IAAgB,KAA8C;CAC7F,MAAM,QAAQ,IAAI,GAAG;CAErB,IAAI,SAAS,MADO,YAAY,SAAS,IAAI,GAAG,KACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG;CAErD,IAAI,OAAO,SAAS,gBAAgB,SAAU,MAAM,UAAU,IAAI,GAAG,KAAM;CAC3E,MAAM,EAAE,gBAAgB,UAAU,GAAG;CACrC,MAAM,YAAY,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CACjE,QAAQ,OAAO,MAAf;EACE,KAAK,gBACH,OAAO;GAAE,QAAQ;GAAa,GAAG;EAAU;EAC7C,KAAK,QACH,OAAO,OAAO,WAAW,KAAA,IACrB;GAAE,QAAQ;GAAU,QAAQ,OAAO;GAAQ,GAAG;EAAU,IACxD;GAAE,QAAQ;GAAU,GAAG;EAAU;EACvC,KAAK,QACH,OAAO;GAAE,QAAQ;GAAQ,GAAG;EAAU;EACxC,KAAK,aACH,OAAO;GAAE,QAAQ;GAAa,GAAG;EAAU;CAC/C;AACF;AAEA,eAAe,QAAQ,OAAiB,IAAgB,KAA0C;CAChG,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAQ,MAAM,IAAI,GAAG;EAC3B,MAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,GAAG;EAC1C,IAAI,OAAO,SAAS,gBAAgB,OAAO;CAC7C;CACA,OAAO;AACT;;;;;AAMA,eAAe,QAAQ,IAAgB,KAAoC;CACzE,MAAM,WAAW,IAAI;CACrB,IAAI,UAAU,YAAY,KAAA,GAAW;CACrC,MAAM,IAAI,KAAK,GAAG,iBAAiB,YAAY;EAC7C,MAAM,SAAS,UAAU;GACvB,UAAU,GAAG;GACb,YAAY,IAAI;GAChB,QAAQ,IAAI;GACZ,IAAI,IAAI;EACV,CAAC;CACH,CAAC;AACH;;;;;AAMA,eAAe,QAAQ,MAAc,IAAgB,KAAoC;CACvF,MAAM,WAAW,IAAI;CACrB,IAAI,UAAU,gBAAgB,KAAA,GAAW;CACzC,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,WAAW,YAAY;EAClD,MAAM,SAAS,cAAc;GAC3B,UAAU,GAAG;GACb,YAAY,IAAI;GAChB,QAAQ,IAAI;GACZ,QAAQ,KAAK;GACb,IAAI,KAAK,IAAI;EACf,CAAC;CACH,CAAC;AACH;;;;;;;;AASA,eAAe,QAAQ,SAA0B,KAAoC;CACnF,MAAM,WAAW,IAAI;CACrB,MAAM,WAAW,MAAM,UAAU,kBAAkB,OAAO;CAC1D,MAAM,OAAO,aAAa,KAAA,IAAY,UAAU;EAAE,GAAG;EAAS;CAAS;CACvE,MAAM,SAAS,MAAM,IAAI,SAAS,KAAK,IAAI;CAC3C,IAAI;EACF,MAAM,UAAU,cAAc,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;CACnE,SAAS,OAAO;EACd,QAAQ,MAAM,wBAAwB,KAAK,eAAe,kBAAkB,KAAK;CACnF;AACF;;;;;;;;;AAUA,eAAe,YACb,QACA,IACA,KAC4B;CAC5B,MAAM,OAAO,GAAG;CAChB,MAAM,WAAW,GAAG;CACpB,IAAI,SAAS,KAAA,KAAa,aAAa,KAAA,GAAW,OAAO;CAEzD,MAAM,QAAQ,UAAU,GAAG;CAC3B,MAAM,SAAS,MAAM,IAAI,KAAK,GAAG,GAAG,OAAO,SAAS,YAAY;EAC9D,MAAM,MAAM,KAAK,IAAI;EAErB,MAAM,UACJ,SAAS,KAAA,KAAa,MAAM,gBAAgB,KAAA,IACxC,MAAM,YAAY,IAAI,KAAK,GAAG,IAC9B;EACN,MAAM,UAAU,aAAa,KAAA,KAAc,MAAM,kBAAkB,UAAU,IAAI,OAAO,GAAG;EAC3F,OAAO;GAAE,QAAQ,SAAS,MAAM;GAAM;EAAQ;CAChD,CAAC;CAED,IAAI,OAAO,WAAW,MAAM;EAC1B,MAAM,gBAAgB,OAAO;EAC7B,IAAI,MAAM,eAAe,MAAM,OAAO,EAAE,MAAM,OAAO;CACvD;CACA,IAAI,OAAO,SAAS,OAAO,EAAE,MAAM,YAAY;CAC/C,OAAO;AACT;;;;;;AAOA,SAAS,SACP,MACA,OACA,KACsC;CACtC,IAAI,IAAI,cAAc,KAAA,GAAW,OAAO;CACxC,IAAI;EACF,OAAO,IAAI,UAAU,SAAS;GAAE,SAAS,KAAK;GAAS,UAAU,KAAK;GAAU;EAAM,CAAC;CACzF,SAAS,OAAO;EACd,IAAI,iBAAiB,OACnB,MAAM,UAAU,IAAI,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,MAAM;EAE1D,MAAM;CACR;AACF;;;;;;;;AASA,eAAe,WACb,MACA,KACkB;CAClB,IAAI,KAAK,UAAU,MAAM,OAAO;CAChC,OAAQ,MAAM,IAAI,MAAM,eAAe,KAAK,SAAS,KAAK,KAAK,MAAO;AACxE;;AAGA,SAAS,QAAQ,MAAuE;CACtF,OAAO,KAAK,YAAY,WAAW,KAAK,YAAY,SAAS,EAAE,OAAO,KAAK,SAAS,KAAK,IAAI,CAAC;AAChG;;;;;;;;;;;;;;;AAkBA,eAAe,SACb,MACA,IACA,KACe;CACf,MAAM,OAAO,MAAM,IAAI,KAAK,GAAoB,GAAG,KAAK,GAAG,QAAQ,YAAY;EAC7E,MAAM,QAAQ,SAAS,MAAM,MAAM,cAAc,KAAK,OAAO,IAAI,KAAK,GAAG,GAAG;EAE5E,IAAI,MAAM,WAAW,MAAM,GAAG,GAAG,OAAO;EACxC,MAAM,SAAS,MAAM,IAAI,MAAM,YAAY;EAE3C,OAAO;GAAE;GAAO,SADA,KAAK,YAAY,WAAW,OAAO,MAAM,GAAG,CAAC,IAAI;EACzC;CAC1B,CAAC;CAED,IAAI,SAAS,MAAM;CACnB,IAAI,KAAK,QAAQ,WAAW,GAAG;EAC7B,QAAQ,IAAI,kBAAkB,KAAK,SAAS,+BAA+B,IAAI,QAAQ;EACvF;CACF;CACA,KAAK,MAAM,CAAC,OAAO,WAAW,KAAK,QAAQ,QAAQ,GACjD,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,SAAS,YAAY;EACxD,MAAM,QACJ;GACE,UAAU,GAAG;GACb,YAAY,IAAI;GAChB,QAAQ,KAAK;GACb,SAAS;GACT,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,QAAQ,IAAI;GACZ,WAAW,OAAO;GAClB;GACA,gBAAgB,GAAG,IAAI,WAAW,GAAG,KAAK,GAAG,GAAG,OAAO;GACvD,GAAG,QAAQ,IAAI;EACjB,GACA,GACF;CACF,CAAC;AAEL;AAEA,eAAe,QAAQ,MAAc,IAAgB,KAA0C;CAC7F,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,IAAI,KAAK,YAAY,QAAQ;IAC3B,MAAM,SAAS,MAAM,IAAI,GAAG;IAC5B,OAAO;GACT;GACA,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC/C,MAAM,QAAQ,SAAS,MAAM,MAAM,cAAc,KAAK,OAAO,IAAI,KAAK,GAAG,GAAG;IAE5E,IAAI,MAAM,WAAW,MAAM,GAAG,GAAG;IACjC,MAAM,gBAAgB,mBAAmB,KAAK;IAC9C,MAAM,YACJ,kBAAkB,KAAA,IAAY,KAAA,IAAY,MAAM,IAAI,MAAM,YAAY,aAAa;IACrF,MAAM,QACJ;KACE,UAAU,GAAG;KACb,YAAY,IAAI;KAChB,QAAQ,KAAK;KACb,SAAS,KAAK;KACd,UAAU,KAAK;KACf;KACA,QAAQ,IAAI;KACZ,WAAW,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,SAAS;KACjE,gBAAgB,GAAG,IAAI,WAAW,GAAG,KAAK;KAC1C,GAAG,QAAQ,IAAI;IACjB,GACA,GACF;GACF,CAAC;GACD,OAAO;EAGT,KAAK;GACH,MAAM,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,SAAS,EAAE;GAC9C,OAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG,KAAM;EAGlD,KAAK,gBAAgB;GAEnB,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC1D,MAAM,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI;IACpC,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC;GACnE,CAAC;GACD,MAAM,IAAI,KAAK,MAAM,GAAG,KAAK,GAAG,SAAS,EAAE;GAC3C,OAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG,KAAM;EAClD;EAEA,KAAK,eAAe;GAClB,MAAM,SAAS,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,UAAU,YAAY;IAChE,MAAM,KACJ,KAAK,OAAO,SACR,OAAQ,MAAM,IAAI,MAAM,YAAY,iBAAiB,KAAM,KAAK,IAChE,KAAK;IACX,OAAO,gBAAgB,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,SAAS,EAAE;GAChE,CAAC;GACD,IAAI,WAAW,MAAM,OAAO;GAG5B,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,aAAa,YAAY,SAAS,KAAK,IAAI,CAAC;GACpF,IAAI,KAAK,GAAG,MAAM,IAAI,KAAK,MAAM,GAAG,KAAK,GAAG,SAAS,EAAE;GACvD,OAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG,KAAM;EAClD;EAEA,KAAK,cAAc;GACjB,MAAM,MAAM,MAAM,UAAU,MAAM,GAAG;GAErC,MAAM,QAAQ,MAAM,YAAY,KAAK,IAAI,IAAI,GAAG;GAChD,IAAI,OAAO,OAAO;GAClB,IAAI,KAAK,OAAO;GAChB,MAAM,YAAY,KAAK;GACvB,IAAI,cAAc,YAAY,OAAO;GACrC,IAAI,cAAc,QAAQ,OAAO;IAAE,MAAM;IAAQ,QAAQ,GAAG,KAAK,GAAG;GAAU;GAC9E,OAAO,QAAQ,WAAW,IAAI,GAAG;EACnC;EAEA,KAAK,UAAU;GACb,MAAM,UAAU,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC/D,MAAM,MAAM,KAAK,IAAI;IACrB,KAAK,MAAM,CAAC,GAAG,eAAe,KAAK,MAAM,QAAQ,GAC/C,IAAI,MAAM,kBAAkB,WAAW,WAAW,IAAI,OAAO,GAAG,GAC9D,OAAO;IAGX,OAAO;GACT,CAAC;GACD,MAAM,OAAO,WAAW,IAAI,KAAK,MAAM,QAAQ,EAAE,OAAO,KAAK;GAC7D,IAAI,SAAS,KAAA,GAAW,OAAO;GAG/B,OAAO,MAFc,QAAQ,MAAM,IAAI,GAAG;EAG5C;EAEA,KAAK,UAIH,OAAO,MAHY,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAChD,kBAAkB,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,CAAC,CACzD,IACc,eAAe;GAAE,MAAM;GAAQ,QAAQ,KAAK,UAAU,GAAG,KAAK,GAAG;EAAW;EAG5F,KAAK,UAAU;GAIb,MAAM,SAAS,aAAa,GAAG,IAAI,OAAO,GAAG,KAAK,OAAO,KAAK,IAAI;GAGlE,IAAI,aAAa;GACjB,KAAK,MAAM,OAAO,KAAK,MAAM;IAC3B,cAAc,KAAK,MAAM,IAAI,SAAS,GAAG;IACzC,IAAI,SAAS,YAAY,OAAO,QAAQ,IAAI,MAAM,IAAI,GAAG;GAC3D;GACA,OAAO;EACT;EAEA,KAAK,QACH,OAAO,KAAK,WAAW,KAAA,IAAY;GAAE,MAAM;GAAQ,QAAQ,KAAK;EAAO,IAAI,EAAE,MAAM,OAAO;EAE5F,KAAK;GACH,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,QAAQ,YAAY;IAC/C,MAAM,UAAU,MAAM,cAAc,KAAK,SAAS,IAAI,KAAK;IAC3D,IAAI;KACF,MAAM,IAAI,OAAO,KAAK,KAAK,OAAO,SAAS,GAAG,IAAI,WAAW,GAAG,KAAK,IAAI;IAC3E,SAAS,OAAO;KAEd,IAAI,iBAAiB,OACnB,MAAM,UAAU,IAAI,IAAI,WAAW,GAAG,KAAK,GAAG,IAAI,MAAM;KAC1D,MAAM;IACR;GACF,CAAC;GACD,OAAO;EAGT,KAAK,UAAU;GAEb,MAAM,UAAU,IAAI;GACpB,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,MACR,WAAW,KAAK,OAAO,6GACzB;GAEF,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,OAAO,YAAY;IAC9C,MAAM,OAAO,MAAM,cAAc,KAAK,MAAM,IAAI,KAAK;IACrD,MAAM,QAAQ,OAAO;KACnB,QAAQ,KAAK;KACb;KACA,QAAQ,IAAI;KACZ,gBAAgB,GAAG,IAAI,WAAW,GAAG,KAAK;IAC5C,CAAC;GACH,CAAC;GACD,OAAO;EACT;CACF;AACF;AAEA,eAAe,UACb,MACA,KACkB;CAClB,MAAM,WAAW,MAAM,IAAI,KAAK,GAC9B,GAAG,KAAK,GAAG,YACX,YAAY,KAAK,IAAI,IAAI,KAAK,QAAQ,EACxC;CACA,MAAM,SAAS,MAAM,IAAI,KAAK,GAAG,GAAG,KAAK,GAAG,UAAU,YACpD,eAAe,KAAK,WAAW,IAAI,KAAK,CAC1C;CAIA,MAAM,WAAW,WAAW,KAAK,QAAQ;CACzC,MAAM,MAAM,MAAM,SAAS,KAAK,IAAI,KAAK,UAAU,QAAQ,OAAO,QAC/D,MAAM,kBAAkB,KAAK,WAAW,IAAI,OAAO,KAAK,EAAE,SAAS,CAAC,IAAK,OAAO,IACnF;CACA,MAAM,IAAI,KAAK,YAAY,GAAG,KAAK,GAAG,aAAa;CACnD,OAAO,QAAQ;AACjB;;;;;;;;AASA,eAAe,UAAU,IAAgB,KAAiD;CACxF,MAAM,WAAW,aAAa,IAAI,GAAG;CACrC,MAAM,OAAO,GAAG;CAChB,IAAI,SAAS,KAAA,KAAa,aAAa,KAAA,GAAW,OAAO;CACzD,MAAM,QAAQ,UAAU,GAAG;CAC3B,IAAI,MAAM,gBAAgB,KAAA,GAAW,OAAO;CAE5C,IAAI,CAAC,MADc,IAAI,KAAK,GAAG,aAAa,YAAY,WAAW,KAAK,IAAI,CAAC,GAClE,OAAO;CAClB,MAAM,WAAW,GAAG;CAOpB,MAAM,MAAM,MAAM,SAAS,QAAQ,KAAK,UAAU,MAN7B,IAAI,KAAK,GAAG,eAAe,YAAY,CAC1D,mBAAG,IAAI,IAAI,CACT,GAAI,MAAM,eAAe,KAAK,WAAW,IAAI,KAAK,GAClD,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,MAAM,eAAe,UAAU,IAAI,KAAK,CAC5E,CAAC,CACH,CAAC,GACyD,OAAO,QAAQ;EACvE,MAAM,UAAU,MAAM,YAAY,IAAI,KAAK,GAAG;EAC9C,IAAI,YAAY,MAAM,OAAO;GAAE,MAAM;GAAiB,IAAI,QAAQ;EAAG;EACrE,IAAI,aAAa,KAAA,KAAc,MAAM,kBAAkB,UAAU,IAAI,OAAO,GAAG,GAC7E,OAAO;GAAE,MAAM;GAAsB,IAAI;EAAI;EAE/C,OAAO;CACT,CAAC;CACD,MAAM,IAAI,KAAK,YAAY,kBAAkB;CAC7C,IAAI,QAAQ,MAAM,OAAO;CACzB,IAAI,IAAI,SAAS,QAAQ;EACvB,MAAM,gBAAgB,IAAI;EAC1B,OAAO,EAAE,MAAM,OAAO;CACxB;CACA,OAAO,EAAE,MAAM,YAAY;AAC7B;;;;;;;AAQA,eAAe,SACb,IACA,KACA,UACA,QACA,OACmB;CACnB,KAAK,IAAI,UAAU,GAAG,UAAU,iBAAiB,WAAW;EAM1D,MAAM,IAAI,KAAK,UAAU,GAAG,GAAG,aAAa,WAAW,QAAQ,EAAE,YAAY,SAAS,CAAC;EAEvF,MAAM,MAAM,MAAM,IAAI,KAAK,GAAG,GAAG,GAAG,SAAS,WAAW,YAAY,MAAM,KAAK,IAAI,CAAC,CAAC;EACrF,IAAI,QAAQ,MAAM,OAAO;EAIzB,MAAM,YAAY,MAAM,IAAI,KAAK,GAC/B,GAAG,GAAG,aAAa,WACnB,YAAY,WAAW,KAAK,IAAI,CAClC;EAEA,IAAI,aAAa,GAAG,OAAO;EAO3B,IAAI,MALe,IAAI,KAAK,YAAY,GAAG,GAAG,QAAQ,WAAW;GAC/D,WAAW;GACX,YAAY;EACd,CAAC,MAEY,WAAW,OAAO,WAAW,IAAI,KAAK,KAAK;CAE1D;CAKA,QAAQ,KACN,aAAa,IAAI,WAAW,GAAG,GAAG,IAAI,gBAAgB,mEACxD;CACA,MAAM,kBAAkB,MAAM,IAAI,KAAK,GACrC,GAAG,GAAG,oBACN,YAAY,WAAW,KAAK,IAAI,CAClC;CACA,IAAI,kBAAkB,GAAG,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,gBAAgB,eAAe;CACnF,OAAO,WAAW,IAAI,KAAK,KAAK;AAClC;;AAGA,eAAe,WACb,IACA,KACA,OACmB;CACnB,OAAO,IAAI,KAAK,GAAG,GAAG,GAAG,SAAS,YAAY,MAAM,KAAK,IAAI,CAAC,CAAC;AACjE;AAEA,eAAe,cACb,QACA,OAC+C;CAC/C,MAAM,WAAiD,CAAC;CACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAC9C,SAAS,OAAO,OAAO,UAAU,WAAW,MAAM,MAAM,YAAY,MAAM,IAAI,IAAI;CAEpF,OAAO;AACT"}

package/dist/engine/ports.d.cts

@@ -78,8 +78,12 @@ export interface FactSource {
   getSegmentCondition(name: string): Promise<ConditionIR | undefined>;
   /** The user's push devices, most recently registered first (empty when the user registered none). */
   listDevices(): Promise<PushDevice[]>;
-  /** The user opted out of the channel (an email unsubscribe): nothing is sent there. */
-  isSuppressed?(channel: ChannelIR): Promise<boolean>;
+  /**
+   * The user opted out of the channel (an email unsubscribe, a push opt-out in the app): nothing
+   * is sent there. With a `topic`, an opt-out of that topic on the channel counts too; without
+   * one, only the channel-wide opt-out.
+   */
+  isSuppressed?(channel: ChannelIR, topic?: string): Promise<boolean>;
 }
 export interface OutboundMessage {
   /** Where the copy comes from: the workflow, its instance and the message node. */
@@ -99,6 +103,8 @@ export interface OutboundMessage {
   recipient?: string | undefined;
   /** Push only: the device this copy goes to — its platform picks the provider. */
   device?: PushDevice | undefined;
+  /** Email and push: the template's subscription topic, null for a transactional message (absent for other channels). */
+  topic?: string | null | undefined;
   /**
    * `${instanceId}:${nodeId}` (plus `:${token}` for a push copy) — one per copy. Senders
    * de-duplicate on it, making replays and retries safe, and it is the copy's identity for
@@ -116,6 +122,12 @@ export type LinkPurpose = 'link' | 'unsubscribe';
  * Each is optional, and a sender ignores what its channel has no use for.
  */
 export interface MessageTracking {
+  /**
+   * The copy's id in the reporting tables: what its tracking URLs name, and what an email's
+   * preferences link carries (`email.preferencesUrl`), so the app's page can read the recipient's
+   * subscriptions by it. The email sender hands it to the renderer.
+   */
+  messageId?: string;
   /**
    * The original `http(s)` URL in, the URL that records the click and redirects out — or, for the
    * email's unsubscribe link, asks the recipient to confirm.

package/dist/engine/ports.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;EAEvB,cAAc,SAAS,YAAY;;iBAGpB;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;;;;;EAMT;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;;EAMf;;;;;EAKA,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/engine/ports.d.mts

@@ -78,8 +78,12 @@ export interface FactSource {
   getSegmentCondition(name: string): Promise<ConditionIR | undefined>;
   /** The user's push devices, most recently registered first (empty when the user registered none). */
   listDevices(): Promise<PushDevice[]>;
-  /** The user opted out of the channel (an email unsubscribe): nothing is sent there. */
-  isSuppressed?(channel: ChannelIR): Promise<boolean>;
+  /**
+   * The user opted out of the channel (an email unsubscribe, a push opt-out in the app): nothing
+   * is sent there. With a `topic`, an opt-out of that topic on the channel counts too; without
+   * one, only the channel-wide opt-out.
+   */
+  isSuppressed?(channel: ChannelIR, topic?: string): Promise<boolean>;
 }
 export interface OutboundMessage {
   /** Where the copy comes from: the workflow, its instance and the message node. */
@@ -99,6 +103,8 @@ export interface OutboundMessage {
   recipient?: string | undefined;
   /** Push only: the device this copy goes to — its platform picks the provider. */
   device?: PushDevice | undefined;
+  /** Email and push: the template's subscription topic, null for a transactional message (absent for other channels). */
+  topic?: string | null | undefined;
   /**
    * `${instanceId}:${nodeId}` (plus `:${token}` for a push copy) — one per copy. Senders
    * de-duplicate on it, making replays and retries safe, and it is the copy's identity for
@@ -116,6 +122,12 @@ export type LinkPurpose = 'link' | 'unsubscribe';
  * Each is optional, and a sender ignores what its channel has no use for.
  */
 export interface MessageTracking {
+  /**
+   * The copy's id in the reporting tables: what its tracking URLs name, and what an email's
+   * preferences link carries (`email.preferencesUrl`), so the app's page can read the recipient's
+   * subscriptions by it. The email sender hands it to the renderer.
+   */
+  messageId?: string;
   /**
    * The original `http(s)` URL in, the URL that records the click and redirects out — or, for the
    * email's unsubscribe link, asks the recipient to confirm.

package/dist/engine/ports.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;EAEvB,cAAc,SAAS,YAAY;;iBAGpB;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;;;;;EAMT;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;;EAMf;;;;;EAKA,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/host/channels.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_engine_retry = require("../engine/retry.cjs");
 const require_apns = require("../apns.cjs");
+const require_host_ingest = require("./ingest.cjs");
 const require_templates = require("../templates.cjs");
 const require_config = require("../config.cjs");
 const require_email_sender = require("../email-sender.cjs");
@@ -10,7 +11,6 @@ const require_push = require("../push.cjs");
 const require_react_email = require("../react-email.cjs");
 const require_webhooks = require("../webhooks.cjs");
 const require_webpush = require("../webpush.cjs");
-const require_host_ingest = require("./ingest.cjs");
 const require_host_senders = require("./senders.cjs");
 let node_buffer = require("node:buffer");
 // src/host/channels.ts

package/dist/host/channels.mjs

@@ -1,5 +1,6 @@
 import { PermanentError } from "../engine/retry.mjs";
 import { ApnsProviderToken, ApnsPushSender, DEAD_TOKEN_REASONS, apnsKeyFromBase64 } from "../apns.mjs";
+import { removeDevice } from "./ingest.mjs";
 import { indexTemplates, lookupTemplate, renderDiscordContent, renderSlackContent } from "../templates.mjs";
 import { apnsEnvironment } from "../config.mjs";
 import { EmailSender } from "../email-sender.mjs";
@@ -9,7 +10,6 @@ import { registryPushRenderer } from "../push.mjs";
 import { registryRenderer } from "../react-email.mjs";
 import { DiscordWebhookSender, SlackWebhookSender } from "../webhooks.mjs";
 import { DEAD_TOKEN_REASONS as DEAD_TOKEN_REASONS$2, VapidSigner, WebPushSender } from "../webpush.mjs";
-import { removeDevice } from "./ingest.mjs";
 import { routeByChannel, routeByPlatform } from "./senders.mjs";
 import { Buffer } from "node:buffer";
 // src/host/channels.ts

package/dist/host/execute.cjs

@@ -1,11 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_store_facts = require("../store/facts.cjs");
+const require_host_ingest = require("./ingest.cjs");
 const require_contract = require("../contract.cjs");
 const require_runtime = require("../runtime.cjs");
 const require_engine_interpreter = require("../engine/interpreter.cjs");
 const require_engine_time_scale = require("../engine/time-scale.cjs");
-const require_store_facts = require("../store/facts.cjs");
 const require_host_fresh_read = require("./fresh-read.cjs");
-const require_host_ingest = require("./ingest.cjs");
 // src/host/execute.ts
 /** Development aid: echo each outbound message before handing it to the real sender. */
 function logging(sender) {

package/dist/host/execute.d.cts

@@ -1,6 +1,6 @@
 import { ActionInvoker, EngineStep, JourneyObserver, JourneyOutcome, MessageSender, MessageValidator } from "../engine/ports.cjs";
-import { JourneyStore } from "../store/index.cjs";
 import { Contract } from "../contract.cjs";
+import { JourneyStore } from "../store/index.cjs";
 import { JourneyRuntimeOptions } from "../runtime.cjs";
 import { JourneyEnv, JourneyParams } from "./platform.cjs";
 /**

package/dist/host/execute.d.mts

@@ -1,6 +1,6 @@
 import { ActionInvoker, EngineStep, JourneyObserver, JourneyOutcome, MessageSender, MessageValidator } from "../engine/ports.mjs";
-import { JourneyStore } from "../store/index.mjs";
 import { Contract } from "../contract.mjs";
+import { JourneyStore } from "../store/index.mjs";
 import { JourneyRuntimeOptions } from "../runtime.mjs";
 import { JourneyEnv, JourneyParams } from "./platform.mjs";
 /**

package/dist/host/execute.mjs

@@ -1,10 +1,10 @@
+import { JourneyFactSource } from "../store/facts.mjs";
+import { ingestEvent } from "./ingest.mjs";
 import { ContractValidationError, checkEvent } from "../contract.mjs";
 import { resolveRuntime } from "../runtime.mjs";
 import { runJourney } from "../engine/interpreter.mjs";
 import { scaleDurations } from "../engine/time-scale.mjs";
-import { JourneyFactSource } from "../store/facts.mjs";
 import { readWithRetry } from "./fresh-read.mjs";
-import { ingestEvent } from "./ingest.mjs";
 // src/host/execute.ts
 /** Development aid: echo each outbound message before handing it to the real sender. */
 function logging(sender) {

package/dist/host/http.cjs

@@ -1,12 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
-const require_templates = require("../templates.cjs");
-const require_contract = require("../contract.cjs");
+const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_store_erasure = require("../store/erasure.cjs");
 const require_store_index = require("../store/index.cjs");
 const require_host_ingest = require("./ingest.cjs");
+const require_email = require("../email.cjs");
+const require_templates = require("../templates.cjs");
+const require_contract = require("../contract.cjs");
 const require_host_channels = require("./channels.cjs");
-const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_host_auth = require("./auth.cjs");
 let zod_mini = require("zod/mini");
 zod_mini = require_runtime.__toESM(zod_mini, 1);
@@ -70,6 +71,23 @@ function checked(validation, result, original, what) {
 		issues: result.issues
 	}, 400) };
 }
+/**
+* The topics the engine knows: the deployed bundle's list (compiled from the contract), or the
+* contract's when the bare API runs without a host — never the caller's.
+*/
+function declaredTopics(ctx) {
+	return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];
+}
+const SUBSCRIPTIONS = /^\/subscriptions\/[^/]+$/;
+const subscriptionsUser = (url) => decodeURIComponent(url.pathname.slice(15));
+/**
+* The same record, reached by one of the user's copies instead of their id: for the app's
+* preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The
+* message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still
+* guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.
+*/
+const SUBSCRIPTIONS_BY_MESSAGE = /^\/subscriptions\/by-message\/[^/]+$/;
+const subscriptionsMessage = (url) => decodeURIComponent(url.pathname.slice(26));
 const routes = [
 	{
 		method: "GET",
@@ -184,6 +202,58 @@ const routes = [
 			});
 		}
 	},
+	{
+		method: "GET",
+		path: SUBSCRIPTIONS,
+		auth: "api",
+		async handle(ctx) {
+			const userId = subscriptionsUser(ctx.url);
+			if (userId === "") return json({ error: "userId required" }, 400);
+			return json(await require_host_ingest.getSubscriptions(ctx.store, userId, declaredTopics(ctx)));
+		}
+	},
+	{
+		method: "PUT",
+		path: SUBSCRIPTIONS,
+		auth: "api",
+		async handle(ctx) {
+			const userId = subscriptionsUser(ctx.url);
+			if (userId === "") return json({ error: "userId required" }, 400);
+			const topics = declaredTopics(ctx);
+			const parsed = require_host_ingest.parseSubscriptionsPatch(await readJson(ctx.request), topics);
+			if (!parsed.ok) return json({
+				error: "subscriptions refused",
+				issues: parsed.issues
+			}, 400);
+			return json(await require_host_ingest.setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));
+		}
+	},
+	{
+		method: "GET",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const found = await require_host_ingest.getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
+	{
+		method: "PUT",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const topics = declaredTopics(ctx);
+			const parsed = require_host_ingest.parseSubscriptionsPatch(await readJson(ctx.request), topics);
+			if (!parsed.ok) return json({
+				error: "subscriptions refused",
+				issues: parsed.issues
+			}, 400);
+			const found = await require_host_ingest.setSubscriptionsByMessage(ctx.env, ctx.store, messageId, parsed.patch, topics);
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
 	{
 		method: "POST",
 		path: "/users/forget",
@@ -243,7 +313,7 @@ const routes = [
 				return json({ error: "props must be a JSON object" }, 400);
 			}
 			if (!isPlainObject(props)) return json({ error: "props must be a JSON object" }, 400);
-			const { subject, html } = await preview.render(key, props);
+			const { subject, html } = await preview.render(key, props, { messageId: require_email.PREVIEW_MESSAGE_ID });
 			return new Response(html, { headers: {
 				"content-type": "text/html; charset=utf-8",
 				"x-subject": encodeURIComponent(subject)
@@ -324,7 +394,7 @@ async function serve(request, ctx) {
 		return failure(error);
 	}
 }
-/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/users/forget`, `/deploy`. */
+/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */
 function handleRequest(request, env, store, validation = {}) {
 	return serve(request, {
 		env,

package/dist/host/http.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"http.cjs","names":["handleTracking","checkEvent","ingestEvent","identifyUser","registerDevice","unbindDevice","removeDevice","recordPushOpen","forgetUser","deployBundle","journeyMode","authorized","z","BundleIntegrityError","TemplateValidationError","UserErasedError","SchemaMismatchError"],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  UserErasedError,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  identifyUser,\n  ingestEvent,\n  registerDevice,\n  removeDevice,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */\nfunction isScalarOrNull(value: unknown): value is string | number | boolean | null {\n  return (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  );\n}\n\n/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */\nconst TS_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst TS_ERROR = 'ts must be a non-negative integer no later than 5 minutes in the future';\n\n/**\n * A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.\n * A far-future ts would put the event ahead of everything a window condition reads, and a\n * fractional or unsafe one does not survive the store.\n */\nfunction isValidTs(ts: unknown): ts is number {\n  return (\n    typeof ts === 'number' &&\n    Number.isSafeInteger(ts) &&\n    ts >= 0 &&\n    ts <= Date.now() + TS_FUTURE_TOLERANCE_MS\n  );\n}\n\n/** The contract's verdict: the value to use, or the response refusing the request. */\nfunction checked<T>(\n  validation: IngestValidation,\n  result: ContractResult<T>,\n  original: T,\n  what: string\n): { value: T } | { refused: Response } {\n  if (result.ok) return { value: result.data };\n  const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n  if (validation.mode === 'report') {\n    console.warn(`[workflow http] contract would refuse ${what}: ${issues.join('; ')}`);\n    return { value: original };\n  }\n  return {\n    refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n  };\n}\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/events',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          checkEvent(validation.contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/identify',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      // Profiles hold scalars only (both stores merge at the top level; a nested object would\n      // be merged differently by each): refused here, contract or not\n      if (!Object.values(props).every(isScalarOrNull)) {\n        return json(\n          { error: 'props values must be scalars (string, number, boolean) or null' },\n          400\n        );\n      }\n      let patch = props as ProfileProps;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          validation.contract.parseProfilePatch(props),\n          patch,\n          'identify'\n        );\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      const device = { userId, token, platform, ...(ts === undefined ? {} : { ts }) };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      return json(await deployBundle(env, host.bundle(), store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>);\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (ctx.host !== undefined && refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;;;;AAyFA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;;AAGA,SAAS,eAAe,OAA2D;CACjF,OACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AAErB;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,WAAW;;;;;;AAOjB,SAAS,UAAU,IAA2B;CAC5C,OACE,OAAO,OAAO,YACd,OAAO,cAAc,EAAE,KACvB,MAAM,KACN,MAAM,KAAK,IAAI,IAAI;AAEvB;;AAGA,SAAS,QACP,YACA,QACA,UACA,MACsC;CACtC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;CAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;CAC7E,IAAI,WAAW,SAAS,UAAU;EAChC,QAAQ,KAAK,yCAAyC,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;EAClF,OAAO,EAAE,OAAO,SAAS;CAC3B;CACA,OAAO,EACL,SAAS,KAAK;EAAE,OAAO,GAAG,KAAK;EAA2B,QAAQ,OAAO;CAAO,GAAG,GAAG,EACxF;AACF;AAIA,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAMA,2BAAAA,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACAC,iBAAAA,WAAW,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACpD,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAMC,oBAAAA,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAGhF,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,cAAc,GAC5C,OAAO,KACL,EAAE,OAAO,iEAAiE,GAC1E,GACF;GAEF,IAAI,QAAQ;GACZ,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,SAAS,kBAAkB,KAAK,GAC3C,OACA,UACF;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,MAAM,SAAS;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG;GAC9E,OAAO,KAAK,MAAMC,oBAAAA,eAAe,KAAK,QAAQ,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAMC,oBAAAA,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAC/C,OAAO,KAAK,MAAMA,oBAAAA,aAAa,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GACpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,KAAiC;GAGrF,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtBC,sBAAAA,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAOC,kBAAAA,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,oBAAAA,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,sBAAAA,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiBC,oBAAAA,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,IAAI,SAAS,KAAA,KAAa,YAAY,SAAS,KAAK,IAAI,QAAQ,GAClE,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}
+{"version":3,"file":"http.cjs","names":["handleTracking","checkEvent","ingestEvent","identifyUser","registerDevice","unbindDevice","removeDevice","recordPushOpen","getSubscriptions","parseSubscriptionsPatch","setSubscriptions","getSubscriptionsByMessage","setSubscriptionsByMessage","forgetUser","deployBundle","PREVIEW_MESSAGE_ID","journeyMode","authorized","z","BundleIntegrityError","TemplateValidationError","UserErasedError","SchemaMismatchError"],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport { PREVIEW_MESSAGE_ID } from '../email';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  UserErasedError,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  getSubscriptions,\n  getSubscriptionsByMessage,\n  identifyUser,\n  ingestEvent,\n  parseSubscriptionsPatch,\n  registerDevice,\n  removeDevice,\n  setSubscriptions,\n  setSubscriptionsByMessage,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | 'PUT' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */\nfunction isScalarOrNull(value: unknown): value is string | number | boolean | null {\n  return (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  );\n}\n\n/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */\nconst TS_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst TS_ERROR = 'ts must be a non-negative integer no later than 5 minutes in the future';\n\n/**\n * A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.\n * A far-future ts would put the event ahead of everything a window condition reads, and a\n * fractional or unsafe one does not survive the store.\n */\nfunction isValidTs(ts: unknown): ts is number {\n  return (\n    typeof ts === 'number' &&\n    Number.isSafeInteger(ts) &&\n    ts >= 0 &&\n    ts <= Date.now() + TS_FUTURE_TOLERANCE_MS\n  );\n}\n\n/** The contract's verdict: the value to use, or the response refusing the request. */\nfunction checked<T>(\n  validation: IngestValidation,\n  result: ContractResult<T>,\n  original: T,\n  what: string\n): { value: T } | { refused: Response } {\n  if (result.ok) return { value: result.data };\n  const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n  if (validation.mode === 'report') {\n    console.warn(`[workflow http] contract would refuse ${what}: ${issues.join('; ')}`);\n    return { value: original };\n  }\n  return {\n    refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n  };\n}\n\n/**\n * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the\n * contract's when the bare API runs without a host — never the caller's.\n */\nfunction declaredTopics(ctx: Pick<RouteContext, 'host' | 'validation'>): readonly string[] {\n  return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];\n}\n\nconst SUBSCRIPTIONS = /^\\/subscriptions\\/[^/]+$/;\nconst subscriptionsUser = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/'.length));\n/**\n * The same record, reached by one of the user's copies instead of their id: for the app's\n * preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The\n * message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still\n * guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.\n */\nconst SUBSCRIPTIONS_BY_MESSAGE = /^\\/subscriptions\\/by-message\\/[^/]+$/;\nconst subscriptionsMessage = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/by-message/'.length));\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/events',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          checkEvent(validation.contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/identify',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      // Profiles hold scalars only (both stores merge at the top level; a nested object would\n      // be merged differently by each): refused here, contract or not\n      if (!Object.values(props).every(isScalarOrNull)) {\n        return json(\n          { error: 'props values must be scalars (string, number, boolean) or null' },\n          400\n        );\n      }\n      let patch = props as ProfileProps;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          validation.contract.parseProfilePatch(props),\n          patch,\n          'identify'\n        );\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      const device = { userId, token, platform, ...(ts === undefined ? {} : { ts }) };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      return json(await getSubscriptions(ctx.store, userId, declaredTopics(ctx)));\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const found = await getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      const found = await setSubscriptionsByMessage(\n        ctx.env,\n        ctx.store,\n        messageId,\n        parsed.patch,\n        topics\n      );\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      return json(await deployBundle(env, host.bundle(), store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      // A preview is no copy, but it shows the footer a sent one has: the preferences link\n      // renders with a placeholder message id\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>, {\n        messageId: PREVIEW_MESSAGE_ID,\n      });\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (ctx.host !== undefined && refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;;;;;AA+FA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;;AAGA,SAAS,eAAe,OAA2D;CACjF,OACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AAErB;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,WAAW;;;;;;AAOjB,SAAS,UAAU,IAA2B;CAC5C,OACE,OAAO,OAAO,YACd,OAAO,cAAc,EAAE,KACvB,MAAM,KACN,MAAM,KAAK,IAAI,IAAI;AAEvB;;AAGA,SAAS,QACP,YACA,QACA,UACA,MACsC;CACtC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;CAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;CAC7E,IAAI,WAAW,SAAS,UAAU;EAChC,QAAQ,KAAK,yCAAyC,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;EAClF,OAAO,EAAE,OAAO,SAAS;CAC3B;CACA,OAAO,EACL,SAAS,KAAK;EAAE,OAAO,GAAG,KAAK;EAA2B,QAAQ,OAAO;CAAO,GAAG,GAAG,EACxF;AACF;;;;;AAMA,SAAS,eAAe,KAAmE;CACzF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,eAAe,UAAU,IAAI,WAAW,UAAU,UAAU,CAAC;AAC1F;AAEA,MAAM,gBAAgB;AACtB,MAAM,qBAAqB,QACzB,mBAAmB,IAAI,SAAS,MAAM,EAAwB,CAAC;;;;;;;AAOjE,MAAM,2BAA2B;AACjC,MAAM,wBAAwB,QAC5B,mBAAmB,IAAI,SAAS,MAAM,EAAmC,CAAC;AAI5E,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAMA,2BAAAA,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACAC,iBAAAA,WAAW,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACpD,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAMC,oBAAAA,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAGhF,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,cAAc,GAC5C,OAAO,KACL,EAAE,OAAO,iEAAiE,GAC1E,GACF;GAEF,IAAI,QAAQ;GACZ,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,SAAS,kBAAkB,KAAK,GAC3C,OACA,UACF;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,MAAM,SAAS;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG;GAC9E,OAAO,KAAK,MAAMC,oBAAAA,eAAe,KAAK,QAAQ,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,OAAO,QAAQ,eAAe,GAAG,CAAC,CAAC;EAC5E;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASC,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,OAAO,MAAM,CAAC;EACtF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,QAAQ,MAAMC,oBAAAA,0BAA0B,IAAI,OAAO,WAAW,eAAe,GAAG,CAAC;GACvF,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASF,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,MAAM,QAAQ,MAAMG,oBAAAA,0BAClB,IAAI,KACJ,IAAI,OACJ,WACA,OAAO,OACP,MACF;GACA,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAMC,oBAAAA,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAC/C,OAAO,KAAK,MAAMA,oBAAAA,aAAa,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAGpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,OAAmC,EACrF,WAAWC,cAAAA,mBACb,CAAC;GAGD,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtBC,sBAAAA,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAOC,kBAAAA,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,oBAAAA,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,sBAAAA,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiBC,oBAAAA,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,IAAI,SAAS,KAAA,KAAa,YAAY,SAAS,KAAK,IAAI,QAAQ,GAClE,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}