@shware/workflow 6.0.0 → 6.1.1

package/README.md

@@ -525,15 +525,20 @@ the engine does before and after the send:
 
 There is no global sender: share addresses through a module of your own. A
 topic email's unsubscribe link is the template's `unsubscribeUrl`, else the
-config's `email.unsubscribeUrl`, else none; a transactional email never has one
-(`resolveEmail` is the rule). A layout reads it from the render, never from a
-constant, so a template's own URL reaches its HTML; the resolved `topic` is
+config's `email.unsubscribeUrl`, else none; its preferences link is the config's
+`email.preferencesUrl` with the copy's message id, when the copy has one; a
+transactional email never has either (`resolveEmail` is the rule). A layout
+reads them from the render, never from a constant, so a template's own URL
+reaches its HTML and each copy's link names that copy; the resolved `topic` is
 there too, for a line like "you get these because you subscribed to tips":
 
 ```tsx
 import { useEmailContext } from '@shware/workflow/email-context';
 
-const { unsubscribeUrl } = useEmailContext();
+const { unsubscribeUrl, preferencesUrl } = useEmailContext();
+{
+  preferencesUrl !== undefined && <Link href={preferencesUrl}>Email preferences</Link>;
+}
 {
   unsubscribeUrl !== undefined && <Link href={unsubscribeUrl}>Unsubscribe</Link>;
 }
@@ -543,6 +548,7 @@ const { unsubscribeUrl } = useEmailContext();
 // workflow.config.ts
 email: {
   unsubscribeUrl: 'https://acme.test/unsubscribe', // templates without their own
+  preferencesUrl: 'https://acme.test/settings/email', // the app's preference page
   tracking: { quickClickMs: 1_000 }, // the default
 },
 ```
@@ -575,6 +581,26 @@ two buttons: the email's topic, and all email. Without reporting, the header nam
 template's own unsubscribe link, with no one-click claim. Only https URLs are named, so a local
 `http://` origin sends no header.
 
+So a topic email carries two ways out, for two readers. The **header** is for the mail client:
+`List-Unsubscribe` points at the Worker's own `/t/u/<message>`, which a one-click POST or the
+Worker's plain confirmation page settles without the app. The **footer** is for the person:
+`preferencesUrl` is the app's own page, branded, signed in or not, reached as
+`https://acme.test/settings/email?m=<message id>` (the page's own query is kept, `m` set beside
+it). The message id in `m` is how the page knows the recipient without a login: it is the
+capability, an unguessable UUID that only ever reached that mailbox, the same trust `/t/u` runs
+on. The page's API calls `GET /subscriptions/by-message/<m>` with the bearer
+(`JourneyClient.getSubscriptionsByMessage`), gets the recipient's record plus
+`message: { channel, topic }` to highlight the topic that email belonged to, and writes with
+`PUT /subscriptions/by-message/<m>` (`setSubscriptionsByMessage`), the same patch as the user
+endpoint. An id that names no copy (never sent, or erased with its user by `/users/forget`) or a
+transactional one answers 404, the rule `/t/u` applies: show the link as expired. The Worker
+does not rate-limit these routes; the app's proxy does, as it sees fit. The link is tracked as
+an ordinary click (`/t/l/...`), never as an unsubscribe: `preferencesUrl` must not share its
+origin and path with `unsubscribeUrl` (or a template's own), and the config refuses one that
+does. Without reporting (no Postgres reporting or no `WORKFLOW_ORIGIN`) there is no message id,
+so `preferencesUrl` is `undefined` in the render and the footer shows nothing; a preview
+(`GET /preview` and the studio) renders it with a placeholder id, `PREVIEW_MESSAGE_ID`.
+
 What a user opted out of is the engine's record, per topic and channel: a topic email is
 skipped while its topic (on email) or all email is opted out, a transactional email never is,
 and `reachable('email')` reads the all-email opt-out only — a user unsubscribed from one topic
@@ -665,6 +691,10 @@ const relay = await startApnsRelay({ port: 8280 });
 // wrangler dev --var APNS_RELAY_ORIGIN:http://localhost:8280
 ```
 
+The relay sees the provider JWT, so production (`ENVIRONMENT` unset or
+`production`) ignores `APNS_RELAY_ORIGIN`: it calls APNs directly and logs one
+`console.error` saying the variable was ignored.
+
 ### Slack and Discord
 
 Team-channel messages go through incoming webhooks. The URL is a secret, so the
@@ -704,20 +734,20 @@ Discord; supply anything else with `journeyWorker({ messages })`.
 
 `defineConfig` takes:
 
-| Field       | Holds                                                                               |
-| ----------- | ----------------------------------------------------------------------------------- |
-| `title`     | The Studio title                                                                    |
-| `contract`  | The `defineContract(...)` every `/events` and `/identify` is validated against      |
-| `workflows` | The workflows to deploy                                                             |
-| `segments`  | Named segments                                                                      |
-| `actions`   | Custom actions `.run()` uses                                                        |
-| `templates` | The registries: `{ email?, push?, discord?, slack? }`; topics typed by the contract |
-| `email`     | `{ unsubscribeUrl?, tracking? }`: what every topic email template shares            |
-| `runtime`   | Per mode (`development`, `production`, …): `{ timeScale?, logMessages? }`           |
-| `apns`      | `{ topic, keyId, teamId, environment? }`                                            |
-| `fcm`       | `{ androidChannelId? }`                                                             |
-| `webPush`   | `{ subject, openedEvent? }`                                                         |
-| `database`  | `{ schema? }`: the Postgres schema, `workflow` by default                           |
+| Field       | Holds                                                                                     |
+| ----------- | ----------------------------------------------------------------------------------------- |
+| `title`     | The Studio title                                                                          |
+| `contract`  | The `defineContract(...)` every `/events` and `/identify` is validated against            |
+| `workflows` | The workflows to deploy                                                                   |
+| `segments`  | Named segments                                                                            |
+| `actions`   | Custom actions `.run()` uses                                                              |
+| `templates` | The registries: `{ email?, push?, discord?, slack? }`; topics typed by the contract       |
+| `email`     | `{ unsubscribeUrl?, preferencesUrl?, tracking? }`: what every topic email template shares |
+| `runtime`   | Per mode (`development`, `production`, …): `{ timeScale?, logMessages? }`                 |
+| `apns`      | `{ topic, keyId, teamId, environment? }`                                                  |
+| `fcm`       | `{ androidChannelId? }`                                                                   |
+| `webPush`   | `{ subject, openedEvent? }`                                                               |
+| `database`  | `{ schema? }`: the Postgres schema, `workflow` by default                                 |
 
 The `ENVIRONMENT` var picks the `runtime` entry (production when unset).
 `timeScale` fast-forwards every duration: 600 turns "1 day" into 2.4 minutes.
@@ -749,18 +779,20 @@ throws `JourneyClientError` with its status and body.
 const journeys = new JourneyClient({ contract, origin, token });
 ```
 
-| Method                                        | Endpoint                | Does                                                     |
-| --------------------------------------------- | ----------------------- | -------------------------------------------------------- |
-| `identify(userId, props)`                     | `POST /identify`        | Merge profile properties; `null` removes one             |
-| `track(userId, event, payload, { id?, ts? })` | `POST /events`          | Record an event; starts and wakes journeys               |
-| `registerDevice(userId, { token, platform })` | `POST /devices`         | Register a push token (`ios`, `android` or `web`)        |
-| `unbindDevice(token)`                         | `POST /devices/unbind`  | Signed out: the token stays, bound to nobody             |
-| `removeDevice(token)`                         | `POST /devices/remove`  | Forget a token for good                                  |
-| `messageOpened(userId, messageId)`            | `POST /messages/opened` | A journey push tapped open (the `message_id` it carried) |
-| `getSubscriptions(userId)`                    | `GET /subscriptions/…`  | `{ email, push }`, each `{ all, topics }`, `true` = on   |
-| `setSubscriptions(userId, patch)`             | `PUT /subscriptions/…`  | Change what the patch names; answers the new state       |
-| `forgetUser(userId)`                          | `POST /users/forget`    | Stop the user's journeys and erase their data            |
-| `deploy(bundle)`                              | `POST /deploy`          | Deploy a compiled bundle                                 |
+| Method                                        | Endpoint                          | Does                                                                      |
+| --------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------- |
+| `identify(userId, props)`                     | `POST /identify`                  | Merge profile properties; `null` removes one                              |
+| `track(userId, event, payload, { id?, ts? })` | `POST /events`                    | Record an event; starts and wakes journeys                                |
+| `registerDevice(userId, { token, platform })` | `POST /devices`                   | Register a push token (`ios`, `android` or `web`)                         |
+| `unbindDevice(token)`                         | `POST /devices/unbind`            | Signed out: the token stays, bound to nobody                              |
+| `removeDevice(token)`                         | `POST /devices/remove`            | Forget a token for good                                                   |
+| `messageOpened(userId, messageId)`            | `POST /messages/opened`           | A journey push tapped open (the `message_id` it carried)                  |
+| `getSubscriptions(userId)`                    | `GET /subscriptions/…`            | `{ email, push }`, each `{ all, topics }`, `true` = on                    |
+| `setSubscriptions(userId, patch)`             | `PUT /subscriptions/…`            | Change what the patch names; answers the new state                        |
+| `getSubscriptionsByMessage(messageId)`        | `GET /subscriptions/by-message/…` | The recipient's record by a copy's id, plus `message: { channel, topic }` |
+| `setSubscriptionsByMessage(messageId, patch)` | `PUT /subscriptions/by-message/…` | The same patch, for the copy's recipient; answers as the GET does         |
+| `forgetUser(userId)`                          | `POST /users/forget`              | Stop the user's journeys and erase their data                             |
+| `deploy(bundle)`                              | `POST /deploy`                    | Deploy a compiled bundle                                                  |
 
 Pass an `id` to `track` whenever a caller may retry; see
 [Give each event an `id`](#give-each-event-an-id).
@@ -790,6 +822,17 @@ A "subscribe to all" button sends `all: true` plus every topic `true`; an
 "unsubscribe from all" sends `all: false` and leaves the topics as they are, so
 turning `all` back on restores the user's own choices.
 
+The same page opened from an email's footer, with no session, reads the `m` query parameter the
+`preferencesUrl` link carries and goes by the copy instead of the user (see
+[Email](#email)); a 404 (`JourneyClientError` with `status` 404) is an expired link:
+
+```ts
+// GET /api/email-preferences?m=<message id>, proxied by the app's API, rate-limited there
+const { email, push, message } = await journeys.getSubscriptionsByMessage(m);
+// message: { channel: 'email', topic: 'promotions' } — the email this page was opened from
+await journeys.setSubscriptionsByMessage(m, { email: { topics: { [message.topic]: false } } });
+```
+
 ## Compiling and planning
 
 `compileConfig(config)` returns the `BundleIR` the Worker deploys. It is
@@ -896,7 +939,7 @@ database.
   bundle live (see [Postgres](#postgres)); `POST /bundle/deploy` forces it.
 - **APNs in development.** `wrangler dev` (workerd) cannot make HTTP/2 subrequests: run
   `@shware/workflow/apns-relay` and point `APNS_RELAY_ORIGIN` at it. A deployed Worker needs no
-  relay.
+  relay, and production ignores the variable.
 
 ## AWS Lambda
 
@@ -1173,7 +1216,9 @@ On Postgres the engine also keeps:
 
 ## HTTP surface
 
-`handleRequest` serves the ingest API:
+`handleRequest` serves the ingest API. It applies the same production gate as
+the full host: with `ENVIRONMENT` resolving to `production` and no `API_TOKEN`,
+everything but `GET /health` answers 503.
 
 - `GET /health` is the only unauthenticated one. Every other route asks the
   host's `authorize`, or without one the `API_TOKEN` bearer: its scheme is
@@ -1206,6 +1251,15 @@ On Postgres the engine also keeps:
   non-boolean answers 400 with the field paths; an erased user 410. Changing
   `email.all` wakes the waits on `reachable('email')`, `push.all` those on
   `reachable('push')`.
+- `GET /subscriptions/by-message/:messageId` answers the same record for the
+  recipient of that copy, plus `message: { channel, topic }` (`channel` is
+  `email` or `push`, the channel the copy went out on); `PUT` takes the same
+  patch as `/subscriptions/:userId` and answers as the GET does. The message id
+  is the capability (the `m` of an email's `preferencesUrl` link), so the app
+  proxies and rate-limits these routes behind its own API; the bearer still
+  guards them. An id that names no copy — never sent, not a UUID, or erased
+  with its user — or a transactional copy (`topic` null) answers 404, the rule
+  `/t/u` applies; a user whose erasure is pending answers 410, as above.
 - `POST /users/forget` takes `{ userId }`; the erasure takes the user's opt-outs
   with the rest, since nothing is ever sent to that id again.
 - `POST /deploy` takes a compiled bundle and swaps the routing table atomically.

package/dist/client.cjs

@@ -126,19 +126,41 @@ var JourneyClient = class {
 	* here, before the request; the engine refuses it too.
 	*/
 	setSubscriptions(userId, patch) {
+		const refused = this.undeclaredTopics(patch);
+		if (refused !== void 0) return Promise.reject(refused);
+		return this.request("PUT", subscriptionsPath(userId), patch);
+	}
+	/**
+	* `getSubscriptions` for the recipient of one copy, by the message id an email's preferences
+	* link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a
+	* sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,
+	* so it can highlight that topic. Rejects with a 404 for an id that names no copy — never
+	* sent, or erased with its user — and for a transactional one; the page should show the link
+	* as expired. The message id is the capability, so the app proxies this behind its own API
+	* and rate-limits it.
+	*/
+	getSubscriptionsByMessage(messageId) {
+		return this.request("GET", subscriptionsByMessagePath(messageId));
+	}
+	/** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */
+	setSubscriptionsByMessage(messageId, patch) {
+		const refused = this.undeclaredTopics(patch);
+		if (refused !== void 0) return Promise.reject(refused);
+		return this.request("PUT", subscriptionsByMessagePath(messageId), patch);
+	}
+	/** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */
+	undeclaredTopics(patch) {
 		const contract = this.options.contract;
-		if (contract !== void 0) {
-			const issues = [];
-			for (const channel of require_host_ingest.SUBSCRIPTION_CHANNELS) for (const topic of Object.keys(patch[channel]?.topics ?? {})) {
-				if (contract.topics.includes(topic)) continue;
-				issues.push({
-					path: `${channel}.topics.${topic}`,
-					message: "not a declared topic"
-				});
-			}
-			if (issues.length > 0) return Promise.reject(new JourneyValidationError("/subscriptions", void 0, issues));
+		if (contract === void 0) return void 0;
+		const issues = [];
+		for (const channel of require_host_ingest.SUBSCRIPTION_CHANNELS) for (const topic of Object.keys(patch[channel]?.topics ?? {})) {
+			if (contract.topics.includes(topic)) continue;
+			issues.push({
+				path: `${channel}.topics.${topic}`,
+				message: "not a declared topic"
+			});
 		}
-		return this.request("PUT", subscriptionsPath(userId), patch);
+		return issues.length > 0 ? new JourneyValidationError("/subscriptions", void 0, issues) : void 0;
 	}
 	/** Deploy a compiled bundle (BundleIR). */
 	deploy(bundle) {
@@ -161,6 +183,7 @@ var JourneyClient = class {
 	}
 };
 const subscriptionsPath = (userId) => `/subscriptions/${encodeURIComponent(userId)}`;
+const subscriptionsByMessagePath = (messageId) => `/subscriptions/by-message/${encodeURIComponent(messageId)}`;
 exports.JourneyClient = JourneyClient;
 exports.JourneyClientError = JourneyClientError;
 exports.JourneyValidationError = JourneyValidationError;

package/dist/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","names":["SUBSCRIPTION_CHANNELS"],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch, Topic } from './contract';\nimport {\n  type DeployResult,\n  type IdentifyResult,\n  type IngestResult,\n  SUBSCRIPTION_CHANNELS,\n  type Subscriptions,\n  type SubscriptionsPatch,\n} from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\n/** The topics the client's contract declares; any string without a contract. */\nexport type ClientTopic<C> = [C] extends [undefined] ? string : Topic<C>;\n\nexport type {\n  ChannelSubscriptions,\n  ChannelSubscriptionsPatch,\n  SubscriptionChannel,\n  Subscriptions,\n  SubscriptionsPatch,\n} from './host/ingest';\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /**\n   * Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they\n   * opted out of the whole channel) and each declared topic (false once they opted out of it on\n   * that channel) — the engine's record, which a preference page shows as it is. The two are\n   * independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`\n   * masks every topic however they read (nothing is sent on the channel until it is true again).\n   * Rejects with a 410 for an erased user.\n   */\n  getSubscriptions(userId: string): Promise<Subscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsPath(userId));\n  }\n\n  /**\n   * Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {\n   * newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every\n   * push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the\n   * channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,\n   * so a preference page's \"subscribe to all\" sends `all: true` plus every topic `true`. Answers\n   * the subscriptions as they now stand. With a contract, a topic it does not declare is refused\n   * here, before the request; the engine refuses it too.\n   */\n  setSubscriptions(\n    userId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<Subscriptions<ClientTopic<C>>> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const issues: ContractIssue[] = [];\n      for (const channel of SUBSCRIPTION_CHANNELS) {\n        for (const topic of Object.keys(patch[channel]?.topics ?? {})) {\n          // `includes`, not the predicate: narrowing `string` by a `topic is string` leaves `never`\n          if (contract.topics.includes(topic)) continue;\n          issues.push({ path: `${channel}.topics.${topic}`, message: 'not a declared topic' });\n        }\n      }\n      if (issues.length > 0) {\n        return Promise.reject(new JourneyValidationError('/subscriptions', undefined, issues));\n      }\n    }\n    return this.request('PUT', subscriptionsPath(userId), patch);\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private post<T>(path: string, body: unknown): Promise<T> {\n    return this.request<T>('POST', path, body);\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'PUT',\n    path: string,\n    body?: unknown\n  ): Promise<T> {\n    const headers: Record<string, string> = {};\n    if (body !== undefined) headers['content-type'] = 'application/json';\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method,\n      headers,\n      ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n\nconst subscriptionsPath = (userId: string) => `/subscriptions/${encodeURIComponent(userId)}`;\n"],"mappings":";;;AAiCA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAkCA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;;;;;;;;CAUA,iBAAiB,QAAwD;EACvE,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,CAAC;CACtD;;;;;;;;;;CAWA,iBACE,QACA,OACwC;EACxC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAA0B,CAAC;GACjC,KAAK,MAAM,WAAWA,oBAAAA,uBACpB,KAAK,MAAM,SAAS,OAAO,KAAK,MAAM,QAAQ,EAAE,UAAU,CAAC,CAAC,GAAG;IAE7D,IAAI,SAAS,OAAO,SAAS,KAAK,GAAG;IACrC,OAAO,KAAK;KAAE,MAAM,GAAG,QAAQ,UAAU;KAAS,SAAS;IAAuB,CAAC;GACrF;GAEF,IAAI,OAAO,SAAS,GAClB,OAAO,QAAQ,OAAO,IAAI,uBAAuB,kBAAkB,KAAA,GAAW,MAAM,CAAC;EAEzF;EACA,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,GAAG,KAAK;CAC7D;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,KAAgB,MAAc,MAA2B;EACvD,OAAO,KAAK,QAAW,QAAQ,MAAM,IAAI;CAC3C;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC,CAAC;EACzC,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAClD,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;EAC7D,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF;AAEA,MAAM,qBAAqB,WAAmB,kBAAkB,mBAAmB,MAAM"}
+{"version":3,"file":"client.cjs","names":["SUBSCRIPTION_CHANNELS"],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch, Topic } from './contract';\nimport {\n  type DeployResult,\n  type IdentifyResult,\n  type IngestResult,\n  type MessageSubscriptions,\n  SUBSCRIPTION_CHANNELS,\n  type Subscriptions,\n  type SubscriptionsPatch,\n} from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\n/** The topics the client's contract declares; any string without a contract. */\nexport type ClientTopic<C> = [C] extends [undefined] ? string : Topic<C>;\n\nexport type {\n  ChannelSubscriptions,\n  ChannelSubscriptionsPatch,\n  MessageOrigin,\n  MessageSubscriptions,\n  SubscriptionChannel,\n  Subscriptions,\n  SubscriptionsPatch,\n} from './host/ingest';\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /**\n   * Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they\n   * opted out of the whole channel) and each declared topic (false once they opted out of it on\n   * that channel) — the engine's record, which a preference page shows as it is. The two are\n   * independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`\n   * masks every topic however they read (nothing is sent on the channel until it is true again).\n   * Rejects with a 410 for an erased user.\n   */\n  getSubscriptions(userId: string): Promise<Subscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsPath(userId));\n  }\n\n  /**\n   * Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {\n   * newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every\n   * push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the\n   * channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,\n   * so a preference page's \"subscribe to all\" sends `all: true` plus every topic `true`. Answers\n   * the subscriptions as they now stand. With a contract, a topic it does not declare is refused\n   * here, before the request; the engine refuses it too.\n   */\n  setSubscriptions(\n    userId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<Subscriptions<ClientTopic<C>>> {\n    const refused = this.undeclaredTopics(patch);\n    if (refused !== undefined) return Promise.reject(refused);\n    return this.request('PUT', subscriptionsPath(userId), patch);\n  }\n\n  /**\n   * `getSubscriptions` for the recipient of one copy, by the message id an email's preferences\n   * link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a\n   * sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,\n   * so it can highlight that topic. Rejects with a 404 for an id that names no copy — never\n   * sent, or erased with its user — and for a transactional one; the page should show the link\n   * as expired. The message id is the capability, so the app proxies this behind its own API\n   * and rate-limits it.\n   */\n  getSubscriptionsByMessage(messageId: string): Promise<MessageSubscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsByMessagePath(messageId));\n  }\n\n  /** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */\n  setSubscriptionsByMessage(\n    messageId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<MessageSubscriptions<ClientTopic<C>>> {\n    const refused = this.undeclaredTopics(patch);\n    if (refused !== undefined) return Promise.reject(refused);\n    return this.request('PUT', subscriptionsByMessagePath(messageId), patch);\n  }\n\n  /** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */\n  private undeclaredTopics(\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): JourneyValidationError | undefined {\n    const contract = this.options.contract;\n    if (contract === undefined) return undefined;\n    const issues: ContractIssue[] = [];\n    for (const channel of SUBSCRIPTION_CHANNELS) {\n      for (const topic of Object.keys(patch[channel]?.topics ?? {})) {\n        // `includes`, not the predicate: narrowing `string` by a `topic is string` leaves `never`\n        if (contract.topics.includes(topic)) continue;\n        issues.push({ path: `${channel}.topics.${topic}`, message: 'not a declared topic' });\n      }\n    }\n    return issues.length > 0\n      ? new JourneyValidationError('/subscriptions', undefined, issues)\n      : undefined;\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private post<T>(path: string, body: unknown): Promise<T> {\n    return this.request<T>('POST', path, body);\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'PUT',\n    path: string,\n    body?: unknown\n  ): Promise<T> {\n    const headers: Record<string, string> = {};\n    if (body !== undefined) headers['content-type'] = 'application/json';\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method,\n      headers,\n      ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n\nconst subscriptionsPath = (userId: string) => `/subscriptions/${encodeURIComponent(userId)}`;\nconst subscriptionsByMessagePath = (messageId: string) =>\n  `/subscriptions/by-message/${encodeURIComponent(messageId)}`;\n"],"mappings":";;;AAkCA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAoCA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;;;;;;;;CAUA,iBAAiB,QAAwD;EACvE,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,CAAC;CACtD;;;;;;;;;;CAWA,iBACE,QACA,OACwC;EACxC,MAAM,UAAU,KAAK,iBAAiB,KAAK;EAC3C,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;EACxD,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,GAAG,KAAK;CAC7D;;;;;;;;;;CAWA,0BAA0B,WAAkE;EAC1F,OAAO,KAAK,QAAQ,OAAO,2BAA2B,SAAS,CAAC;CAClE;;CAGA,0BACE,WACA,OAC+C;EAC/C,MAAM,UAAU,KAAK,iBAAiB,KAAK;EAC3C,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;EACxD,OAAO,KAAK,QAAQ,OAAO,2BAA2B,SAAS,GAAG,KAAK;CACzE;;CAGA,iBACE,OACoC;EACpC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;EACnC,MAAM,SAA0B,CAAC;EACjC,KAAK,MAAM,WAAWA,oBAAAA,uBACpB,KAAK,MAAM,SAAS,OAAO,KAAK,MAAM,QAAQ,EAAE,UAAU,CAAC,CAAC,GAAG;GAE7D,IAAI,SAAS,OAAO,SAAS,KAAK,GAAG;GACrC,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ,UAAU;IAAS,SAAS;GAAuB,CAAC;EACrF;EAEF,OAAO,OAAO,SAAS,IACnB,IAAI,uBAAuB,kBAAkB,KAAA,GAAW,MAAM,IAC9D,KAAA;CACN;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,KAAgB,MAAc,MAA2B;EACvD,OAAO,KAAK,QAAW,QAAQ,MAAM,IAAI;CAC3C;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC,CAAC;EACzC,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAClD,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;EAC7D,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF;AAEA,MAAM,qBAAqB,WAAmB,kBAAkB,mBAAmB,MAAM;AACzF,MAAM,8BAA8B,cAClC,6BAA6B,mBAAmB,SAAS"}

package/dist/client.d.cts

@@ -1,6 +1,6 @@
 import { Contract, ContractIssue, ProfilePatch, Topic } from "./contract.cjs";
 import { ProfileProps } from "./store/index.cjs";
-import { ChannelSubscriptions, ChannelSubscriptionsPatch, DeployResult, IdentifyResult, IngestResult, SubscriptionChannel, Subscriptions, SubscriptionsPatch } from "./host/ingest.cjs";
+import { ChannelSubscriptions, ChannelSubscriptionsPatch, DeployResult, IdentifyResult, IngestResult, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch } from "./host/ingest.cjs";
 import * as core from "zod/v4/core";
 /**
  * `@shware/workflow/client` — the producer side of the ingest API, for the
@@ -120,10 +120,24 @@ export declare class JourneyClient<C extends Contract | undefined = undefined> {
    * here, before the request; the engine refuses it too.
    */
   setSubscriptions(userId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<Subscriptions<ClientTopic<C>>>;
+  /**
+   * `getSubscriptions` for the recipient of one copy, by the message id an email's preferences
+   * link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a
+   * sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,
+   * so it can highlight that topic. Rejects with a 404 for an id that names no copy — never
+   * sent, or erased with its user — and for a transactional one; the page should show the link
+   * as expired. The message id is the capability, so the app proxies this behind its own API
+   * and rate-limits it.
+   */
+  getSubscriptionsByMessage(messageId: string): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */
+  setSubscriptionsByMessage(messageId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */
+  private undeclaredTopics;
   /** Deploy a compiled bundle (BundleIR). */
   deploy(bundle: unknown): Promise<DeployResult>;
   private post;
   private request;
 }
-export type { ChannelSubscriptions, ChannelSubscriptionsPatch, SubscriptionChannel, Subscriptions, SubscriptionsPatch };
+export type { ChannelSubscriptions, ChannelSubscriptionsPatch, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch };
 //# sourceMappingURL=client.d.cts.map

package/dist/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAmBiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;;YAIP,YAAY,MAAM,kCAAkC,MAAM;iBAUrD;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;;;;;;;;EAYjD,iBAAiB,iBAAiB,QAAQ,cAAc,YAAY;;;;;;;;;;EAapE,iBACE,gBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,cAAc,YAAY;;EAmBrC,OAAO,kBAAkB,QAAQ;UAIzB;UAIM"}
+{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAoBiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;;YAIP,YAAY,MAAM,kCAAkC,MAAM;iBAYrD;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;;;;;;;;EAYjD,iBAAiB,iBAAiB,QAAQ,cAAc,YAAY;;;;;;;;;;EAapE,iBACE,gBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,cAAc,YAAY;;;;;;;;;;EAerC,0BAA0B,oBAAoB,QAAQ,qBAAqB,YAAY;;EAKvF,0BACE,mBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,qBAAqB,YAAY;;UAOpC;;EAmBR,OAAO,kBAAkB,QAAQ;UAIzB;UAIM"}

package/dist/client.d.mts

@@ -1,6 +1,6 @@
 import { Contract, ContractIssue, ProfilePatch, Topic } from "./contract.mjs";
 import { ProfileProps } from "./store/index.mjs";
-import { ChannelSubscriptions, ChannelSubscriptionsPatch, DeployResult, IdentifyResult, IngestResult, SubscriptionChannel, Subscriptions, SubscriptionsPatch } from "./host/ingest.mjs";
+import { ChannelSubscriptions, ChannelSubscriptionsPatch, DeployResult, IdentifyResult, IngestResult, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch } from "./host/ingest.mjs";
 import * as core from "zod/v4/core";
 /**
  * `@shware/workflow/client` — the producer side of the ingest API, for the
@@ -120,10 +120,24 @@ export declare class JourneyClient<C extends Contract | undefined = undefined> {
    * here, before the request; the engine refuses it too.
    */
   setSubscriptions(userId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<Subscriptions<ClientTopic<C>>>;
+  /**
+   * `getSubscriptions` for the recipient of one copy, by the message id an email's preferences
+   * link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a
+   * sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,
+   * so it can highlight that topic. Rejects with a 404 for an id that names no copy — never
+   * sent, or erased with its user — and for a transactional one; the page should show the link
+   * as expired. The message id is the capability, so the app proxies this behind its own API
+   * and rate-limits it.
+   */
+  getSubscriptionsByMessage(messageId: string): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */
+  setSubscriptionsByMessage(messageId: string, patch: SubscriptionsPatch<ClientTopic<C>>): Promise<MessageSubscriptions<ClientTopic<C>>>;
+  /** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */
+  private undeclaredTopics;
   /** Deploy a compiled bundle (BundleIR). */
   deploy(bundle: unknown): Promise<DeployResult>;
   private post;
   private request;
 }
-export type { ChannelSubscriptions, ChannelSubscriptionsPatch, SubscriptionChannel, Subscriptions, SubscriptionsPatch };
+export type { ChannelSubscriptions, ChannelSubscriptionsPatch, MessageOrigin, MessageSubscriptions, SubscriptionChannel, Subscriptions, SubscriptionsPatch };
 //# sourceMappingURL=client.d.mts.map

package/dist/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAmBiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;;YAIP,YAAY,MAAM,kCAAkC,MAAM;iBAUrD;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;;;;;;;;EAYjD,iBAAiB,iBAAiB,QAAQ,cAAc,YAAY;;;;;;;;;;EAapE,iBACE,gBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,cAAc,YAAY;;EAmBrC,OAAO,kBAAkB,QAAQ;UAIzB;UAIM"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;iBAoBiB,qBAAqB,UAAU;;;;;EAK9C,WAAW;;EAEX;;EAEA;;EAEA,eAAe;;qBAGJ,2BAA2B;WAE3B;WACA;WACA;EAHX,YACW,cACA,gBACA;;;qBAQA,+BAA+B;WAE/B;WACA;WACA,QAAQ;EAHnB,YACW,cACA,2BACA,QAAQ;;KAWhB,SAAS,KAAK,UAAU,eAAe,KAAK;;YAErC,gBAAgB,MAAM,wCAAwC,SAAS;KAC9E,UAAU,GAAG,MAAM,0BACnB,UAAU,yBAAyB,UAAU,gBAC9C,gBAAgB,SAAS,MACtB,SAAS,KAAK,MAAM,SAAS,GAAG,KAAK,UAAU;KAEjD,cAAc,MAAM,yBACrB,eACA,UAAU,SAAS,eAAe,KAAK,mBAAmB,KACxD,aAAa;;YAIP,YAAY,MAAM,kCAAkC,MAAM;iBAYrD;;EAEf;;EAEA;;qBAGW,cAAc,UAAU;mBACN;EAA7B,YAA6B,SAAS,qBAAqB;;EAG3D,SAAS,gBAAgB,OAAO,cAAc,KAAK,QAAQ;;;;;;;EAgB3D,MAAM,UAAU,gBAAgB,IAC9B,gBACA,OAAO,MACJ,MAAM,UAAU,GAAG,KACrB,QAAQ;;;;;;EAsBX,eACE,gBACA;IAAU;IAAe;IAAqC;MAC7D;IAAU;IAAU;;;;;;EAcvB,cAAc,gBAAgB,oBAAoB;IAAU;IAAU;;;;;;;;EAUtE,WAAW,iBAAiB;IAAU;IAAU;IAAiB;;;EAKjE,aAAa,gBAAgB;IAAU;IAAU;;;EAKjD,aAAa,gBAAgB;IAAU;IAAU;;;;;;;;;;EAYjD,iBAAiB,iBAAiB,QAAQ,cAAc,YAAY;;;;;;;;;;EAapE,iBACE,gBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,cAAc,YAAY;;;;;;;;;;EAerC,0BAA0B,oBAAoB,QAAQ,qBAAqB,YAAY;;EAKvF,0BACE,mBACA,OAAO,mBAAmB,YAAY,MACrC,QAAQ,qBAAqB,YAAY;;UAOpC;;EAmBR,OAAO,kBAAkB,QAAQ;UAIzB;UAIM"}

package/dist/client.mjs

@@ -125,19 +125,41 @@ var JourneyClient = class {
 	* here, before the request; the engine refuses it too.
 	*/
 	setSubscriptions(userId, patch) {
+		const refused = this.undeclaredTopics(patch);
+		if (refused !== void 0) return Promise.reject(refused);
+		return this.request("PUT", subscriptionsPath(userId), patch);
+	}
+	/**
+	* `getSubscriptions` for the recipient of one copy, by the message id an email's preferences
+	* link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a
+	* sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,
+	* so it can highlight that topic. Rejects with a 404 for an id that names no copy — never
+	* sent, or erased with its user — and for a transactional one; the page should show the link
+	* as expired. The message id is the capability, so the app proxies this behind its own API
+	* and rate-limits it.
+	*/
+	getSubscriptionsByMessage(messageId) {
+		return this.request("GET", subscriptionsByMessagePath(messageId));
+	}
+	/** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */
+	setSubscriptionsByMessage(messageId, patch) {
+		const refused = this.undeclaredTopics(patch);
+		if (refused !== void 0) return Promise.reject(refused);
+		return this.request("PUT", subscriptionsByMessagePath(messageId), patch);
+	}
+	/** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */
+	undeclaredTopics(patch) {
 		const contract = this.options.contract;
-		if (contract !== void 0) {
-			const issues = [];
-			for (const channel of SUBSCRIPTION_CHANNELS) for (const topic of Object.keys(patch[channel]?.topics ?? {})) {
-				if (contract.topics.includes(topic)) continue;
-				issues.push({
-					path: `${channel}.topics.${topic}`,
-					message: "not a declared topic"
-				});
-			}
-			if (issues.length > 0) return Promise.reject(new JourneyValidationError("/subscriptions", void 0, issues));
+		if (contract === void 0) return void 0;
+		const issues = [];
+		for (const channel of SUBSCRIPTION_CHANNELS) for (const topic of Object.keys(patch[channel]?.topics ?? {})) {
+			if (contract.topics.includes(topic)) continue;
+			issues.push({
+				path: `${channel}.topics.${topic}`,
+				message: "not a declared topic"
+			});
 		}
-		return this.request("PUT", subscriptionsPath(userId), patch);
+		return issues.length > 0 ? new JourneyValidationError("/subscriptions", void 0, issues) : void 0;
 	}
 	/** Deploy a compiled bundle (BundleIR). */
 	deploy(bundle) {
@@ -160,6 +182,7 @@ var JourneyClient = class {
 	}
 };
 const subscriptionsPath = (userId) => `/subscriptions/${encodeURIComponent(userId)}`;
+const subscriptionsByMessagePath = (messageId) => `/subscriptions/by-message/${encodeURIComponent(messageId)}`;
 export { JourneyClient, JourneyClientError, JourneyValidationError };
 
 //# sourceMappingURL=client.mjs.map

package/dist/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch, Topic } from './contract';\nimport {\n  type DeployResult,\n  type IdentifyResult,\n  type IngestResult,\n  SUBSCRIPTION_CHANNELS,\n  type Subscriptions,\n  type SubscriptionsPatch,\n} from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\n/** The topics the client's contract declares; any string without a contract. */\nexport type ClientTopic<C> = [C] extends [undefined] ? string : Topic<C>;\n\nexport type {\n  ChannelSubscriptions,\n  ChannelSubscriptionsPatch,\n  SubscriptionChannel,\n  Subscriptions,\n  SubscriptionsPatch,\n} from './host/ingest';\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /**\n   * Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they\n   * opted out of the whole channel) and each declared topic (false once they opted out of it on\n   * that channel) — the engine's record, which a preference page shows as it is. The two are\n   * independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`\n   * masks every topic however they read (nothing is sent on the channel until it is true again).\n   * Rejects with a 410 for an erased user.\n   */\n  getSubscriptions(userId: string): Promise<Subscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsPath(userId));\n  }\n\n  /**\n   * Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {\n   * newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every\n   * push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the\n   * channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,\n   * so a preference page's \"subscribe to all\" sends `all: true` plus every topic `true`. Answers\n   * the subscriptions as they now stand. With a contract, a topic it does not declare is refused\n   * here, before the request; the engine refuses it too.\n   */\n  setSubscriptions(\n    userId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<Subscriptions<ClientTopic<C>>> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const issues: ContractIssue[] = [];\n      for (const channel of SUBSCRIPTION_CHANNELS) {\n        for (const topic of Object.keys(patch[channel]?.topics ?? {})) {\n          // `includes`, not the predicate: narrowing `string` by a `topic is string` leaves `never`\n          if (contract.topics.includes(topic)) continue;\n          issues.push({ path: `${channel}.topics.${topic}`, message: 'not a declared topic' });\n        }\n      }\n      if (issues.length > 0) {\n        return Promise.reject(new JourneyValidationError('/subscriptions', undefined, issues));\n      }\n    }\n    return this.request('PUT', subscriptionsPath(userId), patch);\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private post<T>(path: string, body: unknown): Promise<T> {\n    return this.request<T>('POST', path, body);\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'PUT',\n    path: string,\n    body?: unknown\n  ): Promise<T> {\n    const headers: Record<string, string> = {};\n    if (body !== undefined) headers['content-type'] = 'application/json';\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method,\n      headers,\n      ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n\nconst subscriptionsPath = (userId: string) => `/subscriptions/${encodeURIComponent(userId)}`;\n"],"mappings":";;AAiCA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAkCA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;;;;;;;;CAUA,iBAAiB,QAAwD;EACvE,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,CAAC;CACtD;;;;;;;;;;CAWA,iBACE,QACA,OACwC;EACxC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAA0B,CAAC;GACjC,KAAK,MAAM,WAAW,uBACpB,KAAK,MAAM,SAAS,OAAO,KAAK,MAAM,QAAQ,EAAE,UAAU,CAAC,CAAC,GAAG;IAE7D,IAAI,SAAS,OAAO,SAAS,KAAK,GAAG;IACrC,OAAO,KAAK;KAAE,MAAM,GAAG,QAAQ,UAAU;KAAS,SAAS;IAAuB,CAAC;GACrF;GAEF,IAAI,OAAO,SAAS,GAClB,OAAO,QAAQ,OAAO,IAAI,uBAAuB,kBAAkB,KAAA,GAAW,MAAM,CAAC;EAEzF;EACA,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,GAAG,KAAK;CAC7D;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,KAAgB,MAAc,MAA2B;EACvD,OAAO,KAAK,QAAW,QAAQ,MAAM,IAAI;CAC3C;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC,CAAC;EACzC,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAClD,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;EAC7D,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF;AAEA,MAAM,qBAAqB,WAAmB,kBAAkB,mBAAmB,MAAM"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type * as core from 'zod/v4/core';\nimport type { Contract, ContractIssue, ProfilePatch, Topic } from './contract';\nimport {\n  type DeployResult,\n  type IdentifyResult,\n  type IngestResult,\n  type MessageSubscriptions,\n  SUBSCRIPTION_CHANNELS,\n  type Subscriptions,\n  type SubscriptionsPatch,\n} from './host/ingest';\nimport type { ProfileProps } from './store';\n\n/**\n * `@shware/workflow/client` — the producer side of the ingest API, for the\n * service that knows what users do (an api server, a webhook handler). Plain\n * fetch, no dependencies; errors carry the status and body so a caller can\n * log them without failing the request that triggered the report.\n */\n\nexport interface JourneyClientOptions<C extends Contract | undefined = undefined> {\n  /**\n   * The shared `defineContract(...)`: types `track` (the event name picks the\n   * payload type) and `identify`, and checks both before anything is sent.\n   */\n  contract?: C;\n  /** The journey Worker's origin, e.g. `https://workflow.example.com`. */\n  origin: string;\n  /** Its API_TOKEN, sent as a bearer; omit against an open local instance. */\n  token?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport class JourneyClientError extends Error {\n  constructor(\n    readonly path: string,\n    readonly status: number,\n    readonly body: string\n  ) {\n    super(`journey ${path} failed: ${status} ${body}`);\n    this.name = 'JourneyClientError';\n  }\n}\n\n/** A payload or profile patch the contract refuses — raised before the request, with the field paths. */\nexport class JourneyValidationError extends Error {\n  constructor(\n    readonly path: string,\n    readonly event: string | undefined,\n    readonly issues: ContractIssue[]\n  ) {\n    super(\n      `journey ${path}${event === undefined ? '' : ` '${event}'`} refused by the contract: ${issues\n        .map((i) => `${i.path || '(root)'} ${i.message}`)\n        .join('; ')}`\n    );\n    this.name = 'JourneyValidationError';\n  }\n}\n\ntype EventsOf<C> = C extends Contract<infer E> ? E : never;\n/** Event names: the contract's, or any string without one. */\nexport type ClientEventName<C> = [C] extends [undefined] ? string : keyof EventsOf<C> & string;\ntype TrackArgs<C, K> = [C] extends [undefined]\n  ? [payload?: Record<string, unknown>, options?: TrackOptions]\n  : K extends keyof EventsOf<C>\n    ? [payload: core.input<EventsOf<C>[K]>, options?: TrackOptions]\n    : never;\ntype IdentifyProps<C> = [C] extends [undefined]\n  ? ProfileProps\n  : C extends Contract<Record<string, core.$ZodObject>, infer P>\n    ? ProfilePatch<P>\n    : never;\n\n/** The topics the client's contract declares; any string without a contract. */\nexport type ClientTopic<C> = [C] extends [undefined] ? string : Topic<C>;\n\nexport type {\n  ChannelSubscriptions,\n  ChannelSubscriptionsPatch,\n  MessageOrigin,\n  MessageSubscriptions,\n  SubscriptionChannel,\n  Subscriptions,\n  SubscriptionsPatch,\n} from './host/ingest';\n\nexport interface TrackOptions {\n  /** The occurrence's identity: a retry with the same id is recorded once. */\n  id?: string;\n  /** When it happened (epoch ms); the Worker's clock when omitted. */\n  ts?: number;\n}\n\nexport class JourneyClient<C extends Contract | undefined = undefined> {\n  constructor(private readonly options: JourneyClientOptions<C>) {}\n\n  /** Merge profile properties (`null` clears one). Every property a journey reads must be identified before the event that starts it. */\n  identify(userId: string, props: IdentifyProps<C>): Promise<IdentifyResult> {\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseProfilePatch(props);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/identify', undefined, result.issues));\n    }\n    return this.post<IdentifyResult>('/identify', { userId, props });\n  }\n\n  /**\n   * Record an event; the Worker starts every journey whose trigger matches it\n   * and wakes waits on it. A caller that retries should pass the same `id`\n   * each time: the Worker stores one occurrence per id, so a retry after a\n   * timeout cannot double-count the event. `ts` defaults to the Worker's clock.\n   */\n  track<K extends ClientEventName<C>>(\n    userId: string,\n    event: K,\n    ...args: TrackArgs<C, K>\n  ): Promise<IngestResult> {\n    const [payload = {}, options = {}] = args as [Record<string, unknown>?, TrackOptions?];\n    const contract = this.options.contract;\n    if (contract !== undefined) {\n      const result = contract.parseEvent(event, payload);\n      if (!result.ok)\n        return Promise.reject(new JourneyValidationError('/events', event, result.issues));\n    }\n    return this.post<IngestResult>('/events', {\n      userId,\n      event,\n      payload,\n      ...(options.id === undefined ? {} : { id: options.id }),\n      ...(options.ts === undefined ? {} : { ts: options.ts }),\n    });\n  }\n\n  /**\n   * A push token the app registered for the user (call it on every registration: a token moves\n   * to the latest user). The engine keeps devices itself — pushes go to them, a token APNs / FCM\n   * reports as gone is dropped — and journeys waiting on `reachable('push')` wake.\n   */\n  registerDevice(\n    userId: string,\n    device: { token: string; platform: 'ios' | 'android' | 'web'; ts?: number }\n  ): Promise<{ ok: true; woke: number }> {\n    const { token, platform, ts } = device;\n    return this.post('/devices', {\n      userId,\n      token,\n      platform,\n      ...(ts === undefined ? {} : { ts }),\n    });\n  }\n\n  /**\n   * A journey push tapped open: the `message_id` the push carried, reported for the user who\n   * tapped it. Recorded as a human open on the copy (an email's opens are tracked by the Worker).\n   */\n  messageOpened(userId: string, messageId: string): Promise<{ ok: true; recorded: boolean }> {\n    return this.post('/messages/opened', { userId, messageId });\n  }\n\n  /**\n   * A deleted account: the engine records the erasure, stops the user's running journeys, then\n   * erases everything it keeps about them (profile, devices, events, reporting). Once this\n   * resolves the request is durable: `erased: false` means an instance would not stop yet, and\n   * the Worker's scheduled sweep finishes the job.\n   */\n  forgetUser(userId: string): Promise<{ ok: true; erased: boolean; pending: string[] }> {\n    return this.post('/users/forget', { userId });\n  }\n\n  /** The user signed out on that device: the token stays registered, bound to nobody. */\n  unbindDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/unbind', { token });\n  }\n\n  /** Forget a push token for good (an uninstall the app learned of, a token it replaced). */\n  removeDevice(token: string): Promise<{ ok: true; woke: number }> {\n    return this.post('/devices/remove', { token });\n  }\n\n  /**\n   * Where the user stands, topic × channel: for `email` and for `push`, `all` (false once they\n   * opted out of the whole channel) and each declared topic (false once they opted out of it on\n   * that channel) — the engine's record, which a preference page shows as it is. The two are\n   * independent flags: a topic answers its own opt-out even while `all` is false, so `all: false`\n   * masks every topic however they read (nothing is sent on the channel until it is true again).\n   * Rejects with a 410 for an erased user.\n   */\n  getSubscriptions(userId: string): Promise<Subscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsPath(userId));\n  }\n\n  /**\n   * Set subscriptions: only what the patch names changes, per channel (`{ email: { topics: {\n   * newsletter: false } } }` opts out of one topic's emails, `{ push: { all: false } }` of every\n   * push — the in-app opt-out App Store Review Guideline 4.5.4 asks for). `all: true` clears the\n   * channel-wide opt-out only: a topic opted out on its own stays off until the patch names it,\n   * so a preference page's \"subscribe to all\" sends `all: true` plus every topic `true`. Answers\n   * the subscriptions as they now stand. With a contract, a topic it does not declare is refused\n   * here, before the request; the engine refuses it too.\n   */\n  setSubscriptions(\n    userId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<Subscriptions<ClientTopic<C>>> {\n    const refused = this.undeclaredTopics(patch);\n    if (refused !== undefined) return Promise.reject(refused);\n    return this.request('PUT', subscriptionsPath(userId), patch);\n  }\n\n  /**\n   * `getSubscriptions` for the recipient of one copy, by the message id an email's preferences\n   * link carries (`email.preferencesUrl?m=<message id>`): how a preference page works without a\n   * sign-in. The answer adds `message: { channel, topic }`, the copy the page was opened from,\n   * so it can highlight that topic. Rejects with a 404 for an id that names no copy — never\n   * sent, or erased with its user — and for a transactional one; the page should show the link\n   * as expired. The message id is the capability, so the app proxies this behind its own API\n   * and rate-limits it.\n   */\n  getSubscriptionsByMessage(messageId: string): Promise<MessageSubscriptions<ClientTopic<C>>> {\n    return this.request('GET', subscriptionsByMessagePath(messageId));\n  }\n\n  /** `setSubscriptions` for the recipient of one copy; the patch and the answer are those of `getSubscriptionsByMessage`. */\n  setSubscriptionsByMessage(\n    messageId: string,\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): Promise<MessageSubscriptions<ClientTopic<C>>> {\n    const refused = this.undeclaredTopics(patch);\n    if (refused !== undefined) return Promise.reject(refused);\n    return this.request('PUT', subscriptionsByMessagePath(messageId), patch);\n  }\n\n  /** With a contract, the refusal of a patch naming a topic it does not declare; undefined when the patch is fine. */\n  private undeclaredTopics(\n    patch: SubscriptionsPatch<ClientTopic<C>>\n  ): JourneyValidationError | undefined {\n    const contract = this.options.contract;\n    if (contract === undefined) return undefined;\n    const issues: ContractIssue[] = [];\n    for (const channel of SUBSCRIPTION_CHANNELS) {\n      for (const topic of Object.keys(patch[channel]?.topics ?? {})) {\n        // `includes`, not the predicate: narrowing `string` by a `topic is string` leaves `never`\n        if (contract.topics.includes(topic)) continue;\n        issues.push({ path: `${channel}.topics.${topic}`, message: 'not a declared topic' });\n      }\n    }\n    return issues.length > 0\n      ? new JourneyValidationError('/subscriptions', undefined, issues)\n      : undefined;\n  }\n\n  /** Deploy a compiled bundle (BundleIR). */\n  deploy(bundle: unknown): Promise<DeployResult> {\n    return this.post<DeployResult>('/deploy', bundle);\n  }\n\n  private post<T>(path: string, body: unknown): Promise<T> {\n    return this.request<T>('POST', path, body);\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'PUT',\n    path: string,\n    body?: unknown\n  ): Promise<T> {\n    const headers: Record<string, string> = {};\n    if (body !== undefined) headers['content-type'] = 'application/json';\n    if (this.options.token !== undefined) headers.authorization = `Bearer ${this.options.token}`;\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(`${this.options.origin.replace(/\\/$/, '')}${path}`, {\n      method,\n      headers,\n      ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n    });\n    if (!response.ok) throw new JourneyClientError(path, response.status, await response.text());\n    return (await response.json()) as T;\n  }\n}\n\nconst subscriptionsPath = (userId: string) => `/subscriptions/${encodeURIComponent(userId)}`;\nconst subscriptionsByMessagePath = (messageId: string) =>\n  `/subscriptions/by-message/${encodeURIComponent(messageId)}`;\n"],"mappings":";;AAkCA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CACA;CAHX,YACE,MACA,QACA,MACA;EACA,MAAM,WAAW,KAAK,WAAW,OAAO,GAAG,MAAM;EAJxC,KAAA,OAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,yBAAb,cAA4C,MAAM;CAErC;CACA;CACA;CAHX,YACE,MACA,OACA,QACA;EACA,MACE,WAAW,OAAO,UAAU,KAAA,IAAY,KAAK,KAAK,MAAM,GAAG,4BAA4B,OACpF,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,GAAG,EAAE,SAAS,CAAC,CAChD,KAAK,IAAI,GACd;EARS,KAAA,OAAA;EACA,KAAA,QAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACd;AACF;AAoCA,IAAa,gBAAb,MAAuE;CACxC;CAA7B,YAAY,SAAmD;EAAlC,KAAA,UAAA;CAAmC;;CAGhE,SAAS,QAAgB,OAAkD;EACzE,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,kBAAkB,KAAK;GAC/C,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,aAAa,KAAA,GAAW,OAAO,MAAM,CAAC;EAC3F;EACA,OAAO,KAAK,KAAqB,aAAa;GAAE;GAAQ;EAAM,CAAC;CACjE;;;;;;;CAQA,MACE,QACA,OACA,GAAG,MACoB;EACvB,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK;EACrC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO;GACjD,IAAI,CAAC,OAAO,IACV,OAAO,QAAQ,OAAO,IAAI,uBAAuB,WAAW,OAAO,OAAO,MAAM,CAAC;EACrF;EACA,OAAO,KAAK,KAAmB,WAAW;GACxC;GACA;GACA;GACA,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;GACrD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;EACvD,CAAC;CACH;;;;;;CAOA,eACE,QACA,QACqC;EACrC,MAAM,EAAE,OAAO,UAAU,OAAO;EAChC,OAAO,KAAK,KAAK,YAAY;GAC3B;GACA;GACA;GACA,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;EACnC,CAAC;CACH;;;;;CAMA,cAAc,QAAgB,WAA6D;EACzF,OAAO,KAAK,KAAK,oBAAoB;GAAE;GAAQ;EAAU,CAAC;CAC5D;;;;;;;CAQA,WAAW,QAA2E;EACpF,OAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;CAC9C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;CAGA,aAAa,OAAoD;EAC/D,OAAO,KAAK,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC/C;;;;;;;;;CAUA,iBAAiB,QAAwD;EACvE,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,CAAC;CACtD;;;;;;;;;;CAWA,iBACE,QACA,OACwC;EACxC,MAAM,UAAU,KAAK,iBAAiB,KAAK;EAC3C,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;EACxD,OAAO,KAAK,QAAQ,OAAO,kBAAkB,MAAM,GAAG,KAAK;CAC7D;;;;;;;;;;CAWA,0BAA0B,WAAkE;EAC1F,OAAO,KAAK,QAAQ,OAAO,2BAA2B,SAAS,CAAC;CAClE;;CAGA,0BACE,WACA,OAC+C;EAC/C,MAAM,UAAU,KAAK,iBAAiB,KAAK;EAC3C,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;EACxD,OAAO,KAAK,QAAQ,OAAO,2BAA2B,SAAS,GAAG,KAAK;CACzE;;CAGA,iBACE,OACoC;EACpC,MAAM,WAAW,KAAK,QAAQ;EAC9B,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;EACnC,MAAM,SAA0B,CAAC;EACjC,KAAK,MAAM,WAAW,uBACpB,KAAK,MAAM,SAAS,OAAO,KAAK,MAAM,QAAQ,EAAE,UAAU,CAAC,CAAC,GAAG;GAE7D,IAAI,SAAS,OAAO,SAAS,KAAK,GAAG;GACrC,OAAO,KAAK;IAAE,MAAM,GAAG,QAAQ,UAAU;IAAS,SAAS;GAAuB,CAAC;EACrF;EAEF,OAAO,OAAO,SAAS,IACnB,IAAI,uBAAuB,kBAAkB,KAAA,GAAW,MAAM,IAC9D,KAAA;CACN;;CAGA,OAAO,QAAwC;EAC7C,OAAO,KAAK,KAAmB,WAAW,MAAM;CAClD;CAEA,KAAgB,MAAc,MAA2B;EACvD,OAAO,KAAK,QAAW,QAAQ,MAAM,IAAI;CAC3C;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC,CAAC;EACzC,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAClD,IAAI,KAAK,QAAQ,UAAU,KAAA,GAAW,QAAQ,gBAAgB,UAAU,KAAK,QAAQ;EAErF,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,GAAG,KAAK,QAAQ,OAAO,QAAQ,OAAO,EAAE,IAAI,QAAQ;GACjF;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;EAC7D,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,mBAAmB,MAAM,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAC3F,OAAQ,MAAM,SAAS,KAAK;CAC9B;AACF;AAEA,MAAM,qBAAqB,WAAmB,kBAAkB,mBAAmB,MAAM;AACzF,MAAM,8BAA8B,cAClC,6BAA6B,mBAAmB,SAAS"}

package/dist/cloudflare/index.cjs

@@ -1,4 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_reporting_classify = require("../reporting/classify.cjs");
+const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_store_facts = require("../store/facts.cjs");
 const require_store_erasure = require("../store/erasure.cjs");
 const require_store_postgres_reporting = require("../store/postgres-reporting.cjs");
@@ -10,8 +12,6 @@ const require_email_sender = require("../email-sender.cjs");
 const require_reporting_observer = require("../reporting/observer.cjs");
 const require_host_senders = require("../host/senders.cjs");
 const require_host_channels = require("../host/channels.cjs");
-const require_reporting_classify = require("../reporting/classify.cjs");
-const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_host_auth = require("../host/auth.cjs");
 const require_host_http = require("../host/http.cjs");
 const require_host_journey_host = require("../host/journey-host.cjs");

package/dist/cloudflare/index.mjs

@@ -1,3 +1,5 @@
+import { BURST_WINDOW_MS, DEFAULT_QUICK_MS, classifyClick, classifyOpen } from "../reporting/classify.mjs";
+import { handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
 import { JourneyFactSource } from "../store/facts.mjs";
 import { UserErasedError } from "../store/erasure.mjs";
 import { PostgresReporting } from "../store/postgres-reporting.mjs";
@@ -9,8 +11,6 @@ import { EmailSender, trackEmail } from "../email-sender.mjs";
 import { reportingObserver } from "../reporting/observer.mjs";
 import { LogMessageSender, WebhookMessageSender, routeByChannel, routeByPlatform } from "../host/senders.mjs";
 import { channelsFromConfig, journeyMode, runtimeFromConfig } from "../host/channels.mjs";
-import { BURST_WINDOW_MS, DEFAULT_QUICK_MS, classifyClick, classifyOpen } from "../reporting/classify.mjs";
-import { handleTracking, recordPushOpen } from "../reporting/tracking.mjs";
 import { authorized, bearerMatches, timingSafeEqual } from "../host/auth.mjs";
 import { handleRequest } from "../host/http.mjs";
 import { EnvValidationError } from "../host/journey-host.mjs";

package/dist/email-sender.cjs

@@ -14,7 +14,8 @@ var EmailSender = class {
 	async send(message) {
 		if (message.channel !== "email") throw new Error(`EmailSender: unsupported channel '${message.channel}'`);
 		if (message.recipient === void 0) throw new Error(`EmailSender: no recipient for user '${message.userId}'`);
-		const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(message.template, message.props);
+		const messageId = message.tracking?.messageId;
+		const { subject, html, from, replyTo, unsubscribeUrl } = await this.options.render(message.template, message.props, messageId === void 0 ? {} : { messageId });
 		const tracked = message.tracking === void 0 ? html : trackEmail(html, message.tracking, unsubscribeUrl);
 		await message.tracking?.commit?.();
 		const headers = unsubscribeHeaders(unsubscribeUrl, message.tracking?.unsubscribe);