@shware/workflow 6.1.1 → 8.0.0

package/dist/host/ingest.d.cts

@@ -56,6 +56,25 @@ export interface SweepResult {
     size: number;
   }[];
 }
+/**
+ * How long an entry may wait for its runner's admission before maintenance looks for its
+ * instance. A create takes well under a second and a queued instance is found by `get`, so this
+ * only has to outlast a create still in flight — generously, since a wrong call fails a journey.
+ */
+export declare const LOST_START_AFTER_MS: number;
+/**
+ * Starts lost between the entry and the platform's create — the Worker cut off there, or a
+ * create that failed with its rollback failing too — leave a `running` entry nothing will ever
+ * admit, and the once-policy would then bar the user from the workflow for good. An instance that
+ * ended before admitting itself leaves the same. An entry old enough, unadmitted, whose instance
+ * the runtime does not know or reports ended, is marked `failed`: the pair's next trigger reclaims
+ * it. Nothing of such an instance ran, since admission precedes its first effect. Platform-neutral:
+ * on AWS a planned start is always known to `get` (its registry row), and reads as ended only once
+ * its retries have given up, so only a start with nothing behind it is touched.
+ */
+export declare function failLostStarts(env: JourneyEnv, store: JourneyStore, now: number): Promise<string[]>;
+/** How long a visitor who never signs in is kept after they were last heard from. */
+export declare const VISITOR_RETENTION_MS: number;
 /** How many users one sweep page evaluates: a unit of resumable work (AWS checkpoints each). */
 export declare const SWEEP_PAGE_SIZE = 500;
 /**
@@ -106,17 +125,26 @@ export interface IdentifyResult {
  * and re-evaluate segment triggers. The merge is one statement in the store, so
  * two identifies landing together cannot lose each other's fields.
  */
-export declare function identifyUser(env: JourneyEnv, userId: string, props: ProfileProps, store: JourneyStore): Promise<IdentifyResult>;
+export declare function identifyUser(env: JourneyEnv, userId: string, props: ProfileProps, store: JourneyStore,
+/** When these values were read; a property written later stays. The Worker's clock by default. */
+at?: number): Promise<IdentifyResult>;
 export interface DeviceRegistration {
-  userId: string;
+  deviceId?: string | undefined;
+  userId?: string | undefined;
+  visitorId?: string | undefined;
   token: string;
   platform: string;
-  ts?: number;
 }
 /**
- * A push token registered for the user (or moved to them from another account: a token belongs
- * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside
- * `waitUntil`), for the new owner and the previous one.
+ * The visitor signed in as the user: what the engine knows of them moves to the user, once. Their
+ * journeys carry on as the user's (`instanceOwner`), except one the user is already in, which
+ * stops. Answers nothing to do when already linked: every signed-in batch names its visitor.
+ */
+export declare function linkVisitor(env: JourneyEnv, visitorId: string, userId: string, store: JourneyStore, at?: number): Promise<void>;
+/**
+ * A push token registered for its current owner: the user, or before sign-in the visitor. The
+ * device holds only that, so a token moves to whoever registered it last. Wakes the waits that read
+ * devices (`reachable('push')` inside `waitUntil`), for the new owner and the previous one.
  */
 export declare function registerDevice(env: JourneyEnv, device: DeviceRegistration, store: JourneyStore): Promise<{
   ok: true;
@@ -177,9 +205,11 @@ export declare class BundleIntegrityError extends Error {
  * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed
  * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens
  * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle
- * compiled into it; without one it is forced, whatever is live.
+ * compiled into it — unless `force` is set: then it happens whatever is live, and the version is
+ * recorded as live (`POST /bundle/deploy`). Without a version it is forced and records nothing
+ * (`POST /deploy`, a hand-posted bundle).
  */
-export declare function deployBundle(env: JourneyEnv, bundle: unknown, store: JourneyStore, version?: BundleVersion): Promise<DeployResult>;
+export declare function deployBundle(env: JourneyEnv, bundle: unknown, store: JourneyStore, version?: BundleVersion, force?: boolean): Promise<DeployResult>;
 /** The channels a user opts out of per topic: `suppression` rows are keyed by (user, channel, topic). */
 export declare const SUBSCRIPTION_CHANNELS: readonly ['email', 'push'];
 export type SubscriptionChannel = (typeof SUBSCRIPTION_CHANNELS)[number];

package/dist/host/ingest.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.d.cts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBAgDiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBA4EmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBA0Fc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;qBAIf;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBAkB7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAgFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO,eACN,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2FD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,gBACT,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ;;iBAwBM,cAAc;EAC7B,SAAS;EACT,OAAO;;;;;;;iBAQQ,qBAAqB,mCAAmC,cAAc;EACrF,SAAS,cAAc;;;;;;;;;wBAUH,oBACpB,OAAO,cACP,oBACC;EAAU;EAAgB,SAAS;;;wBAchB,0BACpB,OAAO,cACP,mBACA,4BACC,QAAQ;;wBAOW,0BACpB,KAAK,YACL,OAAO,cACP,mBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}
+{"version":3,"file":"ingest.d.cts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBAiDiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBAgFmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBAkGc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;;;;;qBAQf;;;;;;;;;;;wBAeS,eACpB,KAAK,YACL,OAAO,cACP,cACC;;qBAsBU;;qBAKA;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBA4B7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAuJM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO;;AAEP,cACC,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;EACA;;;;;;;wBAQoB,YACpB,KAAK,YACL,mBACA,gBACA,OAAO,cACP,cACC;;;;;;wBA2BmB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2GD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;;;wBAgDQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,eACV,kBACC,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ;;iBAwBM,cAAc;EAC7B,SAAS;EACT,OAAO;;;;;;;iBAQQ,qBAAqB,mCAAmC,cAAc;EACrF,SAAS,cAAc;;;;;;;;;wBAUH,oBACpB,OAAO,cACP,oBACC;EAAU;EAAgB,SAAS;;;wBAchB,0BACpB,OAAO,cACP,mBACA,4BACC,QAAQ;;wBAOW,0BACpB,KAAK,YACL,OAAO,cACP,mBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}

package/dist/host/ingest.d.mts

@@ -56,6 +56,25 @@ export interface SweepResult {
     size: number;
   }[];
 }
+/**
+ * How long an entry may wait for its runner's admission before maintenance looks for its
+ * instance. A create takes well under a second and a queued instance is found by `get`, so this
+ * only has to outlast a create still in flight — generously, since a wrong call fails a journey.
+ */
+export declare const LOST_START_AFTER_MS: number;
+/**
+ * Starts lost between the entry and the platform's create — the Worker cut off there, or a
+ * create that failed with its rollback failing too — leave a `running` entry nothing will ever
+ * admit, and the once-policy would then bar the user from the workflow for good. An instance that
+ * ended before admitting itself leaves the same. An entry old enough, unadmitted, whose instance
+ * the runtime does not know or reports ended, is marked `failed`: the pair's next trigger reclaims
+ * it. Nothing of such an instance ran, since admission precedes its first effect. Platform-neutral:
+ * on AWS a planned start is always known to `get` (its registry row), and reads as ended only once
+ * its retries have given up, so only a start with nothing behind it is touched.
+ */
+export declare function failLostStarts(env: JourneyEnv, store: JourneyStore, now: number): Promise<string[]>;
+/** How long a visitor who never signs in is kept after they were last heard from. */
+export declare const VISITOR_RETENTION_MS: number;
 /** How many users one sweep page evaluates: a unit of resumable work (AWS checkpoints each). */
 export declare const SWEEP_PAGE_SIZE = 500;
 /**
@@ -106,17 +125,26 @@ export interface IdentifyResult {
  * and re-evaluate segment triggers. The merge is one statement in the store, so
  * two identifies landing together cannot lose each other's fields.
  */
-export declare function identifyUser(env: JourneyEnv, userId: string, props: ProfileProps, store: JourneyStore): Promise<IdentifyResult>;
+export declare function identifyUser(env: JourneyEnv, userId: string, props: ProfileProps, store: JourneyStore,
+/** When these values were read; a property written later stays. The Worker's clock by default. */
+at?: number): Promise<IdentifyResult>;
 export interface DeviceRegistration {
-  userId: string;
+  deviceId?: string | undefined;
+  userId?: string | undefined;
+  visitorId?: string | undefined;
   token: string;
   platform: string;
-  ts?: number;
 }
 /**
- * A push token registered for the user (or moved to them from another account: a token belongs
- * to one user at a time). Wakes the waits that read devices (`reachable('push')` inside
- * `waitUntil`), for the new owner and the previous one.
+ * The visitor signed in as the user: what the engine knows of them moves to the user, once. Their
+ * journeys carry on as the user's (`instanceOwner`), except one the user is already in, which
+ * stops. Answers nothing to do when already linked: every signed-in batch names its visitor.
+ */
+export declare function linkVisitor(env: JourneyEnv, visitorId: string, userId: string, store: JourneyStore, at?: number): Promise<void>;
+/**
+ * A push token registered for its current owner: the user, or before sign-in the visitor. The
+ * device holds only that, so a token moves to whoever registered it last. Wakes the waits that read
+ * devices (`reachable('push')` inside `waitUntil`), for the new owner and the previous one.
  */
 export declare function registerDevice(env: JourneyEnv, device: DeviceRegistration, store: JourneyStore): Promise<{
   ok: true;
@@ -177,9 +205,11 @@ export declare class BundleIntegrityError extends Error {
  * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed
  * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens
  * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle
- * compiled into it; without one it is forced, whatever is live.
+ * compiled into it — unless `force` is set: then it happens whatever is live, and the version is
+ * recorded as live (`POST /bundle/deploy`). Without a version it is forced and records nothing
+ * (`POST /deploy`, a hand-posted bundle).
  */
-export declare function deployBundle(env: JourneyEnv, bundle: unknown, store: JourneyStore, version?: BundleVersion): Promise<DeployResult>;
+export declare function deployBundle(env: JourneyEnv, bundle: unknown, store: JourneyStore, version?: BundleVersion, force?: boolean): Promise<DeployResult>;
 /** The channels a user opts out of per topic: `suppression` rows are keyed by (user, channel, topic). */
 export declare const SUBSCRIPTION_CHANNELS: readonly ['email', 'push'];
 export type SubscriptionChannel = (typeof SUBSCRIPTION_CHANNELS)[number];

package/dist/host/ingest.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.d.mts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBAgDiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBA4EmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBA0Fc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;qBAIf;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBAkB7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAgFM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO,eACN,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;;;;;;;wBAQoB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2FD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;wBA8CQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,gBACT,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ;;iBAwBM,cAAc;EAC7B,SAAS;EACT,OAAO;;;;;;;iBAQQ,qBAAqB,mCAAmC,cAAc;EACrF,SAAS,cAAc;;;;;;;;;wBAUH,oBACpB,OAAO,cACP,oBACC;EAAU;EAAgB,SAAS;;;wBAchB,0BACpB,OAAO,cACP,mBACA,4BACC,QAAQ;;wBAOW,0BACpB,KAAK,YACL,OAAO,cACP,mBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}
+{"version":3,"file":"ingest.d.mts","names":[],"sources":["../../src/host/ingest.ts"],"mappings":";;;iBAiDiB;EACf;EACA;EACA,UAAU;EACV;;;;;;;;;;;;;;;EAeA;;iBAGe;;EAEf;;EAEA;EACA;EACA;;wBAGoB,YACpB,KAAK,YACL,OAAO,aACP,OAAO,eACN,QAAQ;;;;;;wBAwCW,gBACpB,KAAK,YACL,OAAO,cACP,gBACA,4BACC;;;;;;;;;wBAgFmB,uBACpB,KAAK,YACL,OAAO,cACP,gBACA,aACC;iBAkGc;EACf;;EAEA;;EAEA;IAAS;IAAiB;;;;;;;;qBAQf;;;;;;;;;;;wBAeS,eACpB,KAAK,YACL,OAAO,cACP,cACC;;qBAsBU;;qBAKA;;;;;;;wBAQS,iBAAiB,KAAK,YAAY,OAAO,eAAe;iBA4B7D;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;;wBASoB,mBACpB,KAAK,YACL,OAAO,cACP;EAAQ;EAA4B;EAA4B;IAC/D,QAAQ;;;;;;;;;wBAsCW,cACpB,KAAK,YACL,OAAO,cACP,eACC,QAAQ;iBAuJM;EACf;EACA,OAAO;EACP;EACA;;;;;;;wBAQoB,aACpB,KAAK,YACL,gBACA,OAAO,cACP,OAAO;;AAEP,cACC,QAAQ;iBAiBM;EACf;EACA;EACA;EACA;EACA;;;;;;;wBAQoB,YACpB,KAAK,YACL,mBACA,gBACA,OAAO,cACP,cACC;;;;;;wBA2BmB,eACpB,KAAK,YACL,QAAQ,oBACR,OAAO,eACN;EAAU;EAAU;;;;;;;;;;;wBA2GD,WACpB,KAAK,YACL,gBACA,OAAO,cACP,eACC;EAAU;EAAU;EAAiB;;;;;;;wBAUlB,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;;wBAQD,aACpB,KAAK,YACL,eACA,OAAO,eACN;EAAU;EAAU;;iBASN;EACf;;;;;;;;EAQA;IAAY;IAAkB,SAAS;;;;;;EAKvC;;;qBAIW,6BAA6B;EACxC,YAAY;;;;;;;;;;wBAgDQ,aACpB,KAAK,YACL,iBACA,OAAO,cACP,UAAU,eACV,kBACC,QAAQ;;qBA2BE;YACD,8BAA8B;;;;;;iBAOzB,qBAAqB;;;;;EAKpC;;;;;;EAMA,QAAQ,OAAO;;;;;;;iBAQA,cAAc;EAC7B,OAAO,qBAAqB;EAC5B,MAAM,qBAAqB;;;iBAIZ,0BAA0B;EACzC;EACA,SAAS,QAAQ,OAAO;;;;;;;iBAQT,mBAAmB;EAClC,QAAQ,0BAA0B;EAClC,OAAO,0BAA0B;;;iBAIlB;EACf;EACA;;;;;;wBAOc,wBACd,eACA;EACG;EAAU,OAAO;;EAAyB;EAAW,QAAQ;;;wBA8D5C,iBACpB,OAAO,cACP,gBACA,4BACC,QAAQ;;;;;;;;;wBAaW,iBACpB,KAAK,YACL,OAAO,cACP,gBACA,OAAO,oBACP,2BACA,eACC,QAAQ;;iBAwBM,cAAc;EAC7B,SAAS;EACT,OAAO;;;;;;;iBAQQ,qBAAqB,mCAAmC,cAAc;EACrF,SAAS,cAAc;;;;;;;;;wBAUH,oBACpB,OAAO,cACP,oBACC;EAAU;EAAgB,SAAS;;;wBAchB,0BACpB,OAAO,cACP,mBACA,4BACC,QAAQ;;wBAOW,0BACpB,KAAK,YACL,OAAO,cACP,mBACA,OAAO,oBACP,2BACA,eACC,QAAQ"}

package/dist/host/ingest.mjs

@@ -6,6 +6,7 @@ import { BundleIR } from "../ir.mjs";
 import { isMessageId } from "../reporting/tracking.mjs";
 import { JourneyFactSource } from "../store/facts.mjs";
 import { UserErasedError } from "../store/erasure.mjs";
+import { isVisitorSubject } from "../store/identity.mjs";
 import { SchemaMismatchError } from "../store/index.mjs";
 import { InstanceNotFoundError, WAKE_EVENT_TYPE } from "./platform.mjs";
 // src/host/ingest.ts
@@ -86,6 +87,7 @@ async function wakeSubscribers(env, store, userId, events) {
 async function startTriggeredJourneys(env, store, input, ts) {
 	const started = [];
 	for (const route of await store.findTriggers(input.event)) {
+		if (isVisitorSubject(input.userId) && !route.visitors) continue;
 		if (route.where !== null && !matchesWhere(input.payload, route.where)) continue;
 		if (route.filter !== null) {
 			const facts = new JourneyFactSource(store, input.userId);
@@ -93,7 +95,8 @@ async function startTriggeredJourneys(env, store, input, ts) {
 		}
 		const instanceId = await startJourney(env, store, route.workflow, route.hash, input.userId, ts, {
 			event: input.event,
-			payload: input.payload
+			payload: input.payload,
+			ts
 		}, route.version);
 		if (instanceId !== null) started.push(instanceId);
 	}
@@ -117,6 +120,7 @@ async function refreshSegmentTriggers(env, store, userId, ts) {
 * users who enter after it is deployed; a user already a member is not entered again.
 */
 async function refreshSegments(env, store, userId, ts, routes, segments = [], definitions = /* @__PURE__ */ new Map()) {
+	if (isVisitorSubject(userId)) return [];
 	const bySegment = new Map(segments.map((name) => [name, []]));
 	for (const route of routes) {
 		const list = bySegment.get(route.segment) ?? [];
@@ -152,7 +156,7 @@ async function refreshSegments(env, store, userId, ts, routes, segments = [], de
 					payload: { segment: segmentId }
 				}, route.version);
 				if (instanceId !== null) started.push(instanceId);
-				await store.completeSegmentStart(segmentId, userId, route.workflow);
+				if (instanceId !== null || await entryStarted(env, store, route.workflow, userId)) await store.completeSegmentStart(segmentId, userId, route.workflow);
 			} catch (error) {
 				failures.push(error);
 			}
@@ -161,6 +165,43 @@ async function refreshSegments(env, store, userId, ts, routes, segments = [], de
 	if (failures.length > 0) throw failures[0];
 	return started;
 }
+/**
+* How long an entry may wait for its runner's admission before maintenance looks for its
+* instance. A create takes well under a second and a queued instance is found by `get`, so this
+* only has to outlast a create still in flight — generously, since a wrong call fails a journey.
+*/
+const LOST_START_AFTER_MS = 9e5;
+/** Entries one maintenance run examines, oldest first; the next run takes the rest. */
+const LOST_START_BATCH = 25;
+/**
+* Starts lost between the entry and the platform's create — the Worker cut off there, or a
+* create that failed with its rollback failing too — leave a `running` entry nothing will ever
+* admit, and the once-policy would then bar the user from the workflow for good. An instance that
+* ended before admitting itself leaves the same. An entry old enough, unadmitted, whose instance
+* the runtime does not know or reports ended, is marked `failed`: the pair's next trigger reclaims
+* it. Nothing of such an instance ran, since admission precedes its first effect. Platform-neutral:
+* on AWS a planned start is always known to `get` (its registry row), and reads as ended only once
+* its retries have given up, so only a start with nothing behind it is touched.
+*/
+async function failLostStarts(env, store, now) {
+	const failed = [];
+	for (const entry of await store.unadmittedEntries(now - LOST_START_AFTER_MS, LOST_START_BATCH)) {
+		try {
+			if (!await hasEnded(await env.JOURNEY.get(entry.instanceId))) continue;
+		} catch (error) {
+			if (!(error instanceof InstanceNotFoundError)) continue;
+		}
+		if (await store.failUnadmittedEntry(entry.instanceId)) {
+			failed.push(entry.instanceId);
+			console.error(`[workflow] the start of ${entry.instanceId} (${entry.workflow}) was lost before its instance existed: marked failed, the next trigger re-enters`);
+		}
+	}
+	return failed;
+}
+/** How long a visitor who never signs in is kept after they were last heard from. */
+const VISITOR_RETENTION_MS = 7776e6;
+/** Visitors one sweep prunes: the next sweep goes on. */
+const VISITOR_PRUNE_BATCH = 100;
 /** How many users one sweep page evaluates: a unit of resumable work (AWS checkpoints each). */
 const SWEEP_PAGE_SIZE = 500;
 /**
@@ -175,6 +216,16 @@ async function sweepMaintenance(env, store) {
 	} catch (error) {
 		console.error("[workflow] runtime maintenance failed", error);
 	}
+	try {
+		await failLostStarts(env, store, Date.now());
+	} catch (error) {
+		console.error("[workflow] reclaiming lost starts failed", error);
+	}
+	try {
+		await store.pruneVisitors(Date.now() - VISITOR_RETENTION_MS, VISITOR_PRUNE_BATCH);
+	} catch (error) {
+		console.error("[workflow] pruning idle visitors failed", error);
+	}
 	for (const userId of await store.pendingErasures()) try {
 		await eraseUser(env, userId, store, Date.now());
 	} catch (error) {
@@ -246,6 +297,50 @@ async function sweepSegments(env, store, now = Date.now()) {
 	};
 }
 /**
+* Whether the (workflow, user) entry's start is known to have happened: the runner admitted
+* itself, the entry already ended, or the runtime knows its instance and it has not ended. An
+* unadmitted entry whose instance cannot be found, cannot be looked up right now, or ended without
+* admitting itself is not; the caller asks again.
+*/
+async function entryStarted(env, store, workflow, userId) {
+	const entry = await store.getEntry(workflow, userId);
+	if (entry === void 0 || entry.status === "failed") return false;
+	if (entry.admitted || entry.status !== "running") return true;
+	try {
+		return !await hasEnded(await env.JOURNEY.get(entry.instanceId));
+	} catch {
+		return false;
+	}
+}
+/**
+* Create the instance, idempotently by id, on a runtime that does not record its starts
+* (Cloudflare): a create the platform refuses because the id already exists — a concurrent
+* retry of the same start won the race — is the instance we wanted, not a failure. Rolling the
+* entry back over it would strand a running instance with no ledger row, and it would never be
+* admitted. A create whose instance the runtime cannot find failed, and so did one refused by an
+* instance that already ended: the id stays taken by that corpse, which will never admit itself,
+* and taking it for the start would leave a running entry nothing ever fails. True when this call
+* created it, false when it already existed.
+*/
+async function createInstance(env, id, params) {
+	try {
+		await env.JOURNEY.create({
+			id,
+			params
+		});
+		return true;
+	} catch (error) {
+		let ended;
+		try {
+			ended = await hasEnded(await env.JOURNEY.get(id));
+		} catch {
+			throw error;
+		}
+		if (ended) throw error;
+		return false;
+	}
+}
+/**
 * Create one journey instance behind the entry ledger. Returns null when the
 * once-policy blocks the entry (the store's attempt is atomic, so concurrent
 * ingests cannot double-enter). A pair whose previous instance is recorded as
@@ -274,17 +369,23 @@ async function startJourney(env, store, workflow, hash, userId, ts, trigger, ver
 		execution
 	});
 	if (outcome === null) {
-		await env.JOURNEY.resume?.({
-			workflow,
-			userId
-		});
-		return null;
+		if (env.JOURNEY.resume !== void 0) {
+			await env.JOURNEY.resume({
+				workflow,
+				userId
+			});
+			return null;
+		}
+		const entry = await store.getEntry(workflow, userId);
+		if (entry?.instanceId !== instanceId || entry.status !== "running" || entry.admitted) return null;
+		return await createInstance(env, instanceId, params) ? instanceId : null;
 	}
 	try {
-		await env.JOURNEY.create({
+		if (execution !== void 0) await env.JOURNEY.create({
 			id: instanceId,
 			params
 		});
+		else await createInstance(env, instanceId, params);
 	} catch (error) {
 		if (execution !== void 0) throw error;
 		if (outcome === "reclaimed") await store.setEntryStatus(instanceId, "failed");
@@ -309,30 +410,58 @@ function buildInstanceId(workflow, hash, userId, ts) {
 * and re-evaluate segment triggers. The merge is one statement in the store, so
 * two identifies landing together cannot lose each other's fields.
 */
-async function identifyUser(env, userId, props, store) {
+async function identifyUser(env, userId, props, store, at) {
 	await refuseIfErased(store, userId);
 	const ts = Date.now();
 	return {
 		ok: true,
-		props: await store.mergeProfile(userId, props),
+		props: await store.mergeProfile(userId, props, at ?? ts),
 		woke: await wakeSubscribers(env, store, userId, Object.keys(props).map(profileUpdatedEvent)),
 		started: await refreshSegmentTriggers(env, store, userId, ts)
 	};
 }
 /**
-* A push token registered for the user (or moved to them from another account: a token belongs
-* to one user at a time). Wakes the waits that read devices (`reachable('push')` inside
-* `waitUntil`), for the new owner and the previous one.
+* The visitor signed in as the user: what the engine knows of them moves to the user, once. Their
+* journeys carry on as the user's (`instanceOwner`), except one the user is already in, which
+* stops. Answers nothing to do when already linked: every signed-in batch names its visitor.
+*/
+async function linkVisitor(env, visitorId, userId, store, at = Date.now()) {
+	await refuseIfErased(store, userId);
+	const linked = await store.linkedUser(visitorId);
+	if (linked !== void 0) {
+		if (linked !== userId) console.warn(`[workflow] visitor ${visitorId} stays with its first user, not ${userId}`);
+		return;
+	}
+	const merge = await store.linkVisitor(visitorId, userId, at);
+	if (merge === null) return;
+	for (const instanceId of merge.dropped) await stopInstance(env, instanceId);
+	await wakeSubscribers(env, store, userId, [
+		DEVICES_UPDATED_EVENT,
+		...merge.events,
+		...merge.props.map(profileUpdatedEvent)
+	]);
+	await refreshSegmentTriggers(env, store, userId, at);
+}
+/**
+* A push token registered for its current owner: the user, or before sign-in the visitor. The
+* device holds only that, so a token moves to whoever registered it last. Wakes the waits that read
+* devices (`reachable('push')` inside `waitUntil`), for the new owner and the previous one.
 */
 async function registerDevice(env, device, store) {
-	await refuseIfErased(store, device.userId);
-	const previous = await store.removeDevice(device.token);
-	await store.upsertDevice({
-		...device,
-		ts: device.ts ?? Date.now()
+	const { deviceId, userId, visitorId, token, platform } = device;
+	if (userId !== void 0 && visitorId !== void 0) await linkVisitor(env, visitorId, userId, store);
+	const subject = userId ?? await store.touchVisitor(visitorId ?? "", Date.now());
+	await refuseIfErased(store, subject);
+	const previous = await store.upsertDevice({
+		deviceId,
+		userId: isVisitorSubject(subject) ? null : subject,
+		visitorId,
+		token,
+		platform,
+		at: Date.now()
 	});
-	let woke = await wakeSubscribers(env, store, device.userId, [DEVICES_UPDATED_EVENT]);
-	if (previous !== void 0 && previous !== device.userId) woke += await wakeSubscribers(env, store, previous, [DEVICES_UPDATED_EVENT]);
+	let woke = await wakeSubscribers(env, store, subject, [DEVICES_UPDATED_EVENT]);
+	for (const owner of previous) woke += await wakeSubscribers(env, store, owner, [DEVICES_UPDATED_EVENT]);
 	return {
 		ok: true,
 		woke
@@ -344,6 +473,11 @@ const STOPPED_STATUSES = /* @__PURE__ */ new Set([
 	"errored",
 	"terminated"
 ]);
+/** Whether the instance reports a terminal state. An unreadable status says nothing: false. */
+async function hasEnded(instance) {
+	const status = await instance.status?.().catch(() => void 0);
+	return status !== void 0 && STOPPED_STATUSES.has(status.status);
+}
 /**
 * Stop one admitted instance for good; true once it is known not to run again: terminated, or
 * already in a terminal state (terminate refuses those). Any other failure is not taken for
@@ -368,8 +502,7 @@ async function stopInstance(env, instanceId) {
 		await instance.terminate();
 		return true;
 	} catch (error) {
-		const status = await instance.status?.().catch(() => void 0);
-		if (status !== void 0 && STOPPED_STATUSES.has(status.status)) return true;
+		if (await hasEnded(instance)) return true;
 		console.warn(`[workflow] terminating ${instanceId} failed`, error);
 		return false;
 	}
@@ -479,16 +612,18 @@ function verifyBundleHashes(parsed) {
 * Bundle deploy, terraform-apply style: workflow bodies first (content-addressed, so a failed
 * deploy leaves only harmless orphans), then the routing swap. With a `version` the swap happens
 * only over an older live version (`replaceRoutesIfNewer`) — how journeyWorker applies the bundle
-* compiled into it; without one it is forced, whatever is live.
+* compiled into it — unless `force` is set: then it happens whatever is live, and the version is
+* recorded as live (`POST /bundle/deploy`). Without a version it is forced and records nothing
+* (`POST /deploy`, a hand-posted bundle).
 */
-async function deployBundle(env, bundle, store, version) {
+async function deployBundle(env, bundle, store, version, force = false) {
 	const parsed = BundleIR.parse(bundle);
 	verifyBundleHashes(parsed);
 	const problems = await store.checkSchema();
 	if (problems.length > 0) throw new SchemaMismatchError(problems);
 	for (const workflow of parsed.workflows) await store.putWorkflowIR(workflow);
 	let applied = true;
-	if (version === void 0) await store.replaceRoutes(parsed);
+	if (version === void 0 || force) await store.replaceRoutes(parsed, version);
 	else applied = await store.replaceRoutesIfNewer(parsed, version);
 	const unrouted = parsed.workflows.filter((workflow) => workflow.trigger.type === "date" || workflow.trigger.type === "webhook").map((workflow) => ({
 		workflow: workflow.id,
@@ -660,6 +795,6 @@ async function setSubscriptionsByMessage(env, store, messageId, patch, topics, n
 		message: owner.message
 	};
 }
-export { BundleIntegrityError, SUBSCRIPTION_CHANNELS, SWEEP_PAGE_SIZE, deployBundle, forgetUser, getSubscriptions, getSubscriptionsByMessage, identifyUser, ingestEvent, parseSubscriptionsPatch, refreshSegmentTriggers, registerDevice, removeDevice, resolveMessageOwner, setSubscriptions, setSubscriptionsByMessage, sweepMaintenance, sweepSegments, sweepSegmentsPaged, unbindDevice, wakeSubscribers };
+export { BundleIntegrityError, LOST_START_AFTER_MS, SUBSCRIPTION_CHANNELS, SWEEP_PAGE_SIZE, VISITOR_RETENTION_MS, deployBundle, failLostStarts, forgetUser, getSubscriptions, getSubscriptionsByMessage, identifyUser, ingestEvent, linkVisitor, parseSubscriptionsPatch, refreshSegmentTriggers, registerDevice, removeDevice, resolveMessageOwner, setSubscriptions, setSubscriptionsByMessage, sweepMaintenance, sweepSegments, sweepSegmentsPaged, unbindDevice, wakeSubscribers };
 
 //# sourceMappingURL=ingest.mjs.map