@shware/workflow 6.0.0 → 6.1.0

package/dist/email.mjs

@@ -25,18 +25,33 @@ function mimeAddress(address) {
 	return `${name} <${email}>`;
 }
 /**
-* The template's metadata, its `unsubscribeUrl` falling back to the config's — for a topic
-* email; a transactional one resolves to no unsubscribe link at all. Leaves both untouched.
+* The message id a preview renders with: the preferences link shows in the studio and
+* `GET /preview`, pointing at a copy that does not exist.
 */
-function resolveEmail(template, config) {
-	const unsubscribeUrl = template.topic === null ? void 0 : template.unsubscribeUrl ?? config?.unsubscribeUrl;
+const PREVIEW_MESSAGE_ID = "00000000-0000-0000-0000-000000000000";
+/**
+* The template's metadata, its `unsubscribeUrl` falling back to the config's, and the
+* preferences link built from the config's page and the copy's message id — for a topic email; a
+* transactional one resolves to neither link. Leaves the inputs untouched.
+*/
+function resolveEmail(template, config, options = {}) {
+	const topical = template.topic !== null;
+	const unsubscribeUrl = topical ? template.unsubscribeUrl ?? config?.unsubscribeUrl : void 0;
+	const preferencesUrl = topical && config?.preferencesUrl !== void 0 && options.messageId !== void 0 ? preferencesLink(config.preferencesUrl, options.messageId) : void 0;
 	return {
 		from: template.from,
 		topic: template.topic,
 		...template.replyTo === void 0 ? {} : { replyTo: template.replyTo },
-		...unsubscribeUrl === void 0 ? {} : { unsubscribeUrl }
+		...unsubscribeUrl === void 0 ? {} : { unsubscribeUrl },
+		...preferencesUrl === void 0 ? {} : { preferencesUrl }
 	};
 }
+/** The preference page's URL for one copy: `m=<message id>` set on its query, the rest of it kept. */
+function preferencesLink(preferencesUrl, messageId) {
+	const url = new URL(preferencesUrl);
+	url.searchParams.set("m", messageId);
+	return url.toString();
+}
 const ADDRESS = /^[^\s@<>]+@[^\s@<>]+$/;
 /** Throws naming `where` when `address` is neither `user@host` nor `{ email: 'user@host', name? }`. */
 function assertEmailAddress(address, where) {
@@ -46,7 +61,7 @@ function assertEmailAddress(address, where) {
 	if (name !== void 0 && typeof name !== "string") throw new TypeError(`${where}.name must be a string`);
 }
 /** Throws naming `where` unless `url` is an absolute http(s) URL; '' and null are not a way to leave it out. */
-function assertUnsubscribeUrl(url, where) {
+function assertHttpUrl(url, where) {
 	let parsed;
 	try {
 		parsed = typeof url === "string" ? new URL(url) : void 0;
@@ -55,16 +70,26 @@ function assertUnsubscribeUrl(url, where) {
 	}
 	if (parsed === void 0 || parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new TypeError(`${where} must be an http(s) URL (leave it out for none)`);
 }
+/** `assertHttpUrl`, under its earlier name. */
+const assertUnsubscribeUrl = assertHttpUrl;
 /** The config's `email` and every registered template's metadata; throws on the first invalid value. */
 function assertEmailConfig(config, templates) {
-	if (Object.hasOwn(config, "emails")) throw new TypeError("the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, and the rest moved to `email: { unsubscribeUrl, tracking }`");
+	if (Object.hasOwn(config, "emails")) throw new TypeError("the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, and the rest moved to `email: { unsubscribeUrl, preferencesUrl, tracking }`");
 	const email = config.email;
 	if (email !== void 0) {
-		if (email.unsubscribeUrl !== void 0) assertUnsubscribeUrl(email.unsubscribeUrl, "email.unsubscribeUrl");
+		if (email.unsubscribeUrl !== void 0) assertHttpUrl(email.unsubscribeUrl, "email.unsubscribeUrl");
+		if (email.preferencesUrl !== void 0) {
+			assertHttpUrl(email.preferencesUrl, "email.preferencesUrl");
+			if (isUnsubscribeLink(email.preferencesUrl, email.unsubscribeUrl)) throw new TypeError("email.preferencesUrl must not share its origin and path with email.unsubscribeUrl: the sender would track the preferences link as the unsubscribe link");
+		}
 		const quick = email.tracking?.quickClickMs;
 		if (quick !== void 0 && !(typeof quick === "number" && Number.isFinite(quick) && quick >= 0)) throw new TypeError("email.tracking.quickClickMs must be a non-negative number");
 	}
-	for (const template of templates) assertEmailMetadata(template, `email template '${template.id}'`, true);
+	for (const template of templates) {
+		const where = `email template '${template.id}'`;
+		assertEmailMetadata(template, where, true);
+		if (email?.preferencesUrl !== void 0 && isUnsubscribeLink(email.preferencesUrl, template.unsubscribeUrl)) throw new TypeError(`${where}: its unsubscribeUrl shares its origin and path with email.preferencesUrl, so the sender would track the preferences link as the unsubscribe link`);
+	}
 }
 /**
 * A template's own `from` / `replyTo` / `unsubscribeUrl` and what it is (`topic` or
@@ -75,7 +100,7 @@ function assertEmailConfig(config, templates) {
 function assertEmailMetadata(template, where, declared = false) {
 	assertEmailAddress(template.from, `${where}: from`);
 	if (template.replyTo !== void 0) assertEmailAddress(template.replyTo, `${where}: replyTo`);
-	if (template.unsubscribeUrl !== void 0) assertUnsubscribeUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);
+	if (template.unsubscribeUrl !== void 0) assertHttpUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);
 	if (assertTemplateTopic(template, where, "email", declared) && template.unsubscribeUrl !== void 0) throw new TypeError(`${where}: a transactional email has no unsubscribe link, so it takes no 'unsubscribeUrl'`);
 }
 /**
@@ -105,6 +130,6 @@ function isUnsubscribeLink(url, unsubscribeUrl) {
 		return false;
 	}
 }
-export { assertEmailAddress, assertEmailConfig, assertEmailMetadata, assertTemplateTopic, assertUnsubscribeUrl, formatEmailAddress, isUnsubscribeLink, mimeAddress, resolveEmail };
+export { PREVIEW_MESSAGE_ID, assertEmailAddress, assertEmailConfig, assertEmailMetadata, assertHttpUrl, assertTemplateTopic, assertUnsubscribeUrl, formatEmailAddress, isUnsubscribeLink, mimeAddress, preferencesLink, resolveEmail };
 
 //# sourceMappingURL=email.mjs.map

package/dist/email.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email.mjs","names":[],"sources":["../src/email.ts"],"sourcesContent":["import type { EmailTemplate } from './templates';\n\n/**\n * Email metadata: who a template's email comes from, where replies go, and the unsubscribe link\n * its layout carries. Each `emailTemplate` declares its own `from` (and `replyTo`, if replies should\n * go elsewhere) and says what it is: a `topic` the recipient may unsubscribe from, or\n * `transactional: true`. A topic email's unsubscribe link is the template's `unsubscribeUrl`,\n * else the config's `email.unsubscribeUrl`, else none; a transactional email never has one,\n * whatever the config says. `resolveEmail` is that rule, and the sender, the renderer, the\n * Worker's preview and the studio all go through it. No React and no I/O here, so a browser can\n * import it.\n */\n\n/** An address as the transports take it: bare, or with a display name. */\nexport type EmailAddress = string | { email: string; name?: string };\n\n/** `Name <email>`, or the bare address. */\nexport function formatEmailAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  return address.name === undefined ? address.email : `${address.name} <${address.email}>`;\n}\n\nconst ASCII = /^[\\x20-\\x7e]*$/;\nconst SPECIALS = /[()<>[\\]:;@\\\\,.\"]/;\n\n/**\n * An address as a mail API reads it (RFC 5322): a display name with specials is quoted, one\n * outside ASCII is a MIME encoded-word — raw non-ASCII names are refused (SES), and an unquoted\n * comma splits the address in two.\n */\nexport function mimeAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  const { email, name } = address;\n  if (name === undefined || name === '') return email;\n  if (!ASCII.test(name)) {\n    const bytes = new TextEncoder().encode(name);\n    let binary = '';\n    for (const byte of bytes) binary += String.fromCharCode(byte);\n    return `=?UTF-8?B?${btoa(binary)}?= <${email}>`;\n  }\n  if (SPECIALS.test(name)) return `\"${name.replace(/([\"\\\\])/g, '\\\\$1')}\" <${email}>`;\n  return `${name} <${email}>`;\n}\n\n/** The config's `email`: what every email template shares. */\nexport interface EmailConfig {\n  /**\n   * The unsubscribe link of every email template that names none of its own. The layout reads it\n   * with `useEmailContext()`; sent, it is tracked like every link, but following it shows a\n   * confirmation page, and only the confirmation (a POST no link scanner sends) unsubscribes.\n   */\n  unsubscribeUrl?: string;\n  /** How the Worker tells a person's opens and clicks from a machine's (see the reporting classifier). */\n  tracking?: {\n    /**\n     * An open or click this many milliseconds after delivery is a weak machine signal — machine\n     * only together with another (a second link within seconds); 1000 by default. A person\n     * tapping a mail notification can click within a few seconds, so keep it short.\n     */\n    quickClickMs?: number;\n  };\n}\n\n/** One template's email metadata, resolved against the config. */\nexport interface ResolvedEmail {\n  from: EmailAddress;\n  /** The template's subscription topic; null for a transactional email. */\n  topic: string | null;\n  /** Absent when the template names none: the email goes out without a Reply-To. */\n  replyTo?: EmailAddress;\n  /**\n   * Absent when the email is transactional, or neither the template nor the config names one:\n   * the email has no unsubscribe link.\n   */\n  unsubscribeUrl?: string;\n}\n\n/**\n * The template's metadata, its `unsubscribeUrl` falling back to the config's — for a topic\n * email; a transactional one resolves to no unsubscribe link at all. Leaves both untouched.\n */\nexport function resolveEmail(\n  template: Pick<EmailTemplate, 'from' | 'replyTo' | 'unsubscribeUrl' | 'topic'>,\n  config?: EmailConfig\n): ResolvedEmail {\n  const unsubscribeUrl =\n    template.topic === null ? undefined : (template.unsubscribeUrl ?? config?.unsubscribeUrl);\n  return {\n    from: template.from,\n    topic: template.topic,\n    ...(template.replyTo === undefined ? {} : { replyTo: template.replyTo }),\n    ...(unsubscribeUrl === undefined ? {} : { unsubscribeUrl }),\n  };\n}\n\nconst ADDRESS = /^[^\\s@<>]+@[^\\s@<>]+$/;\n\n/** Throws naming `where` when `address` is neither `user@host` nor `{ email: 'user@host', name? }`. */\nexport function assertEmailAddress(address: unknown, where: string): void {\n  const email =\n    typeof address === 'object' && address !== null\n      ? (address as { email?: unknown }).email\n      : address;\n  const name =\n    typeof address === 'object' && address !== null\n      ? (address as { name?: unknown }).name\n      : undefined;\n  if (typeof email !== 'string' || !ADDRESS.test(email)) {\n    throw new TypeError(`${where} must be an email address or { email, name? }`);\n  }\n  if (name !== undefined && typeof name !== 'string') {\n    throw new TypeError(`${where}.name must be a string`);\n  }\n}\n\n/** Throws naming `where` unless `url` is an absolute http(s) URL; '' and null are not a way to leave it out. */\nexport function assertUnsubscribeUrl(url: unknown, where: string): void {\n  let parsed: URL | undefined;\n  try {\n    parsed = typeof url === 'string' ? new URL(url) : undefined;\n  } catch {\n    parsed = undefined;\n  }\n  if (parsed === undefined || (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')) {\n    throw new TypeError(`${where} must be an http(s) URL (leave it out for none)`);\n  }\n}\n\n/** The config's `email` and every registered template's metadata; throws on the first invalid value. */\nexport function assertEmailConfig(\n  config: { email?: EmailConfig },\n  templates: Iterable<EmailTemplate>\n): void {\n  if (Object.hasOwn(config, 'emails')) {\n    throw new TypeError(\n      \"the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, \" +\n        'and the rest moved to `email: { unsubscribeUrl, tracking }`'\n    );\n  }\n  const email = config.email;\n  if (email !== undefined) {\n    if (email.unsubscribeUrl !== undefined) {\n      assertUnsubscribeUrl(email.unsubscribeUrl, 'email.unsubscribeUrl');\n    }\n    const quick = email.tracking?.quickClickMs;\n    if (\n      quick !== undefined &&\n      !(typeof quick === 'number' && Number.isFinite(quick) && quick >= 0)\n    ) {\n      throw new TypeError('email.tracking.quickClickMs must be a non-negative number');\n    }\n  }\n  for (const template of templates)\n    assertEmailMetadata(template, `email template '${template.id}'`, true);\n}\n\n/**\n * A template's own `from` / `replyTo` / `unsubscribeUrl` and what it is (`topic` or\n * `transactional: true`), as `emailTemplate` checks them — and `compileConfig` again, for a\n * definition that did not come through `emailTemplate`. A declared template carries `topic`\n * (a string, or null for transactional); a definition carries one of the two options.\n */\nexport function assertEmailMetadata(\n  template: {\n    from?: unknown;\n    replyTo?: unknown;\n    unsubscribeUrl?: unknown;\n    topic?: unknown;\n    transactional?: unknown;\n  },\n  where: string,\n  /** True for a declared template (`topic: string | null`), false for `emailTemplate`'s argument. */\n  declared = false\n): void {\n  assertEmailAddress(template.from, `${where}: from`);\n  if (template.replyTo !== undefined) assertEmailAddress(template.replyTo, `${where}: replyTo`);\n  if (template.unsubscribeUrl !== undefined) {\n    assertUnsubscribeUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);\n  }\n  const transactional = assertTemplateTopic(template, where, 'email', declared);\n  if (transactional && template.unsubscribeUrl !== undefined) {\n    throw new TypeError(\n      `${where}: a transactional email has no unsubscribe link, so it takes no 'unsubscribeUrl'`\n    );\n  }\n}\n\n/**\n * What a template is — `topic: <id>` or `transactional: true`, one of the two — as `emailTemplate`\n * and `pushTemplate` check their argument and `compileConfig` checks a declared template (where\n * `topic: null` is transactional). Answers whether the template is transactional. Whether the\n * topic is one the contract declares is `compileConfig`'s check, where the contract is at hand.\n */\nexport function assertTemplateTopic(\n  template: { topic?: unknown; transactional?: unknown },\n  where: string,\n  channel: 'email' | 'push',\n  declared = false\n): boolean {\n  const { topic } = template;\n  // A declared template says `topic: null` for transactional; a definition says `transactional: true`\n  const transactional = template.transactional === true || (declared && topic === null);\n  if (template.transactional !== undefined && template.transactional !== true) {\n    throw new TypeError(\n      `${where}: 'transactional' must be the literal true (leave it out for a topic ${channel})`\n    );\n  }\n  const hasTopic = topic !== undefined && topic !== null;\n  if (hasTopic && (typeof topic !== 'string' || topic.trim() === '')) {\n    throw new TypeError(`${where}: 'topic' must be a topic id the contract declares`);\n  }\n  if (hasTopic && transactional) {\n    throw new TypeError(`${where}: give either 'topic' or 'transactional: true', not both`);\n  }\n  if (!hasTopic && !transactional) {\n    throw new TypeError(\n      `${where}: every ${channel} template says what it is — 'topic: <id>' (one the contract's subscriptions.topics declares) or 'transactional: true'`\n    );\n  }\n  return transactional;\n}\n\n/** The unsubscribe link may carry its own query (a token, a list): the path names it. */\nexport function isUnsubscribeLink(url: string, unsubscribeUrl: string | undefined): boolean {\n  if (unsubscribeUrl === undefined) return false;\n  try {\n    const a = new URL(url);\n    const b = new URL(unsubscribeUrl);\n    return a.origin === b.origin && a.pathname === b.pathname;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;AAiBA,SAAgB,mBAAmB,SAA+B;CAChE,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,OAAO,QAAQ,SAAS,KAAA,IAAY,QAAQ,QAAQ,GAAG,QAAQ,KAAK,IAAI,QAAQ,MAAM;AACxF;AAEA,MAAM,QAAQ;AACd,MAAM,WAAW;;;;;;AAOjB,SAAgB,YAAY,SAA+B;CACzD,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,MAAM,EAAE,OAAO,SAAS;CACxB,IAAI,SAAS,KAAA,KAAa,SAAS,IAAI,OAAO;CAC9C,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG;EACrB,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;EAC3C,IAAI,SAAS;EACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;EAC5D,OAAO,aAAa,KAAK,MAAM,EAAE,MAAM,MAAM;CAC/C;CACA,IAAI,SAAS,KAAK,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,YAAY,MAAM,EAAE,KAAK,MAAM;CAChF,OAAO,GAAG,KAAK,IAAI,MAAM;AAC3B;;;;;AAuCA,SAAgB,aACd,UACA,QACe;CACf,MAAM,iBACJ,SAAS,UAAU,OAAO,KAAA,IAAa,SAAS,kBAAkB,QAAQ;CAC5E,OAAO;EACL,MAAM,SAAS;EACf,OAAO,SAAS;EAChB,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACtE,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe;CAC3D;AACF;AAEA,MAAM,UAAU;;AAGhB,SAAgB,mBAAmB,SAAkB,OAAqB;CACxE,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAAgC,QACjC;CACN,MAAM,OACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAA+B,OAChC,KAAA;CACN,IAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,KAAK,GAClD,MAAM,IAAI,UAAU,GAAG,MAAM,8CAA8C;CAE7E,IAAI,SAAS,KAAA,KAAa,OAAO,SAAS,UACxC,MAAM,IAAI,UAAU,GAAG,MAAM,uBAAuB;AAExD;;AAGA,SAAgB,qBAAqB,KAAc,OAAqB;CACtE,IAAI;CACJ,IAAI;EACF,SAAS,OAAO,QAAQ,WAAW,IAAI,IAAI,GAAG,IAAI,KAAA;CACpD,QAAQ;EACN,SAAS,KAAA;CACX;CACA,IAAI,WAAW,KAAA,KAAc,OAAO,aAAa,YAAY,OAAO,aAAa,SAC/E,MAAM,IAAI,UAAU,GAAG,MAAM,gDAAgD;AAEjF;;AAGA,SAAgB,kBACd,QACA,WACM;CACN,IAAI,OAAO,OAAO,QAAQ,QAAQ,GAChC,MAAM,IAAI,UACR,qJAEF;CAEF,MAAM,QAAQ,OAAO;CACrB,IAAI,UAAU,KAAA,GAAW;EACvB,IAAI,MAAM,mBAAmB,KAAA,GAC3B,qBAAqB,MAAM,gBAAgB,sBAAsB;EAEnE,MAAM,QAAQ,MAAM,UAAU;EAC9B,IACE,UAAU,KAAA,KACV,EAAE,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,SAAS,IAElE,MAAM,IAAI,UAAU,2DAA2D;CAEnF;CACA,KAAK,MAAM,YAAY,WACrB,oBAAoB,UAAU,mBAAmB,SAAS,GAAG,IAAI,IAAI;AACzE;;;;;;;AAQA,SAAgB,oBACd,UAOA,OAEA,WAAW,OACL;CACN,mBAAmB,SAAS,MAAM,GAAG,MAAM,OAAO;CAClD,IAAI,SAAS,YAAY,KAAA,GAAW,mBAAmB,SAAS,SAAS,GAAG,MAAM,UAAU;CAC5F,IAAI,SAAS,mBAAmB,KAAA,GAC9B,qBAAqB,SAAS,gBAAgB,GAAG,MAAM,iBAAiB;CAG1E,IADsB,oBAAoB,UAAU,OAAO,SAAS,QACpD,KAAK,SAAS,mBAAmB,KAAA,GAC/C,MAAM,IAAI,UACR,GAAG,MAAM,iFACX;AAEJ;;;;;;;AAQA,SAAgB,oBACd,UACA,OACA,SACA,WAAW,OACF;CACT,MAAM,EAAE,UAAU;CAElB,MAAM,gBAAgB,SAAS,kBAAkB,QAAS,YAAY,UAAU;CAChF,IAAI,SAAS,kBAAkB,KAAA,KAAa,SAAS,kBAAkB,MACrE,MAAM,IAAI,UACR,GAAG,MAAM,uEAAuE,QAAQ,EAC1F;CAEF,MAAM,WAAW,UAAU,KAAA,KAAa,UAAU;CAClD,IAAI,aAAa,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAC7D,MAAM,IAAI,UAAU,GAAG,MAAM,mDAAmD;CAElF,IAAI,YAAY,eACd,MAAM,IAAI,UAAU,GAAG,MAAM,yDAAyD;CAExF,IAAI,CAAC,YAAY,CAAC,eAChB,MAAM,IAAI,UACR,GAAG,MAAM,UAAU,QAAQ,sHAC7B;CAEF,OAAO;AACT;;AAGA,SAAgB,kBAAkB,KAAa,gBAA6C;CAC1F,IAAI,mBAAmB,KAAA,GAAW,OAAO;CACzC,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,GAAG;EACrB,MAAM,IAAI,IAAI,IAAI,cAAc;EAChC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE;CACnD,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"email.mjs","names":[],"sources":["../src/email.ts"],"sourcesContent":["import type { EmailTemplate } from './templates';\n\n/**\n * Email metadata: who a template's email comes from, where replies go, and the unsubscribe and\n * preference links its layout carries. Each `emailTemplate` declares its own `from` (and\n * `replyTo`, if replies should go elsewhere) and says what it is: a `topic` the recipient may\n * unsubscribe from, or `transactional: true`. A topic email's unsubscribe link is the template's\n * `unsubscribeUrl`, else the config's `email.unsubscribeUrl`, else none; its preferences link is\n * the config's `email.preferencesUrl` with the copy's message id, when the copy has one (reporting\n * on); a transactional email never has either, whatever the config says. `resolveEmail` is that\n * rule, and the sender, the renderer, the Worker's preview and the studio all go through it. No\n * React and no I/O here, so a browser can import it.\n */\n\n/** An address as the transports take it: bare, or with a display name. */\nexport type EmailAddress = string | { email: string; name?: string };\n\n/** `Name <email>`, or the bare address. */\nexport function formatEmailAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  return address.name === undefined ? address.email : `${address.name} <${address.email}>`;\n}\n\nconst ASCII = /^[\\x20-\\x7e]*$/;\nconst SPECIALS = /[()<>[\\]:;@\\\\,.\"]/;\n\n/**\n * An address as a mail API reads it (RFC 5322): a display name with specials is quoted, one\n * outside ASCII is a MIME encoded-word — raw non-ASCII names are refused (SES), and an unquoted\n * comma splits the address in two.\n */\nexport function mimeAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  const { email, name } = address;\n  if (name === undefined || name === '') return email;\n  if (!ASCII.test(name)) {\n    const bytes = new TextEncoder().encode(name);\n    let binary = '';\n    for (const byte of bytes) binary += String.fromCharCode(byte);\n    return `=?UTF-8?B?${btoa(binary)}?= <${email}>`;\n  }\n  if (SPECIALS.test(name)) return `\"${name.replace(/([\"\\\\])/g, '\\\\$1')}\" <${email}>`;\n  return `${name} <${email}>`;\n}\n\n/** The config's `email`: what every email template shares. */\nexport interface EmailConfig {\n  /**\n   * The unsubscribe link of every email template that names none of its own. The layout reads it\n   * with `useEmailContext()`; sent, it is tracked like every link, but following it shows a\n   * confirmation page, and only the confirmation (a POST no link scanner sends) unsubscribes.\n   */\n  unsubscribeUrl?: string;\n  /**\n   * The app's email preference page. A topic email sent with reporting on links to it with the\n   * copy's message id as the `m` query parameter (`useEmailContext().preferencesUrl`), and the\n   * page reads and sets the recipient's subscriptions by that id — no sign-in — through\n   * `GET` / `PUT /subscriptions/by-message/:messageId` (`JourneyClient.getSubscriptionsByMessage`\n   * / `setSubscriptionsByMessage`). Tracked as an ordinary link; it must not share its origin and\n   * path with `unsubscribeUrl`, which would make it the unsubscribe link instead.\n   */\n  preferencesUrl?: string;\n  /** How the Worker tells a person's opens and clicks from a machine's (see the reporting classifier). */\n  tracking?: {\n    /**\n     * An open or click this many milliseconds after delivery is a weak machine signal — machine\n     * only together with another (a second link within seconds); 1000 by default. A person\n     * tapping a mail notification can click within a few seconds, so keep it short.\n     */\n    quickClickMs?: number;\n  };\n}\n\n/** One template's email metadata, resolved against the config. */\nexport interface ResolvedEmail {\n  from: EmailAddress;\n  /** The template's subscription topic; null for a transactional email. */\n  topic: string | null;\n  /** Absent when the template names none: the email goes out without a Reply-To. */\n  replyTo?: EmailAddress;\n  /**\n   * Absent when the email is transactional, or neither the template nor the config names one:\n   * the email has no unsubscribe link.\n   */\n  unsubscribeUrl?: string;\n  /**\n   * The config's `preferencesUrl` with this copy's message id as `m`. Absent when the email is\n   * transactional, the config names no page, or the copy has no message id (reporting off): the\n   * email has no preferences link, and a layout renders none.\n   */\n  preferencesUrl?: string;\n}\n\n/** What a render knows of the copy beyond the template: its message id, when reporting records one. */\nexport interface EmailRenderOptions {\n  /** The copy's id in the reporting tables — what `/t/...` and `/subscriptions/by-message` key on. */\n  messageId?: string | undefined;\n}\n\n/**\n * The message id a preview renders with: the preferences link shows in the studio and\n * `GET /preview`, pointing at a copy that does not exist.\n */\nexport const PREVIEW_MESSAGE_ID = '00000000-0000-0000-0000-000000000000';\n\n/**\n * The template's metadata, its `unsubscribeUrl` falling back to the config's, and the\n * preferences link built from the config's page and the copy's message id — for a topic email; a\n * transactional one resolves to neither link. Leaves the inputs untouched.\n */\nexport function resolveEmail(\n  template: Pick<EmailTemplate, 'from' | 'replyTo' | 'unsubscribeUrl' | 'topic'>,\n  config?: EmailConfig,\n  options: EmailRenderOptions = {}\n): ResolvedEmail {\n  const topical = template.topic !== null;\n  const unsubscribeUrl = topical ? (template.unsubscribeUrl ?? config?.unsubscribeUrl) : undefined;\n  const preferencesUrl =\n    topical && config?.preferencesUrl !== undefined && options.messageId !== undefined\n      ? preferencesLink(config.preferencesUrl, options.messageId)\n      : undefined;\n  return {\n    from: template.from,\n    topic: template.topic,\n    ...(template.replyTo === undefined ? {} : { replyTo: template.replyTo }),\n    ...(unsubscribeUrl === undefined ? {} : { unsubscribeUrl }),\n    ...(preferencesUrl === undefined ? {} : { preferencesUrl }),\n  };\n}\n\n/** The preference page's URL for one copy: `m=<message id>` set on its query, the rest of it kept. */\nexport function preferencesLink(preferencesUrl: string, messageId: string): string {\n  const url = new URL(preferencesUrl);\n  url.searchParams.set('m', messageId);\n  return url.toString();\n}\n\nconst ADDRESS = /^[^\\s@<>]+@[^\\s@<>]+$/;\n\n/** Throws naming `where` when `address` is neither `user@host` nor `{ email: 'user@host', name? }`. */\nexport function assertEmailAddress(address: unknown, where: string): void {\n  const email =\n    typeof address === 'object' && address !== null\n      ? (address as { email?: unknown }).email\n      : address;\n  const name =\n    typeof address === 'object' && address !== null\n      ? (address as { name?: unknown }).name\n      : undefined;\n  if (typeof email !== 'string' || !ADDRESS.test(email)) {\n    throw new TypeError(`${where} must be an email address or { email, name? }`);\n  }\n  if (name !== undefined && typeof name !== 'string') {\n    throw new TypeError(`${where}.name must be a string`);\n  }\n}\n\n/** Throws naming `where` unless `url` is an absolute http(s) URL; '' and null are not a way to leave it out. */\nexport function assertHttpUrl(url: unknown, where: string): void {\n  let parsed: URL | undefined;\n  try {\n    parsed = typeof url === 'string' ? new URL(url) : undefined;\n  } catch {\n    parsed = undefined;\n  }\n  if (parsed === undefined || (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')) {\n    throw new TypeError(`${where} must be an http(s) URL (leave it out for none)`);\n  }\n}\n\n/** `assertHttpUrl`, under its earlier name. */\nexport const assertUnsubscribeUrl: typeof assertHttpUrl = assertHttpUrl;\n\n/** The config's `email` and every registered template's metadata; throws on the first invalid value. */\nexport function assertEmailConfig(\n  config: { email?: EmailConfig },\n  templates: Iterable<EmailTemplate>\n): void {\n  if (Object.hasOwn(config, 'emails')) {\n    throw new TypeError(\n      \"the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, \" +\n        'and the rest moved to `email: { unsubscribeUrl, preferencesUrl, tracking }`'\n    );\n  }\n  const email = config.email;\n  if (email !== undefined) {\n    if (email.unsubscribeUrl !== undefined) {\n      assertHttpUrl(email.unsubscribeUrl, 'email.unsubscribeUrl');\n    }\n    if (email.preferencesUrl !== undefined) {\n      assertHttpUrl(email.preferencesUrl, 'email.preferencesUrl');\n      // The sender tells the unsubscribe link from the others by origin and path: a preference\n      // page at the same address would be tracked as the unsubscribe link and land on `/t/u`\n      if (isUnsubscribeLink(email.preferencesUrl, email.unsubscribeUrl)) {\n        throw new TypeError(\n          'email.preferencesUrl must not share its origin and path with email.unsubscribeUrl: ' +\n            'the sender would track the preferences link as the unsubscribe link'\n        );\n      }\n    }\n    const quick = email.tracking?.quickClickMs;\n    if (\n      quick !== undefined &&\n      !(typeof quick === 'number' && Number.isFinite(quick) && quick >= 0)\n    ) {\n      throw new TypeError('email.tracking.quickClickMs must be a non-negative number');\n    }\n  }\n  for (const template of templates) {\n    const where = `email template '${template.id}'`;\n    assertEmailMetadata(template, where, true);\n    if (\n      email?.preferencesUrl !== undefined &&\n      isUnsubscribeLink(email.preferencesUrl, template.unsubscribeUrl)\n    ) {\n      throw new TypeError(\n        `${where}: its unsubscribeUrl shares its origin and path with email.preferencesUrl, so ` +\n          'the sender would track the preferences link as the unsubscribe link'\n      );\n    }\n  }\n}\n\n/**\n * A template's own `from` / `replyTo` / `unsubscribeUrl` and what it is (`topic` or\n * `transactional: true`), as `emailTemplate` checks them — and `compileConfig` again, for a\n * definition that did not come through `emailTemplate`. A declared template carries `topic`\n * (a string, or null for transactional); a definition carries one of the two options.\n */\nexport function assertEmailMetadata(\n  template: {\n    from?: unknown;\n    replyTo?: unknown;\n    unsubscribeUrl?: unknown;\n    topic?: unknown;\n    transactional?: unknown;\n  },\n  where: string,\n  /** True for a declared template (`topic: string | null`), false for `emailTemplate`'s argument. */\n  declared = false\n): void {\n  assertEmailAddress(template.from, `${where}: from`);\n  if (template.replyTo !== undefined) assertEmailAddress(template.replyTo, `${where}: replyTo`);\n  if (template.unsubscribeUrl !== undefined) {\n    assertHttpUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);\n  }\n  const transactional = assertTemplateTopic(template, where, 'email', declared);\n  if (transactional && template.unsubscribeUrl !== undefined) {\n    throw new TypeError(\n      `${where}: a transactional email has no unsubscribe link, so it takes no 'unsubscribeUrl'`\n    );\n  }\n}\n\n/**\n * What a template is — `topic: <id>` or `transactional: true`, one of the two — as `emailTemplate`\n * and `pushTemplate` check their argument and `compileConfig` checks a declared template (where\n * `topic: null` is transactional). Answers whether the template is transactional. Whether the\n * topic is one the contract declares is `compileConfig`'s check, where the contract is at hand.\n */\nexport function assertTemplateTopic(\n  template: { topic?: unknown; transactional?: unknown },\n  where: string,\n  channel: 'email' | 'push',\n  declared = false\n): boolean {\n  const { topic } = template;\n  // A declared template says `topic: null` for transactional; a definition says `transactional: true`\n  const transactional = template.transactional === true || (declared && topic === null);\n  if (template.transactional !== undefined && template.transactional !== true) {\n    throw new TypeError(\n      `${where}: 'transactional' must be the literal true (leave it out for a topic ${channel})`\n    );\n  }\n  const hasTopic = topic !== undefined && topic !== null;\n  if (hasTopic && (typeof topic !== 'string' || topic.trim() === '')) {\n    throw new TypeError(`${where}: 'topic' must be a topic id the contract declares`);\n  }\n  if (hasTopic && transactional) {\n    throw new TypeError(`${where}: give either 'topic' or 'transactional: true', not both`);\n  }\n  if (!hasTopic && !transactional) {\n    throw new TypeError(\n      `${where}: every ${channel} template says what it is — 'topic: <id>' (one the contract's subscriptions.topics declares) or 'transactional: true'`\n    );\n  }\n  return transactional;\n}\n\n/** The unsubscribe link may carry its own query (a token, a list): the path names it. */\nexport function isUnsubscribeLink(url: string, unsubscribeUrl: string | undefined): boolean {\n  if (unsubscribeUrl === undefined) return false;\n  try {\n    const a = new URL(url);\n    const b = new URL(unsubscribeUrl);\n    return a.origin === b.origin && a.pathname === b.pathname;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;AAkBA,SAAgB,mBAAmB,SAA+B;CAChE,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,OAAO,QAAQ,SAAS,KAAA,IAAY,QAAQ,QAAQ,GAAG,QAAQ,KAAK,IAAI,QAAQ,MAAM;AACxF;AAEA,MAAM,QAAQ;AACd,MAAM,WAAW;;;;;;AAOjB,SAAgB,YAAY,SAA+B;CACzD,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,MAAM,EAAE,OAAO,SAAS;CACxB,IAAI,SAAS,KAAA,KAAa,SAAS,IAAI,OAAO;CAC9C,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG;EACrB,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;EAC3C,IAAI,SAAS;EACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;EAC5D,OAAO,aAAa,KAAK,MAAM,EAAE,MAAM,MAAM;CAC/C;CACA,IAAI,SAAS,KAAK,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,YAAY,MAAM,EAAE,KAAK,MAAM;CAChF,OAAO,GAAG,KAAK,IAAI,MAAM;AAC3B;;;;;AA4DA,MAAa,qBAAqB;;;;;;AAOlC,SAAgB,aACd,UACA,QACA,UAA8B,CAAC,GAChB;CACf,MAAM,UAAU,SAAS,UAAU;CACnC,MAAM,iBAAiB,UAAW,SAAS,kBAAkB,QAAQ,iBAAkB,KAAA;CACvF,MAAM,iBACJ,WAAW,QAAQ,mBAAmB,KAAA,KAAa,QAAQ,cAAc,KAAA,IACrE,gBAAgB,OAAO,gBAAgB,QAAQ,SAAS,IACxD,KAAA;CACN,OAAO;EACL,MAAM,SAAS;EACf,OAAO,SAAS;EAChB,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACtE,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe;EACzD,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe;CAC3D;AACF;;AAGA,SAAgB,gBAAgB,gBAAwB,WAA2B;CACjF,MAAM,MAAM,IAAI,IAAI,cAAc;CAClC,IAAI,aAAa,IAAI,KAAK,SAAS;CACnC,OAAO,IAAI,SAAS;AACtB;AAEA,MAAM,UAAU;;AAGhB,SAAgB,mBAAmB,SAAkB,OAAqB;CACxE,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAAgC,QACjC;CACN,MAAM,OACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAA+B,OAChC,KAAA;CACN,IAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,KAAK,GAClD,MAAM,IAAI,UAAU,GAAG,MAAM,8CAA8C;CAE7E,IAAI,SAAS,KAAA,KAAa,OAAO,SAAS,UACxC,MAAM,IAAI,UAAU,GAAG,MAAM,uBAAuB;AAExD;;AAGA,SAAgB,cAAc,KAAc,OAAqB;CAC/D,IAAI;CACJ,IAAI;EACF,SAAS,OAAO,QAAQ,WAAW,IAAI,IAAI,GAAG,IAAI,KAAA;CACpD,QAAQ;EACN,SAAS,KAAA;CACX;CACA,IAAI,WAAW,KAAA,KAAc,OAAO,aAAa,YAAY,OAAO,aAAa,SAC/E,MAAM,IAAI,UAAU,GAAG,MAAM,gDAAgD;AAEjF;;AAGA,MAAa,uBAA6C;;AAG1D,SAAgB,kBACd,QACA,WACM;CACN,IAAI,OAAO,OAAO,QAAQ,QAAQ,GAChC,MAAM,IAAI,UACR,qKAEF;CAEF,MAAM,QAAQ,OAAO;CACrB,IAAI,UAAU,KAAA,GAAW;EACvB,IAAI,MAAM,mBAAmB,KAAA,GAC3B,cAAc,MAAM,gBAAgB,sBAAsB;EAE5D,IAAI,MAAM,mBAAmB,KAAA,GAAW;GACtC,cAAc,MAAM,gBAAgB,sBAAsB;GAG1D,IAAI,kBAAkB,MAAM,gBAAgB,MAAM,cAAc,GAC9D,MAAM,IAAI,UACR,wJAEF;EAEJ;EACA,MAAM,QAAQ,MAAM,UAAU;EAC9B,IACE,UAAU,KAAA,KACV,EAAE,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,SAAS,IAElE,MAAM,IAAI,UAAU,2DAA2D;CAEnF;CACA,KAAK,MAAM,YAAY,WAAW;EAChC,MAAM,QAAQ,mBAAmB,SAAS,GAAG;EAC7C,oBAAoB,UAAU,OAAO,IAAI;EACzC,IACE,OAAO,mBAAmB,KAAA,KAC1B,kBAAkB,MAAM,gBAAgB,SAAS,cAAc,GAE/D,MAAM,IAAI,UACR,GAAG,MAAM,kJAEX;CAEJ;AACF;;;;;;;AAQA,SAAgB,oBACd,UAOA,OAEA,WAAW,OACL;CACN,mBAAmB,SAAS,MAAM,GAAG,MAAM,OAAO;CAClD,IAAI,SAAS,YAAY,KAAA,GAAW,mBAAmB,SAAS,SAAS,GAAG,MAAM,UAAU;CAC5F,IAAI,SAAS,mBAAmB,KAAA,GAC9B,cAAc,SAAS,gBAAgB,GAAG,MAAM,iBAAiB;CAGnE,IADsB,oBAAoB,UAAU,OAAO,SAAS,QACpD,KAAK,SAAS,mBAAmB,KAAA,GAC/C,MAAM,IAAI,UACR,GAAG,MAAM,iFACX;AAEJ;;;;;;;AAQA,SAAgB,oBACd,UACA,OACA,SACA,WAAW,OACF;CACT,MAAM,EAAE,UAAU;CAElB,MAAM,gBAAgB,SAAS,kBAAkB,QAAS,YAAY,UAAU;CAChF,IAAI,SAAS,kBAAkB,KAAA,KAAa,SAAS,kBAAkB,MACrE,MAAM,IAAI,UACR,GAAG,MAAM,uEAAuE,QAAQ,EAC1F;CAEF,MAAM,WAAW,UAAU,KAAA,KAAa,UAAU;CAClD,IAAI,aAAa,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAC7D,MAAM,IAAI,UAAU,GAAG,MAAM,mDAAmD;CAElF,IAAI,YAAY,eACd,MAAM,IAAI,UAAU,GAAG,MAAM,yDAAyD;CAExF,IAAI,CAAC,YAAY,CAAC,eAChB,MAAM,IAAI,UACR,GAAG,MAAM,UAAU,QAAQ,sHAC7B;CAEF,OAAO;AACT;;AAGA,SAAgB,kBAAkB,KAAa,gBAA6C;CAC1F,IAAI,mBAAmB,KAAA,GAAW,OAAO;CACzC,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,GAAG;EACrB,MAAM,IAAI,IAAI,IAAI,cAAc;EAChC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE;CACnD,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/engine/ports.d.cts

@@ -122,6 +122,12 @@ export type LinkPurpose = 'link' | 'unsubscribe';
  * Each is optional, and a sender ignores what its channel has no use for.
  */
 export interface MessageTracking {
+  /**
+   * The copy's id in the reporting tables: what its tracking URLs name, and what an email's
+   * preferences link carries (`email.preferencesUrl`), so the app's page can read the recipient's
+   * subscriptions by it. The email sender hands it to the renderer.
+   */
+  messageId?: string;
   /**
    * The original `http(s)` URL in, the URL that records the click and redirects out — or, for the
    * email's unsubscribe link, asks the recipient to confirm.

package/dist/engine/ports.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;;EAMf;;;;;EAKA,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/engine/ports.d.mts

@@ -122,6 +122,12 @@ export type LinkPurpose = 'link' | 'unsubscribe';
  * Each is optional, and a sender ignores what its channel has no use for.
  */
 export interface MessageTracking {
+  /**
+   * The copy's id in the reporting tables: what its tracking URLs name, and what an email's
+   * preferences link carries (`email.preferencesUrl`), so the app's page can read the recipient's
+   * subscriptions by it. The email sender hands it to the renderer.
+   */
+  messageId?: string;
   /**
    * The original `http(s)` URL in, the URL that records the click and redirects out — or, for the
    * email's unsubscribe link, asks the recipient to confirm.

package/dist/engine/ports.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;;EAMf;;;;;EAKA,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/host/http.cjs

@@ -1,12 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_store_erasure = require("../store/erasure.cjs");
 const require_store_index = require("../store/index.cjs");
 const require_host_ingest = require("./ingest.cjs");
+const require_email = require("../email.cjs");
 const require_templates = require("../templates.cjs");
 const require_contract = require("../contract.cjs");
 const require_host_channels = require("./channels.cjs");
-const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_host_auth = require("./auth.cjs");
 let zod_mini = require("zod/mini");
 zod_mini = require_runtime.__toESM(zod_mini, 1);
@@ -79,6 +80,14 @@ function declaredTopics(ctx) {
 }
 const SUBSCRIPTIONS = /^\/subscriptions\/[^/]+$/;
 const subscriptionsUser = (url) => decodeURIComponent(url.pathname.slice(15));
+/**
+* The same record, reached by one of the user's copies instead of their id: for the app's
+* preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The
+* message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still
+* guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.
+*/
+const SUBSCRIPTIONS_BY_MESSAGE = /^\/subscriptions\/by-message\/[^/]+$/;
+const subscriptionsMessage = (url) => decodeURIComponent(url.pathname.slice(26));
 const routes = [
 	{
 		method: "GET",
@@ -219,6 +228,32 @@ const routes = [
 			return json(await require_host_ingest.setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));
 		}
 	},
+	{
+		method: "GET",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const found = await require_host_ingest.getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
+	{
+		method: "PUT",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const topics = declaredTopics(ctx);
+			const parsed = require_host_ingest.parseSubscriptionsPatch(await readJson(ctx.request), topics);
+			if (!parsed.ok) return json({
+				error: "subscriptions refused",
+				issues: parsed.issues
+			}, 400);
+			const found = await require_host_ingest.setSubscriptionsByMessage(ctx.env, ctx.store, messageId, parsed.patch, topics);
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
 	{
 		method: "POST",
 		path: "/users/forget",
@@ -278,7 +313,7 @@ const routes = [
 				return json({ error: "props must be a JSON object" }, 400);
 			}
 			if (!isPlainObject(props)) return json({ error: "props must be a JSON object" }, 400);
-			const { subject, html } = await preview.render(key, props);
+			const { subject, html } = await preview.render(key, props, { messageId: require_email.PREVIEW_MESSAGE_ID });
 			return new Response(html, { headers: {
 				"content-type": "text/html; charset=utf-8",
 				"x-subject": encodeURIComponent(subject)
@@ -359,7 +394,7 @@ async function serve(request, ctx) {
 		return failure(error);
 	}
 }
-/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/users/forget`, `/deploy`. */
+/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */
 function handleRequest(request, env, store, validation = {}) {
 	return serve(request, {
 		env,

package/dist/host/http.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"http.cjs","names":["handleTracking","checkEvent","ingestEvent","identifyUser","registerDevice","unbindDevice","removeDevice","recordPushOpen","getSubscriptions","parseSubscriptionsPatch","setSubscriptions","forgetUser","deployBundle","journeyMode","authorized","z","BundleIntegrityError","TemplateValidationError","UserErasedError","SchemaMismatchError"],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  UserErasedError,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  getSubscriptions,\n  identifyUser,\n  ingestEvent,\n  parseSubscriptionsPatch,\n  registerDevice,\n  removeDevice,\n  setSubscriptions,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | 'PUT' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */\nfunction isScalarOrNull(value: unknown): value is string | number | boolean | null {\n  return (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  );\n}\n\n/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */\nconst TS_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst TS_ERROR = 'ts must be a non-negative integer no later than 5 minutes in the future';\n\n/**\n * A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.\n * A far-future ts would put the event ahead of everything a window condition reads, and a\n * fractional or unsafe one does not survive the store.\n */\nfunction isValidTs(ts: unknown): ts is number {\n  return (\n    typeof ts === 'number' &&\n    Number.isSafeInteger(ts) &&\n    ts >= 0 &&\n    ts <= Date.now() + TS_FUTURE_TOLERANCE_MS\n  );\n}\n\n/** The contract's verdict: the value to use, or the response refusing the request. */\nfunction checked<T>(\n  validation: IngestValidation,\n  result: ContractResult<T>,\n  original: T,\n  what: string\n): { value: T } | { refused: Response } {\n  if (result.ok) return { value: result.data };\n  const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n  if (validation.mode === 'report') {\n    console.warn(`[workflow http] contract would refuse ${what}: ${issues.join('; ')}`);\n    return { value: original };\n  }\n  return {\n    refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n  };\n}\n\n/**\n * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the\n * contract's when the bare API runs without a host — never the caller's.\n */\nfunction declaredTopics(ctx: Pick<RouteContext, 'host' | 'validation'>): readonly string[] {\n  return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];\n}\n\nconst SUBSCRIPTIONS = /^\\/subscriptions\\/[^/]+$/;\nconst subscriptionsUser = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/'.length));\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/events',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          checkEvent(validation.contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/identify',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      // Profiles hold scalars only (both stores merge at the top level; a nested object would\n      // be merged differently by each): refused here, contract or not\n      if (!Object.values(props).every(isScalarOrNull)) {\n        return json(\n          { error: 'props values must be scalars (string, number, boolean) or null' },\n          400\n        );\n      }\n      let patch = props as ProfileProps;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          validation.contract.parseProfilePatch(props),\n          patch,\n          'identify'\n        );\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      const device = { userId, token, platform, ...(ts === undefined ? {} : { ts }) };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      return json(await getSubscriptions(ctx.store, userId, declaredTopics(ctx)));\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      return json(await deployBundle(env, host.bundle(), store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>);\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (ctx.host !== undefined && refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;;;;AA4FA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;;AAGA,SAAS,eAAe,OAA2D;CACjF,OACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AAErB;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,WAAW;;;;;;AAOjB,SAAS,UAAU,IAA2B;CAC5C,OACE,OAAO,OAAO,YACd,OAAO,cAAc,EAAE,KACvB,MAAM,KACN,MAAM,KAAK,IAAI,IAAI;AAEvB;;AAGA,SAAS,QACP,YACA,QACA,UACA,MACsC;CACtC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;CAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;CAC7E,IAAI,WAAW,SAAS,UAAU;EAChC,QAAQ,KAAK,yCAAyC,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;EAClF,OAAO,EAAE,OAAO,SAAS;CAC3B;CACA,OAAO,EACL,SAAS,KAAK;EAAE,OAAO,GAAG,KAAK;EAA2B,QAAQ,OAAO;CAAO,GAAG,GAAG,EACxF;AACF;;;;;AAMA,SAAS,eAAe,KAAmE;CACzF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,eAAe,UAAU,IAAI,WAAW,UAAU,UAAU,CAAC;AAC1F;AAEA,MAAM,gBAAgB;AACtB,MAAM,qBAAqB,QACzB,mBAAmB,IAAI,SAAS,MAAM,EAAwB,CAAC;AAIjE,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAMA,2BAAAA,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACAC,iBAAAA,WAAW,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACpD,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAMC,oBAAAA,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAGhF,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,cAAc,GAC5C,OAAO,KACL,EAAE,OAAO,iEAAiE,GAC1E,GACF;GAEF,IAAI,QAAQ;GACZ,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,SAAS,kBAAkB,KAAK,GAC3C,OACA,UACF;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,MAAM,SAAS;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG;GAC9E,OAAO,KAAK,MAAMC,oBAAAA,eAAe,KAAK,QAAQ,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,OAAO,QAAQ,eAAe,GAAG,CAAC,CAAC;EAC5E;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASC,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,OAAO,MAAM,CAAC;EACtF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAMC,oBAAAA,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAC/C,OAAO,KAAK,MAAMA,oBAAAA,aAAa,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GACpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,KAAiC;GAGrF,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtBC,sBAAAA,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAOC,kBAAAA,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,oBAAAA,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,sBAAAA,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiBC,oBAAAA,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,IAAI,SAAS,KAAA,KAAa,YAAY,SAAS,KAAK,IAAI,QAAQ,GAClE,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}
+{"version":3,"file":"http.cjs","names":["handleTracking","checkEvent","ingestEvent","identifyUser","registerDevice","unbindDevice","removeDevice","recordPushOpen","getSubscriptions","parseSubscriptionsPatch","setSubscriptions","getSubscriptionsByMessage","setSubscriptionsByMessage","forgetUser","deployBundle","PREVIEW_MESSAGE_ID","journeyMode","authorized","z","BundleIntegrityError","TemplateValidationError","UserErasedError","SchemaMismatchError"],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport { PREVIEW_MESSAGE_ID } from '../email';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  UserErasedError,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  getSubscriptions,\n  getSubscriptionsByMessage,\n  identifyUser,\n  ingestEvent,\n  parseSubscriptionsPatch,\n  registerDevice,\n  removeDevice,\n  setSubscriptions,\n  setSubscriptionsByMessage,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | 'PUT' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */\nfunction isScalarOrNull(value: unknown): value is string | number | boolean | null {\n  return (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  );\n}\n\n/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */\nconst TS_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst TS_ERROR = 'ts must be a non-negative integer no later than 5 minutes in the future';\n\n/**\n * A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.\n * A far-future ts would put the event ahead of everything a window condition reads, and a\n * fractional or unsafe one does not survive the store.\n */\nfunction isValidTs(ts: unknown): ts is number {\n  return (\n    typeof ts === 'number' &&\n    Number.isSafeInteger(ts) &&\n    ts >= 0 &&\n    ts <= Date.now() + TS_FUTURE_TOLERANCE_MS\n  );\n}\n\n/** The contract's verdict: the value to use, or the response refusing the request. */\nfunction checked<T>(\n  validation: IngestValidation,\n  result: ContractResult<T>,\n  original: T,\n  what: string\n): { value: T } | { refused: Response } {\n  if (result.ok) return { value: result.data };\n  const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n  if (validation.mode === 'report') {\n    console.warn(`[workflow http] contract would refuse ${what}: ${issues.join('; ')}`);\n    return { value: original };\n  }\n  return {\n    refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n  };\n}\n\n/**\n * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the\n * contract's when the bare API runs without a host — never the caller's.\n */\nfunction declaredTopics(ctx: Pick<RouteContext, 'host' | 'validation'>): readonly string[] {\n  return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];\n}\n\nconst SUBSCRIPTIONS = /^\\/subscriptions\\/[^/]+$/;\nconst subscriptionsUser = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/'.length));\n/**\n * The same record, reached by one of the user's copies instead of their id: for the app's\n * preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The\n * message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still\n * guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.\n */\nconst SUBSCRIPTIONS_BY_MESSAGE = /^\\/subscriptions\\/by-message\\/[^/]+$/;\nconst subscriptionsMessage = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/by-message/'.length));\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/events',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          checkEvent(validation.contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/identify',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      // Profiles hold scalars only (both stores merge at the top level; a nested object would\n      // be merged differently by each): refused here, contract or not\n      if (!Object.values(props).every(isScalarOrNull)) {\n        return json(\n          { error: 'props values must be scalars (string, number, boolean) or null' },\n          400\n        );\n      }\n      let patch = props as ProfileProps;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          validation.contract.parseProfilePatch(props),\n          patch,\n          'identify'\n        );\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      const device = { userId, token, platform, ...(ts === undefined ? {} : { ts }) };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      return json(await getSubscriptions(ctx.store, userId, declaredTopics(ctx)));\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const found = await getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      const found = await setSubscriptionsByMessage(\n        ctx.env,\n        ctx.store,\n        messageId,\n        parsed.patch,\n        topics\n      );\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      return json(await deployBundle(env, host.bundle(), store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      // A preview is no copy, but it shows the footer a sent one has: the preferences link\n      // renders with a placeholder message id\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>, {\n        messageId: PREVIEW_MESSAGE_ID,\n      });\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (ctx.host !== undefined && refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;;;;;AA+FA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;;AAGA,SAAS,eAAe,OAA2D;CACjF,OACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AAErB;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,WAAW;;;;;;AAOjB,SAAS,UAAU,IAA2B;CAC5C,OACE,OAAO,OAAO,YACd,OAAO,cAAc,EAAE,KACvB,MAAM,KACN,MAAM,KAAK,IAAI,IAAI;AAEvB;;AAGA,SAAS,QACP,YACA,QACA,UACA,MACsC;CACtC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;CAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;CAC7E,IAAI,WAAW,SAAS,UAAU;EAChC,QAAQ,KAAK,yCAAyC,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;EAClF,OAAO,EAAE,OAAO,SAAS;CAC3B;CACA,OAAO,EACL,SAAS,KAAK;EAAE,OAAO,GAAG,KAAK;EAA2B,QAAQ,OAAO;CAAO,GAAG,GAAG,EACxF;AACF;;;;;AAMA,SAAS,eAAe,KAAmE;CACzF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,eAAe,UAAU,IAAI,WAAW,UAAU,UAAU,CAAC;AAC1F;AAEA,MAAM,gBAAgB;AACtB,MAAM,qBAAqB,QACzB,mBAAmB,IAAI,SAAS,MAAM,EAAwB,CAAC;;;;;;;AAOjE,MAAM,2BAA2B;AACjC,MAAM,wBAAwB,QAC5B,mBAAmB,IAAI,SAAS,MAAM,EAAmC,CAAC;AAI5E,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAMA,2BAAAA,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACAC,iBAAAA,WAAW,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACpD,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAMC,oBAAAA,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAGhF,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,cAAc,GAC5C,OAAO,KACL,EAAE,OAAO,iEAAiE,GAC1E,GACF;GAEF,IAAI,QAAQ;GACZ,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,SAAS,kBAAkB,KAAK,GAC3C,OACA,UACF;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,MAAM,SAAS;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG;GAC9E,OAAO,KAAK,MAAMC,oBAAAA,eAAe,KAAK,QAAQ,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,OAAO,QAAQ,eAAe,GAAG,CAAC,CAAC;EAC5E;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASC,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,OAAO,MAAM,CAAC;EACtF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,QAAQ,MAAMC,oBAAAA,0BAA0B,IAAI,OAAO,WAAW,eAAe,GAAG,CAAC;GACvF,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASF,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,MAAM,QAAQ,MAAMG,oBAAAA,0BAClB,IAAI,KACJ,IAAI,OACJ,WACA,OAAO,OACP,MACF;GACA,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAMC,oBAAAA,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAC/C,OAAO,KAAK,MAAMA,oBAAAA,aAAa,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAGpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,OAAmC,EACrF,WAAWC,cAAAA,mBACb,CAAC;GAGD,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtBC,sBAAAA,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAOC,kBAAAA,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,oBAAAA,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,sBAAAA,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiBC,oBAAAA,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,IAAI,SAAS,KAAA,KAAa,YAAY,SAAS,KAAK,IAAI,QAAQ,GAClE,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}

package/dist/host/http.d.cts

@@ -51,6 +51,6 @@ export interface ServeContext {
 }
 /** One request through the table: the production gate, the bearer, the route, the error mapping. */
 export declare function serve(request: Request, ctx: ServeContext): Promise<Response>;
-/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/users/forget`, `/deploy`. */
+/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */
 export declare function handleRequest(request: Request, env: JourneyEnv, store: JourneyStore, validation?: IngestValidation): Promise<Response>;
 //# sourceMappingURL=http.d.cts.map

package/dist/host/http.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.cts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA2CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBAiZF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}
+{"version":3,"file":"http.d.cts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA8CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBA2bF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}

package/dist/host/http.d.mts

@@ -51,6 +51,6 @@ export interface ServeContext {
 }
 /** One request through the table: the production gate, the bearer, the route, the error mapping. */
 export declare function serve(request: Request, ctx: ServeContext): Promise<Response>;
-/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/users/forget`, `/deploy`. */
+/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */
 export declare function handleRequest(request: Request, env: JourneyEnv, store: JourneyStore, validation?: IngestValidation): Promise<Response>;
 //# sourceMappingURL=http.d.mts.map

package/dist/host/http.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.mts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA2CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBAiZF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}
+{"version":3,"file":"http.d.mts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA8CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBA2bF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}

package/dist/host/http.mjs

@@ -1,10 +1,11 @@
+import { handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
 import { UserErasedError } from "../store/erasure.mjs";
 import { SchemaMismatchError } from "../store/index.mjs";
-import { BundleIntegrityError, deployBundle, forgetUser, getSubscriptions, identifyUser, ingestEvent, parseSubscriptionsPatch, registerDevice, removeDevice, setSubscriptions, unbindDevice } from "./ingest.mjs";
+import { BundleIntegrityError, deployBundle, forgetUser, getSubscriptions, getSubscriptionsByMessage, identifyUser, ingestEvent, parseSubscriptionsPatch, registerDevice, removeDevice, setSubscriptions, setSubscriptionsByMessage, unbindDevice } from "./ingest.mjs";
+import { PREVIEW_MESSAGE_ID } from "../email.mjs";
 import { TemplateValidationError } from "../templates.mjs";
 import { checkEvent } from "../contract.mjs";
 import { journeyMode } from "./channels.mjs";
-import { handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
 import { authorized } from "./auth.mjs";
 import * as z from "zod/mini";
 // src/host/http.ts
@@ -76,6 +77,14 @@ function declaredTopics(ctx) {
 }
 const SUBSCRIPTIONS = /^\/subscriptions\/[^/]+$/;
 const subscriptionsUser = (url) => decodeURIComponent(url.pathname.slice(15));
+/**
+* The same record, reached by one of the user's copies instead of their id: for the app's
+* preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The
+* message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still
+* guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.
+*/
+const SUBSCRIPTIONS_BY_MESSAGE = /^\/subscriptions\/by-message\/[^/]+$/;
+const subscriptionsMessage = (url) => decodeURIComponent(url.pathname.slice(26));
 const routes = [
 	{
 		method: "GET",
@@ -216,6 +225,32 @@ const routes = [
 			return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));
 		}
 	},
+	{
+		method: "GET",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const found = await getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
+	{
+		method: "PUT",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const topics = declaredTopics(ctx);
+			const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);
+			if (!parsed.ok) return json({
+				error: "subscriptions refused",
+				issues: parsed.issues
+			}, 400);
+			const found = await setSubscriptionsByMessage(ctx.env, ctx.store, messageId, parsed.patch, topics);
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
 	{
 		method: "POST",
 		path: "/users/forget",
@@ -275,7 +310,7 @@ const routes = [
 				return json({ error: "props must be a JSON object" }, 400);
 			}
 			if (!isPlainObject(props)) return json({ error: "props must be a JSON object" }, 400);
-			const { subject, html } = await preview.render(key, props);
+			const { subject, html } = await preview.render(key, props, { messageId: PREVIEW_MESSAGE_ID });
 			return new Response(html, { headers: {
 				"content-type": "text/html; charset=utf-8",
 				"x-subject": encodeURIComponent(subject)
@@ -356,7 +391,7 @@ async function serve(request, ctx) {
 		return failure(error);
 	}
 }
-/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/users/forget`, `/deploy`. */
+/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */
 function handleRequest(request, env, store, validation = {}) {
 	return serve(request, {
 		env,