@shware/workflow 6.0.0 → 6.1.0

package/dist/host/http.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"http.mjs","names":[],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  UserErasedError,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  getSubscriptions,\n  identifyUser,\n  ingestEvent,\n  parseSubscriptionsPatch,\n  registerDevice,\n  removeDevice,\n  setSubscriptions,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | 'PUT' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */\nfunction isScalarOrNull(value: unknown): value is string | number | boolean | null {\n  return (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  );\n}\n\n/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */\nconst TS_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst TS_ERROR = 'ts must be a non-negative integer no later than 5 minutes in the future';\n\n/**\n * A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.\n * A far-future ts would put the event ahead of everything a window condition reads, and a\n * fractional or unsafe one does not survive the store.\n */\nfunction isValidTs(ts: unknown): ts is number {\n  return (\n    typeof ts === 'number' &&\n    Number.isSafeInteger(ts) &&\n    ts >= 0 &&\n    ts <= Date.now() + TS_FUTURE_TOLERANCE_MS\n  );\n}\n\n/** The contract's verdict: the value to use, or the response refusing the request. */\nfunction checked<T>(\n  validation: IngestValidation,\n  result: ContractResult<T>,\n  original: T,\n  what: string\n): { value: T } | { refused: Response } {\n  if (result.ok) return { value: result.data };\n  const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n  if (validation.mode === 'report') {\n    console.warn(`[workflow http] contract would refuse ${what}: ${issues.join('; ')}`);\n    return { value: original };\n  }\n  return {\n    refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n  };\n}\n\n/**\n * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the\n * contract's when the bare API runs without a host — never the caller's.\n */\nfunction declaredTopics(ctx: Pick<RouteContext, 'host' | 'validation'>): readonly string[] {\n  return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];\n}\n\nconst SUBSCRIPTIONS = /^\\/subscriptions\\/[^/]+$/;\nconst subscriptionsUser = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/'.length));\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/events',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          checkEvent(validation.contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/identify',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      // Profiles hold scalars only (both stores merge at the top level; a nested object would\n      // be merged differently by each): refused here, contract or not\n      if (!Object.values(props).every(isScalarOrNull)) {\n        return json(\n          { error: 'props values must be scalars (string, number, boolean) or null' },\n          400\n        );\n      }\n      let patch = props as ProfileProps;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          validation.contract.parseProfilePatch(props),\n          patch,\n          'identify'\n        );\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      const device = { userId, token, platform, ...(ts === undefined ? {} : { ts }) };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      return json(await getSubscriptions(ctx.store, userId, declaredTopics(ctx)));\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      return json(await deployBundle(env, host.bundle(), store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>);\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (ctx.host !== undefined && refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;AA4FA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;;AAGA,SAAS,eAAe,OAA2D;CACjF,OACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AAErB;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,WAAW;;;;;;AAOjB,SAAS,UAAU,IAA2B;CAC5C,OACE,OAAO,OAAO,YACd,OAAO,cAAc,EAAE,KACvB,MAAM,KACN,MAAM,KAAK,IAAI,IAAI;AAEvB;;AAGA,SAAS,QACP,YACA,QACA,UACA,MACsC;CACtC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;CAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;CAC7E,IAAI,WAAW,SAAS,UAAU;EAChC,QAAQ,KAAK,yCAAyC,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;EAClF,OAAO,EAAE,OAAO,SAAS;CAC3B;CACA,OAAO,EACL,SAAS,KAAK;EAAE,OAAO,GAAG,KAAK;EAA2B,QAAQ,OAAO;CAAO,GAAG,GAAG,EACxF;AACF;;;;;AAMA,SAAS,eAAe,KAAmE;CACzF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,eAAe,UAAU,IAAI,WAAW,UAAU,UAAU,CAAC;AAC1F;AAEA,MAAM,gBAAgB;AACtB,MAAM,qBAAqB,QACzB,mBAAmB,IAAI,SAAS,MAAM,EAAwB,CAAC;AAIjE,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAM,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACpD,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAM,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAGhF,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,cAAc,GAC5C,OAAO,KACL,EAAE,OAAO,iEAAiE,GAC1E,GACF;GAEF,IAAI,QAAQ;GACZ,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,SAAS,kBAAkB,KAAK,GAC3C,OACA,UACF;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAM,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,MAAM,SAAS;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG;GAC9E,OAAO,KAAK,MAAM,eAAe,KAAK,QAAQ,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAM,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,OAAO,KAAK,MAAM,iBAAiB,IAAI,OAAO,QAAQ,eAAe,GAAG,CAAC,CAAC;EAC5E;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAAS,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,OAAO,KAAK,MAAM,iBAAiB,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,OAAO,MAAM,CAAC;EACtF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAM,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAM,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAC/C,OAAO,KAAK,MAAM,aAAa,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GACpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,KAAiC;GAGrF,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtB,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAO,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiB,EAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiB,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiB,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiB,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiB,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,IAAI,SAAS,KAAA,KAAa,YAAY,SAAS,KAAK,IAAI,QAAQ,GAClE,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}
+{"version":3,"file":"http.mjs","names":[],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport { PREVIEW_MESSAGE_ID } from '../email';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  UserErasedError,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  getSubscriptions,\n  getSubscriptionsByMessage,\n  identifyUser,\n  ingestEvent,\n  parseSubscriptionsPatch,\n  registerDevice,\n  removeDevice,\n  setSubscriptions,\n  setSubscriptionsByMessage,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | 'PUT' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */\nfunction isScalarOrNull(value: unknown): value is string | number | boolean | null {\n  return (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  );\n}\n\n/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */\nconst TS_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst TS_ERROR = 'ts must be a non-negative integer no later than 5 minutes in the future';\n\n/**\n * A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.\n * A far-future ts would put the event ahead of everything a window condition reads, and a\n * fractional or unsafe one does not survive the store.\n */\nfunction isValidTs(ts: unknown): ts is number {\n  return (\n    typeof ts === 'number' &&\n    Number.isSafeInteger(ts) &&\n    ts >= 0 &&\n    ts <= Date.now() + TS_FUTURE_TOLERANCE_MS\n  );\n}\n\n/** The contract's verdict: the value to use, or the response refusing the request. */\nfunction checked<T>(\n  validation: IngestValidation,\n  result: ContractResult<T>,\n  original: T,\n  what: string\n): { value: T } | { refused: Response } {\n  if (result.ok) return { value: result.data };\n  const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n  if (validation.mode === 'report') {\n    console.warn(`[workflow http] contract would refuse ${what}: ${issues.join('; ')}`);\n    return { value: original };\n  }\n  return {\n    refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n  };\n}\n\n/**\n * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the\n * contract's when the bare API runs without a host — never the caller's.\n */\nfunction declaredTopics(ctx: Pick<RouteContext, 'host' | 'validation'>): readonly string[] {\n  return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];\n}\n\nconst SUBSCRIPTIONS = /^\\/subscriptions\\/[^/]+$/;\nconst subscriptionsUser = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/'.length));\n/**\n * The same record, reached by one of the user's copies instead of their id: for the app's\n * preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The\n * message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still\n * guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.\n */\nconst SUBSCRIPTIONS_BY_MESSAGE = /^\\/subscriptions\\/by-message\\/[^/]+$/;\nconst subscriptionsMessage = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/by-message/'.length));\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/events',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          checkEvent(validation.contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/identify',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      // Profiles hold scalars only (both stores merge at the top level; a nested object would\n      // be merged differently by each): refused here, contract or not\n      if (!Object.values(props).every(isScalarOrNull)) {\n        return json(\n          { error: 'props values must be scalars (string, number, boolean) or null' },\n          400\n        );\n      }\n      let patch = props as ProfileProps;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          validation.contract.parseProfilePatch(props),\n          patch,\n          'identify'\n        );\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      const device = { userId, token, platform, ...(ts === undefined ? {} : { ts }) };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      return json(await getSubscriptions(ctx.store, userId, declaredTopics(ctx)));\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const found = await getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      const found = await setSubscriptionsByMessage(\n        ctx.env,\n        ctx.store,\n        messageId,\n        parsed.patch,\n        topics\n      );\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      return json(await deployBundle(env, host.bundle(), store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      // A preview is no copy, but it shows the footer a sent one has: the preferences link\n      // renders with a placeholder message id\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>, {\n        messageId: PREVIEW_MESSAGE_ID,\n      });\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (ctx.host !== undefined && refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;;AA+FA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;;AAGA,SAAS,eAAe,OAA2D;CACjF,OACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AAErB;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,WAAW;;;;;;AAOjB,SAAS,UAAU,IAA2B;CAC5C,OACE,OAAO,OAAO,YACd,OAAO,cAAc,EAAE,KACvB,MAAM,KACN,MAAM,KAAK,IAAI,IAAI;AAEvB;;AAGA,SAAS,QACP,YACA,QACA,UACA,MACsC;CACtC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;CAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;CAC7E,IAAI,WAAW,SAAS,UAAU;EAChC,QAAQ,KAAK,yCAAyC,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;EAClF,OAAO,EAAE,OAAO,SAAS;CAC3B;CACA,OAAO,EACL,SAAS,KAAK;EAAE,OAAO,GAAG,KAAK;EAA2B,QAAQ,OAAO;CAAO,GAAG,GAAG,EACxF;AACF;;;;;AAMA,SAAS,eAAe,KAAmE;CACzF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,eAAe,UAAU,IAAI,WAAW,UAAU,UAAU,CAAC;AAC1F;AAEA,MAAM,gBAAgB;AACtB,MAAM,qBAAqB,QACzB,mBAAmB,IAAI,SAAS,MAAM,EAAwB,CAAC;;;;;;;AAOjE,MAAM,2BAA2B;AACjC,MAAM,wBAAwB,QAC5B,mBAAmB,IAAI,SAAS,MAAM,EAAmC,CAAC;AAI5E,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAM,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACpD,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAM,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAGhF,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,cAAc,GAC5C,OAAO,KACL,EAAE,OAAO,iEAAiE,GAC1E,GACF;GAEF,IAAI,QAAQ;GACZ,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,SAAS,kBAAkB,KAAK,GAC3C,OACA,UACF;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAM,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,MAAM,SAAS;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG;GAC9E,OAAO,KAAK,MAAM,eAAe,KAAK,QAAQ,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAM,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAM,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,OAAO,KAAK,MAAM,iBAAiB,IAAI,OAAO,QAAQ,eAAe,GAAG,CAAC,CAAC;EAC5E;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAAS,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,OAAO,KAAK,MAAM,iBAAiB,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,OAAO,MAAM,CAAC;EACtF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,QAAQ,MAAM,0BAA0B,IAAI,OAAO,WAAW,eAAe,GAAG,CAAC;GACvF,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAAS,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,MAAM,QAAQ,MAAM,0BAClB,IAAI,KACJ,IAAI,OACJ,WACA,OAAO,OACP,MACF;GACA,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAM,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAM,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAC/C,OAAO,KAAK,MAAM,aAAa,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAGpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,OAAmC,EACrF,WAAW,mBACb,CAAC;GAGD,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtB,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAO,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiB,EAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiB,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiB,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiB,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiB,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,IAAI,SAAS,KAAA,KAAa,YAAY,SAAS,KAAK,IAAI,QAAQ,GAClE,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}

package/dist/host/ingest.cjs

@@ -4,6 +4,7 @@ const require_engine_recipient = require("../engine/recipient.cjs");
 const require_engine_condition = require("../engine/condition.cjs");
 const require_hash = require("../hash.cjs");
 const require_ir = require("../ir.cjs");
+const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_store_facts = require("../store/facts.cjs");
 const require_store_erasure = require("../store/erasure.cjs");
 const require_store_index = require("../store/index.cjs");
@@ -616,19 +617,63 @@ async function setSubscriptions(env, store, userId, patch, topics, now = Date.no
 	}
 	return readSubscriptions(store, userId, topics);
 }
+/**
+* The recipient of a topic copy, by the copy's id. The id is the capability: a UUID nobody can
+* guess, the same trust `/t/u/<message>` runs on. Undefined — a 404 — for an id that names no
+* copy (never sent, or erased with its user by `forgetUser`), and for a transactional one, which
+* has nothing to opt out of; the same rule as `/t/u`. A push copy's `push_<platform>` channel
+* reads as `push`, the channel its subscriptions are keyed on.
+*/
+async function resolveMessageOwner(store, messageId) {
+	if (!require_reporting_tracking.isMessageId(messageId)) return void 0;
+	const found = await store.reporting.lookupMessage(messageId);
+	if (found === void 0) return void 0;
+	const { userId, topic } = found;
+	if (topic === null) return void 0;
+	const channel = found.channel === "email" ? "email" : found.channel.startsWith("push") ? "push" : void 0;
+	if (channel === void 0) return void 0;
+	return {
+		userId,
+		message: {
+			channel,
+			topic
+		}
+	};
+}
+/** `getSubscriptions` for the copy's recipient, with the copy's channel and topic; undefined when `resolveMessageOwner` is. */
+async function getSubscriptionsByMessage(store, messageId, topics) {
+	const owner = await resolveMessageOwner(store, messageId);
+	if (owner === void 0) return void 0;
+	return {
+		...await getSubscriptions(store, owner.userId, topics),
+		message: owner.message
+	};
+}
+/** `setSubscriptions` for the copy's recipient, answering as `getSubscriptionsByMessage` does; undefined when `resolveMessageOwner` is. */
+async function setSubscriptionsByMessage(env, store, messageId, patch, topics, now = Date.now()) {
+	const owner = await resolveMessageOwner(store, messageId);
+	if (owner === void 0) return void 0;
+	return {
+		...await setSubscriptions(env, store, owner.userId, patch, topics, now),
+		message: owner.message
+	};
+}
 exports.BundleIntegrityError = BundleIntegrityError;
 exports.SUBSCRIPTION_CHANNELS = SUBSCRIPTION_CHANNELS;
 exports.SWEEP_PAGE_SIZE = SWEEP_PAGE_SIZE;
 exports.deployBundle = deployBundle;
 exports.forgetUser = forgetUser;
 exports.getSubscriptions = getSubscriptions;
+exports.getSubscriptionsByMessage = getSubscriptionsByMessage;
 exports.identifyUser = identifyUser;
 exports.ingestEvent = ingestEvent;
 exports.parseSubscriptionsPatch = parseSubscriptionsPatch;
 exports.refreshSegmentTriggers = refreshSegmentTriggers;
 exports.registerDevice = registerDevice;
 exports.removeDevice = removeDevice;
+exports.resolveMessageOwner = resolveMessageOwner;
 exports.setSubscriptions = setSubscriptions;
+exports.setSubscriptionsByMessage = setSubscriptionsByMessage;
 exports.sweepMaintenance = sweepMaintenance;
 exports.sweepSegments = sweepSegments;
 exports.sweepSegmentsPaged = sweepSegmentsPaged;

package/dist/host/ingest.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.cjs","names":["UserErasedError","InstanceNotFoundError","WAKE_EVENT_TYPE","matchesWhere","JourneyFactSource","evaluateCondition","murmur3","profileUpdatedEvent","DEVICES_UPDATED_EVENT","semanticHash","BundleIR","SchemaMismatchError","RECIPIENT_PROPERTY"],"sources":["../../src/host/ingest.ts"],"sourcesContent":["import { murmur3 } from '../engine/bucket';\nimport {\n  DEVICES_UPDATED_EVENT,\n  evaluateCondition,\n  matchesWhere,\n  profileUpdatedEvent,\n} from '../engine/condition';\nimport { RECIPIENT_PROPERTY } from '../engine/recipient';\nimport { semanticHash } from '../hash';\nimport { BundleIR, type ConditionIR, type TriggerIR } from '../ir';\nimport { JourneyFactSource } from '../store/facts';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  type SegmentTriggerRoute,\n  type SuppressionChange,\n  UserErasedError,\n} from '../store/index';\nimport {\n  InstanceNotFoundError,\n  type JourneyEnv,\n  type JourneyParams,\n  WAKE_EVENT_TYPE,\n  type WorkflowInstanceLike,\n} from './platform';\n\n/**\n * Ingest: what the host does with what comes in, HTTP aside (that is `http.ts`). An incoming\n * event does four things: it is stored, it wakes waiting instances, it is matched against event\n * triggers, and it re-evaluates segment-trigger membership. An identify merges a profile, which\n * wakes the waits on the properties it patched and re-evaluates segment triggers too. Plus\n * devices, subscriptions, erasure, the segment sweep and bundle deploys.\n *\n * Storage goes through a JourneyStore; every entry point takes the one the host opened.\n */\n\n/**\n * The fast answer for a user with an erasure tombstone (being erased, or erased for good): every\n * ingest-side entry point starts here and does no work for them. The gate itself is the store's\n * conditional write, which throws the same error when the tombstone lands after this check.\n */\nasync function refuseIfErased(store: JourneyStore, userId: string): Promise<void> {\n  if ((await store.erasureState(userId)) !== 'none') throw new UserErasedError(userId);\n}\n\nexport interface IngestInput {\n  userId: string;\n  event: string;\n  payload?: Record<string, unknown>;\n  ts?: number;\n  /**\n   * This occurrence's identity, and with it the idempotency of sending it.\n   *\n   * Only the sender can know whether two deliveries describe one occurrence or\n   * two, so the engine does not decide: an id it has already stored makes the\n   * second delivery a no-op. That matters because ingest is reachable from two\n   * retrying callers — an HTTP client retrying a 500, and the interpreter's\n   * send_event step being retried after it already committed its row — and a\n   * second copy of an event silently changes every count- and window-based\n   * condition that reads the log.\n   *\n   * Callers that retry should send an id they can reproduce. Omitting it gets\n   * a fresh one, which records the event as its own occurrence.\n   */\n  id?: string;\n}\n\nexport interface IngestResult {\n  /** The occurrence's identity: the caller's `id`, or the one minted for it. */\n  id: string;\n  /** False when that id was already in the log: nothing was written this time. */\n  stored: boolean;\n  woke: number;\n  started: string[];\n}\n\nexport async function ingestEvent(\n  env: JourneyEnv,\n  input: IngestInput,\n  store: JourneyStore\n): Promise<IngestResult> {\n  if (input.event.startsWith('$')) {\n    throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);\n  }\n  // Also reached from a running instance's send_event: an erased user's instances are stopped\n  // before the erase, so one that still gets here is refused like any other writer\n  await refuseIfErased(store, input.userId);\n  const ts = input.ts ?? Date.now();\n  const payload = input.payload ?? {};\n  // No id means the sender is not claiming this is a repeat of anything, which\n  // a fresh one states truthfully — unlike a key derived from the contents,\n  // which would silently collapse two identical events a second apart.\n  const id = input.id ?? crypto.randomUUID();\n\n  const stored = await store.insertEvent({\n    id,\n    userId: input.userId,\n    event: input.event,\n    ts,\n    payload,\n  });\n\n  /*\n   * The rest runs even for a duplicate. A retry arrives precisely because the\n   * first attempt did not finish — it committed the row and then failed — so\n   * returning early would strand the journeys the retry exists to start. Both\n   * halves are independently idempotent: waking an instance that already moved\n   * on is a no-op, and the entry ledger refuses a second entry.\n   */\n  const woke = await wakeSubscribers(env, store, input.userId, [input.event]);\n  const started = await startTriggeredJourneys(env, store, { ...input, payload }, ts);\n  started.push(...(await refreshSegmentTriggers(env, store, input.userId, ts)));\n  return { id, stored, woke, started };\n}\n\n/**\n * Wake every instance of the user waiting on any of `events`, once each: an instance subscribed\n * to several of them (a wait on two profile properties, patched together) gets one wake-up, and\n * the payload names the first event it matched.\n */\nexport async function wakeSubscribers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  events: readonly string[]\n): Promise<number> {\n  const handles = new Map<string, string>(); // handle → the event that matched it first\n  for (const event of events) {\n    for (const handle of await store.findWakeHandles(userId, event)) {\n      if (!handles.has(handle)) handles.set(handle, event);\n    }\n  }\n  let woke = 0;\n  for (const [handle, event] of handles) {\n    let instance: WorkflowInstanceLike;\n    try {\n      instance = await env.JOURNEY.get(handle);\n    } catch (error) {\n      // Unknown instance (errored out without cleanup): drop the dangling subscription. Any\n      // other failure (a database blip) keeps it: deleting would silence the wait for good\n      if (error instanceof InstanceNotFoundError) await store.unsubscribe(handle);\n      else console.warn(`[workflow] looking up ${handle} to wake it failed`, error);\n      continue;\n    }\n    try {\n      await instance.sendEvent({ type: WAKE_EVENT_TYPE, payload: { event } });\n      woke++;\n    } catch {\n      // Transient send failure (or an instance finishing right now): keep the\n      // subscription — a later event retries it, and the wait's own timeout\n      // bounds the damage. Deleting here would silence all future wake-ups.\n    }\n  }\n  return woke;\n}\n\nasync function startTriggeredJourneys(\n  env: JourneyEnv,\n  store: JourneyStore,\n  input: IngestInput & { payload: Record<string, unknown> },\n  ts: number\n): Promise<string[]> {\n  const started: string[] = [];\n  for (const route of await store.findTriggers(input.event)) {\n    // where: the payload gate — evaluated against the incoming event first\n    if (route.where !== null && !matchesWhere(input.payload, route.where)) continue;\n\n    // filter: the profile gate\n    if (route.filter !== null) {\n      const facts = new JourneyFactSource(store, input.userId);\n      if (!(await evaluateCondition(route.filter, facts, ts))) continue;\n    }\n\n    const instanceId = await startJourney(\n      env,\n      store,\n      route.workflow,\n      route.hash,\n      input.userId,\n      ts,\n      {\n        event: input.event,\n        payload: input.payload,\n      },\n      route.version\n    );\n    if (instanceId !== null) started.push(instanceId);\n  }\n  return started;\n}\n\n/**\n * Segment-entry triggers, maintained lazily: on each ingest/identify for a\n * user, re-evaluate every trigger-routed segment for that user and act on the\n * membership transition (enter → start journeys, leave → drop membership so a\n * later re-entry is observable). Purely time-driven drift (an inactivity\n * segment turning true by clock alone) has no event to ride on: the scheduled\n * sweep catches it (`sweepSegments`).\n */\nexport async function refreshSegmentTriggers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number\n): Promise<string[]> {\n  return refreshSegments(env, store, userId, ts, await store.listSegmentTriggers());\n}\n\n/**\n * Re-evaluate segments for one user — the routed ones only, or with `segments` every one named —\n * and act on each membership transition: entering records the membership and starts the\n * segment's routed workflows, leaving drops it. A segment trigger therefore starts journeys for\n * users who enter after it is deployed; a user already a member is not entered again.\n */\nasync function refreshSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number,\n  routes: readonly SegmentTriggerRoute[],\n  segments: readonly string[] = [],\n  // A sweep loads each definition once for all its users, not once per user\n  definitions = new Map<string, ConditionIR | undefined>()\n): Promise<string[]> {\n  const bySegment = new Map<string, { workflow: string; hash: string; version?: string }[]>(\n    segments.map((name) => [name, []])\n  );\n  for (const route of routes) {\n    const list = bySegment.get(route.segment) ?? [];\n    list.push({\n      workflow: route.workflow,\n      hash: route.hash,\n      ...(route.version === undefined ? {} : { version: route.version }),\n    });\n    bySegment.set(route.segment, list);\n  }\n  if (bySegment.size === 0) return [];\n\n  const facts = new JourneyFactSource(store, userId);\n  const started: string[] = [];\n  const failures: unknown[] = [];\n  for (const [segmentId, segmentRoutes] of bySegment) {\n    if (!definitions.has(segmentId)) {\n      definitions.set(segmentId, await store.getSegmentCondition(segmentId));\n    }\n    const definition = definitions.get(segmentId);\n    if (definition === undefined) continue; // route without a definition: broken deploy, skip\n\n    const matches = await evaluateCondition(definition, facts, ts);\n    const member = await store.isSegmentMember(segmentId, userId);\n\n    if (matches && !member) {\n      // Entry transition: the membership and the starts it owes, recorded together\n      await store.addSegmentMember(\n        segmentId,\n        userId,\n        ts,\n        segmentRoutes.map((route) => route.workflow)\n      );\n    } else if (!matches && member) {\n      await store.removeSegmentMember(segmentId, userId);\n      continue;\n    }\n    if (!matches) continue;\n\n    // Every start the entry still owes — a fresh entry's, or one an earlier evaluation failed on.\n    // Each is crossed off once its instance exists, so one workflow failing neither blocks the\n    // others nor gets lost: the next evaluation (the sweep, the user's next event) retries it.\n    const pending = new Set(await store.pendingSegmentStarts(segmentId, userId));\n    for (const route of segmentRoutes) {\n      if (!pending.has(route.workflow)) continue;\n      try {\n        const instanceId = await startJourney(\n          env,\n          store,\n          route.workflow,\n          route.hash,\n          userId,\n          ts,\n          { event: '$segment_entry', payload: { segment: segmentId } },\n          route.version\n        );\n        if (instanceId !== null) started.push(instanceId);\n        await store.completeSegmentStart(segmentId, userId, route.workflow);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n  }\n  // Surface a failure to the caller (an ingest answers 500) once every start had its chance\n  if (failures.length > 0) throw failures[0];\n  return started;\n}\n\nexport interface SweepResult {\n  users: number;\n  /** Journeys the segments' entries started. */\n  started: string[];\n  /** Each deployed segment's size after the sweep (empty when the store keeps no reporting). */\n  sizes: { segment: string; size: number }[];\n}\n\n/** How many users one sweep page evaluates: a unit of resumable work (AWS checkpoints each). */\nexport const SWEEP_PAGE_SIZE = 500;\n\n/**\n * What the sweep does before it looks at any user: the runtime's own upkeep (AWS: unconfirmed\n * starts, executions that ended unseen) and the erasures left unfinished (an instance would not\n * stop). A failure of either is logged, never fatal: the pages still run. Users whose erasure is\n * still pending afterwards are skipped by every page (`sweepSegmentsPaged`).\n */\nexport async function sweepMaintenance(env: JourneyEnv, store: JourneyStore): Promise<void> {\n  try {\n    await env.JOURNEY.maintain?.();\n  } catch (error) {\n    console.error('[workflow] runtime maintenance failed', error);\n  }\n  // Erasures left pending (an admitted instance would not stop, or is still draining): retried\n  // until every one of them is confirmed stopped and the data is gone\n  for (const userId of await store.pendingErasures()) {\n    try {\n      await eraseUser(env, userId, store, Date.now());\n    } catch (error) {\n      // Still pending: the next sweep tries again, and the rest of this one goes on\n      console.error(`[workflow] erasure of ${userId} failed`, error);\n    }\n  }\n}\n\nexport interface SweepPage {\n  /** Users evaluated on this page (those being erased are listed but skipped). */\n  users: number;\n  /** Journeys the segments' entries started on this page. */\n  started: string[];\n  /** The last user id listed, to resume past (`after`); undefined when the page was empty. */\n  lastUserId?: string | undefined;\n  /** Whether the page was full, so another may follow. */\n  more: boolean;\n}\n\n/**\n * One page of the sweep: the users after `after` (ascending, at most `limit`), every deployed\n * segment evaluated for each. The pages are what makes the sweep resumable — a host whose run\n * can be cut short (a Lambda timeout) checkpoints each one and replays the checkpointed pages\n * instead of starting over; `sweepSegments` is the plain loop over them.\n */\nexport async function sweepSegmentsPaged(\n  env: JourneyEnv,\n  store: JourneyStore,\n  page: { after?: string | undefined; limit?: number | undefined; now?: number | undefined }\n): Promise<SweepPage> {\n  const now = page.now ?? Date.now();\n  const limit = page.limit ?? SWEEP_PAGE_SIZE;\n  const segments = (await store.listSegments()).map((segment) => segment.id);\n  const routes = await store.listSegmentTriggers();\n  // Read per page, not once up front: an erasure requested since the last page is honored too\n  const erasing = new Set(await store.pendingErasures());\n  const listed = await store.listUserIds({ after: page.after, limit });\n  const lastUserId = listed.at(-1);\n  // A store that ignores `after` would hand back the same page forever: refuse to loop on it.\n  // Equality only — the order is the store's collation, which JavaScript's `<` does not know\n  if (page.after !== undefined && lastUserId === page.after) {\n    throw new Error(`listUserIds did not advance past ${page.after}: the store ignores 'after'`);\n  }\n  const users = listed.filter((userId) => !erasing.has(userId));\n  const started: string[] = [];\n  const definitions = new Map<string, ConditionIR | undefined>();\n  for (const userId of users) {\n    try {\n      started.push(\n        ...(await refreshSegments(env, store, userId, now, routes, segments, definitions))\n      );\n    } catch (error) {\n      // One user's failed start is kept for the next sweep; it must not stop everyone else's\n      console.error(`[workflow] segment refresh for ${userId} failed`, error);\n    }\n  }\n  return { users: users.length, started, lastUserId, more: listed.length >= limit };\n}\n\n/**\n * The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a\n * journey's conditions run on, so a member is exactly who a journey would see in it. Membership\n * follows (joiners keep the time they joined, leavers are removed), segment triggers start the\n * journeys of whoever entered by the clock alone, and the store records each segment's size.\n * It walks users page by page (`sweepSegmentsPaged`): fine for thousands, a large audience wants\n * SQL-side evaluation.\n */\nexport async function sweepSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<SweepResult> {\n  await sweepMaintenance(env, store);\n  let users = 0;\n  const started: string[] = [];\n  let after: string | undefined;\n  for (;;) {\n    const page = await sweepSegmentsPaged(env, store, { after, limit: SWEEP_PAGE_SIZE, now });\n    users += page.users;\n    started.push(...page.started);\n    if (!page.more || page.lastUserId === undefined) break;\n    after = page.lastUserId;\n  }\n  const sizes = await store.reporting.snapshotSegments(now);\n  return { users, started, sizes };\n}\n\n/**\n * Create one journey instance behind the entry ledger. Returns null when the\n * once-policy blocks the entry (the store's attempt is atomic, so concurrent\n * ingests cannot double-enter). A pair whose previous instance is recorded as\n * 'failed' is reclaimed rather than barred forever over one outage.\n */\nasync function startJourney(\n  env: JourneyEnv,\n  store: JourneyStore,\n  workflow: string,\n  hash: string,\n  userId: string,\n  ts: number,\n  trigger: { event: string; payload: Record<string, unknown> },\n  /** The code version whose bundle routed this start, read with the hash (see TriggerRoute). */\n  version?: string\n): Promise<string | null> {\n  const instanceId = buildInstanceId(workflow, hash, userId, ts);\n  const params: JourneyParams = { workflowId: workflow, contentHash: hash, userId, trigger };\n  const execution = await env.JOURNEY.plan?.({ id: instanceId, params, ts, version });\n\n  const outcome = await store.enterJourney({ workflow, userId, instanceId, hash, ts, execution });\n  if (outcome === null) {\n    // Already entered and still alive — unless its start never got through: this retry is the\n    // first chance to finish it\n    await env.JOURNEY.resume?.({ workflow, userId });\n    return null;\n  }\n\n  try {\n    await env.JOURNEY.create({ id: instanceId, params });\n  } catch (error) {\n    // A recorded start stays: the runtime may have taken it, and a retry with the same name\n    // and payload finds that execution instead of starting a second one\n    if (execution !== undefined) throw error;\n    if (outcome === 'reclaimed') {\n      // Put the corpse back rather than deleting it: the entry is still a\n      // failure, and dropping the row would erase that from the ledger.\n      await store.setEntryStatus(instanceId, 'failed');\n    } else {\n      // Roll the ledger back so a retried ingest can enter — otherwise the\n      // once-policy would permanently record an entry that never ran.\n      await store.removeEntry(instanceId);\n    }\n    throw error;\n  }\n  return instanceId;\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * Instance id: addressable (the host gets it directly to wake it), ≤100\n * chars, legal charset. The murmur3 fingerprint keeps ids distinct when the\n * sanitized/truncated userId alone would collide.\n */\nfunction buildInstanceId(workflow: string, hash: string, userId: string, ts: number): string {\n  const uid = userId.replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 24);\n  const fingerprint = murmur3(utf8.encode(userId)).toString(36);\n  return `${workflow.slice(0, 32)}-${hash.slice(0, 8)}-${uid}-${fingerprint}-${ts.toString(36)}`;\n}\n\n/* --------------------------------- identify --------------------------------- */\n\nexport interface IdentifyResult {\n  ok: true;\n  props: ProfileProps;\n  woke: number;\n  started: string[];\n}\n\n/**\n * Merge-patch profile properties (a null removes one), then wake property waits\n * and re-evaluate segment triggers. The merge is one statement in the store, so\n * two identifies landing together cannot lose each other's fields.\n */\nexport async function identifyUser(\n  env: JourneyEnv,\n  userId: string,\n  props: ProfileProps,\n  store: JourneyStore\n): Promise<IdentifyResult> {\n  await refuseIfErased(store, userId);\n  const ts = Date.now();\n  const merged = await store.mergeProfile(userId, props);\n  // A property wait subscribes to its own property's channel (see relevantEvents): only the\n  // waits on what this patch touched wake up\n  const woke = await wakeSubscribers(\n    env,\n    store,\n    userId,\n    Object.keys(props).map(profileUpdatedEvent)\n  );\n  // A profile change can move the user into (or out of) a trigger-routed segment\n  const started = await refreshSegmentTriggers(env, store, userId, ts);\n  return { ok: true, props: merged, woke, started };\n}\n\nexport interface DeviceRegistration {\n  userId: string;\n  token: string;\n  platform: string;\n  ts?: number;\n}\n\n/**\n * A push token registered for the user (or moved to them from another account: a token belongs\n * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside\n * `waitUntil`), for the new owner and the previous one.\n */\nexport async function registerDevice(\n  env: JourneyEnv,\n  device: DeviceRegistration,\n  store: JourneyStore\n): Promise<{ ok: true; woke: number }> {\n  await refuseIfErased(store, device.userId);\n  const previous = await store.removeDevice(device.token);\n  await store.upsertDevice({ ...device, ts: device.ts ?? Date.now() });\n  let woke = await wakeSubscribers(env, store, device.userId, [DEVICES_UPDATED_EVENT]);\n  if (previous !== undefined && previous !== device.userId) {\n    woke += await wakeSubscribers(env, store, previous, [DEVICES_UPDATED_EVENT]);\n  }\n  return { ok: true, woke };\n}\n\n/** Workflow instance states that will never run another step. */\nconst STOPPED_STATUSES = new Set(['complete', 'errored', 'terminated']);\n\n/**\n * Stop one admitted instance for good; true once it is known not to run again: terminated, or\n * already in a terminal state (terminate refuses those). Any other failure is not taken for\n * \"already gone\": it answers false, and the erasure waits for a retry.\n *\n * An admitted instance the platform no longer knows counts as stopped too — but only an\n * admitted one. Admission is the runner's first act, so an admitted instance did reach the\n * runtime: not found now means it finished and was evicted. An entry that is not admitted is\n * never passed here: for it, not found may just as well mean its `create` is still in flight.\n */\nasync function stopInstance(env: JourneyEnv, instanceId: string): Promise<boolean> {\n  let instance: WorkflowInstanceLike;\n  try {\n    instance = await env.JOURNEY.get(instanceId);\n  } catch (error) {\n    if (error instanceof InstanceNotFoundError) return true;\n    console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);\n    return false;\n  }\n  if (instance.terminate === undefined) return false;\n  try {\n    await instance.terminate();\n    return true;\n  } catch (error) {\n    const status = await instance.status?.().catch(() => undefined);\n    if (status !== undefined && STOPPED_STATUSES.has(status.status)) return true;\n    console.warn(`[workflow] terminating ${instanceId} failed`, error);\n    return false;\n  }\n}\n\n/**\n * Carry out a recorded erasure: stop every running instance of the user, and only once all are\n * known not to run erase their data. The tombstone is already committed, so no new entry,\n * event, profile or device of theirs lands meanwhile.\n *\n * An entry's runner admits itself before its first effect (`admitInstance`, mutually exclusive\n * with the tombstone's commit), which splits the running instances in two:\n *\n * - not admitted: nothing of it has run, and nothing will — a `create` still in flight, or a\n *   runner invoked later, meets the tombstone at admission and exits. No stop is needed, and\n *   none would be reliable: the platform may not know the instance yet.\n * - admitted: it did reach the runtime and must be stopped (`stopInstance`), or it would write\n *   rows back after the erase. One that will not stop leaves the erasure pending.\n *\n * Erasing nothing until then keeps the entries that name the instances still to stop, so a\n * retry can finish the job. The tombstone outlives the erase (`erased_at`), which is what makes\n * a repeat idempotent and a late write harmless. There is no straggler to come back for: every\n * write about a user runs in the user's locked transaction, the same lock the tombstone takes,\n * so a write either committed before the tombstone — and `forgetUser` deletes it here — or\n * waited for the lock and is refused by the tombstone it then sees.\n */\nasync function eraseUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore,\n  now: number\n): Promise<{ erased: boolean; pending: string[] }> {\n  const pending: string[] = [];\n  for (const { instanceId, admitted } of await store.runningInstances(userId)) {\n    if (!admitted) continue;\n    if (!(await stopInstance(env, instanceId))) pending.push(instanceId);\n  }\n  if (pending.length > 0) return { erased: false, pending };\n  await store.forgetUser(userId, now);\n  return { erased: true, pending };\n}\n\n/**\n * Forget a user (a deleted account): the tombstone is committed first, then the erasure carried\n * out. `erased: true` means every admitted runner of theirs was confirmed stopped, the entries\n * never admitted can never run, and the data is deleted — for good, with no time window and no\n * second pass: the tombstone commits under the user's lock, which every write about the user\n * also takes, so nothing of theirs can land after it. An admitted instance that will not stop\n * leaves it pending — nothing erased yet — and the scheduled sweep retries it; `erased: false`\n * says so. A user already erased answers `erased: true` again, with nothing to do.\n */\nexport async function forgetUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n  await store.requestErasure(userId, now);\n  return { ok: true, ...(await eraseUser(env, userId, store, now)) };\n}\n\n/**\n * The user signed out on the device: the token stays registered, bound to nobody, so the next\n * sign-in only has to bind it again. Wakes the former owner's device waits (`reachable('push')`\n * may no longer hold).\n */\nexport async function unbindDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.unbindDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT]);\n  return { ok: true, woke };\n}\n\n/** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */\nexport async function removeDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.removeDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT]);\n  return { ok: true, woke };\n}\n\n/* ---------------------------------- deploy ---------------------------------- */\n\nexport interface DeployResult {\n  workflows: string[];\n  /**\n   * Workflows whose trigger type has no runtime routing yet — they deploy (the\n   * IR is stored and versioned) but will never start until the routing lands.\n   * Currently: date (TODO — needs cron + Queues, instance creation is\n   * rate-limited and a date trigger fans out to the whole audience at once)\n   * and webhook (TODO — needs endpoint allocation).\n   */\n  unrouted: { workflow: string; trigger: TriggerIR['type'] }[];\n  /**\n   * Whether the routes now point at this bundle: always for a forced deploy, false for a\n   * versioned one when a version as new or newer is already live (nothing was swapped).\n   */\n  applied: boolean;\n}\n\n/** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */\nexport class BundleIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'BundleIntegrityError';\n  }\n}\n\n/**\n * Recompute every declared contentHash and refuse the bundle if one disagrees.\n *\n * The contentHash is the address an in-flight journey reads its IR from, so\n * a hash that does not describe its own content is a way to change what a\n * pinned instance executes: submit an edited flow under the old hash and the\n * next replay picks it up. The compiler always computes the hash it ships, so\n * a mismatch means a hand-rolled payload or a stale client — neither should be\n * able to overwrite a version that journeys are running.\n *\n * Each hash is recomputed exactly the way its compiler produced it: a workflow\n * hashes its whole IR (contentHash strips itself), a segment hashes only its\n * condition. Mirroring them is load-bearing — recomputing a segment over the\n * whole record would reject every honest deploy.\n */\nfunction verifyBundleHashes(parsed: BundleIR): void {\n  const mismatched: string[] = [];\n  for (const workflow of parsed.workflows) {\n    if (semanticHash(workflow) !== workflow.contentHash) {\n      mismatched.push(`workflow '${workflow.id}'`);\n    }\n  }\n  for (const segment of parsed.segments) {\n    if (semanticHash(segment.condition) !== segment.contentHash) {\n      mismatched.push(`segment '${segment.id}'`);\n    }\n  }\n  if (mismatched.length > 0) {\n    throw new BundleIntegrityError(\n      `contentHash does not match content for ${mismatched.join(', ')} — recompile the bundle instead of editing it by hand`\n    );\n  }\n}\n\n/**\n * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed\n * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens\n * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle\n * compiled into it; without one it is forced, whatever is live.\n */\nexport async function deployBundle(\n  env: JourneyEnv,\n  bundle: unknown,\n  store: JourneyStore,\n  version?: BundleVersion\n): Promise<DeployResult> {\n  const parsed = BundleIR.parse(bundle);\n  // Before any write: a bad hash must not reach the store, where it would address content it does not describe\n  verifyBundleHashes(parsed);\n  // Nor a bundle the database cannot hold: the host migrates, the engine only checks\n  const problems = await store.checkSchema();\n  if (problems.length > 0) throw new SchemaMismatchError(problems);\n\n  for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);\n  let applied = true;\n  if (version === undefined) await store.replaceRoutes(parsed);\n  else applied = await store.replaceRoutesIfNewer(parsed, version);\n\n  const unrouted = parsed.workflows\n    .filter((workflow) => workflow.trigger.type === 'date' || workflow.trigger.type === 'webhook')\n    .map((workflow) => ({ workflow: workflow.id, trigger: workflow.trigger.type }));\n\n  return {\n    workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),\n    unrouted,\n    applied,\n  };\n}\n\n/* ------------------------------- subscriptions ------------------------------- */\n\n/** The channels a user opts out of per topic: `suppression` rows are keyed by (user, channel, topic). */\nexport const SUBSCRIPTION_CHANNELS = ['email', 'push'] as const;\nexport type SubscriptionChannel = (typeof SUBSCRIPTION_CHANNELS)[number];\n\n/**\n * Where a user stands with one channel: `true` is subscribed, per topic and for the channel as\n * a whole. The two are independent records: `all: false` masks every topic, whatever `topics`\n * says about it, and `all: true` does not switch a topic back on.\n */\nexport interface ChannelSubscriptions<T extends string = string> {\n  /**\n   * False once the user opted out of the whole channel (all email, all push). No topic is sent\n   * while it is false, however `topics` reads, so a consumer treats it as masking every topic.\n   */\n  all: boolean;\n  /**\n   * Each declared topic: false once the user opted out of it on this channel. A topic's flag is\n   * its own record, answered as it is even while `all` is false, and it stays false when `all`\n   * turns true again until a patch names the topic.\n   */\n  topics: Record<T, boolean>;\n}\n\n/**\n * A user's subscriptions, topic × channel — what `GET /subscriptions/:userId` answers. Every\n * channel lists every declared topic: a topic is a content category, and the user chooses per\n * channel whether to get it.\n */\nexport interface Subscriptions<T extends string = string> {\n  email: ChannelSubscriptions<T>;\n  push: ChannelSubscriptions<T>;\n}\n\n/** One channel's part of a patch: only what changes. */\nexport interface ChannelSubscriptionsPatch<T extends string = string> {\n  all?: boolean;\n  topics?: Partial<Record<T, boolean>>;\n}\n\n/**\n * What `PUT /subscriptions/:userId` takes: only what changes; an omitted channel or field stays\n * as it is. `all: true` clears the channel-wide opt-out only — a topic opted out on its own stays\n * off until the patch names it (a \"subscribe to all\" sends `all: true` plus every topic `true`).\n */\nexport interface SubscriptionsPatch<T extends string = string> {\n  email?: ChannelSubscriptionsPatch<T>;\n  push?: ChannelSubscriptionsPatch<T>;\n}\n\n/** One field of a patch refused, with the path the producer can fix. */\nexport interface SubscriptionsIssue {\n  path: string;\n  message: string;\n}\n\n/**\n * A subscriptions patch as it arrives over HTTP: untrusted JSON, read field by field and never\n * cast. Every topic must be one the bundle declares — the engine's list, not the caller's word.\n */\nexport function parseSubscriptionsPatch(\n  body: unknown,\n  topics: readonly string[]\n): { ok: true; patch: SubscriptionsPatch } | { ok: false; issues: SubscriptionsIssue[] } {\n  const issues: SubscriptionsIssue[] = [];\n  const object = (value: unknown): value is Record<string, unknown> =>\n    typeof value === 'object' && value !== null && !Array.isArray(value);\n  if (!object(body)) return { ok: false, issues: [{ path: '', message: 'must be an object' }] };\n  const known = new Set(topics);\n  const patch: SubscriptionsPatch = {};\n  for (const [channel, value] of Object.entries(body)) {\n    if (!(SUBSCRIPTION_CHANNELS as readonly string[]).includes(channel)) {\n      issues.push({ path: channel, message: 'not a subscription channel' });\n      continue;\n    }\n    if (!object(value)) {\n      issues.push({ path: channel, message: 'must be an object' });\n      continue;\n    }\n    const part: ChannelSubscriptionsPatch = {};\n    for (const [field, setting] of Object.entries(value)) {\n      if (field === 'all') {\n        if (typeof setting === 'boolean') part.all = setting;\n        else issues.push({ path: `${channel}.all`, message: 'must be a boolean' });\n      } else if (field === 'topics') {\n        if (!object(setting)) {\n          issues.push({ path: `${channel}.topics`, message: 'must be an object' });\n          continue;\n        }\n        const chosen: Record<string, boolean> = {};\n        for (const [topic, subscribed] of Object.entries(setting)) {\n          if (!known.has(topic)) {\n            issues.push({ path: `${channel}.topics.${topic}`, message: 'not a declared topic' });\n          } else if (typeof subscribed !== 'boolean') {\n            issues.push({ path: `${channel}.topics.${topic}`, message: 'must be a boolean' });\n          } else {\n            chosen[topic] = subscribed;\n          }\n        }\n        part.topics = chosen;\n      } else {\n        issues.push({ path: `${channel}.${field}`, message: 'unknown field' });\n      }\n    }\n    patch[channel as SubscriptionChannel] = part;\n  }\n  return issues.length > 0 ? { ok: false, issues } : { ok: true, patch };\n}\n\nasync function readSubscriptions(\n  store: JourneyStore,\n  userId: string,\n  topics: readonly string[]\n): Promise<Subscriptions> {\n  const read = async (channel: SubscriptionChannel): Promise<ChannelSubscriptions> => {\n    const suppressed = new Set(await store.listSuppressions(userId, channel));\n    return {\n      all: !suppressed.has(null),\n      topics: Object.fromEntries(topics.map((topic) => [topic, !suppressed.has(topic)])),\n    };\n  };\n  return { email: await read('email'), push: await read('push') };\n}\n\n/** The user's subscriptions over the declared `topics`; a user with an erasure tombstone is refused. */\nexport async function getSubscriptions(\n  store: JourneyStore,\n  userId: string,\n  topics: readonly string[]\n): Promise<Subscriptions> {\n  await refuseIfErased(store, userId);\n  return readSubscriptions(store, userId, topics);\n}\n\n/**\n * Apply a patch — each field given sets or clears the matching opt-out, one transaction per\n * channel — and answer the subscriptions as they now stand. A change of a channel's `all` is a\n * change of its reachability, so the waits reading it wake, both ways: an\n * `exitWhen: not(reachable('email'))` fires on the opt-out, and a wait for the channel to become\n * reachable resumes on the opt-in. Email waits key on the address property, push waits on the\n * device channel (`reachable('push')` subscribes to device changes).\n */\nexport async function setSubscriptions(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  patch: SubscriptionsPatch,\n  topics: readonly string[],\n  now = Date.now()\n): Promise<Subscriptions> {\n  await refuseIfErased(store, userId);\n  for (const channel of SUBSCRIPTION_CHANNELS) {\n    const part = patch[channel];\n    if (part === undefined) continue;\n    const changes: SuppressionChange[] = [];\n    if (part.all !== undefined) changes.push({ topic: null, suppressed: !part.all });\n    for (const [topic, subscribed] of Object.entries(part.topics ?? {})) {\n      if (subscribed !== undefined) changes.push({ topic, suppressed: !subscribed });\n    }\n    if (changes.length === 0) continue;\n    await store.updateSuppressions(userId, channel, changes, now);\n    if (part.all !== undefined) {\n      const wake =\n        channel === 'push'\n          ? DEVICES_UPDATED_EVENT\n          : profileUpdatedEvent(RECIPIENT_PROPERTY.email ?? 'email');\n      await wakeSubscribers(env, store, userId, [wake]);\n    }\n  }\n  return readSubscriptions(store, userId, topics);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,eAAe,eAAe,OAAqB,QAA+B;CAChF,IAAK,MAAM,MAAM,aAAa,MAAM,MAAO,QAAQ,MAAM,IAAIA,sBAAAA,gBAAgB,MAAM;AACrF;AAiCA,eAAsB,YACpB,KACA,OACA,OACuB;CACvB,IAAI,MAAM,MAAM,WAAW,GAAG,GAC5B,MAAM,IAAI,MAAM,eAAe,MAAM,MAAM,uCAAuC;CAIpF,MAAM,eAAe,OAAO,MAAM,MAAM;CACxC,MAAM,KAAK,MAAM,MAAM,KAAK,IAAI;CAChC,MAAM,UAAU,MAAM,WAAW,CAAC;CAIlC,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW;CAEzC,MAAM,SAAS,MAAM,MAAM,YAAY;EACrC;EACA,QAAQ,MAAM;EACd,OAAO,MAAM;EACb;EACA;CACF,CAAC;CASD,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,CAAC,MAAM,KAAK,CAAC;CAC1E,MAAM,UAAU,MAAM,uBAAuB,KAAK,OAAO;EAAE,GAAG;EAAO;CAAQ,GAAG,EAAE;CAClF,QAAQ,KAAK,GAAI,MAAM,uBAAuB,KAAK,OAAO,MAAM,QAAQ,EAAE,CAAE;CAC5E,OAAO;EAAE;EAAI;EAAQ;EAAM;CAAQ;AACrC;;;;;;AAOA,eAAsB,gBACpB,KACA,OACA,QACA,QACiB;CACjB,MAAM,0BAAU,IAAI,IAAoB;CACxC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,QAAQ,KAAK,GAC5D,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG,QAAQ,IAAI,QAAQ,KAAK;CAGvD,IAAI,OAAO;CACX,KAAK,MAAM,CAAC,QAAQ,UAAU,SAAS;EACrC,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,IAAI,QAAQ,IAAI,MAAM;EACzC,SAAS,OAAO;GAGd,IAAI,iBAAiBC,sBAAAA,uBAAuB,MAAM,MAAM,YAAY,MAAM;QACrE,QAAQ,KAAK,yBAAyB,OAAO,qBAAqB,KAAK;GAC5E;EACF;EACA,IAAI;GACF,MAAM,SAAS,UAAU;IAAE,MAAMC,sBAAAA;IAAiB,SAAS,EAAE,MAAM;GAAE,CAAC;GACtE;EACF,QAAQ,CAIR;CACF;CACA,OAAO;AACT;AAEA,eAAe,uBACb,KACA,OACA,OACA,IACmB;CACnB,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,MAAM,MAAM,aAAa,MAAM,KAAK,GAAG;EAEzD,IAAI,MAAM,UAAU,QAAQ,CAACC,yBAAAA,aAAa,MAAM,SAAS,MAAM,KAAK,GAAG;EAGvE,IAAI,MAAM,WAAW,MAAM;GACzB,MAAM,QAAQ,IAAIC,oBAAAA,kBAAkB,OAAO,MAAM,MAAM;GACvD,IAAI,CAAE,MAAMC,yBAAAA,kBAAkB,MAAM,QAAQ,OAAO,EAAE,GAAI;EAC3D;EAEA,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,MAAM,QACN,IACA;GACE,OAAO,MAAM;GACb,SAAS,MAAM;EACjB,GACA,MAAM,OACR;EACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;CAClD;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,uBACpB,KACA,OACA,QACA,IACmB;CACnB,OAAO,gBAAgB,KAAK,OAAO,QAAQ,IAAI,MAAM,MAAM,oBAAoB,CAAC;AAClF;;;;;;;AAQA,eAAe,gBACb,KACA,OACA,QACA,IACA,QACA,WAA8B,CAAC,GAE/B,8BAAc,IAAI,IAAqC,GACpC;CACnB,MAAM,YAAY,IAAI,IACpB,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CACnC;CACA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OAAO,UAAU,IAAI,MAAM,OAAO,KAAK,CAAC;EAC9C,KAAK,KAAK;GACR,UAAU,MAAM;GAChB,MAAM,MAAM;GACZ,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;EAClE,CAAC;EACD,UAAU,IAAI,MAAM,SAAS,IAAI;CACnC;CACA,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,IAAID,oBAAAA,kBAAkB,OAAO,MAAM;CACjD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,WAAW,kBAAkB,WAAW;EAClD,IAAI,CAAC,YAAY,IAAI,SAAS,GAC5B,YAAY,IAAI,WAAW,MAAM,MAAM,oBAAoB,SAAS,CAAC;EAEvE,MAAM,aAAa,YAAY,IAAI,SAAS;EAC5C,IAAI,eAAe,KAAA,GAAW;EAE9B,MAAM,UAAU,MAAMC,yBAAAA,kBAAkB,YAAY,OAAO,EAAE;EAC7D,MAAM,SAAS,MAAM,MAAM,gBAAgB,WAAW,MAAM;EAE5D,IAAI,WAAW,CAAC,QAEd,MAAM,MAAM,iBACV,WACA,QACA,IACA,cAAc,KAAK,UAAU,MAAM,QAAQ,CAC7C;OACK,IAAI,CAAC,WAAW,QAAQ;GAC7B,MAAM,MAAM,oBAAoB,WAAW,MAAM;GACjD;EACF;EACA,IAAI,CAAC,SAAS;EAKd,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,qBAAqB,WAAW,MAAM,CAAC;EAC3E,KAAK,MAAM,SAAS,eAAe;GACjC,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG;GAClC,IAAI;IACF,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,QACA,IACA;KAAE,OAAO;KAAkB,SAAS,EAAE,SAAS,UAAU;IAAE,GAC3D,MAAM,OACR;IACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;IAChD,MAAM,MAAM,qBAAqB,WAAW,QAAQ,MAAM,QAAQ;GACpE,SAAS,OAAO;IACd,SAAS,KAAK,KAAK;GACrB;EACF;CACF;CAEA,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CACxC,OAAO;AACT;;AAWA,MAAa,kBAAkB;;;;;;;AAQ/B,eAAsB,iBAAiB,KAAiB,OAAoC;CAC1F,IAAI;EACF,MAAM,IAAI,QAAQ,WAAW;CAC/B,SAAS,OAAO;EACd,QAAQ,MAAM,yCAAyC,KAAK;CAC9D;CAGA,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,GAC/C,IAAI;EACF,MAAM,UAAU,KAAK,QAAQ,OAAO,KAAK,IAAI,CAAC;CAChD,SAAS,OAAO;EAEd,QAAQ,MAAM,yBAAyB,OAAO,UAAU,KAAK;CAC/D;AAEJ;;;;;;;AAmBA,eAAsB,mBACpB,KACA,OACA,MACoB;CACpB,MAAM,MAAM,KAAK,OAAO,KAAK,IAAI;CACjC,MAAM,QAAQ,KAAK,SAAA;CACnB,MAAM,YAAY,MAAM,MAAM,aAAa,EAAA,CAAG,KAAK,YAAY,QAAQ,EAAE;CACzE,MAAM,SAAS,MAAM,MAAM,oBAAoB;CAE/C,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,gBAAgB,CAAC;CACrD,MAAM,SAAS,MAAM,MAAM,YAAY;EAAE,OAAO,KAAK;EAAO;CAAM,CAAC;CACnE,MAAM,aAAa,OAAO,GAAG,EAAE;CAG/B,IAAI,KAAK,UAAU,KAAA,KAAa,eAAe,KAAK,OAClD,MAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,4BAA4B;CAE7F,MAAM,QAAQ,OAAO,QAAQ,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC;CAC5D,MAAM,UAAoB,CAAC;CAC3B,MAAM,8BAAc,IAAI,IAAqC;CAC7D,KAAK,MAAM,UAAU,OACnB,IAAI;EACF,QAAQ,KACN,GAAI,MAAM,gBAAgB,KAAK,OAAO,QAAQ,KAAK,QAAQ,UAAU,WAAW,CAClF;CACF,SAAS,OAAO;EAEd,QAAQ,MAAM,kCAAkC,OAAO,UAAU,KAAK;CACxE;CAEF,OAAO;EAAE,OAAO,MAAM;EAAQ;EAAS;EAAY,MAAM,OAAO,UAAU;CAAM;AAClF;;;;;;;;;AAUA,eAAsB,cACpB,KACA,OACA,MAAM,KAAK,IAAI,GACO;CACtB,MAAM,iBAAiB,KAAK,KAAK;CACjC,IAAI,QAAQ;CACZ,MAAM,UAAoB,CAAC;CAC3B,IAAI;CACJ,SAAS;EACP,MAAM,OAAO,MAAM,mBAAmB,KAAK,OAAO;GAAE;GAAO,OAAA;GAAwB;EAAI,CAAC;EACxF,SAAS,KAAK;EACd,QAAQ,KAAK,GAAG,KAAK,OAAO;EAC5B,IAAI,CAAC,KAAK,QAAQ,KAAK,eAAe,KAAA,GAAW;EACjD,QAAQ,KAAK;CACf;CACA,MAAM,QAAQ,MAAM,MAAM,UAAU,iBAAiB,GAAG;CACxD,OAAO;EAAE;EAAO;EAAS;CAAM;AACjC;;;;;;;AAQA,eAAe,aACb,KACA,OACA,UACA,MACA,QACA,IACA,SAEA,SACwB;CACxB,MAAM,aAAa,gBAAgB,UAAU,MAAM,QAAQ,EAAE;CAC7D,MAAM,SAAwB;EAAE,YAAY;EAAU,aAAa;EAAM;EAAQ;CAAQ;CACzF,MAAM,YAAY,MAAM,IAAI,QAAQ,OAAO;EAAE,IAAI;EAAY;EAAQ;EAAI;CAAQ,CAAC;CAElF,MAAM,UAAU,MAAM,MAAM,aAAa;EAAE;EAAU;EAAQ;EAAY;EAAM;EAAI;CAAU,CAAC;CAC9F,IAAI,YAAY,MAAM;EAGpB,MAAM,IAAI,QAAQ,SAAS;GAAE;GAAU;EAAO,CAAC;EAC/C,OAAO;CACT;CAEA,IAAI;EACF,MAAM,IAAI,QAAQ,OAAO;GAAE,IAAI;GAAY;EAAO,CAAC;CACrD,SAAS,OAAO;EAGd,IAAI,cAAc,KAAA,GAAW,MAAM;EACnC,IAAI,YAAY,aAGd,MAAM,MAAM,eAAe,YAAY,QAAQ;OAI/C,MAAM,MAAM,YAAY,UAAU;EAEpC,MAAM;CACR;CACA,OAAO;AACT;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAS,gBAAgB,UAAkB,MAAc,QAAgB,IAAoB;CAC3F,MAAM,MAAM,OAAO,QAAQ,mBAAmB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAC9D,MAAM,cAAcC,sBAAAA,QAAQ,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE;CAC5D,OAAO,GAAG,SAAS,MAAM,GAAG,EAAE,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,YAAY,GAAG,GAAG,SAAS,EAAE;AAC7F;;;;;;AAgBA,eAAsB,aACpB,KACA,QACA,OACA,OACyB;CACzB,MAAM,eAAe,OAAO,MAAM;CAClC,MAAM,KAAK,KAAK,IAAI;CAYpB,OAAO;EAAE,IAAI;EAAM,OAAO,MAXL,MAAM,aAAa,QAAQ,KAAK;EAWnB,MAAA,MARf,gBACjB,KACA,OACA,QACA,OAAO,KAAK,KAAK,CAAC,CAAC,IAAIC,yBAAAA,mBAAmB,CAC5C;EAGwC,SAAA,MADlB,uBAAuB,KAAK,OAAO,QAAQ,EAAE;CACnB;AAClD;;;;;;AAcA,eAAsB,eACpB,KACA,QACA,OACqC;CACrC,MAAM,eAAe,OAAO,OAAO,MAAM;CACzC,MAAM,WAAW,MAAM,MAAM,aAAa,OAAO,KAAK;CACtD,MAAM,MAAM,aAAa;EAAE,GAAG;EAAQ,IAAI,OAAO,MAAM,KAAK,IAAI;CAAE,CAAC;CACnE,IAAI,OAAO,MAAM,gBAAgB,KAAK,OAAO,OAAO,QAAQ,CAACC,yBAAAA,qBAAqB,CAAC;CACnF,IAAI,aAAa,KAAA,KAAa,aAAa,OAAO,QAChD,QAAQ,MAAM,gBAAgB,KAAK,OAAO,UAAU,CAACA,yBAAAA,qBAAqB,CAAC;CAE7E,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;AAGA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAY;CAAW;AAAY,CAAC;;;;;;;;;;;AAYtE,eAAe,aAAa,KAAiB,YAAsC;CACjF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,IAAI,QAAQ,IAAI,UAAU;CAC7C,SAAS,OAAO;EACd,IAAI,iBAAiBP,sBAAAA,uBAAuB,OAAO;EACnD,QAAQ,KAAK,yBAAyB,WAAW,qBAAqB,KAAK;EAC3E,OAAO;CACT;CACA,IAAI,SAAS,cAAc,KAAA,GAAW,OAAO;CAC7C,IAAI;EACF,MAAM,SAAS,UAAU;EACzB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9D,IAAI,WAAW,KAAA,KAAa,iBAAiB,IAAI,OAAO,MAAM,GAAG,OAAO;EACxE,QAAQ,KAAK,0BAA0B,WAAW,UAAU,KAAK;EACjE,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAe,UACb,KACA,QACA,OACA,KACiD;CACjD,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,EAAE,YAAY,cAAc,MAAM,MAAM,iBAAiB,MAAM,GAAG;EAC3E,IAAI,CAAC,UAAU;EACf,IAAI,CAAE,MAAM,aAAa,KAAK,UAAU,GAAI,QAAQ,KAAK,UAAU;CACrE;CACA,IAAI,QAAQ,SAAS,GAAG,OAAO;EAAE,QAAQ;EAAO;CAAQ;CACxD,MAAM,MAAM,WAAW,QAAQ,GAAG;CAClC,OAAO;EAAE,QAAQ;EAAM;CAAQ;AACjC;;;;;;;;;;AAWA,eAAsB,WACpB,KACA,QACA,OACA,MAAM,KAAK,IAAI,GAC4C;CAC3D,MAAM,MAAM,eAAe,QAAQ,GAAG;CACtC,OAAO;EAAE,IAAI;EAAM,GAAI,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG;CAAG;AACnE;;;;;;AAOA,eAAsB,aACpB,KACA,OACA,OACqC;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAO,CAACO,yBAAAA,qBAAqB,CAAC;CACpE;AAC1B;;AAGA,eAAsB,aACpB,KACA,OACA,OACqC;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAO,CAACA,yBAAAA,qBAAqB,CAAC;CACpE;AAC1B;;AAsBA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,mBAAmB,QAAwB;CAClD,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,YAAY,OAAO,WAC5B,IAAIC,aAAAA,aAAa,QAAQ,MAAM,SAAS,aACtC,WAAW,KAAK,aAAa,SAAS,GAAG,EAAE;CAG/C,KAAK,MAAM,WAAW,OAAO,UAC3B,IAAIA,aAAAA,aAAa,QAAQ,SAAS,MAAM,QAAQ,aAC9C,WAAW,KAAK,YAAY,QAAQ,GAAG,EAAE;CAG7C,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,qBACR,0CAA0C,WAAW,KAAK,IAAI,EAAE,sDAClE;AAEJ;;;;;;;AAQA,eAAsB,aACpB,KACA,QACA,OACA,SACuB;CACvB,MAAM,SAASC,WAAAA,SAAS,MAAM,MAAM;CAEpC,mBAAmB,MAAM;CAEzB,MAAM,WAAW,MAAM,MAAM,YAAY;CACzC,IAAI,SAAS,SAAS,GAAG,MAAM,IAAIC,oBAAAA,oBAAoB,QAAQ;CAE/D,KAAK,MAAM,YAAY,OAAO,WAAW,MAAM,MAAM,cAAc,QAAQ;CAC3E,IAAI,UAAU;CACd,IAAI,YAAY,KAAA,GAAW,MAAM,MAAM,cAAc,MAAM;MACtD,UAAU,MAAM,MAAM,qBAAqB,QAAQ,OAAO;CAE/D,MAAM,WAAW,OAAO,UACrB,QAAQ,aAAa,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ,SAAS,SAAS,CAAC,CAC7F,KAAK,cAAc;EAAE,UAAU,SAAS;EAAI,SAAS,SAAS,QAAQ;CAAK,EAAE;CAEhF,OAAO;EACL,WAAW,OAAO,UAAU,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,GAAG;EAC7E;EACA;CACF;AACF;;AAKA,MAAa,wBAAwB,CAAC,SAAS,MAAM;;;;;AA0DrD,SAAgB,wBACd,MACA,QACuF;CACvF,MAAM,SAA+B,CAAC;CACtC,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;CACrE,IAAI,CAAC,OAAO,IAAI,GAAG,OAAO;EAAE,IAAI;EAAO,QAAQ,CAAC;GAAE,MAAM;GAAI,SAAS;EAAoB,CAAC;CAAE;CAC5F,MAAM,QAAQ,IAAI,IAAI,MAAM;CAC5B,MAAM,QAA4B,CAAC;CACnC,KAAK,MAAM,CAAC,SAAS,UAAU,OAAO,QAAQ,IAAI,GAAG;EACnD,IAAI,CAAE,sBAA4C,SAAS,OAAO,GAAG;GACnE,OAAO,KAAK;IAAE,MAAM;IAAS,SAAS;GAA6B,CAAC;GACpE;EACF;EACA,IAAI,CAAC,OAAO,KAAK,GAAG;GAClB,OAAO,KAAK;IAAE,MAAM;IAAS,SAAS;GAAoB,CAAC;GAC3D;EACF;EACA,MAAM,OAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,OAAO,YAAY,OAAO,QAAQ,KAAK,GACjD,IAAI,UAAU,OAAO;GACnB,IAAI,OAAO,YAAY,WAAW,KAAK,MAAM;QACxC,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ;IAAO,SAAS;GAAoB,CAAC;EAC3E,OAAO,IAAI,UAAU,UAAU;GAC7B,IAAI,CAAC,OAAO,OAAO,GAAG;IACpB,OAAO,KAAK;KAAE,MAAM,GAAG,QAAQ;KAAU,SAAS;IAAoB,CAAC;IACvE;GACF;GACA,MAAM,SAAkC,CAAC;GACzC,KAAK,MAAM,CAAC,OAAO,eAAe,OAAO,QAAQ,OAAO,GACtD,IAAI,CAAC,MAAM,IAAI,KAAK,GAClB,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ,UAAU;IAAS,SAAS;GAAuB,CAAC;QAC9E,IAAI,OAAO,eAAe,WAC/B,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ,UAAU;IAAS,SAAS;GAAoB,CAAC;QAEhF,OAAO,SAAS;GAGpB,KAAK,SAAS;EAChB,OACE,OAAO,KAAK;GAAE,MAAM,GAAG,QAAQ,GAAG;GAAS,SAAS;EAAgB,CAAC;EAGzE,MAAM,WAAkC;CAC1C;CACA,OAAO,OAAO,SAAS,IAAI;EAAE,IAAI;EAAO;CAAO,IAAI;EAAE,IAAI;EAAM;CAAM;AACvE;AAEA,eAAe,kBACb,OACA,QACA,QACwB;CACxB,MAAM,OAAO,OAAO,YAAgE;EAClF,MAAM,aAAa,IAAI,IAAI,MAAM,MAAM,iBAAiB,QAAQ,OAAO,CAAC;EACxE,OAAO;GACL,KAAK,CAAC,WAAW,IAAI,IAAI;GACzB,QAAQ,OAAO,YAAY,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC;EACnF;CACF;CACA,OAAO;EAAE,OAAO,MAAM,KAAK,OAAO;EAAG,MAAM,MAAM,KAAK,MAAM;CAAE;AAChE;;AAGA,eAAsB,iBACpB,OACA,QACA,QACwB;CACxB,MAAM,eAAe,OAAO,MAAM;CAClC,OAAO,kBAAkB,OAAO,QAAQ,MAAM;AAChD;;;;;;;;;AAUA,eAAsB,iBACpB,KACA,OACA,QACA,OACA,QACA,MAAM,KAAK,IAAI,GACS;CACxB,MAAM,eAAe,OAAO,MAAM;CAClC,KAAK,MAAM,WAAW,uBAAuB;EAC3C,MAAM,OAAO,MAAM;EACnB,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,UAA+B,CAAC;EACtC,IAAI,KAAK,QAAQ,KAAA,GAAW,QAAQ,KAAK;GAAE,OAAO;GAAM,YAAY,CAAC,KAAK;EAAI,CAAC;EAC/E,KAAK,MAAM,CAAC,OAAO,eAAe,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAChE,IAAI,eAAe,KAAA,GAAW,QAAQ,KAAK;GAAE;GAAO,YAAY,CAAC;EAAW,CAAC;EAE/E,IAAI,QAAQ,WAAW,GAAG;EAC1B,MAAM,MAAM,mBAAmB,QAAQ,SAAS,SAAS,GAAG;EAC5D,IAAI,KAAK,QAAQ,KAAA,GAKf,MAAM,gBAAgB,KAAK,OAAO,QAAQ,CAHxC,YAAY,SACRH,yBAAAA,wBACAD,yBAAAA,oBAAoBK,yBAAAA,mBAAmB,SAAS,OAAO,CACd,CAAC;CAEpD;CACA,OAAO,kBAAkB,OAAO,QAAQ,MAAM;AAChD"}
+{"version":3,"file":"ingest.cjs","names":["UserErasedError","InstanceNotFoundError","WAKE_EVENT_TYPE","matchesWhere","JourneyFactSource","evaluateCondition","murmur3","profileUpdatedEvent","DEVICES_UPDATED_EVENT","semanticHash","BundleIR","SchemaMismatchError","RECIPIENT_PROPERTY","isMessageId"],"sources":["../../src/host/ingest.ts"],"sourcesContent":["import { murmur3 } from '../engine/bucket';\nimport {\n  DEVICES_UPDATED_EVENT,\n  evaluateCondition,\n  matchesWhere,\n  profileUpdatedEvent,\n} from '../engine/condition';\nimport { RECIPIENT_PROPERTY } from '../engine/recipient';\nimport { semanticHash } from '../hash';\nimport { BundleIR, type ConditionIR, type TriggerIR } from '../ir';\nimport { isMessageId } from '../reporting/tracking';\nimport { JourneyFactSource } from '../store/facts';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  type SegmentTriggerRoute,\n  type SuppressionChange,\n  UserErasedError,\n} from '../store/index';\nimport {\n  InstanceNotFoundError,\n  type JourneyEnv,\n  type JourneyParams,\n  WAKE_EVENT_TYPE,\n  type WorkflowInstanceLike,\n} from './platform';\n\n/**\n * Ingest: what the host does with what comes in, HTTP aside (that is `http.ts`). An incoming\n * event does four things: it is stored, it wakes waiting instances, it is matched against event\n * triggers, and it re-evaluates segment-trigger membership. An identify merges a profile, which\n * wakes the waits on the properties it patched and re-evaluates segment triggers too. Plus\n * devices, subscriptions, erasure, the segment sweep and bundle deploys.\n *\n * Storage goes through a JourneyStore; every entry point takes the one the host opened.\n */\n\n/**\n * The fast answer for a user with an erasure tombstone (being erased, or erased for good): every\n * ingest-side entry point starts here and does no work for them. The gate itself is the store's\n * conditional write, which throws the same error when the tombstone lands after this check.\n */\nasync function refuseIfErased(store: JourneyStore, userId: string): Promise<void> {\n  if ((await store.erasureState(userId)) !== 'none') throw new UserErasedError(userId);\n}\n\nexport interface IngestInput {\n  userId: string;\n  event: string;\n  payload?: Record<string, unknown>;\n  ts?: number;\n  /**\n   * This occurrence's identity, and with it the idempotency of sending it.\n   *\n   * Only the sender can know whether two deliveries describe one occurrence or\n   * two, so the engine does not decide: an id it has already stored makes the\n   * second delivery a no-op. That matters because ingest is reachable from two\n   * retrying callers — an HTTP client retrying a 500, and the interpreter's\n   * send_event step being retried after it already committed its row — and a\n   * second copy of an event silently changes every count- and window-based\n   * condition that reads the log.\n   *\n   * Callers that retry should send an id they can reproduce. Omitting it gets\n   * a fresh one, which records the event as its own occurrence.\n   */\n  id?: string;\n}\n\nexport interface IngestResult {\n  /** The occurrence's identity: the caller's `id`, or the one minted for it. */\n  id: string;\n  /** False when that id was already in the log: nothing was written this time. */\n  stored: boolean;\n  woke: number;\n  started: string[];\n}\n\nexport async function ingestEvent(\n  env: JourneyEnv,\n  input: IngestInput,\n  store: JourneyStore\n): Promise<IngestResult> {\n  if (input.event.startsWith('$')) {\n    throw new Error(`event name '${input.event}' is reserved ('$' prefix is internal)`);\n  }\n  // Also reached from a running instance's send_event: an erased user's instances are stopped\n  // before the erase, so one that still gets here is refused like any other writer\n  await refuseIfErased(store, input.userId);\n  const ts = input.ts ?? Date.now();\n  const payload = input.payload ?? {};\n  // No id means the sender is not claiming this is a repeat of anything, which\n  // a fresh one states truthfully — unlike a key derived from the contents,\n  // which would silently collapse two identical events a second apart.\n  const id = input.id ?? crypto.randomUUID();\n\n  const stored = await store.insertEvent({\n    id,\n    userId: input.userId,\n    event: input.event,\n    ts,\n    payload,\n  });\n\n  /*\n   * The rest runs even for a duplicate. A retry arrives precisely because the\n   * first attempt did not finish — it committed the row and then failed — so\n   * returning early would strand the journeys the retry exists to start. Both\n   * halves are independently idempotent: waking an instance that already moved\n   * on is a no-op, and the entry ledger refuses a second entry.\n   */\n  const woke = await wakeSubscribers(env, store, input.userId, [input.event]);\n  const started = await startTriggeredJourneys(env, store, { ...input, payload }, ts);\n  started.push(...(await refreshSegmentTriggers(env, store, input.userId, ts)));\n  return { id, stored, woke, started };\n}\n\n/**\n * Wake every instance of the user waiting on any of `events`, once each: an instance subscribed\n * to several of them (a wait on two profile properties, patched together) gets one wake-up, and\n * the payload names the first event it matched.\n */\nexport async function wakeSubscribers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  events: readonly string[]\n): Promise<number> {\n  const handles = new Map<string, string>(); // handle → the event that matched it first\n  for (const event of events) {\n    for (const handle of await store.findWakeHandles(userId, event)) {\n      if (!handles.has(handle)) handles.set(handle, event);\n    }\n  }\n  let woke = 0;\n  for (const [handle, event] of handles) {\n    let instance: WorkflowInstanceLike;\n    try {\n      instance = await env.JOURNEY.get(handle);\n    } catch (error) {\n      // Unknown instance (errored out without cleanup): drop the dangling subscription. Any\n      // other failure (a database blip) keeps it: deleting would silence the wait for good\n      if (error instanceof InstanceNotFoundError) await store.unsubscribe(handle);\n      else console.warn(`[workflow] looking up ${handle} to wake it failed`, error);\n      continue;\n    }\n    try {\n      await instance.sendEvent({ type: WAKE_EVENT_TYPE, payload: { event } });\n      woke++;\n    } catch {\n      // Transient send failure (or an instance finishing right now): keep the\n      // subscription — a later event retries it, and the wait's own timeout\n      // bounds the damage. Deleting here would silence all future wake-ups.\n    }\n  }\n  return woke;\n}\n\nasync function startTriggeredJourneys(\n  env: JourneyEnv,\n  store: JourneyStore,\n  input: IngestInput & { payload: Record<string, unknown> },\n  ts: number\n): Promise<string[]> {\n  const started: string[] = [];\n  for (const route of await store.findTriggers(input.event)) {\n    // where: the payload gate — evaluated against the incoming event first\n    if (route.where !== null && !matchesWhere(input.payload, route.where)) continue;\n\n    // filter: the profile gate\n    if (route.filter !== null) {\n      const facts = new JourneyFactSource(store, input.userId);\n      if (!(await evaluateCondition(route.filter, facts, ts))) continue;\n    }\n\n    const instanceId = await startJourney(\n      env,\n      store,\n      route.workflow,\n      route.hash,\n      input.userId,\n      ts,\n      {\n        event: input.event,\n        payload: input.payload,\n      },\n      route.version\n    );\n    if (instanceId !== null) started.push(instanceId);\n  }\n  return started;\n}\n\n/**\n * Segment-entry triggers, maintained lazily: on each ingest/identify for a\n * user, re-evaluate every trigger-routed segment for that user and act on the\n * membership transition (enter → start journeys, leave → drop membership so a\n * later re-entry is observable). Purely time-driven drift (an inactivity\n * segment turning true by clock alone) has no event to ride on: the scheduled\n * sweep catches it (`sweepSegments`).\n */\nexport async function refreshSegmentTriggers(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number\n): Promise<string[]> {\n  return refreshSegments(env, store, userId, ts, await store.listSegmentTriggers());\n}\n\n/**\n * Re-evaluate segments for one user — the routed ones only, or with `segments` every one named —\n * and act on each membership transition: entering records the membership and starts the\n * segment's routed workflows, leaving drops it. A segment trigger therefore starts journeys for\n * users who enter after it is deployed; a user already a member is not entered again.\n */\nasync function refreshSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  ts: number,\n  routes: readonly SegmentTriggerRoute[],\n  segments: readonly string[] = [],\n  // A sweep loads each definition once for all its users, not once per user\n  definitions = new Map<string, ConditionIR | undefined>()\n): Promise<string[]> {\n  const bySegment = new Map<string, { workflow: string; hash: string; version?: string }[]>(\n    segments.map((name) => [name, []])\n  );\n  for (const route of routes) {\n    const list = bySegment.get(route.segment) ?? [];\n    list.push({\n      workflow: route.workflow,\n      hash: route.hash,\n      ...(route.version === undefined ? {} : { version: route.version }),\n    });\n    bySegment.set(route.segment, list);\n  }\n  if (bySegment.size === 0) return [];\n\n  const facts = new JourneyFactSource(store, userId);\n  const started: string[] = [];\n  const failures: unknown[] = [];\n  for (const [segmentId, segmentRoutes] of bySegment) {\n    if (!definitions.has(segmentId)) {\n      definitions.set(segmentId, await store.getSegmentCondition(segmentId));\n    }\n    const definition = definitions.get(segmentId);\n    if (definition === undefined) continue; // route without a definition: broken deploy, skip\n\n    const matches = await evaluateCondition(definition, facts, ts);\n    const member = await store.isSegmentMember(segmentId, userId);\n\n    if (matches && !member) {\n      // Entry transition: the membership and the starts it owes, recorded together\n      await store.addSegmentMember(\n        segmentId,\n        userId,\n        ts,\n        segmentRoutes.map((route) => route.workflow)\n      );\n    } else if (!matches && member) {\n      await store.removeSegmentMember(segmentId, userId);\n      continue;\n    }\n    if (!matches) continue;\n\n    // Every start the entry still owes — a fresh entry's, or one an earlier evaluation failed on.\n    // Each is crossed off once its instance exists, so one workflow failing neither blocks the\n    // others nor gets lost: the next evaluation (the sweep, the user's next event) retries it.\n    const pending = new Set(await store.pendingSegmentStarts(segmentId, userId));\n    for (const route of segmentRoutes) {\n      if (!pending.has(route.workflow)) continue;\n      try {\n        const instanceId = await startJourney(\n          env,\n          store,\n          route.workflow,\n          route.hash,\n          userId,\n          ts,\n          { event: '$segment_entry', payload: { segment: segmentId } },\n          route.version\n        );\n        if (instanceId !== null) started.push(instanceId);\n        await store.completeSegmentStart(segmentId, userId, route.workflow);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n  }\n  // Surface a failure to the caller (an ingest answers 500) once every start had its chance\n  if (failures.length > 0) throw failures[0];\n  return started;\n}\n\nexport interface SweepResult {\n  users: number;\n  /** Journeys the segments' entries started. */\n  started: string[];\n  /** Each deployed segment's size after the sweep (empty when the store keeps no reporting). */\n  sizes: { segment: string; size: number }[];\n}\n\n/** How many users one sweep page evaluates: a unit of resumable work (AWS checkpoints each). */\nexport const SWEEP_PAGE_SIZE = 500;\n\n/**\n * What the sweep does before it looks at any user: the runtime's own upkeep (AWS: unconfirmed\n * starts, executions that ended unseen) and the erasures left unfinished (an instance would not\n * stop). A failure of either is logged, never fatal: the pages still run. Users whose erasure is\n * still pending afterwards are skipped by every page (`sweepSegmentsPaged`).\n */\nexport async function sweepMaintenance(env: JourneyEnv, store: JourneyStore): Promise<void> {\n  try {\n    await env.JOURNEY.maintain?.();\n  } catch (error) {\n    console.error('[workflow] runtime maintenance failed', error);\n  }\n  // Erasures left pending (an admitted instance would not stop, or is still draining): retried\n  // until every one of them is confirmed stopped and the data is gone\n  for (const userId of await store.pendingErasures()) {\n    try {\n      await eraseUser(env, userId, store, Date.now());\n    } catch (error) {\n      // Still pending: the next sweep tries again, and the rest of this one goes on\n      console.error(`[workflow] erasure of ${userId} failed`, error);\n    }\n  }\n}\n\nexport interface SweepPage {\n  /** Users evaluated on this page (those being erased are listed but skipped). */\n  users: number;\n  /** Journeys the segments' entries started on this page. */\n  started: string[];\n  /** The last user id listed, to resume past (`after`); undefined when the page was empty. */\n  lastUserId?: string | undefined;\n  /** Whether the page was full, so another may follow. */\n  more: boolean;\n}\n\n/**\n * One page of the sweep: the users after `after` (ascending, at most `limit`), every deployed\n * segment evaluated for each. The pages are what makes the sweep resumable — a host whose run\n * can be cut short (a Lambda timeout) checkpoints each one and replays the checkpointed pages\n * instead of starting over; `sweepSegments` is the plain loop over them.\n */\nexport async function sweepSegmentsPaged(\n  env: JourneyEnv,\n  store: JourneyStore,\n  page: { after?: string | undefined; limit?: number | undefined; now?: number | undefined }\n): Promise<SweepPage> {\n  const now = page.now ?? Date.now();\n  const limit = page.limit ?? SWEEP_PAGE_SIZE;\n  const segments = (await store.listSegments()).map((segment) => segment.id);\n  const routes = await store.listSegmentTriggers();\n  // Read per page, not once up front: an erasure requested since the last page is honored too\n  const erasing = new Set(await store.pendingErasures());\n  const listed = await store.listUserIds({ after: page.after, limit });\n  const lastUserId = listed.at(-1);\n  // A store that ignores `after` would hand back the same page forever: refuse to loop on it.\n  // Equality only — the order is the store's collation, which JavaScript's `<` does not know\n  if (page.after !== undefined && lastUserId === page.after) {\n    throw new Error(`listUserIds did not advance past ${page.after}: the store ignores 'after'`);\n  }\n  const users = listed.filter((userId) => !erasing.has(userId));\n  const started: string[] = [];\n  const definitions = new Map<string, ConditionIR | undefined>();\n  for (const userId of users) {\n    try {\n      started.push(\n        ...(await refreshSegments(env, store, userId, now, routes, segments, definitions))\n      );\n    } catch (error) {\n      // One user's failed start is kept for the next sweep; it must not stop everyone else's\n      console.error(`[workflow] segment refresh for ${userId} failed`, error);\n    }\n  }\n  return { users: users.length, started, lastUserId, more: listed.length >= limit };\n}\n\n/**\n * The scheduled sweep: every deployed segment evaluated for every known user — the evaluator a\n * journey's conditions run on, so a member is exactly who a journey would see in it. Membership\n * follows (joiners keep the time they joined, leavers are removed), segment triggers start the\n * journeys of whoever entered by the clock alone, and the store records each segment's size.\n * It walks users page by page (`sweepSegmentsPaged`): fine for thousands, a large audience wants\n * SQL-side evaluation.\n */\nexport async function sweepSegments(\n  env: JourneyEnv,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<SweepResult> {\n  await sweepMaintenance(env, store);\n  let users = 0;\n  const started: string[] = [];\n  let after: string | undefined;\n  for (;;) {\n    const page = await sweepSegmentsPaged(env, store, { after, limit: SWEEP_PAGE_SIZE, now });\n    users += page.users;\n    started.push(...page.started);\n    if (!page.more || page.lastUserId === undefined) break;\n    after = page.lastUserId;\n  }\n  const sizes = await store.reporting.snapshotSegments(now);\n  return { users, started, sizes };\n}\n\n/**\n * Create one journey instance behind the entry ledger. Returns null when the\n * once-policy blocks the entry (the store's attempt is atomic, so concurrent\n * ingests cannot double-enter). A pair whose previous instance is recorded as\n * 'failed' is reclaimed rather than barred forever over one outage.\n */\nasync function startJourney(\n  env: JourneyEnv,\n  store: JourneyStore,\n  workflow: string,\n  hash: string,\n  userId: string,\n  ts: number,\n  trigger: { event: string; payload: Record<string, unknown> },\n  /** The code version whose bundle routed this start, read with the hash (see TriggerRoute). */\n  version?: string\n): Promise<string | null> {\n  const instanceId = buildInstanceId(workflow, hash, userId, ts);\n  const params: JourneyParams = { workflowId: workflow, contentHash: hash, userId, trigger };\n  const execution = await env.JOURNEY.plan?.({ id: instanceId, params, ts, version });\n\n  const outcome = await store.enterJourney({ workflow, userId, instanceId, hash, ts, execution });\n  if (outcome === null) {\n    // Already entered and still alive — unless its start never got through: this retry is the\n    // first chance to finish it\n    await env.JOURNEY.resume?.({ workflow, userId });\n    return null;\n  }\n\n  try {\n    await env.JOURNEY.create({ id: instanceId, params });\n  } catch (error) {\n    // A recorded start stays: the runtime may have taken it, and a retry with the same name\n    // and payload finds that execution instead of starting a second one\n    if (execution !== undefined) throw error;\n    if (outcome === 'reclaimed') {\n      // Put the corpse back rather than deleting it: the entry is still a\n      // failure, and dropping the row would erase that from the ledger.\n      await store.setEntryStatus(instanceId, 'failed');\n    } else {\n      // Roll the ledger back so a retried ingest can enter — otherwise the\n      // once-policy would permanently record an entry that never ran.\n      await store.removeEntry(instanceId);\n    }\n    throw error;\n  }\n  return instanceId;\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * Instance id: addressable (the host gets it directly to wake it), ≤100\n * chars, legal charset. The murmur3 fingerprint keeps ids distinct when the\n * sanitized/truncated userId alone would collide.\n */\nfunction buildInstanceId(workflow: string, hash: string, userId: string, ts: number): string {\n  const uid = userId.replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 24);\n  const fingerprint = murmur3(utf8.encode(userId)).toString(36);\n  return `${workflow.slice(0, 32)}-${hash.slice(0, 8)}-${uid}-${fingerprint}-${ts.toString(36)}`;\n}\n\n/* --------------------------------- identify --------------------------------- */\n\nexport interface IdentifyResult {\n  ok: true;\n  props: ProfileProps;\n  woke: number;\n  started: string[];\n}\n\n/**\n * Merge-patch profile properties (a null removes one), then wake property waits\n * and re-evaluate segment triggers. The merge is one statement in the store, so\n * two identifies landing together cannot lose each other's fields.\n */\nexport async function identifyUser(\n  env: JourneyEnv,\n  userId: string,\n  props: ProfileProps,\n  store: JourneyStore\n): Promise<IdentifyResult> {\n  await refuseIfErased(store, userId);\n  const ts = Date.now();\n  const merged = await store.mergeProfile(userId, props);\n  // A property wait subscribes to its own property's channel (see relevantEvents): only the\n  // waits on what this patch touched wake up\n  const woke = await wakeSubscribers(\n    env,\n    store,\n    userId,\n    Object.keys(props).map(profileUpdatedEvent)\n  );\n  // A profile change can move the user into (or out of) a trigger-routed segment\n  const started = await refreshSegmentTriggers(env, store, userId, ts);\n  return { ok: true, props: merged, woke, started };\n}\n\nexport interface DeviceRegistration {\n  userId: string;\n  token: string;\n  platform: string;\n  ts?: number;\n}\n\n/**\n * A push token registered for the user (or moved to them from another account: a token belongs\n * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside\n * `waitUntil`), for the new owner and the previous one.\n */\nexport async function registerDevice(\n  env: JourneyEnv,\n  device: DeviceRegistration,\n  store: JourneyStore\n): Promise<{ ok: true; woke: number }> {\n  await refuseIfErased(store, device.userId);\n  const previous = await store.removeDevice(device.token);\n  await store.upsertDevice({ ...device, ts: device.ts ?? Date.now() });\n  let woke = await wakeSubscribers(env, store, device.userId, [DEVICES_UPDATED_EVENT]);\n  if (previous !== undefined && previous !== device.userId) {\n    woke += await wakeSubscribers(env, store, previous, [DEVICES_UPDATED_EVENT]);\n  }\n  return { ok: true, woke };\n}\n\n/** Workflow instance states that will never run another step. */\nconst STOPPED_STATUSES = new Set(['complete', 'errored', 'terminated']);\n\n/**\n * Stop one admitted instance for good; true once it is known not to run again: terminated, or\n * already in a terminal state (terminate refuses those). Any other failure is not taken for\n * \"already gone\": it answers false, and the erasure waits for a retry.\n *\n * An admitted instance the platform no longer knows counts as stopped too — but only an\n * admitted one. Admission is the runner's first act, so an admitted instance did reach the\n * runtime: not found now means it finished and was evicted. An entry that is not admitted is\n * never passed here: for it, not found may just as well mean its `create` is still in flight.\n */\nasync function stopInstance(env: JourneyEnv, instanceId: string): Promise<boolean> {\n  let instance: WorkflowInstanceLike;\n  try {\n    instance = await env.JOURNEY.get(instanceId);\n  } catch (error) {\n    if (error instanceof InstanceNotFoundError) return true;\n    console.warn(`[workflow] looking up ${instanceId} to stop it failed`, error);\n    return false;\n  }\n  if (instance.terminate === undefined) return false;\n  try {\n    await instance.terminate();\n    return true;\n  } catch (error) {\n    const status = await instance.status?.().catch(() => undefined);\n    if (status !== undefined && STOPPED_STATUSES.has(status.status)) return true;\n    console.warn(`[workflow] terminating ${instanceId} failed`, error);\n    return false;\n  }\n}\n\n/**\n * Carry out a recorded erasure: stop every running instance of the user, and only once all are\n * known not to run erase their data. The tombstone is already committed, so no new entry,\n * event, profile or device of theirs lands meanwhile.\n *\n * An entry's runner admits itself before its first effect (`admitInstance`, mutually exclusive\n * with the tombstone's commit), which splits the running instances in two:\n *\n * - not admitted: nothing of it has run, and nothing will — a `create` still in flight, or a\n *   runner invoked later, meets the tombstone at admission and exits. No stop is needed, and\n *   none would be reliable: the platform may not know the instance yet.\n * - admitted: it did reach the runtime and must be stopped (`stopInstance`), or it would write\n *   rows back after the erase. One that will not stop leaves the erasure pending.\n *\n * Erasing nothing until then keeps the entries that name the instances still to stop, so a\n * retry can finish the job. The tombstone outlives the erase (`erased_at`), which is what makes\n * a repeat idempotent and a late write harmless. There is no straggler to come back for: every\n * write about a user runs in the user's locked transaction, the same lock the tombstone takes,\n * so a write either committed before the tombstone — and `forgetUser` deletes it here — or\n * waited for the lock and is refused by the tombstone it then sees.\n */\nasync function eraseUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore,\n  now: number\n): Promise<{ erased: boolean; pending: string[] }> {\n  const pending: string[] = [];\n  for (const { instanceId, admitted } of await store.runningInstances(userId)) {\n    if (!admitted) continue;\n    if (!(await stopInstance(env, instanceId))) pending.push(instanceId);\n  }\n  if (pending.length > 0) return { erased: false, pending };\n  await store.forgetUser(userId, now);\n  return { erased: true, pending };\n}\n\n/**\n * Forget a user (a deleted account): the tombstone is committed first, then the erasure carried\n * out. `erased: true` means every admitted runner of theirs was confirmed stopped, the entries\n * never admitted can never run, and the data is deleted — for good, with no time window and no\n * second pass: the tombstone commits under the user's lock, which every write about the user\n * also takes, so nothing of theirs can land after it. An admitted instance that will not stop\n * leaves it pending — nothing erased yet — and the scheduled sweep retries it; `erased: false`\n * says so. A user already erased answers `erased: true` again, with nothing to do.\n */\nexport async function forgetUser(\n  env: JourneyEnv,\n  userId: string,\n  store: JourneyStore,\n  now = Date.now()\n): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n  await store.requestErasure(userId, now);\n  return { ok: true, ...(await eraseUser(env, userId, store, now)) };\n}\n\n/**\n * The user signed out on the device: the token stays registered, bound to nobody, so the next\n * sign-in only has to bind it again. Wakes the former owner's device waits (`reachable('push')`\n * may no longer hold).\n */\nexport async function unbindDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.unbindDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT]);\n  return { ok: true, woke };\n}\n\n/** A push token forgotten for good (the push service reports it gone); wakes its owner's device waits. */\nexport async function removeDevice(\n  env: JourneyEnv,\n  token: string,\n  store: JourneyStore\n): Promise<{ ok: true; woke: number }> {\n  const owner = await store.removeDevice(token);\n  const woke =\n    owner === undefined ? 0 : await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT]);\n  return { ok: true, woke };\n}\n\n/* ---------------------------------- deploy ---------------------------------- */\n\nexport interface DeployResult {\n  workflows: string[];\n  /**\n   * Workflows whose trigger type has no runtime routing yet — they deploy (the\n   * IR is stored and versioned) but will never start until the routing lands.\n   * Currently: date (TODO — needs cron + Queues, instance creation is\n   * rate-limited and a date trigger fans out to the whole audience at once)\n   * and webhook (TODO — needs endpoint allocation).\n   */\n  unrouted: { workflow: string; trigger: TriggerIR['type'] }[];\n  /**\n   * Whether the routes now point at this bundle: always for a forced deploy, false for a\n   * versioned one when a version as new or newer is already live (nothing was swapped).\n   */\n  applied: boolean;\n}\n\n/** A bundle whose declared hashes do not describe its contents — rejected before anything is written. */\nexport class BundleIntegrityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'BundleIntegrityError';\n  }\n}\n\n/**\n * Recompute every declared contentHash and refuse the bundle if one disagrees.\n *\n * The contentHash is the address an in-flight journey reads its IR from, so\n * a hash that does not describe its own content is a way to change what a\n * pinned instance executes: submit an edited flow under the old hash and the\n * next replay picks it up. The compiler always computes the hash it ships, so\n * a mismatch means a hand-rolled payload or a stale client — neither should be\n * able to overwrite a version that journeys are running.\n *\n * Each hash is recomputed exactly the way its compiler produced it: a workflow\n * hashes its whole IR (contentHash strips itself), a segment hashes only its\n * condition. Mirroring them is load-bearing — recomputing a segment over the\n * whole record would reject every honest deploy.\n */\nfunction verifyBundleHashes(parsed: BundleIR): void {\n  const mismatched: string[] = [];\n  for (const workflow of parsed.workflows) {\n    if (semanticHash(workflow) !== workflow.contentHash) {\n      mismatched.push(`workflow '${workflow.id}'`);\n    }\n  }\n  for (const segment of parsed.segments) {\n    if (semanticHash(segment.condition) !== segment.contentHash) {\n      mismatched.push(`segment '${segment.id}'`);\n    }\n  }\n  if (mismatched.length > 0) {\n    throw new BundleIntegrityError(\n      `contentHash does not match content for ${mismatched.join(', ')} — recompile the bundle instead of editing it by hand`\n    );\n  }\n}\n\n/**\n * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed\n * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens\n * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle\n * compiled into it; without one it is forced, whatever is live.\n */\nexport async function deployBundle(\n  env: JourneyEnv,\n  bundle: unknown,\n  store: JourneyStore,\n  version?: BundleVersion\n): Promise<DeployResult> {\n  const parsed = BundleIR.parse(bundle);\n  // Before any write: a bad hash must not reach the store, where it would address content it does not describe\n  verifyBundleHashes(parsed);\n  // Nor a bundle the database cannot hold: the host migrates, the engine only checks\n  const problems = await store.checkSchema();\n  if (problems.length > 0) throw new SchemaMismatchError(problems);\n\n  for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);\n  let applied = true;\n  if (version === undefined) await store.replaceRoutes(parsed);\n  else applied = await store.replaceRoutesIfNewer(parsed, version);\n\n  const unrouted = parsed.workflows\n    .filter((workflow) => workflow.trigger.type === 'date' || workflow.trigger.type === 'webhook')\n    .map((workflow) => ({ workflow: workflow.id, trigger: workflow.trigger.type }));\n\n  return {\n    workflows: parsed.workflows.map((w) => `${w.id}@${w.contentHash.slice(0, 8)}`),\n    unrouted,\n    applied,\n  };\n}\n\n/* ------------------------------- subscriptions ------------------------------- */\n\n/** The channels a user opts out of per topic: `suppression` rows are keyed by (user, channel, topic). */\nexport const SUBSCRIPTION_CHANNELS = ['email', 'push'] as const;\nexport type SubscriptionChannel = (typeof SUBSCRIPTION_CHANNELS)[number];\n\n/**\n * Where a user stands with one channel: `true` is subscribed, per topic and for the channel as\n * a whole. The two are independent records: `all: false` masks every topic, whatever `topics`\n * says about it, and `all: true` does not switch a topic back on.\n */\nexport interface ChannelSubscriptions<T extends string = string> {\n  /**\n   * False once the user opted out of the whole channel (all email, all push). No topic is sent\n   * while it is false, however `topics` reads, so a consumer treats it as masking every topic.\n   */\n  all: boolean;\n  /**\n   * Each declared topic: false once the user opted out of it on this channel. A topic's flag is\n   * its own record, answered as it is even while `all` is false, and it stays false when `all`\n   * turns true again until a patch names the topic.\n   */\n  topics: Record<T, boolean>;\n}\n\n/**\n * A user's subscriptions, topic × channel — what `GET /subscriptions/:userId` answers. Every\n * channel lists every declared topic: a topic is a content category, and the user chooses per\n * channel whether to get it.\n */\nexport interface Subscriptions<T extends string = string> {\n  email: ChannelSubscriptions<T>;\n  push: ChannelSubscriptions<T>;\n}\n\n/** One channel's part of a patch: only what changes. */\nexport interface ChannelSubscriptionsPatch<T extends string = string> {\n  all?: boolean;\n  topics?: Partial<Record<T, boolean>>;\n}\n\n/**\n * What `PUT /subscriptions/:userId` takes: only what changes; an omitted channel or field stays\n * as it is. `all: true` clears the channel-wide opt-out only — a topic opted out on its own stays\n * off until the patch names it (a \"subscribe to all\" sends `all: true` plus every topic `true`).\n */\nexport interface SubscriptionsPatch<T extends string = string> {\n  email?: ChannelSubscriptionsPatch<T>;\n  push?: ChannelSubscriptionsPatch<T>;\n}\n\n/** One field of a patch refused, with the path the producer can fix. */\nexport interface SubscriptionsIssue {\n  path: string;\n  message: string;\n}\n\n/**\n * A subscriptions patch as it arrives over HTTP: untrusted JSON, read field by field and never\n * cast. Every topic must be one the bundle declares — the engine's list, not the caller's word.\n */\nexport function parseSubscriptionsPatch(\n  body: unknown,\n  topics: readonly string[]\n): { ok: true; patch: SubscriptionsPatch } | { ok: false; issues: SubscriptionsIssue[] } {\n  const issues: SubscriptionsIssue[] = [];\n  const object = (value: unknown): value is Record<string, unknown> =>\n    typeof value === 'object' && value !== null && !Array.isArray(value);\n  if (!object(body)) return { ok: false, issues: [{ path: '', message: 'must be an object' }] };\n  const known = new Set(topics);\n  const patch: SubscriptionsPatch = {};\n  for (const [channel, value] of Object.entries(body)) {\n    if (!(SUBSCRIPTION_CHANNELS as readonly string[]).includes(channel)) {\n      issues.push({ path: channel, message: 'not a subscription channel' });\n      continue;\n    }\n    if (!object(value)) {\n      issues.push({ path: channel, message: 'must be an object' });\n      continue;\n    }\n    const part: ChannelSubscriptionsPatch = {};\n    for (const [field, setting] of Object.entries(value)) {\n      if (field === 'all') {\n        if (typeof setting === 'boolean') part.all = setting;\n        else issues.push({ path: `${channel}.all`, message: 'must be a boolean' });\n      } else if (field === 'topics') {\n        if (!object(setting)) {\n          issues.push({ path: `${channel}.topics`, message: 'must be an object' });\n          continue;\n        }\n        const chosen: Record<string, boolean> = {};\n        for (const [topic, subscribed] of Object.entries(setting)) {\n          if (!known.has(topic)) {\n            issues.push({ path: `${channel}.topics.${topic}`, message: 'not a declared topic' });\n          } else if (typeof subscribed !== 'boolean') {\n            issues.push({ path: `${channel}.topics.${topic}`, message: 'must be a boolean' });\n          } else {\n            chosen[topic] = subscribed;\n          }\n        }\n        part.topics = chosen;\n      } else {\n        issues.push({ path: `${channel}.${field}`, message: 'unknown field' });\n      }\n    }\n    patch[channel as SubscriptionChannel] = part;\n  }\n  return issues.length > 0 ? { ok: false, issues } : { ok: true, patch };\n}\n\nasync function readSubscriptions(\n  store: JourneyStore,\n  userId: string,\n  topics: readonly string[]\n): Promise<Subscriptions> {\n  const read = async (channel: SubscriptionChannel): Promise<ChannelSubscriptions> => {\n    const suppressed = new Set(await store.listSuppressions(userId, channel));\n    return {\n      all: !suppressed.has(null),\n      topics: Object.fromEntries(topics.map((topic) => [topic, !suppressed.has(topic)])),\n    };\n  };\n  return { email: await read('email'), push: await read('push') };\n}\n\n/** The user's subscriptions over the declared `topics`; a user with an erasure tombstone is refused. */\nexport async function getSubscriptions(\n  store: JourneyStore,\n  userId: string,\n  topics: readonly string[]\n): Promise<Subscriptions> {\n  await refuseIfErased(store, userId);\n  return readSubscriptions(store, userId, topics);\n}\n\n/**\n * Apply a patch — each field given sets or clears the matching opt-out, one transaction per\n * channel — and answer the subscriptions as they now stand. A change of a channel's `all` is a\n * change of its reachability, so the waits reading it wake, both ways: an\n * `exitWhen: not(reachable('email'))` fires on the opt-out, and a wait for the channel to become\n * reachable resumes on the opt-in. Email waits key on the address property, push waits on the\n * device channel (`reachable('push')` subscribes to device changes).\n */\nexport async function setSubscriptions(\n  env: JourneyEnv,\n  store: JourneyStore,\n  userId: string,\n  patch: SubscriptionsPatch,\n  topics: readonly string[],\n  now = Date.now()\n): Promise<Subscriptions> {\n  await refuseIfErased(store, userId);\n  for (const channel of SUBSCRIPTION_CHANNELS) {\n    const part = patch[channel];\n    if (part === undefined) continue;\n    const changes: SuppressionChange[] = [];\n    if (part.all !== undefined) changes.push({ topic: null, suppressed: !part.all });\n    for (const [topic, subscribed] of Object.entries(part.topics ?? {})) {\n      if (subscribed !== undefined) changes.push({ topic, suppressed: !subscribed });\n    }\n    if (changes.length === 0) continue;\n    await store.updateSuppressions(userId, channel, changes, now);\n    if (part.all !== undefined) {\n      const wake =\n        channel === 'push'\n          ? DEVICES_UPDATED_EVENT\n          : profileUpdatedEvent(RECIPIENT_PROPERTY.email ?? 'email');\n      await wakeSubscribers(env, store, userId, [wake]);\n    }\n  }\n  return readSubscriptions(store, userId, topics);\n}\n\n/** The copy a message-scoped request came from: the channel it went out on, and its topic. */\nexport interface MessageOrigin<T extends string = string> {\n  channel: SubscriptionChannel;\n  topic: T;\n}\n\n/**\n * A user's subscriptions reached through one of their copies — what\n * `GET` / `PUT /subscriptions/by-message/:messageId` answer: the record, plus which channel and\n * topic that copy belonged to, so a preference page opened from an email can highlight it.\n */\nexport interface MessageSubscriptions<T extends string = string> extends Subscriptions<T> {\n  message: MessageOrigin<T>;\n}\n\n/**\n * The recipient of a topic copy, by the copy's id. The id is the capability: a UUID nobody can\n * guess, the same trust `/t/u/<message>` runs on. Undefined — a 404 — for an id that names no\n * copy (never sent, or erased with its user by `forgetUser`), and for a transactional one, which\n * has nothing to opt out of; the same rule as `/t/u`. A push copy's `push_<platform>` channel\n * reads as `push`, the channel its subscriptions are keyed on.\n */\nexport async function resolveMessageOwner(\n  store: JourneyStore,\n  messageId: string\n): Promise<{ userId: string; message: MessageOrigin } | undefined> {\n  if (!isMessageId(messageId)) return undefined;\n  const found = await store.reporting.lookupMessage(messageId);\n  if (found === undefined) return undefined;\n  const { userId, topic } = found;\n  // A transactional copy has no topic, and a Slack or Discord copy no subscriptions at all\n  if (topic === null) return undefined;\n  const channel =\n    found.channel === 'email' ? 'email' : found.channel.startsWith('push') ? 'push' : undefined;\n  if (channel === undefined) return undefined;\n  return { userId, message: { channel, topic } };\n}\n\n/** `getSubscriptions` for the copy's recipient, with the copy's channel and topic; undefined when `resolveMessageOwner` is. */\nexport async function getSubscriptionsByMessage(\n  store: JourneyStore,\n  messageId: string,\n  topics: readonly string[]\n): Promise<MessageSubscriptions | undefined> {\n  const owner = await resolveMessageOwner(store, messageId);\n  if (owner === undefined) return undefined;\n  return { ...(await getSubscriptions(store, owner.userId, topics)), message: owner.message };\n}\n\n/** `setSubscriptions` for the copy's recipient, answering as `getSubscriptionsByMessage` does; undefined when `resolveMessageOwner` is. */\nexport async function setSubscriptionsByMessage(\n  env: JourneyEnv,\n  store: JourneyStore,\n  messageId: string,\n  patch: SubscriptionsPatch,\n  topics: readonly string[],\n  now = Date.now()\n): Promise<MessageSubscriptions | undefined> {\n  const owner = await resolveMessageOwner(store, messageId);\n  if (owner === undefined) return undefined;\n  return {\n    ...(await setSubscriptions(env, store, owner.userId, patch, topics, now)),\n    message: owner.message,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,eAAe,eAAe,OAAqB,QAA+B;CAChF,IAAK,MAAM,MAAM,aAAa,MAAM,MAAO,QAAQ,MAAM,IAAIA,sBAAAA,gBAAgB,MAAM;AACrF;AAiCA,eAAsB,YACpB,KACA,OACA,OACuB;CACvB,IAAI,MAAM,MAAM,WAAW,GAAG,GAC5B,MAAM,IAAI,MAAM,eAAe,MAAM,MAAM,uCAAuC;CAIpF,MAAM,eAAe,OAAO,MAAM,MAAM;CACxC,MAAM,KAAK,MAAM,MAAM,KAAK,IAAI;CAChC,MAAM,UAAU,MAAM,WAAW,CAAC;CAIlC,MAAM,KAAK,MAAM,MAAM,OAAO,WAAW;CAEzC,MAAM,SAAS,MAAM,MAAM,YAAY;EACrC;EACA,QAAQ,MAAM;EACd,OAAO,MAAM;EACb;EACA;CACF,CAAC;CASD,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,CAAC,MAAM,KAAK,CAAC;CAC1E,MAAM,UAAU,MAAM,uBAAuB,KAAK,OAAO;EAAE,GAAG;EAAO;CAAQ,GAAG,EAAE;CAClF,QAAQ,KAAK,GAAI,MAAM,uBAAuB,KAAK,OAAO,MAAM,QAAQ,EAAE,CAAE;CAC5E,OAAO;EAAE;EAAI;EAAQ;EAAM;CAAQ;AACrC;;;;;;AAOA,eAAsB,gBACpB,KACA,OACA,QACA,QACiB;CACjB,MAAM,0BAAU,IAAI,IAAoB;CACxC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,QAAQ,KAAK,GAC5D,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG,QAAQ,IAAI,QAAQ,KAAK;CAGvD,IAAI,OAAO;CACX,KAAK,MAAM,CAAC,QAAQ,UAAU,SAAS;EACrC,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,IAAI,QAAQ,IAAI,MAAM;EACzC,SAAS,OAAO;GAGd,IAAI,iBAAiBC,sBAAAA,uBAAuB,MAAM,MAAM,YAAY,MAAM;QACrE,QAAQ,KAAK,yBAAyB,OAAO,qBAAqB,KAAK;GAC5E;EACF;EACA,IAAI;GACF,MAAM,SAAS,UAAU;IAAE,MAAMC,sBAAAA;IAAiB,SAAS,EAAE,MAAM;GAAE,CAAC;GACtE;EACF,QAAQ,CAIR;CACF;CACA,OAAO;AACT;AAEA,eAAe,uBACb,KACA,OACA,OACA,IACmB;CACnB,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,MAAM,MAAM,aAAa,MAAM,KAAK,GAAG;EAEzD,IAAI,MAAM,UAAU,QAAQ,CAACC,yBAAAA,aAAa,MAAM,SAAS,MAAM,KAAK,GAAG;EAGvE,IAAI,MAAM,WAAW,MAAM;GACzB,MAAM,QAAQ,IAAIC,oBAAAA,kBAAkB,OAAO,MAAM,MAAM;GACvD,IAAI,CAAE,MAAMC,yBAAAA,kBAAkB,MAAM,QAAQ,OAAO,EAAE,GAAI;EAC3D;EAEA,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,MAAM,QACN,IACA;GACE,OAAO,MAAM;GACb,SAAS,MAAM;EACjB,GACA,MAAM,OACR;EACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;CAClD;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,uBACpB,KACA,OACA,QACA,IACmB;CACnB,OAAO,gBAAgB,KAAK,OAAO,QAAQ,IAAI,MAAM,MAAM,oBAAoB,CAAC;AAClF;;;;;;;AAQA,eAAe,gBACb,KACA,OACA,QACA,IACA,QACA,WAA8B,CAAC,GAE/B,8BAAc,IAAI,IAAqC,GACpC;CACnB,MAAM,YAAY,IAAI,IACpB,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CACnC;CACA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,OAAO,UAAU,IAAI,MAAM,OAAO,KAAK,CAAC;EAC9C,KAAK,KAAK;GACR,UAAU,MAAM;GAChB,MAAM,MAAM;GACZ,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;EAClE,CAAC;EACD,UAAU,IAAI,MAAM,SAAS,IAAI;CACnC;CACA,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;CAElC,MAAM,QAAQ,IAAID,oBAAAA,kBAAkB,OAAO,MAAM;CACjD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,WAAW,kBAAkB,WAAW;EAClD,IAAI,CAAC,YAAY,IAAI,SAAS,GAC5B,YAAY,IAAI,WAAW,MAAM,MAAM,oBAAoB,SAAS,CAAC;EAEvE,MAAM,aAAa,YAAY,IAAI,SAAS;EAC5C,IAAI,eAAe,KAAA,GAAW;EAE9B,MAAM,UAAU,MAAMC,yBAAAA,kBAAkB,YAAY,OAAO,EAAE;EAC7D,MAAM,SAAS,MAAM,MAAM,gBAAgB,WAAW,MAAM;EAE5D,IAAI,WAAW,CAAC,QAEd,MAAM,MAAM,iBACV,WACA,QACA,IACA,cAAc,KAAK,UAAU,MAAM,QAAQ,CAC7C;OACK,IAAI,CAAC,WAAW,QAAQ;GAC7B,MAAM,MAAM,oBAAoB,WAAW,MAAM;GACjD;EACF;EACA,IAAI,CAAC,SAAS;EAKd,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,qBAAqB,WAAW,MAAM,CAAC;EAC3E,KAAK,MAAM,SAAS,eAAe;GACjC,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG;GAClC,IAAI;IACF,MAAM,aAAa,MAAM,aACvB,KACA,OACA,MAAM,UACN,MAAM,MACN,QACA,IACA;KAAE,OAAO;KAAkB,SAAS,EAAE,SAAS,UAAU;IAAE,GAC3D,MAAM,OACR;IACA,IAAI,eAAe,MAAM,QAAQ,KAAK,UAAU;IAChD,MAAM,MAAM,qBAAqB,WAAW,QAAQ,MAAM,QAAQ;GACpE,SAAS,OAAO;IACd,SAAS,KAAK,KAAK;GACrB;EACF;CACF;CAEA,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CACxC,OAAO;AACT;;AAWA,MAAa,kBAAkB;;;;;;;AAQ/B,eAAsB,iBAAiB,KAAiB,OAAoC;CAC1F,IAAI;EACF,MAAM,IAAI,QAAQ,WAAW;CAC/B,SAAS,OAAO;EACd,QAAQ,MAAM,yCAAyC,KAAK;CAC9D;CAGA,KAAK,MAAM,UAAU,MAAM,MAAM,gBAAgB,GAC/C,IAAI;EACF,MAAM,UAAU,KAAK,QAAQ,OAAO,KAAK,IAAI,CAAC;CAChD,SAAS,OAAO;EAEd,QAAQ,MAAM,yBAAyB,OAAO,UAAU,KAAK;CAC/D;AAEJ;;;;;;;AAmBA,eAAsB,mBACpB,KACA,OACA,MACoB;CACpB,MAAM,MAAM,KAAK,OAAO,KAAK,IAAI;CACjC,MAAM,QAAQ,KAAK,SAAA;CACnB,MAAM,YAAY,MAAM,MAAM,aAAa,EAAA,CAAG,KAAK,YAAY,QAAQ,EAAE;CACzE,MAAM,SAAS,MAAM,MAAM,oBAAoB;CAE/C,MAAM,UAAU,IAAI,IAAI,MAAM,MAAM,gBAAgB,CAAC;CACrD,MAAM,SAAS,MAAM,MAAM,YAAY;EAAE,OAAO,KAAK;EAAO;CAAM,CAAC;CACnE,MAAM,aAAa,OAAO,GAAG,EAAE;CAG/B,IAAI,KAAK,UAAU,KAAA,KAAa,eAAe,KAAK,OAClD,MAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,4BAA4B;CAE7F,MAAM,QAAQ,OAAO,QAAQ,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC;CAC5D,MAAM,UAAoB,CAAC;CAC3B,MAAM,8BAAc,IAAI,IAAqC;CAC7D,KAAK,MAAM,UAAU,OACnB,IAAI;EACF,QAAQ,KACN,GAAI,MAAM,gBAAgB,KAAK,OAAO,QAAQ,KAAK,QAAQ,UAAU,WAAW,CAClF;CACF,SAAS,OAAO;EAEd,QAAQ,MAAM,kCAAkC,OAAO,UAAU,KAAK;CACxE;CAEF,OAAO;EAAE,OAAO,MAAM;EAAQ;EAAS;EAAY,MAAM,OAAO,UAAU;CAAM;AAClF;;;;;;;;;AAUA,eAAsB,cACpB,KACA,OACA,MAAM,KAAK,IAAI,GACO;CACtB,MAAM,iBAAiB,KAAK,KAAK;CACjC,IAAI,QAAQ;CACZ,MAAM,UAAoB,CAAC;CAC3B,IAAI;CACJ,SAAS;EACP,MAAM,OAAO,MAAM,mBAAmB,KAAK,OAAO;GAAE;GAAO,OAAA;GAAwB;EAAI,CAAC;EACxF,SAAS,KAAK;EACd,QAAQ,KAAK,GAAG,KAAK,OAAO;EAC5B,IAAI,CAAC,KAAK,QAAQ,KAAK,eAAe,KAAA,GAAW;EACjD,QAAQ,KAAK;CACf;CACA,MAAM,QAAQ,MAAM,MAAM,UAAU,iBAAiB,GAAG;CACxD,OAAO;EAAE;EAAO;EAAS;CAAM;AACjC;;;;;;;AAQA,eAAe,aACb,KACA,OACA,UACA,MACA,QACA,IACA,SAEA,SACwB;CACxB,MAAM,aAAa,gBAAgB,UAAU,MAAM,QAAQ,EAAE;CAC7D,MAAM,SAAwB;EAAE,YAAY;EAAU,aAAa;EAAM;EAAQ;CAAQ;CACzF,MAAM,YAAY,MAAM,IAAI,QAAQ,OAAO;EAAE,IAAI;EAAY;EAAQ;EAAI;CAAQ,CAAC;CAElF,MAAM,UAAU,MAAM,MAAM,aAAa;EAAE;EAAU;EAAQ;EAAY;EAAM;EAAI;CAAU,CAAC;CAC9F,IAAI,YAAY,MAAM;EAGpB,MAAM,IAAI,QAAQ,SAAS;GAAE;GAAU;EAAO,CAAC;EAC/C,OAAO;CACT;CAEA,IAAI;EACF,MAAM,IAAI,QAAQ,OAAO;GAAE,IAAI;GAAY;EAAO,CAAC;CACrD,SAAS,OAAO;EAGd,IAAI,cAAc,KAAA,GAAW,MAAM;EACnC,IAAI,YAAY,aAGd,MAAM,MAAM,eAAe,YAAY,QAAQ;OAI/C,MAAM,MAAM,YAAY,UAAU;EAEpC,MAAM;CACR;CACA,OAAO;AACT;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAS,gBAAgB,UAAkB,MAAc,QAAgB,IAAoB;CAC3F,MAAM,MAAM,OAAO,QAAQ,mBAAmB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAC9D,MAAM,cAAcC,sBAAAA,QAAQ,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE;CAC5D,OAAO,GAAG,SAAS,MAAM,GAAG,EAAE,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,YAAY,GAAG,GAAG,SAAS,EAAE;AAC7F;;;;;;AAgBA,eAAsB,aACpB,KACA,QACA,OACA,OACyB;CACzB,MAAM,eAAe,OAAO,MAAM;CAClC,MAAM,KAAK,KAAK,IAAI;CAYpB,OAAO;EAAE,IAAI;EAAM,OAAO,MAXL,MAAM,aAAa,QAAQ,KAAK;EAWnB,MAAA,MARf,gBACjB,KACA,OACA,QACA,OAAO,KAAK,KAAK,CAAC,CAAC,IAAIC,yBAAAA,mBAAmB,CAC5C;EAGwC,SAAA,MADlB,uBAAuB,KAAK,OAAO,QAAQ,EAAE;CACnB;AAClD;;;;;;AAcA,eAAsB,eACpB,KACA,QACA,OACqC;CACrC,MAAM,eAAe,OAAO,OAAO,MAAM;CACzC,MAAM,WAAW,MAAM,MAAM,aAAa,OAAO,KAAK;CACtD,MAAM,MAAM,aAAa;EAAE,GAAG;EAAQ,IAAI,OAAO,MAAM,KAAK,IAAI;CAAE,CAAC;CACnE,IAAI,OAAO,MAAM,gBAAgB,KAAK,OAAO,OAAO,QAAQ,CAACC,yBAAAA,qBAAqB,CAAC;CACnF,IAAI,aAAa,KAAA,KAAa,aAAa,OAAO,QAChD,QAAQ,MAAM,gBAAgB,KAAK,OAAO,UAAU,CAACA,yBAAAA,qBAAqB,CAAC;CAE7E,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;AAGA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAY;CAAW;AAAY,CAAC;;;;;;;;;;;AAYtE,eAAe,aAAa,KAAiB,YAAsC;CACjF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,IAAI,QAAQ,IAAI,UAAU;CAC7C,SAAS,OAAO;EACd,IAAI,iBAAiBP,sBAAAA,uBAAuB,OAAO;EACnD,QAAQ,KAAK,yBAAyB,WAAW,qBAAqB,KAAK;EAC3E,OAAO;CACT;CACA,IAAI,SAAS,cAAc,KAAA,GAAW,OAAO;CAC7C,IAAI;EACF,MAAM,SAAS,UAAU;EACzB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,SAAS,MAAM,SAAS,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9D,IAAI,WAAW,KAAA,KAAa,iBAAiB,IAAI,OAAO,MAAM,GAAG,OAAO;EACxE,QAAQ,KAAK,0BAA0B,WAAW,UAAU,KAAK;EACjE,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAe,UACb,KACA,QACA,OACA,KACiD;CACjD,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,EAAE,YAAY,cAAc,MAAM,MAAM,iBAAiB,MAAM,GAAG;EAC3E,IAAI,CAAC,UAAU;EACf,IAAI,CAAE,MAAM,aAAa,KAAK,UAAU,GAAI,QAAQ,KAAK,UAAU;CACrE;CACA,IAAI,QAAQ,SAAS,GAAG,OAAO;EAAE,QAAQ;EAAO;CAAQ;CACxD,MAAM,MAAM,WAAW,QAAQ,GAAG;CAClC,OAAO;EAAE,QAAQ;EAAM;CAAQ;AACjC;;;;;;;;;;AAWA,eAAsB,WACpB,KACA,QACA,OACA,MAAM,KAAK,IAAI,GAC4C;CAC3D,MAAM,MAAM,eAAe,QAAQ,GAAG;CACtC,OAAO;EAAE,IAAI;EAAM,GAAI,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG;CAAG;AACnE;;;;;;AAOA,eAAsB,aACpB,KACA,OACA,OACqC;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAO,CAACO,yBAAAA,qBAAqB,CAAC;CACpE;AAC1B;;AAGA,eAAsB,aACpB,KACA,OACA,OACqC;CACrC,MAAM,QAAQ,MAAM,MAAM,aAAa,KAAK;CAG5C,OAAO;EAAE,IAAI;EAAM,MADjB,UAAU,KAAA,IAAY,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAO,CAACA,yBAAAA,qBAAqB,CAAC;CACpE;AAC1B;;AAsBA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,mBAAmB,QAAwB;CAClD,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,YAAY,OAAO,WAC5B,IAAIC,aAAAA,aAAa,QAAQ,MAAM,SAAS,aACtC,WAAW,KAAK,aAAa,SAAS,GAAG,EAAE;CAG/C,KAAK,MAAM,WAAW,OAAO,UAC3B,IAAIA,aAAAA,aAAa,QAAQ,SAAS,MAAM,QAAQ,aAC9C,WAAW,KAAK,YAAY,QAAQ,GAAG,EAAE;CAG7C,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,qBACR,0CAA0C,WAAW,KAAK,IAAI,EAAE,sDAClE;AAEJ;;;;;;;AAQA,eAAsB,aACpB,KACA,QACA,OACA,SACuB;CACvB,MAAM,SAASC,WAAAA,SAAS,MAAM,MAAM;CAEpC,mBAAmB,MAAM;CAEzB,MAAM,WAAW,MAAM,MAAM,YAAY;CACzC,IAAI,SAAS,SAAS,GAAG,MAAM,IAAIC,oBAAAA,oBAAoB,QAAQ;CAE/D,KAAK,MAAM,YAAY,OAAO,WAAW,MAAM,MAAM,cAAc,QAAQ;CAC3E,IAAI,UAAU;CACd,IAAI,YAAY,KAAA,GAAW,MAAM,MAAM,cAAc,MAAM;MACtD,UAAU,MAAM,MAAM,qBAAqB,QAAQ,OAAO;CAE/D,MAAM,WAAW,OAAO,UACrB,QAAQ,aAAa,SAAS,QAAQ,SAAS,UAAU,SAAS,QAAQ,SAAS,SAAS,CAAC,CAC7F,KAAK,cAAc;EAAE,UAAU,SAAS;EAAI,SAAS,SAAS,QAAQ;CAAK,EAAE;CAEhF,OAAO;EACL,WAAW,OAAO,UAAU,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,GAAG;EAC7E;EACA;CACF;AACF;;AAKA,MAAa,wBAAwB,CAAC,SAAS,MAAM;;;;;AA0DrD,SAAgB,wBACd,MACA,QACuF;CACvF,MAAM,SAA+B,CAAC;CACtC,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;CACrE,IAAI,CAAC,OAAO,IAAI,GAAG,OAAO;EAAE,IAAI;EAAO,QAAQ,CAAC;GAAE,MAAM;GAAI,SAAS;EAAoB,CAAC;CAAE;CAC5F,MAAM,QAAQ,IAAI,IAAI,MAAM;CAC5B,MAAM,QAA4B,CAAC;CACnC,KAAK,MAAM,CAAC,SAAS,UAAU,OAAO,QAAQ,IAAI,GAAG;EACnD,IAAI,CAAE,sBAA4C,SAAS,OAAO,GAAG;GACnE,OAAO,KAAK;IAAE,MAAM;IAAS,SAAS;GAA6B,CAAC;GACpE;EACF;EACA,IAAI,CAAC,OAAO,KAAK,GAAG;GAClB,OAAO,KAAK;IAAE,MAAM;IAAS,SAAS;GAAoB,CAAC;GAC3D;EACF;EACA,MAAM,OAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,OAAO,YAAY,OAAO,QAAQ,KAAK,GACjD,IAAI,UAAU,OAAO;GACnB,IAAI,OAAO,YAAY,WAAW,KAAK,MAAM;QACxC,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ;IAAO,SAAS;GAAoB,CAAC;EAC3E,OAAO,IAAI,UAAU,UAAU;GAC7B,IAAI,CAAC,OAAO,OAAO,GAAG;IACpB,OAAO,KAAK;KAAE,MAAM,GAAG,QAAQ;KAAU,SAAS;IAAoB,CAAC;IACvE;GACF;GACA,MAAM,SAAkC,CAAC;GACzC,KAAK,MAAM,CAAC,OAAO,eAAe,OAAO,QAAQ,OAAO,GACtD,IAAI,CAAC,MAAM,IAAI,KAAK,GAClB,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ,UAAU;IAAS,SAAS;GAAuB,CAAC;QAC9E,IAAI,OAAO,eAAe,WAC/B,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ,UAAU;IAAS,SAAS;GAAoB,CAAC;QAEhF,OAAO,SAAS;GAGpB,KAAK,SAAS;EAChB,OACE,OAAO,KAAK;GAAE,MAAM,GAAG,QAAQ,GAAG;GAAS,SAAS;EAAgB,CAAC;EAGzE,MAAM,WAAkC;CAC1C;CACA,OAAO,OAAO,SAAS,IAAI;EAAE,IAAI;EAAO;CAAO,IAAI;EAAE,IAAI;EAAM;CAAM;AACvE;AAEA,eAAe,kBACb,OACA,QACA,QACwB;CACxB,MAAM,OAAO,OAAO,YAAgE;EAClF,MAAM,aAAa,IAAI,IAAI,MAAM,MAAM,iBAAiB,QAAQ,OAAO,CAAC;EACxE,OAAO;GACL,KAAK,CAAC,WAAW,IAAI,IAAI;GACzB,QAAQ,OAAO,YAAY,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC;EACnF;CACF;CACA,OAAO;EAAE,OAAO,MAAM,KAAK,OAAO;EAAG,MAAM,MAAM,KAAK,MAAM;CAAE;AAChE;;AAGA,eAAsB,iBACpB,OACA,QACA,QACwB;CACxB,MAAM,eAAe,OAAO,MAAM;CAClC,OAAO,kBAAkB,OAAO,QAAQ,MAAM;AAChD;;;;;;;;;AAUA,eAAsB,iBACpB,KACA,OACA,QACA,OACA,QACA,MAAM,KAAK,IAAI,GACS;CACxB,MAAM,eAAe,OAAO,MAAM;CAClC,KAAK,MAAM,WAAW,uBAAuB;EAC3C,MAAM,OAAO,MAAM;EACnB,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,UAA+B,CAAC;EACtC,IAAI,KAAK,QAAQ,KAAA,GAAW,QAAQ,KAAK;GAAE,OAAO;GAAM,YAAY,CAAC,KAAK;EAAI,CAAC;EAC/E,KAAK,MAAM,CAAC,OAAO,eAAe,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAChE,IAAI,eAAe,KAAA,GAAW,QAAQ,KAAK;GAAE;GAAO,YAAY,CAAC;EAAW,CAAC;EAE/E,IAAI,QAAQ,WAAW,GAAG;EAC1B,MAAM,MAAM,mBAAmB,QAAQ,SAAS,SAAS,GAAG;EAC5D,IAAI,KAAK,QAAQ,KAAA,GAKf,MAAM,gBAAgB,KAAK,OAAO,QAAQ,CAHxC,YAAY,SACRH,yBAAAA,wBACAD,yBAAAA,oBAAoBK,yBAAAA,mBAAmB,SAAS,OAAO,CACd,CAAC;CAEpD;CACA,OAAO,kBAAkB,OAAO,QAAQ,MAAM;AAChD;;;;;;;;AAwBA,eAAsB,oBACpB,OACA,WACiE;CACjE,IAAI,CAACC,2BAAAA,YAAY,SAAS,GAAG,OAAO,KAAA;CACpC,MAAM,QAAQ,MAAM,MAAM,UAAU,cAAc,SAAS;CAC3D,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,EAAE,QAAQ,UAAU;CAE1B,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,MAAM,UACJ,MAAM,YAAY,UAAU,UAAU,MAAM,QAAQ,WAAW,MAAM,IAAI,SAAS,KAAA;CACpF,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,OAAO;EAAE;EAAQ,SAAS;GAAE;GAAS;EAAM;CAAE;AAC/C;;AAGA,eAAsB,0BACpB,OACA,WACA,QAC2C;CAC3C,MAAM,QAAQ,MAAM,oBAAoB,OAAO,SAAS;CACxD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,MAAM,iBAAiB,OAAO,MAAM,QAAQ,MAAM;EAAI,SAAS,MAAM;CAAQ;AAC5F;;AAGA,eAAsB,0BACpB,KACA,OACA,WACA,OACA,QACA,MAAM,KAAK,IAAI,GAC4B;CAC3C,MAAM,QAAQ,MAAM,oBAAoB,OAAO,SAAS;CACxD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO;EACL,GAAI,MAAM,iBAAiB,KAAK,OAAO,MAAM,QAAQ,OAAO,QAAQ,GAAG;EACvE,SAAS,MAAM;CACjB;AACF"}

package/dist/host/ingest.d.cts

@@ -251,4 +251,32 @@ export declare function getSubscriptions(store: JourneyStore, userId: string, to
  * device channel (`reachable('push')` subscribes to device changes).
  */
 export declare function setSubscriptions(env: JourneyEnv, store: JourneyStore, userId: string, patch: SubscriptionsPatch, topics: readonly string[], now?: number): Promise<Subscriptions>;
+/** The copy a message-scoped request came from: the channel it went out on, and its topic. */
+export interface MessageOrigin<T extends string = string> {
+  channel: SubscriptionChannel;
+  topic: T;
+}
+/**
+ * A user's subscriptions reached through one of their copies — what
+ * `GET` / `PUT /subscriptions/by-message/:messageId` answer: the record, plus which channel and
+ * topic that copy belonged to, so a preference page opened from an email can highlight it.
+ */
+export interface MessageSubscriptions<T extends string = string> extends Subscriptions<T> {
+  message: MessageOrigin<T>;
+}
+/**
+ * The recipient of a topic copy, by the copy's id. The id is the capability: a UUID nobody can
+ * guess, the same trust `/t/u/<message>` runs on. Undefined — a 404 — for an id that names no
+ * copy (never sent, or erased with its user by `forgetUser`), and for a transactional one, which
+ * has nothing to opt out of; the same rule as `/t/u`. A push copy's `push_<platform>` channel
+ * reads as `push`, the channel its subscriptions are keyed on.
+ */
+export declare function resolveMessageOwner(store: JourneyStore, messageId: string): Promise<{
+  userId: string;
+  message: MessageOrigin;
+} | undefined>;
+/** `getSubscriptions` for the copy's recipient, with the copy's channel and topic; undefined when `resolveMessageOwner` is. */
+export declare function getSubscriptionsByMessage(store: JourneyStore, messageId: string, topics: readonly string[]): Promise<MessageSubscriptions | undefined>;
+/** `setSubscriptions` for the copy's recipient, answering as `getSubscriptionsByMessage` does; undefined when `resolveMessageOwner` is. */
+export declare function setSubscriptionsByMessage(env: JourneyEnv, store: JourneyStore, messageId: string, patch: SubscriptionsPatch, topics: readonly string[], now?: number): Promise<MessageSubscriptions | undefined>;
 //# sourceMappingURL=ingest.d.cts.map

package/dist/host/ingest.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.d.cts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBA+CiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBA0EmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBA0Fc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;qBAIf;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBAkB7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAgFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO,eACN,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2FD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,gBACT,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}
+{"version":3,"file":"ingest.d.cts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBAgDiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBA0EmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBA0Fc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;qBAIf;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBAkB7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAgFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO,eACN,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2FD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,gBACT,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ;;iBAwBM,cAAc;EAC7B,SAAS;EACT,OAAO;;;;;;;iBAQQ,qBAAqB,mCAAmC,cAAc;EACrF,SAAS,cAAc;;;;;;;;;wBAUH,oBACpB,OAAO,cACP,oBACC;EAAU;EAAgB,SAAS;;;wBAchB,0BACpB,OAAO,cACP,mBACA,4BACC,QAAQ;;wBAOW,0BACpB,KAAK,YACL,OAAO,cACP,mBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}

package/dist/host/ingest.d.mts

@@ -251,4 +251,32 @@ export declare function getSubscriptions(store: JourneyStore, userId: string, to
  * device channel (`reachable('push')` subscribes to device changes).
  */
 export declare function setSubscriptions(env: JourneyEnv, store: JourneyStore, userId: string, patch: SubscriptionsPatch, topics: readonly string[], now?: number): Promise<Subscriptions>;
+/** The copy a message-scoped request came from: the channel it went out on, and its topic. */
+export interface MessageOrigin<T extends string = string> {
+  channel: SubscriptionChannel;
+  topic: T;
+}
+/**
+ * A user's subscriptions reached through one of their copies — what
+ * `GET` / `PUT /subscriptions/by-message/:messageId` answer: the record, plus which channel and
+ * topic that copy belonged to, so a preference page opened from an email can highlight it.
+ */
+export interface MessageSubscriptions<T extends string = string> extends Subscriptions<T> {
+  message: MessageOrigin<T>;
+}
+/**
+ * The recipient of a topic copy, by the copy's id. The id is the capability: a UUID nobody can
+ * guess, the same trust `/t/u/<message>` runs on. Undefined — a 404 — for an id that names no
+ * copy (never sent, or erased with its user by `forgetUser`), and for a transactional one, which
+ * has nothing to opt out of; the same rule as `/t/u`. A push copy's `push_<platform>` channel
+ * reads as `push`, the channel its subscriptions are keyed on.
+ */
+export declare function resolveMessageOwner(store: JourneyStore, messageId: string): Promise<{
+  userId: string;
+  message: MessageOrigin;
+} | undefined>;
+/** `getSubscriptions` for the copy's recipient, with the copy's channel and topic; undefined when `resolveMessageOwner` is. */
+export declare function getSubscriptionsByMessage(store: JourneyStore, messageId: string, topics: readonly string[]): Promise<MessageSubscriptions | undefined>;
+/** `setSubscriptions` for the copy's recipient, answering as `getSubscriptionsByMessage` does; undefined when `resolveMessageOwner` is. */
+export declare function setSubscriptionsByMessage(env: JourneyEnv, store: JourneyStore, messageId: string, patch: SubscriptionsPatch, topics: readonly string[], now?: number): Promise<MessageSubscriptions | undefined>;
 //# sourceMappingURL=ingest.d.mts.map

package/dist/host/ingest.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.d.mts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBA+CiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBA0EmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBA0Fc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;qBAIf;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBAkB7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAgFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO,eACN,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2FD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,gBACT,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}
+{"version":3,"file":"ingest.d.mts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBAgDiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBA0EmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBA0Fc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;qBAIf;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBAkB7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAgFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO,eACN,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2FD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,gBACT,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ;;iBAwBM,cAAc;EAC7B,SAAS;EACT,OAAO;;;;;;;iBAQQ,qBAAqB,mCAAmC,cAAc;EACrF,SAAS,cAAc;;;;;;;;;wBAUH,oBACpB,OAAO,cACP,oBACC;EAAU;EAAgB,SAAS;;;wBAchB,0BACpB,OAAO,cACP,mBACA,4BACC,QAAQ;;wBAOW,0BACpB,KAAK,YACL,OAAO,cACP,mBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}