@shware/workflow 6.1.1 → 8.0.0

package/dist/ir.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ir.mjs","names":[],"sources":["../src/ir.ts"],"sourcesContent":["import * as z from 'zod/mini';\n\n/**\n * IR (Intermediate Representation) — what the DSL compiles to: serializable\n * JSON. It is the three-way contract between the engine that interprets it,\n * the UI (react-flow) that renders it, and diff / audit tooling.\n *\n * Validation strategy: the zod/mini schemas are the authoritative definition.\n * TS types are either inferred from a schema or hand-written under the same\n * name (zod cannot infer recursive types; the hand-written type is anchored\n * with a ZodMiniType<T> annotation, so any drift fails to compile). IR crosses\n * process boundaries (database, network, UI), so runtime validation is a must.\n *\n * ## Versioning (two independent axes)\n *\n * 1. IR format version (irVersion): evolution of the IR schema itself. Adding\n *    optional fields does not bump it; only structurally incompatible changes\n *    do (changing a discriminant, dropping a field, altering semantics).\n *    Readers dispatch on irVersion to the matching schema/migrator; writers\n *    always write the current version.\n * 2. Content version (contentHash): a content-addressed id for a single\n *    definition's **execution semantics** — the canonical-JSON hash after\n *    metadata (meta / label / reason) is stripped, see hash.ts. It is used to:\n *    - pin a version when a user enters, so an in-flight journey runs the\n *      pinned version to completion (the default policy; compatible hot\n *      updates are a future explicit-migration topic). Known exception:\n *      segment conditions are resolved **by id at evaluation time** — a\n *      segment redeploy changes behaviour of in-flight journeys that\n *      reference it. Pinning covers the workflow's own structure; per-hash\n *      segment snapshots are future work;\n *    - diff on deploy: same hash means unchanged, skip publishing;\n *    - audit: answer \"which version was this user on\" at any point.\n *\n * ## Node ids\n *\n * Derived from the structural path at compile time — stable and deterministic:\n * root level '0', '1', …; the j-th child of a branch's i-th case is\n * '{branchId}.c{i}.{j}', the default arm '{branchId}.o.{j}'; cohort arms use\n * the arm name '{cohortId}.{armName}.{j}'; a waitUntil timeout flow '{id}.t.{j}'.\n * Editing a node's parameters keeps its id; inserting a node shifts the ids of\n * its later siblings (a known trade-off — locating in-flight users relies on\n * the pinned version rather than cross-version id alignment, and cross-version\n * mapping is an explicit migrator's job).\n */\n\nexport const IR_VERSION = 2;\n\n/* -------------------------------- Base values ------------------------------- */\n\nexport const ScalarIR = z.union([z.string(), z.number(), z.boolean()]);\nexport type ScalarIR = z.infer<typeof ScalarIR>;\n\n/** Duration: `value` keeps the DSL literal ('23 hours', for display), `ms` is what the engine uses. */\n/*\n * TODO: `value` is hashed alongside `ms`, so '7 days' / '1 week' / '168 hours'\n * — identical to the engine, which only reads ms — produce three different\n * contentHashes. Rewording a duration therefore reports as a semantic change in\n * plan and repins in-flight users. Moving `value` out of the hash (it is a\n * display string) would fix it; deferred because it changes existing hashes.\n */\nexport const DurationIR = z.object({ value: z.string(), ms: z.number() });\nexport type DurationIR = z.infer<typeof DurationIR>;\n\n/** User-property reference — isomorphic to the DSL's UserPropertyRef once serialized (phantom type dropped). */\nexport const UserPropertyRefIR = z.object({\n  type: z.literal('user_property'),\n  path: z.string(),\n});\nexport type UserPropertyRefIR = z.infer<typeof UserPropertyRefIR>;\n\n/** A message prop / event payload value: either a literal or a user-property reference. */\nexport const PropValueIR = z.union([ScalarIR, UserPropertyRefIR]);\nexport type PropValueIR = z.infer<typeof PropValueIR>;\n\nexport const ChannelIR = z.enum(['email', 'sms', 'push', 'in_app', 'slack', 'discord', 'survey']);\nexport type ChannelIR = z.infer<typeof ChannelIR>;\n\nexport const WeekdayIR = z.enum(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']);\nexport type WeekdayIR = z.infer<typeof WeekdayIR>;\n\n/* --------------------------------- Provenance -------------------------------- */\n\n/**\n * Source location of the builder call that produced a definition — the IR's\n * source map. Lives under `meta`, so it is **excluded from contentHash**\n * (see hash.ts): provenance never affects execution identity or plan.\n * `file` is cwd-relative when compiled under Node, a URL under Vite dev.\n */\nexport const SourceLocIR = z.object({\n  file: z.string(),\n  line: z.number(),\n  column: z.number(),\n});\nexport type SourceLocIR = z.infer<typeof SourceLocIR>;\n\n/** Node-level metadata: provenance only, for now. Excluded from contentHash. */\nexport const NodeMetaIR = z.object({\n  loc: z.optional(SourceLocIR),\n});\nexport type NodeMetaIR = z.infer<typeof NodeMetaIR>;\n\n/* -------------------------------- Conditions -------------------------------- */\n\nexport const PropertyOperatorIR = z.enum([\n  'eq',\n  'ne',\n  'gt',\n  'gte',\n  'lt',\n  'lte',\n  'between',\n  'not_between',\n  'in_array',\n  'not_in_array',\n  'exists',\n  'not_exists',\n  'contains',\n  'not_contains',\n]);\nexport type PropertyOperatorIR = z.infer<typeof PropertyOperatorIR>;\n\n/**\n * Condition expression tree. The shape of value/values follows `op`:\n * eq/ne/gt/gte/lt/lte/contains/not_contains → value; in_array/not_in_array →\n * values; between/not_between → values = [min, max]; exists/not_exists → neither.\n *\n * `payload` predicates test the payload of an event (dotted paths reach nested\n * fields). They are only valid inside a `where` subtree — `performed.where`\n * and the event trigger's `where` — where an event row is in scope; the\n * compiler (compileBundle) and the evaluator both enforce the placement.\n * TODO: runtime refinement narrowing by op.\n */\n/**\n * Provenance rides on conditions too, so the studio can point at the exact\n * `eq(...)` / `and(...)` that produced a node — same rule as nodes: `meta` is\n * dropped before hashing, so carrying it never affects execution identity.\n */\ninterface ConditionBaseIR {\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type ConditionIR =\n  | (ConditionBaseIR & { type: 'and'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'or'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'not'; condition: ConditionIR })\n  /** Reference a segment by id (defined in SegmentIR, versioned separately). */\n  | (ConditionBaseIR & { type: 'segment'; segment: string })\n  | (ConditionBaseIR & {\n      type: 'property';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      /** Event payload predicate; `path` is dotted for nested fields ('tags.utm_source'). */\n      type: 'payload';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      type: 'performed';\n      event: string;\n      /** Payload filter: only events matching it count (a payload-only subtree). */\n      where?: ConditionIR | undefined;\n      within?: DurationIR | undefined;\n      count?: number | undefined;\n    })\n  /**\n   * The user can be reached on the channel right now: for push, the host's\n   * device directory lists at least one device; for the others, the channel's\n   * recipient property (email, phone, …) is set.\n   */\n  | (ConditionBaseIR & { type: 'reachable'; channel: ChannelIR });\n\nconst conditionBase = { meta: z.optional(NodeMetaIR) };\n\nexport const ConditionIR: z.ZodMiniType<ConditionIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({ ...conditionBase, type: z.literal('and'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('or'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('not'), condition: ConditionIR }),\n    z.object({ ...conditionBase, type: z.literal('segment'), segment: z.string() }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('property'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('payload'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('performed'),\n      event: z.string(),\n      where: z.optional(ConditionIR),\n      within: z.optional(DurationIR),\n      count: z.optional(z.number()),\n    }),\n    z.object({ ...conditionBase, type: z.literal('reachable'), channel: ChannelIR }),\n  ])\n);\n\n/* --------------------------------- Triggers --------------------------------- */\n\n/**\n * Trigger shapes. The event trigger has two independent gates: `where` tests\n * the triggering event's payload (payload-only subtree, evaluated against the\n * incoming event before anything else), `filter` tests the user's profile.\n */\nexport const TriggerIR = z.discriminatedUnion('type', [\n  z.object({\n    type: z.literal('event'),\n    event: z.string(),\n    where: z.optional(ConditionIR),\n    filter: z.optional(ConditionIR),\n  }),\n  z.object({ type: z.literal('segment'), segment: z.string() }),\n  z.object({ type: z.literal('date'), at: z.string() }),\n  z.object({ type: z.literal('webhook') }),\n]);\nexport type TriggerIR = z.infer<typeof TriggerIR>;\n\n/* ----------------------------------- Nodes ---------------------------------- */\n\ninterface NodeBaseIR {\n  /** Stable id derived from the structural path (rules in the file header). */\n  id: string;\n  /** Optional node name: UI title / observability handle (branch's optional first argument lands here). */\n  label?: string | undefined;\n  /** Metadata (provenance); excluded from contentHash. */\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type NodeIR =\n  | (NodeBaseIR & {\n      type: 'message';\n      channel: ChannelIR;\n      template: string;\n      props: Record<string, PropValueIR>;\n      /**\n       * Push only: which of the user's devices get a copy. Absent means every\n       * device the directory lists; 'latest' only the most recently registered.\n       */\n      devices?: 'latest' | undefined;\n      /**\n       * Email and push: the template's subscription topic, or null for a transactional message\n       * (sent whatever the user opted out of). Absent for other channels, and in IR compiled\n       * before topics existed: such a step checks the channel-level opt-out only, as it always did.\n       */\n      topic?: string | null | undefined;\n    })\n  | (NodeBaseIR & { type: 'delay'; duration: DurationIR })\n  | (NodeBaseIR & { type: 'random_delay'; min: DurationIR; max: DurationIR })\n  | (NodeBaseIR & {\n      type: 'time_window';\n      days: WeekdayIR[];\n      between: [string, string];\n      tz: string;\n    })\n  | (NodeBaseIR & {\n      type: 'wait_until';\n      condition: ConditionIR;\n      timeout: DurationIR;\n      onTimeout: 'continue' | 'exit' | NodeIR[];\n    })\n  | (NodeBaseIR & {\n      type: 'branch';\n      cases: { label?: string | undefined; condition: ConditionIR; flow: NodeIR[] }[];\n      /** Default arm (the DSL's bare tail argument). Absent = fall through to the main line. */\n      otherwise?: NodeIR[] | undefined;\n    })\n  | (NodeBaseIR & {\n      type: 'filter';\n      /** Audit-log line for the users this gate drops. Metadata: excluded from contentHash. */\n      reason?: string | undefined;\n      condition: ConditionIR;\n    })\n  | (NodeBaseIR & {\n      type: 'cohort';\n      /**\n       * Explicit experiment key: bucketing hashes `userId:key` instead of the\n       * structural node id, so the assignment survives node insertion/moves and\n       * the experiment keeps one identity across workflow versions. Absent →\n       * the node id is used (fine for one-off splits).\n       */\n      key?: string | undefined;\n      /**\n       * Arms in authoring order — the order the interpreter accumulates weights\n       * in, so it decides which bucket range each arm owns. The DSL keeps that\n       * promise by rejecting integer-like arm names, which JavaScript would\n       * hoist to the front of the object in numeric order. Weights sum to 100.\n       */\n      arms: { name: string; weight: number; flow: NodeIR[] }[];\n    })\n  | (NodeBaseIR & {\n      /** `reason` is the audit-log line. Metadata: excluded from contentHash. */\n      type: 'exit';\n      reason?: string | undefined;\n    })\n  | (NodeBaseIR & { type: 'send_event'; event: string; payload: Record<string, PropValueIR> })\n  | (NodeBaseIR & {\n      type: 'action';\n      /** Registry name of the custom action; the code itself lives in the deployed Worker bundle. */\n      action: string;\n      /** Argument values; user_property references are resolved at run time, like message props. */\n      args: Record<string, PropValueIR>;\n    });\n\nconst nodeBase = { id: z.string(), label: z.optional(z.string()), meta: z.optional(NodeMetaIR) };\n\nexport const NodeIR: z.ZodMiniType<NodeIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({\n      ...nodeBase,\n      type: z.literal('message'),\n      channel: ChannelIR,\n      template: z.string(),\n      props: z.record(z.string(), PropValueIR),\n      devices: z.optional(z.literal('latest')),\n      topic: z.optional(z.nullable(z.string())),\n    }),\n    z.object({ ...nodeBase, type: z.literal('delay'), duration: DurationIR }),\n    z.object({ ...nodeBase, type: z.literal('random_delay'), min: DurationIR, max: DurationIR }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('time_window'),\n      days: z.array(WeekdayIR),\n      between: z.tuple([z.string(), z.string()]),\n      tz: z.string(),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('wait_until'),\n      condition: ConditionIR,\n      timeout: DurationIR,\n      onTimeout: z.union([z.literal('continue'), z.literal('exit'), z.array(NodeIR)]),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('branch'),\n      cases: z.array(\n        z.object({\n          label: z.optional(z.string()),\n          condition: ConditionIR,\n          flow: z.array(NodeIR),\n        })\n      ),\n      otherwise: z.optional(z.array(NodeIR)),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('filter'),\n      condition: ConditionIR,\n      reason: z.optional(z.string()),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('cohort'),\n      key: z.optional(z.string()),\n      arms: z.array(z.object({ name: z.string(), weight: z.number(), flow: z.array(NodeIR) })),\n    }),\n    z.object({ ...nodeBase, type: z.literal('exit'), reason: z.optional(z.string()) }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('send_event'),\n      event: z.string(),\n      payload: z.record(z.string(), PropValueIR),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('action'),\n      action: z.string(),\n      args: z.record(z.string(), PropValueIR),\n    }),\n  ])\n);\n\n/* ---------------------- Top-level definitions and bundle --------------------- */\n\nexport const GoalIR = z.object({\n  condition: ConditionIR,\n  within: z.optional(DurationIR),\n  exitOnMatch: z.boolean(),\n});\nexport type GoalIR = z.infer<typeof GoalIR>;\n\n/**\n * Human-facing metadata: **excluded from contentHash** (see hash.ts).\n * Editing a name or description does not touch execution semantics, so it never\n * invalidates the version in-flight users are pinned to, nor shows up in plan.\n */\nexport const MetaIR = z.object({\n  /**\n   * Human label. The asset's `id` is its identity — a wire key that routing\n   * tables and the entry ledger are built on — so it is not something to\n   * rename for readability. This is: it is metadata, dropped before hashing,\n   * and the studio shows it in place of the key wherever it is set.\n   */\n  name: z.optional(z.string()),\n  description: z.optional(z.string()),\n  loc: z.optional(SourceLocIR),\n});\nexport type MetaIR = z.infer<typeof MetaIR>;\n\nexport const WorkflowIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`workflow({ id })`): routing tables, the entry ledger and reporting are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  meta: z.optional(MetaIR),\n  trigger: TriggerIR,\n  goal: z.optional(GoalIR),\n  exitWhen: z.optional(ConditionIR),\n  flow: z.array(NodeIR),\n});\nexport type WorkflowIR = z.infer<typeof WorkflowIR>;\n\nexport const SegmentIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`segment({ id })`): segment references and the membership store are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  /** Provenance plus the human label — MetaIR, same as a workflow's. */\n  meta: z.optional(MetaIR),\n  condition: ConditionIR,\n});\nexport type SegmentIR = z.infer<typeof SegmentIR>;\n\n/** Template manifest entry: IR records only the reference; the body lives in the template system. */\nexport const TemplateIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  key: z.string(),\n  channel: ChannelIR,\n});\nexport type TemplateIR = z.infer<typeof TemplateIR>;\n\n/**\n * Action manifest entry: IR records the name; the implementation solidifies\n * into the Worker bundle at deploy time, never into IR (custom code stays out\n * of the data plane by design).\n */\nexport const ActionIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  name: z.string(),\n});\nexport type ActionIR = z.infer<typeof ActionIR>;\n\n/**\n * Deployment unit: the complete snapshot one `deploy` produces (terraform\n * apply, same mental model). The server diffs each definition's contentHash to\n * decide publish / skip / retire.\n */\n/**\n * The subscription topics the contract declares, carried by the bundle so the engine validates\n * `/subscriptions` and the templates' topics against the deployed list, not the SDK's word.\n */\nexport const SubscriptionsIR = z.object({\n  topics: z.array(z.string()),\n});\nexport type SubscriptionsIR = z.infer<typeof SubscriptionsIR>;\n\nexport const BundleIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  workflows: z.array(WorkflowIR),\n  segments: z.array(SegmentIR),\n  templates: z.array(TemplateIR),\n  actions: z.array(ActionIR),\n  /** Absent in a bundle compiled before topics existed: no topics. */\n  subscriptions: z.optional(SubscriptionsIR),\n});\nexport type BundleIR = z.infer<typeof BundleIR>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,aAAa;AAI1B,MAAa,WAAW,EAAE,MAAM;CAAC,EAAE,OAAO;CAAG,EAAE,OAAO;CAAG,EAAE,QAAQ;AAAC,CAAC;;AAWrE,MAAa,aAAa,EAAE,OAAO;CAAE,OAAO,EAAE,OAAO;CAAG,IAAI,EAAE,OAAO;AAAE,CAAC;;AAIxE,MAAa,oBAAoB,EAAE,OAAO;CACxC,MAAM,EAAE,QAAQ,eAAe;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;AAID,MAAa,cAAc,EAAE,MAAM,CAAC,UAAU,iBAAiB,CAAC;AAGhE,MAAa,YAAY,EAAE,KAAK;CAAC;CAAS;CAAO;CAAQ;CAAU;CAAS;CAAW;AAAQ,CAAC;AAGhG,MAAa,YAAY,EAAE,KAAK;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK,CAAC;;;;;;;AAWjF,MAAa,cAAc,EAAE,OAAO;CAClC,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO,EACjC,KAAK,EAAE,SAAS,WAAW,EAC7B,CAAC;AAKD,MAAa,qBAAqB,EAAE,KAAK;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AA2DD,MAAM,gBAAgB,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE;AAErD,MAAa,cAA0C,EAAE,WACvD,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACvF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,IAAI;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACtF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,WAAW;CAAY,CAAC;CAC7E,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC9E,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,UAAU;EAC1B,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,WAAW;EAC3B,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,UAAU;EAC7B,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAC9B,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,WAAW;EAAG,SAAS;CAAU,CAAC;AACjF,CAAC,CACH;;;;;;AASA,MAAa,YAAY,EAAE,mBAAmB,QAAQ;CACpD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,WAAW;CAChC,CAAC;CACD,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC5D,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,IAAI,EAAE,OAAO;CAAE,CAAC;CACpD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AACzC,CAAC;AAyFD,MAAM,WAAW;CAAE,IAAI,EAAE,OAAO;CAAG,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAAG,MAAM,EAAE,SAAS,UAAU;AAAE;AAE/F,MAAa,SAAgC,EAAE,WAC7C,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS;EACT,UAAU,EAAE,OAAO;EACnB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;EACvC,SAAS,EAAE,SAAS,EAAE,QAAQ,QAAQ,CAAC;EACvC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;CAC1C,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,OAAO;EAAG,UAAU;CAAW,CAAC;CACxE,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,cAAc;EAAG,KAAK;EAAY,KAAK;CAAW,CAAC;CAC3F,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,EAAE,MAAM,SAAS;EACvB,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC;EACzC,IAAI,EAAE,OAAO;CACf,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,WAAW;EACX,SAAS;EACT,WAAW,EAAE,MAAM;GAAC,EAAE,QAAQ,UAAU;GAAG,EAAE,QAAQ,MAAM;GAAG,EAAE,MAAM,MAAM;EAAC,CAAC;CAChF,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,OAAO,EAAE,MACP,EAAE,OAAO;GACP,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;GAC5B,WAAW;GACX,MAAM,EAAE,MAAM,MAAM;EACtB,CAAC,CACH;EACA,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;CACvC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,WAAW;EACX,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;EAC1B,MAAM,EAAE,MAAM,EAAE,OAAO;GAAE,MAAM,EAAE,OAAO;GAAG,QAAQ,EAAE,OAAO;GAAG,MAAM,EAAE,MAAM,MAAM;EAAE,CAAC,CAAC;CACzF,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,MAAM;EAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAAE,CAAC;CACjF,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,OAAO,EAAE,OAAO;EAChB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CAC3C,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,QAAQ,EAAE,OAAO;EACjB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CACxC,CAAC;AACH,CAAC,CACH;AAIA,MAAa,SAAS,EAAE,OAAO;CAC7B,WAAW;CACX,QAAQ,EAAE,SAAS,UAAU;CAC7B,aAAa,EAAE,QAAQ;AACzB,CAAC;;;;;;AAQD,MAAa,SAAS,EAAE,OAAO;;;;;;;CAO7B,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;CAC3B,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC;CAClC,KAAK,EAAE,SAAS,WAAW;AAC7B,CAAC;AAGD,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;CACtB,MAAM,EAAE,SAAS,MAAM;CACvB,SAAS;CACT,MAAM,EAAE,SAAS,MAAM;CACvB,UAAU,EAAE,SAAS,WAAW;CAChC,MAAM,EAAE,MAAM,MAAM;AACtB,CAAC;AAGD,MAAa,YAAY,EAAE,OAAO;CAChC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;;CAEtB,MAAM,EAAE,SAAS,MAAM;CACvB,WAAW;AACb,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;CAC/B,KAAK,EAAE,OAAO;CACd,SAAS;AACX,CAAC;;;;;;AAQD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;;;;;;;;;AAYD,MAAa,kBAAkB,EAAE,OAAO,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAC5B,CAAC;AAGD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,WAAW,EAAE,MAAM,UAAU;CAC7B,UAAU,EAAE,MAAM,SAAS;CAC3B,WAAW,EAAE,MAAM,UAAU;CAC7B,SAAS,EAAE,MAAM,QAAQ;;CAEzB,eAAe,EAAE,SAAS,eAAe;AAC3C,CAAC"}
+{"version":3,"file":"ir.mjs","names":[],"sources":["../src/ir.ts"],"sourcesContent":["import * as z from 'zod/mini';\n\n/**\n * IR (Intermediate Representation) — what the DSL compiles to: serializable\n * JSON. It is the three-way contract between the engine that interprets it,\n * the UI (react-flow) that renders it, and diff / audit tooling.\n *\n * Validation strategy: the zod/mini schemas are the authoritative definition.\n * TS types are either inferred from a schema or hand-written under the same\n * name (zod cannot infer recursive types; the hand-written type is anchored\n * with a ZodMiniType<T> annotation, so any drift fails to compile). IR crosses\n * process boundaries (database, network, UI), so runtime validation is a must.\n *\n * ## Versioning (two independent axes)\n *\n * 1. IR format version (irVersion): evolution of the IR schema itself. Adding\n *    optional fields does not bump it; only structurally incompatible changes\n *    do (changing a discriminant, dropping a field, altering semantics).\n *    Readers dispatch on irVersion to the matching schema/migrator; writers\n *    always write the current version.\n * 2. Content version (contentHash): a content-addressed id for a single\n *    definition's **execution semantics** — the canonical-JSON hash after\n *    metadata (meta / label / reason) is stripped, see hash.ts. It is used to:\n *    - pin a version when a user enters, so an in-flight journey runs the\n *      pinned version to completion (the default policy; compatible hot\n *      updates are a future explicit-migration topic). Known exception:\n *      segment conditions are resolved **by id at evaluation time** — a\n *      segment redeploy changes behaviour of in-flight journeys that\n *      reference it. Pinning covers the workflow's own structure; per-hash\n *      segment snapshots are future work;\n *    - diff on deploy: same hash means unchanged, skip publishing;\n *    - audit: answer \"which version was this user on\" at any point.\n *\n * ## Node ids\n *\n * Derived from the structural path at compile time — stable and deterministic:\n * root level '0', '1', …; the j-th child of a branch's i-th case is\n * '{branchId}.c{i}.{j}', the default arm '{branchId}.o.{j}'; cohort arms use\n * the arm name '{cohortId}.{armName}.{j}'; a waitUntil timeout flow '{id}.t.{j}'.\n * Editing a node's parameters keeps its id; inserting a node shifts the ids of\n * its later siblings (a known trade-off — locating in-flight users relies on\n * the pinned version rather than cross-version id alignment, and cross-version\n * mapping is an explicit migrator's job).\n */\n\nexport const IR_VERSION = 2;\n\n/* -------------------------------- Base values ------------------------------- */\n\nexport const ScalarIR = z.union([z.string(), z.number(), z.boolean()]);\nexport type ScalarIR = z.infer<typeof ScalarIR>;\n\n/** Duration: `value` keeps the DSL literal ('23 hours', for display), `ms` is what the engine uses. */\n/*\n * TODO: `value` is hashed alongside `ms`, so '7 days' / '1 week' / '168 hours'\n * — identical to the engine, which only reads ms — produce three different\n * contentHashes. Rewording a duration therefore reports as a semantic change in\n * plan and repins in-flight users. Moving `value` out of the hash (it is a\n * display string) would fix it; deferred because it changes existing hashes.\n */\nexport const DurationIR = z.object({ value: z.string(), ms: z.number() });\nexport type DurationIR = z.infer<typeof DurationIR>;\n\n/** User-property reference — isomorphic to the DSL's UserPropertyRef once serialized (phantom type dropped). */\nexport const UserPropertyRefIR = z.object({\n  type: z.literal('user_property'),\n  path: z.string(),\n});\nexport type UserPropertyRefIR = z.infer<typeof UserPropertyRefIR>;\n\n/** A message prop / event payload value: either a literal or a user-property reference. */\nexport const PropValueIR = z.union([ScalarIR, UserPropertyRefIR]);\nexport type PropValueIR = z.infer<typeof PropValueIR>;\n\nexport const ChannelIR = z.enum(['email', 'sms', 'push', 'in_app', 'slack', 'discord', 'survey']);\nexport type ChannelIR = z.infer<typeof ChannelIR>;\n\nexport const WeekdayIR = z.enum(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']);\nexport type WeekdayIR = z.infer<typeof WeekdayIR>;\n\n/* --------------------------------- Provenance -------------------------------- */\n\n/**\n * Source location of the builder call that produced a definition — the IR's\n * source map. Lives under `meta`, so it is **excluded from contentHash**\n * (see hash.ts): provenance never affects execution identity or plan.\n * `file` is cwd-relative when compiled under Node, a URL under Vite dev.\n */\nexport const SourceLocIR = z.object({\n  file: z.string(),\n  line: z.number(),\n  column: z.number(),\n});\nexport type SourceLocIR = z.infer<typeof SourceLocIR>;\n\n/** Node-level metadata: provenance only, for now. Excluded from contentHash. */\nexport const NodeMetaIR = z.object({\n  loc: z.optional(SourceLocIR),\n});\nexport type NodeMetaIR = z.infer<typeof NodeMetaIR>;\n\n/* -------------------------------- Conditions -------------------------------- */\n\nexport const PropertyOperatorIR = z.enum([\n  'eq',\n  'ne',\n  'gt',\n  'gte',\n  'lt',\n  'lte',\n  'between',\n  'not_between',\n  'in_array',\n  'not_in_array',\n  'exists',\n  'not_exists',\n  'contains',\n  'not_contains',\n]);\nexport type PropertyOperatorIR = z.infer<typeof PropertyOperatorIR>;\n\n/**\n * Condition expression tree. The shape of value/values follows `op`:\n * eq/ne/gt/gte/lt/lte/contains/not_contains → value; in_array/not_in_array →\n * values; between/not_between → values = [min, max]; exists/not_exists → neither.\n *\n * `payload` predicates test the payload of an event (dotted paths reach nested\n * fields). They are only valid inside a `where` subtree — `performed.where`\n * and the event trigger's `where` — where an event row is in scope; the\n * compiler (compileBundle) and the evaluator both enforce the placement.\n * TODO: runtime refinement narrowing by op.\n */\n/**\n * Provenance rides on conditions too, so the studio can point at the exact\n * `eq(...)` / `and(...)` that produced a node — same rule as nodes: `meta` is\n * dropped before hashing, so carrying it never affects execution identity.\n */\ninterface ConditionBaseIR {\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type ConditionIR =\n  | (ConditionBaseIR & { type: 'and'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'or'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'not'; condition: ConditionIR })\n  /** Reference a segment by id (defined in SegmentIR, versioned separately). */\n  | (ConditionBaseIR & { type: 'segment'; segment: string })\n  | (ConditionBaseIR & {\n      type: 'property';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      /** Event payload predicate; `path` is dotted for nested fields ('tags.utm_source'). */\n      type: 'payload';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      type: 'performed';\n      event: string;\n      /** Payload filter: only events matching it count (a payload-only subtree). */\n      where?: ConditionIR | undefined;\n      within?: DurationIR | undefined;\n      count?: number | undefined;\n    })\n  /**\n   * The user can be reached on the channel right now: for push, the host's\n   * device directory lists at least one device; for the others, the channel's\n   * recipient property (email, phone, …) is set.\n   */\n  | (ConditionBaseIR & { type: 'reachable'; channel: ChannelIR });\n\nconst conditionBase = { meta: z.optional(NodeMetaIR) };\n\nexport const ConditionIR: z.ZodMiniType<ConditionIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({ ...conditionBase, type: z.literal('and'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('or'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('not'), condition: ConditionIR }),\n    z.object({ ...conditionBase, type: z.literal('segment'), segment: z.string() }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('property'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('payload'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('performed'),\n      event: z.string(),\n      where: z.optional(ConditionIR),\n      within: z.optional(DurationIR),\n      count: z.optional(z.number()),\n    }),\n    z.object({ ...conditionBase, type: z.literal('reachable'), channel: ChannelIR }),\n  ])\n);\n\n/* --------------------------------- Triggers --------------------------------- */\n\n/**\n * Trigger shapes. The event trigger has two independent gates: `where` tests\n * the triggering event's payload (payload-only subtree, evaluated against the\n * incoming event before anything else), `filter` tests the user's profile.\n */\nexport const TriggerIR = z.discriminatedUnion('type', [\n  z.object({\n    type: z.literal('event'),\n    event: z.string(),\n    where: z.optional(ConditionIR),\n    filter: z.optional(ConditionIR),\n    visitors: z.optional(z.literal(true)),\n  }),\n  z.object({ type: z.literal('segment'), segment: z.string() }),\n  z.object({ type: z.literal('date'), at: z.string() }),\n  z.object({ type: z.literal('webhook') }),\n]);\nexport type TriggerIR = z.infer<typeof TriggerIR>;\n\n/* ----------------------------------- Nodes ---------------------------------- */\n\ninterface NodeBaseIR {\n  /** Stable id derived from the structural path (rules in the file header). */\n  id: string;\n  /** Optional node name: UI title / observability handle (branch's optional first argument lands here). */\n  label?: string | undefined;\n  /** Metadata (provenance); excluded from contentHash. */\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type NodeIR =\n  | (NodeBaseIR & {\n      type: 'message';\n      channel: ChannelIR;\n      template: string;\n      props: Record<string, PropValueIR>;\n      /**\n       * Push only: which of the user's devices get a copy. Absent means every\n       * device the directory lists; 'latest' only the most recently registered.\n       */\n      devices?: 'latest' | undefined;\n      /**\n       * Email and push: the template's subscription topic, or null for a transactional message\n       * (sent whatever the user opted out of). Absent for other channels, and in IR compiled\n       * before topics existed: such a step checks the channel-level opt-out only, as it always did.\n       */\n      topic?: string | null | undefined;\n    })\n  | (NodeBaseIR & { type: 'delay'; duration: DurationIR })\n  | (NodeBaseIR & { type: 'random_delay'; min: DurationIR; max: DurationIR })\n  | (NodeBaseIR & {\n      type: 'time_window';\n      days: WeekdayIR[];\n      between: [string, string];\n      tz: string;\n    })\n  | (NodeBaseIR & {\n      type: 'wait_until';\n      condition: ConditionIR;\n      timeout: DurationIR;\n      onTimeout: 'continue' | 'exit' | NodeIR[];\n    })\n  | (NodeBaseIR & {\n      type: 'branch';\n      cases: { label?: string | undefined; condition: ConditionIR; flow: NodeIR[] }[];\n      /** Default arm (the DSL's bare tail argument). Absent = fall through to the main line. */\n      otherwise?: NodeIR[] | undefined;\n    })\n  | (NodeBaseIR & {\n      type: 'filter';\n      /** Audit-log line for the users this gate drops. Metadata: excluded from contentHash. */\n      reason?: string | undefined;\n      condition: ConditionIR;\n    })\n  | (NodeBaseIR & {\n      type: 'cohort';\n      /**\n       * Explicit experiment key: bucketing hashes `userId:key` instead of the\n       * structural node id, so the assignment survives node insertion/moves and\n       * the experiment keeps one identity across workflow versions. Absent →\n       * the node id is used (fine for one-off splits).\n       */\n      key?: string | undefined;\n      /**\n       * Arms in authoring order — the order the interpreter accumulates weights\n       * in, so it decides which bucket range each arm owns. The DSL keeps that\n       * promise by rejecting integer-like arm names, which JavaScript would\n       * hoist to the front of the object in numeric order. Weights sum to 100.\n       */\n      arms: { name: string; weight: number; flow: NodeIR[] }[];\n    })\n  | (NodeBaseIR & {\n      /** `reason` is the audit-log line. Metadata: excluded from contentHash. */\n      type: 'exit';\n      reason?: string | undefined;\n    })\n  | (NodeBaseIR & { type: 'send_event'; event: string; payload: Record<string, PropValueIR> })\n  | (NodeBaseIR & {\n      type: 'action';\n      /** Registry name of the custom action; the code itself lives in the deployed Worker bundle. */\n      action: string;\n      /** Argument values; user_property references are resolved at run time, like message props. */\n      args: Record<string, PropValueIR>;\n    });\n\nconst nodeBase = { id: z.string(), label: z.optional(z.string()), meta: z.optional(NodeMetaIR) };\n\nexport const NodeIR: z.ZodMiniType<NodeIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({\n      ...nodeBase,\n      type: z.literal('message'),\n      channel: ChannelIR,\n      template: z.string(),\n      props: z.record(z.string(), PropValueIR),\n      devices: z.optional(z.literal('latest')),\n      topic: z.optional(z.nullable(z.string())),\n    }),\n    z.object({ ...nodeBase, type: z.literal('delay'), duration: DurationIR }),\n    z.object({ ...nodeBase, type: z.literal('random_delay'), min: DurationIR, max: DurationIR }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('time_window'),\n      days: z.array(WeekdayIR),\n      between: z.tuple([z.string(), z.string()]),\n      tz: z.string(),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('wait_until'),\n      condition: ConditionIR,\n      timeout: DurationIR,\n      onTimeout: z.union([z.literal('continue'), z.literal('exit'), z.array(NodeIR)]),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('branch'),\n      cases: z.array(\n        z.object({\n          label: z.optional(z.string()),\n          condition: ConditionIR,\n          flow: z.array(NodeIR),\n        })\n      ),\n      otherwise: z.optional(z.array(NodeIR)),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('filter'),\n      condition: ConditionIR,\n      reason: z.optional(z.string()),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('cohort'),\n      key: z.optional(z.string()),\n      arms: z.array(z.object({ name: z.string(), weight: z.number(), flow: z.array(NodeIR) })),\n    }),\n    z.object({ ...nodeBase, type: z.literal('exit'), reason: z.optional(z.string()) }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('send_event'),\n      event: z.string(),\n      payload: z.record(z.string(), PropValueIR),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('action'),\n      action: z.string(),\n      args: z.record(z.string(), PropValueIR),\n    }),\n  ])\n);\n\n/* ---------------------- Top-level definitions and bundle --------------------- */\n\nexport const GoalIR = z.object({\n  condition: ConditionIR,\n  within: z.optional(DurationIR),\n  exitOnMatch: z.boolean(),\n});\nexport type GoalIR = z.infer<typeof GoalIR>;\n\n/**\n * Human-facing metadata: **excluded from contentHash** (see hash.ts).\n * Editing a name or description does not touch execution semantics, so it never\n * invalidates the version in-flight users are pinned to, nor shows up in plan.\n */\nexport const MetaIR = z.object({\n  /**\n   * Human label. The asset's `id` is its identity — a wire key that routing\n   * tables and the entry ledger are built on — so it is not something to\n   * rename for readability. This is: it is metadata, dropped before hashing,\n   * and the studio shows it in place of the key wherever it is set.\n   */\n  name: z.optional(z.string()),\n  description: z.optional(z.string()),\n  loc: z.optional(SourceLocIR),\n});\nexport type MetaIR = z.infer<typeof MetaIR>;\n\nexport const WorkflowIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`workflow({ id })`): routing tables, the entry ledger and reporting are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  meta: z.optional(MetaIR),\n  trigger: TriggerIR,\n  goal: z.optional(GoalIR),\n  exitWhen: z.optional(ConditionIR),\n  flow: z.array(NodeIR),\n});\nexport type WorkflowIR = z.infer<typeof WorkflowIR>;\n\nexport const SegmentIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`segment({ id })`): segment references and the membership store are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  /** Provenance plus the human label — MetaIR, same as a workflow's. */\n  meta: z.optional(MetaIR),\n  condition: ConditionIR,\n});\nexport type SegmentIR = z.infer<typeof SegmentIR>;\n\n/** Template manifest entry: IR records only the reference; the body lives in the template system. */\nexport const TemplateIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  key: z.string(),\n  channel: ChannelIR,\n});\nexport type TemplateIR = z.infer<typeof TemplateIR>;\n\n/**\n * Action manifest entry: IR records the name; the implementation solidifies\n * into the Worker bundle at deploy time, never into IR (custom code stays out\n * of the data plane by design).\n */\nexport const ActionIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  name: z.string(),\n});\nexport type ActionIR = z.infer<typeof ActionIR>;\n\n/**\n * Deployment unit: the complete snapshot one `deploy` produces (terraform\n * apply, same mental model). The server diffs each definition's contentHash to\n * decide publish / skip / retire.\n */\n/**\n * The subscription topics the contract declares, carried by the bundle so the engine validates\n * `/subscriptions` and the templates' topics against the deployed list, not the SDK's word.\n */\nexport const SubscriptionsIR = z.object({\n  topics: z.array(z.string()),\n});\nexport type SubscriptionsIR = z.infer<typeof SubscriptionsIR>;\n\nexport const BundleIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  workflows: z.array(WorkflowIR),\n  segments: z.array(SegmentIR),\n  templates: z.array(TemplateIR),\n  actions: z.array(ActionIR),\n  /** Absent in a bundle compiled before topics existed: no topics. */\n  subscriptions: z.optional(SubscriptionsIR),\n});\nexport type BundleIR = z.infer<typeof BundleIR>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,aAAa;AAI1B,MAAa,WAAW,EAAE,MAAM;CAAC,EAAE,OAAO;CAAG,EAAE,OAAO;CAAG,EAAE,QAAQ;AAAC,CAAC;;AAWrE,MAAa,aAAa,EAAE,OAAO;CAAE,OAAO,EAAE,OAAO;CAAG,IAAI,EAAE,OAAO;AAAE,CAAC;;AAIxE,MAAa,oBAAoB,EAAE,OAAO;CACxC,MAAM,EAAE,QAAQ,eAAe;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;AAID,MAAa,cAAc,EAAE,MAAM,CAAC,UAAU,iBAAiB,CAAC;AAGhE,MAAa,YAAY,EAAE,KAAK;CAAC;CAAS;CAAO;CAAQ;CAAU;CAAS;CAAW;AAAQ,CAAC;AAGhG,MAAa,YAAY,EAAE,KAAK;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK,CAAC;;;;;;;AAWjF,MAAa,cAAc,EAAE,OAAO;CAClC,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO,EACjC,KAAK,EAAE,SAAS,WAAW,EAC7B,CAAC;AAKD,MAAa,qBAAqB,EAAE,KAAK;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AA2DD,MAAM,gBAAgB,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE;AAErD,MAAa,cAA0C,EAAE,WACvD,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACvF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,IAAI;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACtF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,WAAW;CAAY,CAAC;CAC7E,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC9E,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,UAAU;EAC1B,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,WAAW;EAC3B,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,UAAU;EAC7B,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAC9B,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,WAAW;EAAG,SAAS;CAAU,CAAC;AACjF,CAAC,CACH;;;;;;AASA,MAAa,YAAY,EAAE,mBAAmB,QAAQ;CACpD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,WAAW;EAC9B,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC5D,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,IAAI,EAAE,OAAO;CAAE,CAAC;CACpD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AACzC,CAAC;AAyFD,MAAM,WAAW;CAAE,IAAI,EAAE,OAAO;CAAG,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAAG,MAAM,EAAE,SAAS,UAAU;AAAE;AAE/F,MAAa,SAAgC,EAAE,WAC7C,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS;EACT,UAAU,EAAE,OAAO;EACnB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;EACvC,SAAS,EAAE,SAAS,EAAE,QAAQ,QAAQ,CAAC;EACvC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;CAC1C,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,OAAO;EAAG,UAAU;CAAW,CAAC;CACxE,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,cAAc;EAAG,KAAK;EAAY,KAAK;CAAW,CAAC;CAC3F,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,EAAE,MAAM,SAAS;EACvB,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC;EACzC,IAAI,EAAE,OAAO;CACf,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,WAAW;EACX,SAAS;EACT,WAAW,EAAE,MAAM;GAAC,EAAE,QAAQ,UAAU;GAAG,EAAE,QAAQ,MAAM;GAAG,EAAE,MAAM,MAAM;EAAC,CAAC;CAChF,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,OAAO,EAAE,MACP,EAAE,OAAO;GACP,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;GAC5B,WAAW;GACX,MAAM,EAAE,MAAM,MAAM;EACtB,CAAC,CACH;EACA,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;CACvC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,WAAW;EACX,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;EAC1B,MAAM,EAAE,MAAM,EAAE,OAAO;GAAE,MAAM,EAAE,OAAO;GAAG,QAAQ,EAAE,OAAO;GAAG,MAAM,EAAE,MAAM,MAAM;EAAE,CAAC,CAAC;CACzF,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,MAAM;EAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAAE,CAAC;CACjF,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,OAAO,EAAE,OAAO;EAChB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CAC3C,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,QAAQ,EAAE,OAAO;EACjB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CACxC,CAAC;AACH,CAAC,CACH;AAIA,MAAa,SAAS,EAAE,OAAO;CAC7B,WAAW;CACX,QAAQ,EAAE,SAAS,UAAU;CAC7B,aAAa,EAAE,QAAQ;AACzB,CAAC;;;;;;AAQD,MAAa,SAAS,EAAE,OAAO;;;;;;;CAO7B,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;CAC3B,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC;CAClC,KAAK,EAAE,SAAS,WAAW;AAC7B,CAAC;AAGD,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;CACtB,MAAM,EAAE,SAAS,MAAM;CACvB,SAAS;CACT,MAAM,EAAE,SAAS,MAAM;CACvB,UAAU,EAAE,SAAS,WAAW;CAChC,MAAM,EAAE,MAAM,MAAM;AACtB,CAAC;AAGD,MAAa,YAAY,EAAE,OAAO;CAChC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;;CAEtB,MAAM,EAAE,SAAS,MAAM;CACvB,WAAW;AACb,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;CAC/B,KAAK,EAAE,OAAO;CACd,SAAS;AACX,CAAC;;;;;;AAQD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;;;;;;;;;AAYD,MAAa,kBAAkB,EAAE,OAAO,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAC5B,CAAC;AAGD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,WAAW,EAAE,MAAM,UAAU;CAC7B,UAAU,EAAE,MAAM,SAAS;CAC3B,WAAW,EAAE,MAAM,UAAU;CAC7B,SAAS,EAAE,MAAM,QAAQ;;CAEzB,eAAe,EAAE,SAAS,eAAe;AAC3C,CAAC"}

package/dist/reporting/observer.cjs

@@ -18,6 +18,7 @@ function reportingObserver(reporting, origin) {
 	return {
 		started: (event) => reporting.instanceStarted(event),
 		nodeReached: (event) => reporting.nodeReached(event),
+		messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),
 		async messagePrepared(message) {
 			const id = await reporting.recordMessage({
 				idempotencyKey: message.idempotencyKey,

package/dist/reporting/observer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"observer.cjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}
+{"version":3,"file":"observer.cjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,iBAAiB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE5E,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}

package/dist/reporting/observer.mjs

@@ -17,6 +17,7 @@ function reportingObserver(reporting, origin) {
 	return {
 		started: (event) => reporting.instanceStarted(event),
 		nodeReached: (event) => reporting.nodeReached(event),
+		messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),
 		async messagePrepared(message) {
 			const id = await reporting.recordMessage({
 				idempotencyKey: message.idempotencyKey,

package/dist/reporting/observer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"observer.mjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}
+{"version":3,"file":"observer.mjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,iBAAiB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE5E,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}

package/dist/store/facts.cjs

@@ -3,27 +3,46 @@ const require_engine_condition = require("../engine/condition.cjs");
 // src/store/facts.ts
 /** The profile path that reads the user's own id (`u.userId`). */
 const USER_ID_PROPERTY = "userId";
+/** Payloads per round trip when a `where` filters events in JS. */
+const PAYLOAD_PAGE = 500;
 /** Single-user fact source over a JourneyStore: evaluation lives in engine/condition.ts, this only reads. */
 var JourneyFactSource = class {
 	store;
 	userId;
-	constructor(store, userId) {
+	owner;
+	constructor(store, userId, owner = () => Promise.resolve(userId)) {
 		this.store = store;
 		this.userId = userId;
+		this.owner = owner;
 	}
 	async countEvents(event, opts) {
 		const window = {
 			...opts?.sinceMs === void 0 ? {} : { sinceMs: opts.sinceMs },
 			...opts?.untilMs === void 0 ? {} : { untilMs: opts.untilMs }
 		};
-		if (opts?.where === void 0) return this.store.countEvents(this.userId, event, window);
+		const atLeast = opts?.atLeast;
+		const userId = await this.owner();
+		if (opts?.where === void 0) return this.store.countEvents(userId, event, window, atLeast);
 		const where = opts.where;
-		return (await this.store.listEventPayloads(this.userId, event, window)).filter((payload) => require_engine_condition.matchesWhere(payload, where)).length;
+		let matched = 0;
+		let after;
+		for (;;) {
+			const page = await this.store.pageEventPayloads(userId, event, window, {
+				limit: PAYLOAD_PAGE,
+				after
+			});
+			for (const payload of page.payloads) {
+				if (require_engine_condition.matchesWhere(payload, where)) matched += 1;
+				if (atLeast !== void 0 && matched >= atLeast) return matched;
+			}
+			if (page.next === void 0) return matched;
+			after = page.next;
+		}
 	}
 	/**
 	* The scalar boundary. Everything downstream — comparisons, subject
 	* placeholders, resolved message props — is typed ScalarIR, but nothing so
-	* far has checked that the stored JSON is one: /identify validates only that
+	* far has checked that the stored JSON is one: /ingest validates only that
 	* `props` is a plain object, and the merge stores whatever nesting it is
 	* handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true
 	* while `eq(score, 5)` is false, and `String(recipient)` on an object
@@ -35,8 +54,9 @@ var JourneyFactSource = class {
 	* place.
 	*/
 	async getProperty(path) {
-		if (path === "userId") return this.userId;
-		const props = await this.store.getProfile(this.userId);
+		const userId = await this.owner();
+		if (path === "userId") return userId;
+		const props = await this.store.getProfile(userId);
 		if (props === void 0) return void 0;
 		if (!Object.hasOwn(props, path)) return void 0;
 		const value = props[path];
@@ -47,10 +67,10 @@ var JourneyFactSource = class {
 	}
 	/** The user's opt-outs: the channel's, or with a topic that topic's as well. */
 	async isSuppressed(channel, topic) {
-		return this.store.isSuppressed(this.userId, channel, topic);
+		return this.store.isSuppressed(await this.owner(), channel, topic);
 	}
-	listDevices() {
-		return this.store.listDevices(this.userId);
+	async listDevices() {
+		return this.store.listDevices(await this.owner());
 	}
 };
 exports.JourneyFactSource = JourneyFactSource;

package/dist/store/facts.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"facts.cjs","names":["matchesWhere"],"sources":["../../src/store/facts.ts"],"sourcesContent":["import { matchesWhere } from '../engine/condition';\nimport type { FactSource, PushDevice } from '../engine/ports';\nimport type { ConditionIR, ScalarIR } from '../ir';\nimport type { JourneyStore } from './index';\n\n/** The profile path that reads the user's own id (`u.userId`). */\nexport const USER_ID_PROPERTY = 'userId';\n\n/** Single-user fact source over a JourneyStore: evaluation lives in engine/condition.ts, this only reads. */\nexport class JourneyFactSource implements FactSource {\n  constructor(\n    private readonly store: JourneyStore,\n    private readonly userId: string\n  ) {}\n\n  async countEvents(\n    event: string,\n    opts?: { sinceMs?: number; untilMs?: number; where?: ConditionIR }\n  ): Promise<number> {\n    const window = {\n      ...(opts?.sinceMs === undefined ? {} : { sinceMs: opts.sinceMs }),\n      ...(opts?.untilMs === undefined ? {} : { untilMs: opts.untilMs }),\n    };\n    if (opts?.where === undefined) return this.store.countEvents(this.userId, event, window);\n    // Payload filtering happens in JS via the shared evaluator — one set of\n    // where semantics with the in-memory FactSource; per-user row counts are small.\n    const where = opts.where;\n    const payloads = await this.store.listEventPayloads(this.userId, event, window);\n    return payloads.filter((payload) => matchesWhere(payload, where)).length;\n  }\n\n  /**\n   * The scalar boundary. Everything downstream — comparisons, subject\n   * placeholders, resolved message props — is typed ScalarIR, but nothing so\n   * far has checked that the stored JSON is one: /identify validates only that\n   * `props` is a plain object, and the merge stores whatever nesting it is\n   * handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true\n   * while `eq(score, 5)` is false, and `String(recipient)` on an object\n   * addresses an email to `[object Object]`.\n   *\n   * So a non-scalar value reads as absent, matching how matchesWhere treats a\n   * non-scalar payload leaf. The port cannot say \"present but not a scalar\",\n   * and guessing at a coercion is what produced the wrong branch in the first\n   * place.\n   */\n  async getProperty(path: string): Promise<ScalarIR | undefined> {\n    // The system field: the request's identity, never stored in the profile (contract.user.userId)\n    if (path === USER_ID_PROPERTY) return this.userId;\n    const props: Record<string, unknown> | undefined = await this.store.getProfile(this.userId);\n    if (props === undefined) return undefined;\n    // Own keys only: `props[path]` would otherwise find Object.prototype, so\n    // `exists(u.toString)` held for every user with a profile row and a subject\n    // placeholder rendered native-code text into the email.\n    if (!Object.hasOwn(props, path)) return undefined;\n    const value = props[path];\n    // An explicit null means \"unset\" and behaves as not_exists. /identify\n    // itself clears a property by removing the key (the merge drops nulls), so\n    // this covers profiles written by other means — a direct SQL fixup, a\n    // migration, an import.\n    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {\n      return value;\n    }\n    return undefined;\n  }\n\n  getSegmentCondition(name: string): Promise<ConditionIR | undefined> {\n    return this.store.getSegmentCondition(name);\n  }\n\n  /** The user's opt-outs: the channel's, or with a topic that topic's as well. */\n  async isSuppressed(channel: string, topic?: string): Promise<boolean> {\n    return this.store.isSuppressed(this.userId, channel, topic);\n  }\n\n  listDevices(): Promise<PushDevice[]> {\n    return this.store.listDevices(this.userId);\n  }\n}\n"],"mappings":";;;;AAMA,MAAa,mBAAmB;;AAGhC,IAAa,oBAAb,MAAqD;CAEhC;CACA;CAFnB,YACE,OACA,QACA;EAFiB,KAAA,QAAA;EACA,KAAA,SAAA;CAChB;CAEH,MAAM,YACJ,OACA,MACiB;EACjB,MAAM,SAAS;GACb,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;GAC/D,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;EACjE;EACA,IAAI,MAAM,UAAU,KAAA,GAAW,OAAO,KAAK,MAAM,YAAY,KAAK,QAAQ,OAAO,MAAM;EAGvF,MAAM,QAAQ,KAAK;EAEnB,QAAO,MADgB,KAAK,MAAM,kBAAkB,KAAK,QAAQ,OAAO,MAAM,EAAA,CAC9D,QAAQ,YAAYA,yBAAAA,aAAa,SAAS,KAAK,CAAC,CAAC,CAAC;CACpE;;;;;;;;;;;;;;;CAgBA,MAAM,YAAY,MAA6C;EAE7D,IAAI,SAAA,UAA2B,OAAO,KAAK;EAC3C,MAAM,QAA6C,MAAM,KAAK,MAAM,WAAW,KAAK,MAAM;EAC1F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAIhC,IAAI,CAAC,OAAO,OAAO,OAAO,IAAI,GAAG,OAAO,KAAA;EACxC,MAAM,QAAQ,MAAM;EAKpB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,WAC7E,OAAO;CAGX;CAEA,oBAAoB,MAAgD;EAClE,OAAO,KAAK,MAAM,oBAAoB,IAAI;CAC5C;;CAGA,MAAM,aAAa,SAAiB,OAAkC;EACpE,OAAO,KAAK,MAAM,aAAa,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,cAAqC;EACnC,OAAO,KAAK,MAAM,YAAY,KAAK,MAAM;CAC3C;AACF"}
+{"version":3,"file":"facts.cjs","names":["matchesWhere"],"sources":["../../src/store/facts.ts"],"sourcesContent":["import { matchesWhere } from '../engine/condition';\nimport type { FactSource, PushDevice } from '../engine/ports';\nimport type { ConditionIR, ScalarIR } from '../ir';\nimport type { EventCursor, JourneyStore } from './index';\n\n/** The profile path that reads the user's own id (`u.userId`). */\nexport const USER_ID_PROPERTY = 'userId';\n\n/** Payloads per round trip when a `where` filters events in JS. */\nconst PAYLOAD_PAGE = 500;\n\n/** Single-user fact source over a JourneyStore: evaluation lives in engine/condition.ts, this only reads. */\nexport class JourneyFactSource implements FactSource {\n  constructor(\n    private readonly store: JourneyStore,\n    private readonly userId: string,\n    /** Who the facts are about now, for a journey that can change hands; `userId` otherwise. */\n    private readonly owner: () => Promise<string> = () => Promise.resolve(userId)\n  ) {}\n\n  async countEvents(\n    event: string,\n    opts?: { sinceMs?: number; untilMs?: number; where?: ConditionIR; atLeast?: number }\n  ): Promise<number> {\n    const window = {\n      ...(opts?.sinceMs === undefined ? {} : { sinceMs: opts.sinceMs }),\n      ...(opts?.untilMs === undefined ? {} : { untilMs: opts.untilMs }),\n    };\n    const atLeast = opts?.atLeast;\n    const userId = await this.owner();\n    if (opts?.where === undefined) {\n      return this.store.countEvents(userId, event, window, atLeast);\n    }\n    // Payload filtering stays in JS through the shared evaluator — one set of where semantics\n    // with the in-memory FactSource — but a page at a time, stopping as soon as enough events\n    // match. A heavy user's history is no longer loaded whole on every evaluation; only a user\n    // with no match left to find is read to the end, and then in bounded pages.\n    const where = opts.where;\n    let matched = 0;\n    let after: EventCursor | undefined;\n    for (;;) {\n      const page = await this.store.pageEventPayloads(userId, event, window, {\n        limit: PAYLOAD_PAGE,\n        after,\n      });\n      for (const payload of page.payloads) {\n        if (matchesWhere(payload, where)) matched += 1;\n        if (atLeast !== undefined && matched >= atLeast) return matched;\n      }\n      if (page.next === undefined) return matched;\n      after = page.next;\n    }\n  }\n\n  /**\n   * The scalar boundary. Everything downstream — comparisons, subject\n   * placeholders, resolved message props — is typed ScalarIR, but nothing so\n   * far has checked that the stored JSON is one: /ingest validates only that\n   * `props` is a plain object, and the merge stores whatever nesting it is\n   * handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true\n   * while `eq(score, 5)` is false, and `String(recipient)` on an object\n   * addresses an email to `[object Object]`.\n   *\n   * So a non-scalar value reads as absent, matching how matchesWhere treats a\n   * non-scalar payload leaf. The port cannot say \"present but not a scalar\",\n   * and guessing at a coercion is what produced the wrong branch in the first\n   * place.\n   */\n  async getProperty(path: string): Promise<ScalarIR | undefined> {\n    // The system field: the request's identity, never stored in the profile (contract.user.userId)\n    const userId = await this.owner();\n    if (path === USER_ID_PROPERTY) return userId;\n    const props: Record<string, unknown> | undefined = await this.store.getProfile(userId);\n    if (props === undefined) return undefined;\n    // Own keys only: `props[path]` would otherwise find Object.prototype, so\n    // `exists(u.toString)` held for every user with a profile row and a subject\n    // placeholder rendered native-code text into the email.\n    if (!Object.hasOwn(props, path)) return undefined;\n    const value = props[path];\n    // An explicit null means \"unset\" and behaves as not_exists. /ingest\n    // itself clears a property by removing the key (the merge drops nulls), so\n    // this covers profiles written by other means — a direct SQL fixup, a\n    // migration, an import.\n    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {\n      return value;\n    }\n    return undefined;\n  }\n\n  getSegmentCondition(name: string): Promise<ConditionIR | undefined> {\n    return this.store.getSegmentCondition(name);\n  }\n\n  /** The user's opt-outs: the channel's, or with a topic that topic's as well. */\n  async isSuppressed(channel: string, topic?: string): Promise<boolean> {\n    return this.store.isSuppressed(await this.owner(), channel, topic);\n  }\n\n  async listDevices(): Promise<PushDevice[]> {\n    return this.store.listDevices(await this.owner());\n  }\n}\n"],"mappings":";;;;AAMA,MAAa,mBAAmB;;AAGhC,MAAM,eAAe;;AAGrB,IAAa,oBAAb,MAAqD;CAEhC;CACA;CAEA;CAJnB,YACE,OACA,QAEA,cAAsD,QAAQ,QAAQ,MAAM,GAC5E;EAJiB,KAAA,QAAA;EACA,KAAA,SAAA;EAEA,KAAA,QAAA;CAChB;CAEH,MAAM,YACJ,OACA,MACiB;EACjB,MAAM,SAAS;GACb,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;GAC/D,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;EACjE;EACA,MAAM,UAAU,MAAM;EACtB,MAAM,SAAS,MAAM,KAAK,MAAM;EAChC,IAAI,MAAM,UAAU,KAAA,GAClB,OAAO,KAAK,MAAM,YAAY,QAAQ,OAAO,QAAQ,OAAO;EAM9D,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU;EACd,IAAI;EACJ,SAAS;GACP,MAAM,OAAO,MAAM,KAAK,MAAM,kBAAkB,QAAQ,OAAO,QAAQ;IACrE,OAAO;IACP;GACF,CAAC;GACD,KAAK,MAAM,WAAW,KAAK,UAAU;IACnC,IAAIA,yBAAAA,aAAa,SAAS,KAAK,GAAG,WAAW;IAC7C,IAAI,YAAY,KAAA,KAAa,WAAW,SAAS,OAAO;GAC1D;GACA,IAAI,KAAK,SAAS,KAAA,GAAW,OAAO;GACpC,QAAQ,KAAK;EACf;CACF;;;;;;;;;;;;;;;CAgBA,MAAM,YAAY,MAA6C;EAE7D,MAAM,SAAS,MAAM,KAAK,MAAM;EAChC,IAAI,SAAA,UAA2B,OAAO;EACtC,MAAM,QAA6C,MAAM,KAAK,MAAM,WAAW,MAAM;EACrF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAIhC,IAAI,CAAC,OAAO,OAAO,OAAO,IAAI,GAAG,OAAO,KAAA;EACxC,MAAM,QAAQ,MAAM;EAKpB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,WAC7E,OAAO;CAGX;CAEA,oBAAoB,MAAgD;EAClE,OAAO,KAAK,MAAM,oBAAoB,IAAI;CAC5C;;CAGA,MAAM,aAAa,SAAiB,OAAkC;EACpE,OAAO,KAAK,MAAM,aAAa,MAAM,KAAK,MAAM,GAAG,SAAS,KAAK;CACnE;CAEA,MAAM,cAAqC;EACzC,OAAO,KAAK,MAAM,YAAY,MAAM,KAAK,MAAM,CAAC;CAClD;AACF"}

package/dist/store/facts.d.cts

@@ -7,16 +7,21 @@ export declare const USER_ID_PROPERTY = "userId";
 export declare class JourneyFactSource implements FactSource {
   private readonly store;
   private readonly userId;
-  constructor(store: JourneyStore, userId: string);
+  /** Who the facts are about now, for a journey that can change hands; `userId` otherwise. */
+  private readonly owner;
+  constructor(store: JourneyStore, userId: string,
+  /** Who the facts are about now, for a journey that can change hands; `userId` otherwise. */
+  owner?: () => Promise<string>);
   countEvents(event: string, opts?: {
     sinceMs?: number;
     untilMs?: number;
     where?: ConditionIR;
+    atLeast?: number;
   }): Promise<number>;
   /**
    * The scalar boundary. Everything downstream — comparisons, subject
    * placeholders, resolved message props — is typed ScalarIR, but nothing so
-   * far has checked that the stored JSON is one: /identify validates only that
+   * far has checked that the stored JSON is one: /ingest validates only that
    * `props` is a plain object, and the merge stores whatever nesting it is
    * handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true
    * while `eq(score, 5)` is false, and `String(recipient)` on an object

package/dist/store/facts.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"facts.d.cts","names":[],"sources":["../../src/store/facts.ts"],"mappings":";;;;qBAMa;;qBAGA,6BAA6B;mBAErB;mBACA;EAFnB,YACmB,OAAO,cACP;EAGb,YACJ,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;;;;;;;;;;;;;;;EA2BG,YAAY,eAAe,QAAQ;EAoBzC,oBAAoB,eAAe,QAAQ;;EAKrC,aAAa,iBAAiB,iBAAiB;EAIrD,eAAe,QAAQ"}
+{"version":3,"file":"facts.d.cts","names":[],"sources":["../../src/store/facts.ts"],"mappings":";;;;qBAMa;;qBAMA,6BAA6B;mBAErB;mBACA;;mBAEA;EAJnB,YACmB,OAAO,cACP;;EAEA,cAAa;EAG1B,YACJ,eACA;IAAS;IAAkB;IAAkB,QAAQ;IAAa;MACjE;;;;;;;;;;;;;;;EA6CG,YAAY,eAAe,QAAQ;EAqBzC,oBAAoB,eAAe,QAAQ;;EAKrC,aAAa,iBAAiB,iBAAiB;EAI/C,eAAe,QAAQ"}

package/dist/store/facts.d.mts

@@ -7,16 +7,21 @@ export declare const USER_ID_PROPERTY = "userId";
 export declare class JourneyFactSource implements FactSource {
   private readonly store;
   private readonly userId;
-  constructor(store: JourneyStore, userId: string);
+  /** Who the facts are about now, for a journey that can change hands; `userId` otherwise. */
+  private readonly owner;
+  constructor(store: JourneyStore, userId: string,
+  /** Who the facts are about now, for a journey that can change hands; `userId` otherwise. */
+  owner?: () => Promise<string>);
   countEvents(event: string, opts?: {
     sinceMs?: number;
     untilMs?: number;
     where?: ConditionIR;
+    atLeast?: number;
   }): Promise<number>;
   /**
    * The scalar boundary. Everything downstream — comparisons, subject
    * placeholders, resolved message props — is typed ScalarIR, but nothing so
-   * far has checked that the stored JSON is one: /identify validates only that
+   * far has checked that the stored JSON is one: /ingest validates only that
    * `props` is a plain object, and the merge stores whatever nesting it is
    * handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true
    * while `eq(score, 5)` is false, and `String(recipient)` on an object

package/dist/store/facts.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"facts.d.mts","names":[],"sources":["../../src/store/facts.ts"],"mappings":";;;;qBAMa;;qBAGA,6BAA6B;mBAErB;mBACA;EAFnB,YACmB,OAAO,cACP;EAGb,YACJ,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;;;;;;;;;;;;;;;EA2BG,YAAY,eAAe,QAAQ;EAoBzC,oBAAoB,eAAe,QAAQ;;EAKrC,aAAa,iBAAiB,iBAAiB;EAIrD,eAAe,QAAQ"}
+{"version":3,"file":"facts.d.mts","names":[],"sources":["../../src/store/facts.ts"],"mappings":";;;;qBAMa;;qBAMA,6BAA6B;mBAErB;mBACA;;mBAEA;EAJnB,YACmB,OAAO,cACP;;EAEA,cAAa;EAG1B,YACJ,eACA;IAAS;IAAkB;IAAkB,QAAQ;IAAa;MACjE;;;;;;;;;;;;;;;EA6CG,YAAY,eAAe,QAAQ;EAqBzC,oBAAoB,eAAe,QAAQ;;EAKrC,aAAa,iBAAiB,iBAAiB;EAI/C,eAAe,QAAQ"}

package/dist/store/facts.mjs

@@ -2,27 +2,46 @@ import { matchesWhere } from "../engine/condition.mjs";
 // src/store/facts.ts
 /** The profile path that reads the user's own id (`u.userId`). */
 const USER_ID_PROPERTY = "userId";
+/** Payloads per round trip when a `where` filters events in JS. */
+const PAYLOAD_PAGE = 500;
 /** Single-user fact source over a JourneyStore: evaluation lives in engine/condition.ts, this only reads. */
 var JourneyFactSource = class {
 	store;
 	userId;
-	constructor(store, userId) {
+	owner;
+	constructor(store, userId, owner = () => Promise.resolve(userId)) {
 		this.store = store;
 		this.userId = userId;
+		this.owner = owner;
 	}
 	async countEvents(event, opts) {
 		const window = {
 			...opts?.sinceMs === void 0 ? {} : { sinceMs: opts.sinceMs },
 			...opts?.untilMs === void 0 ? {} : { untilMs: opts.untilMs }
 		};
-		if (opts?.where === void 0) return this.store.countEvents(this.userId, event, window);
+		const atLeast = opts?.atLeast;
+		const userId = await this.owner();
+		if (opts?.where === void 0) return this.store.countEvents(userId, event, window, atLeast);
 		const where = opts.where;
-		return (await this.store.listEventPayloads(this.userId, event, window)).filter((payload) => matchesWhere(payload, where)).length;
+		let matched = 0;
+		let after;
+		for (;;) {
+			const page = await this.store.pageEventPayloads(userId, event, window, {
+				limit: PAYLOAD_PAGE,
+				after
+			});
+			for (const payload of page.payloads) {
+				if (matchesWhere(payload, where)) matched += 1;
+				if (atLeast !== void 0 && matched >= atLeast) return matched;
+			}
+			if (page.next === void 0) return matched;
+			after = page.next;
+		}
 	}
 	/**
 	* The scalar boundary. Everything downstream — comparisons, subject
 	* placeholders, resolved message props — is typed ScalarIR, but nothing so
-	* far has checked that the stored JSON is one: /identify validates only that
+	* far has checked that the stored JSON is one: /ingest validates only that
 	* `props` is a plain object, and the merge stores whatever nesting it is
 	* handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true
 	* while `eq(score, 5)` is false, and `String(recipient)` on an object
@@ -34,8 +53,9 @@ var JourneyFactSource = class {
 	* place.
 	*/
 	async getProperty(path) {
-		if (path === "userId") return this.userId;
-		const props = await this.store.getProfile(this.userId);
+		const userId = await this.owner();
+		if (path === "userId") return userId;
+		const props = await this.store.getProfile(userId);
 		if (props === void 0) return void 0;
 		if (!Object.hasOwn(props, path)) return void 0;
 		const value = props[path];
@@ -46,10 +66,10 @@ var JourneyFactSource = class {
 	}
 	/** The user's opt-outs: the channel's, or with a topic that topic's as well. */
 	async isSuppressed(channel, topic) {
-		return this.store.isSuppressed(this.userId, channel, topic);
+		return this.store.isSuppressed(await this.owner(), channel, topic);
 	}
-	listDevices() {
-		return this.store.listDevices(this.userId);
+	async listDevices() {
+		return this.store.listDevices(await this.owner());
 	}
 };
 export { JourneyFactSource, USER_ID_PROPERTY };

package/dist/store/facts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"facts.mjs","names":[],"sources":["../../src/store/facts.ts"],"sourcesContent":["import { matchesWhere } from '../engine/condition';\nimport type { FactSource, PushDevice } from '../engine/ports';\nimport type { ConditionIR, ScalarIR } from '../ir';\nimport type { JourneyStore } from './index';\n\n/** The profile path that reads the user's own id (`u.userId`). */\nexport const USER_ID_PROPERTY = 'userId';\n\n/** Single-user fact source over a JourneyStore: evaluation lives in engine/condition.ts, this only reads. */\nexport class JourneyFactSource implements FactSource {\n  constructor(\n    private readonly store: JourneyStore,\n    private readonly userId: string\n  ) {}\n\n  async countEvents(\n    event: string,\n    opts?: { sinceMs?: number; untilMs?: number; where?: ConditionIR }\n  ): Promise<number> {\n    const window = {\n      ...(opts?.sinceMs === undefined ? {} : { sinceMs: opts.sinceMs }),\n      ...(opts?.untilMs === undefined ? {} : { untilMs: opts.untilMs }),\n    };\n    if (opts?.where === undefined) return this.store.countEvents(this.userId, event, window);\n    // Payload filtering happens in JS via the shared evaluator — one set of\n    // where semantics with the in-memory FactSource; per-user row counts are small.\n    const where = opts.where;\n    const payloads = await this.store.listEventPayloads(this.userId, event, window);\n    return payloads.filter((payload) => matchesWhere(payload, where)).length;\n  }\n\n  /**\n   * The scalar boundary. Everything downstream — comparisons, subject\n   * placeholders, resolved message props — is typed ScalarIR, but nothing so\n   * far has checked that the stored JSON is one: /identify validates only that\n   * `props` is a plain object, and the merge stores whatever nesting it is\n   * handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true\n   * while `eq(score, 5)` is false, and `String(recipient)` on an object\n   * addresses an email to `[object Object]`.\n   *\n   * So a non-scalar value reads as absent, matching how matchesWhere treats a\n   * non-scalar payload leaf. The port cannot say \"present but not a scalar\",\n   * and guessing at a coercion is what produced the wrong branch in the first\n   * place.\n   */\n  async getProperty(path: string): Promise<ScalarIR | undefined> {\n    // The system field: the request's identity, never stored in the profile (contract.user.userId)\n    if (path === USER_ID_PROPERTY) return this.userId;\n    const props: Record<string, unknown> | undefined = await this.store.getProfile(this.userId);\n    if (props === undefined) return undefined;\n    // Own keys only: `props[path]` would otherwise find Object.prototype, so\n    // `exists(u.toString)` held for every user with a profile row and a subject\n    // placeholder rendered native-code text into the email.\n    if (!Object.hasOwn(props, path)) return undefined;\n    const value = props[path];\n    // An explicit null means \"unset\" and behaves as not_exists. /identify\n    // itself clears a property by removing the key (the merge drops nulls), so\n    // this covers profiles written by other means — a direct SQL fixup, a\n    // migration, an import.\n    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {\n      return value;\n    }\n    return undefined;\n  }\n\n  getSegmentCondition(name: string): Promise<ConditionIR | undefined> {\n    return this.store.getSegmentCondition(name);\n  }\n\n  /** The user's opt-outs: the channel's, or with a topic that topic's as well. */\n  async isSuppressed(channel: string, topic?: string): Promise<boolean> {\n    return this.store.isSuppressed(this.userId, channel, topic);\n  }\n\n  listDevices(): Promise<PushDevice[]> {\n    return this.store.listDevices(this.userId);\n  }\n}\n"],"mappings":";;;AAMA,MAAa,mBAAmB;;AAGhC,IAAa,oBAAb,MAAqD;CAEhC;CACA;CAFnB,YACE,OACA,QACA;EAFiB,KAAA,QAAA;EACA,KAAA,SAAA;CAChB;CAEH,MAAM,YACJ,OACA,MACiB;EACjB,MAAM,SAAS;GACb,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;GAC/D,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;EACjE;EACA,IAAI,MAAM,UAAU,KAAA,GAAW,OAAO,KAAK,MAAM,YAAY,KAAK,QAAQ,OAAO,MAAM;EAGvF,MAAM,QAAQ,KAAK;EAEnB,QAAO,MADgB,KAAK,MAAM,kBAAkB,KAAK,QAAQ,OAAO,MAAM,EAAA,CAC9D,QAAQ,YAAY,aAAa,SAAS,KAAK,CAAC,CAAC,CAAC;CACpE;;;;;;;;;;;;;;;CAgBA,MAAM,YAAY,MAA6C;EAE7D,IAAI,SAAA,UAA2B,OAAO,KAAK;EAC3C,MAAM,QAA6C,MAAM,KAAK,MAAM,WAAW,KAAK,MAAM;EAC1F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAIhC,IAAI,CAAC,OAAO,OAAO,OAAO,IAAI,GAAG,OAAO,KAAA;EACxC,MAAM,QAAQ,MAAM;EAKpB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,WAC7E,OAAO;CAGX;CAEA,oBAAoB,MAAgD;EAClE,OAAO,KAAK,MAAM,oBAAoB,IAAI;CAC5C;;CAGA,MAAM,aAAa,SAAiB,OAAkC;EACpE,OAAO,KAAK,MAAM,aAAa,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,cAAqC;EACnC,OAAO,KAAK,MAAM,YAAY,KAAK,MAAM;CAC3C;AACF"}
+{"version":3,"file":"facts.mjs","names":[],"sources":["../../src/store/facts.ts"],"sourcesContent":["import { matchesWhere } from '../engine/condition';\nimport type { FactSource, PushDevice } from '../engine/ports';\nimport type { ConditionIR, ScalarIR } from '../ir';\nimport type { EventCursor, JourneyStore } from './index';\n\n/** The profile path that reads the user's own id (`u.userId`). */\nexport const USER_ID_PROPERTY = 'userId';\n\n/** Payloads per round trip when a `where` filters events in JS. */\nconst PAYLOAD_PAGE = 500;\n\n/** Single-user fact source over a JourneyStore: evaluation lives in engine/condition.ts, this only reads. */\nexport class JourneyFactSource implements FactSource {\n  constructor(\n    private readonly store: JourneyStore,\n    private readonly userId: string,\n    /** Who the facts are about now, for a journey that can change hands; `userId` otherwise. */\n    private readonly owner: () => Promise<string> = () => Promise.resolve(userId)\n  ) {}\n\n  async countEvents(\n    event: string,\n    opts?: { sinceMs?: number; untilMs?: number; where?: ConditionIR; atLeast?: number }\n  ): Promise<number> {\n    const window = {\n      ...(opts?.sinceMs === undefined ? {} : { sinceMs: opts.sinceMs }),\n      ...(opts?.untilMs === undefined ? {} : { untilMs: opts.untilMs }),\n    };\n    const atLeast = opts?.atLeast;\n    const userId = await this.owner();\n    if (opts?.where === undefined) {\n      return this.store.countEvents(userId, event, window, atLeast);\n    }\n    // Payload filtering stays in JS through the shared evaluator — one set of where semantics\n    // with the in-memory FactSource — but a page at a time, stopping as soon as enough events\n    // match. A heavy user's history is no longer loaded whole on every evaluation; only a user\n    // with no match left to find is read to the end, and then in bounded pages.\n    const where = opts.where;\n    let matched = 0;\n    let after: EventCursor | undefined;\n    for (;;) {\n      const page = await this.store.pageEventPayloads(userId, event, window, {\n        limit: PAYLOAD_PAGE,\n        after,\n      });\n      for (const payload of page.payloads) {\n        if (matchesWhere(payload, where)) matched += 1;\n        if (atLeast !== undefined && matched >= atLeast) return matched;\n      }\n      if (page.next === undefined) return matched;\n      after = page.next;\n    }\n  }\n\n  /**\n   * The scalar boundary. Everything downstream — comparisons, subject\n   * placeholders, resolved message props — is typed ScalarIR, but nothing so\n   * far has checked that the stored JSON is one: /ingest validates only that\n   * `props` is a plain object, and the merge stores whatever nesting it is\n   * handed. Left unchecked, `gt(score, 3)` on `['5']` coerces its way to true\n   * while `eq(score, 5)` is false, and `String(recipient)` on an object\n   * addresses an email to `[object Object]`.\n   *\n   * So a non-scalar value reads as absent, matching how matchesWhere treats a\n   * non-scalar payload leaf. The port cannot say \"present but not a scalar\",\n   * and guessing at a coercion is what produced the wrong branch in the first\n   * place.\n   */\n  async getProperty(path: string): Promise<ScalarIR | undefined> {\n    // The system field: the request's identity, never stored in the profile (contract.user.userId)\n    const userId = await this.owner();\n    if (path === USER_ID_PROPERTY) return userId;\n    const props: Record<string, unknown> | undefined = await this.store.getProfile(userId);\n    if (props === undefined) return undefined;\n    // Own keys only: `props[path]` would otherwise find Object.prototype, so\n    // `exists(u.toString)` held for every user with a profile row and a subject\n    // placeholder rendered native-code text into the email.\n    if (!Object.hasOwn(props, path)) return undefined;\n    const value = props[path];\n    // An explicit null means \"unset\" and behaves as not_exists. /ingest\n    // itself clears a property by removing the key (the merge drops nulls), so\n    // this covers profiles written by other means — a direct SQL fixup, a\n    // migration, an import.\n    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {\n      return value;\n    }\n    return undefined;\n  }\n\n  getSegmentCondition(name: string): Promise<ConditionIR | undefined> {\n    return this.store.getSegmentCondition(name);\n  }\n\n  /** The user's opt-outs: the channel's, or with a topic that topic's as well. */\n  async isSuppressed(channel: string, topic?: string): Promise<boolean> {\n    return this.store.isSuppressed(await this.owner(), channel, topic);\n  }\n\n  async listDevices(): Promise<PushDevice[]> {\n    return this.store.listDevices(await this.owner());\n  }\n}\n"],"mappings":";;;AAMA,MAAa,mBAAmB;;AAGhC,MAAM,eAAe;;AAGrB,IAAa,oBAAb,MAAqD;CAEhC;CACA;CAEA;CAJnB,YACE,OACA,QAEA,cAAsD,QAAQ,QAAQ,MAAM,GAC5E;EAJiB,KAAA,QAAA;EACA,KAAA,SAAA;EAEA,KAAA,QAAA;CAChB;CAEH,MAAM,YACJ,OACA,MACiB;EACjB,MAAM,SAAS;GACb,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;GAC/D,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;EACjE;EACA,MAAM,UAAU,MAAM;EACtB,MAAM,SAAS,MAAM,KAAK,MAAM;EAChC,IAAI,MAAM,UAAU,KAAA,GAClB,OAAO,KAAK,MAAM,YAAY,QAAQ,OAAO,QAAQ,OAAO;EAM9D,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU;EACd,IAAI;EACJ,SAAS;GACP,MAAM,OAAO,MAAM,KAAK,MAAM,kBAAkB,QAAQ,OAAO,QAAQ;IACrE,OAAO;IACP;GACF,CAAC;GACD,KAAK,MAAM,WAAW,KAAK,UAAU;IACnC,IAAI,aAAa,SAAS,KAAK,GAAG,WAAW;IAC7C,IAAI,YAAY,KAAA,KAAa,WAAW,SAAS,OAAO;GAC1D;GACA,IAAI,KAAK,SAAS,KAAA,GAAW,OAAO;GACpC,QAAQ,KAAK;EACf;CACF;;;;;;;;;;;;;;;CAgBA,MAAM,YAAY,MAA6C;EAE7D,MAAM,SAAS,MAAM,KAAK,MAAM;EAChC,IAAI,SAAA,UAA2B,OAAO;EACtC,MAAM,QAA6C,MAAM,KAAK,MAAM,WAAW,MAAM;EACrF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAIhC,IAAI,CAAC,OAAO,OAAO,OAAO,IAAI,GAAG,OAAO,KAAA;EACxC,MAAM,QAAQ,MAAM;EAKpB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,WAC7E,OAAO;CAGX;CAEA,oBAAoB,MAAgD;EAClE,OAAO,KAAK,MAAM,oBAAoB,IAAI;CAC5C;;CAGA,MAAM,aAAa,SAAiB,OAAkC;EACpE,OAAO,KAAK,MAAM,aAAa,MAAM,KAAK,MAAM,GAAG,SAAS,KAAK;CACnE;CAEA,MAAM,cAAqC;EACzC,OAAO,KAAK,MAAM,YAAY,MAAM,KAAK,MAAM,CAAC;CAClD;AACF"}

package/dist/store/identity.cjs

@@ -0,0 +1,34 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+// src/store/identity.ts
+/**
+* Who the engine's rows are about: a user, or a visitor not signed in yet. A visitor is a user
+* with a reserved id, so journeys, events, profiles and opt-outs work the same for both; signing
+* in moves the visitor's rows to the user (`linkVisitor`). Callers never see the prefix: they
+* pass `userId` and `visitorId` as two fields.
+*/
+const VISITOR_PREFIX = "visitor:";
+function visitorSubject(visitorId) {
+	return `${VISITOR_PREFIX}${visitorId}`;
+}
+function isVisitorSubject(subject) {
+	return subject.startsWith(VISITOR_PREFIX);
+}
+/** The visitor id inside a subject; undefined for a user. */
+function visitorIdOf(subject) {
+	return isVisitorSubject(subject) ? subject.slice(8) : void 0;
+}
+/**
+* Who an instance belongs to now. A journey a visitor started moves to the user when they sign in,
+* with its entry: read per use, because a wait can outlast the sign-in. An instance a user started
+* never moves, so it costs no read.
+*/
+async function instanceOwner(store, instanceId, startedAs) {
+	if (!isVisitorSubject(startedAs)) return startedAs;
+	return await store.entryOwner(instanceId) ?? startedAs;
+}
+exports.instanceOwner = instanceOwner;
+exports.isVisitorSubject = isVisitorSubject;
+exports.visitorIdOf = visitorIdOf;
+exports.visitorSubject = visitorSubject;
+
+//# sourceMappingURL=identity.cjs.map

package/dist/store/identity.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.cjs","names":[],"sources":["../../src/store/identity.ts"],"sourcesContent":["/**\n * Who the engine's rows are about: a user, or a visitor not signed in yet. A visitor is a user\n * with a reserved id, so journeys, events, profiles and opt-outs work the same for both; signing\n * in moves the visitor's rows to the user (`linkVisitor`). Callers never see the prefix: they\n * pass `userId` and `visitorId` as two fields.\n */\nconst VISITOR_PREFIX = 'visitor:';\n\nexport function visitorSubject(visitorId: string): string {\n  return `${VISITOR_PREFIX}${visitorId}`;\n}\n\nexport function isVisitorSubject(subject: string): boolean {\n  return subject.startsWith(VISITOR_PREFIX);\n}\n\n/** The visitor id inside a subject; undefined for a user. */\nexport function visitorIdOf(subject: string): string | undefined {\n  return isVisitorSubject(subject) ? subject.slice(VISITOR_PREFIX.length) : undefined;\n}\n\n/**\n * Who an instance belongs to now. A journey a visitor started moves to the user when they sign in,\n * with its entry: read per use, because a wait can outlast the sign-in. An instance a user started\n * never moves, so it costs no read.\n */\nexport async function instanceOwner(\n  store: { entryOwner(instanceId: string): Promise<string | undefined> },\n  instanceId: string,\n  startedAs: string\n): Promise<string> {\n  if (!isVisitorSubject(startedAs)) return startedAs;\n  return (await store.entryOwner(instanceId)) ?? startedAs;\n}\n"],"mappings":";;;;;;;;AAMA,MAAM,iBAAiB;AAEvB,SAAgB,eAAe,WAA2B;CACxD,OAAO,GAAG,iBAAiB;AAC7B;AAEA,SAAgB,iBAAiB,SAA0B;CACzD,OAAO,QAAQ,WAAW,cAAc;AAC1C;;AAGA,SAAgB,YAAY,SAAqC;CAC/D,OAAO,iBAAiB,OAAO,IAAI,QAAQ,MAAM,CAAqB,IAAI,KAAA;AAC5E;;;;;;AAOA,eAAsB,cACpB,OACA,YACA,WACiB;CACjB,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO;CACzC,OAAQ,MAAM,MAAM,WAAW,UAAU,KAAM;AACjD"}

package/dist/store/identity.d.cts

@@ -0,0 +1,13 @@
+export declare function visitorSubject(visitorId: string): string;
+export declare function isVisitorSubject(subject: string): boolean;
+/** The visitor id inside a subject; undefined for a user. */
+export declare function visitorIdOf(subject: string): string | undefined;
+/**
+ * Who an instance belongs to now. A journey a visitor started moves to the user when they sign in,
+ * with its entry: read per use, because a wait can outlast the sign-in. An instance a user started
+ * never moves, so it costs no read.
+ */
+export declare function instanceOwner(store: {
+  entryOwner(instanceId: string): Promise<string | undefined>;
+}, instanceId: string, startedAs: string): Promise<string>;
+//# sourceMappingURL=identity.d.cts.map

package/dist/store/identity.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.cts","names":[],"sources":["../../src/store/identity.ts"],"mappings":"A,wBAQgB,eAAe;wBAIf,iBAAiB;;wBAKjB,YAAY;;;;;;wBASN,cACpB;EAAS,WAAW,qBAAqB;GACzC,oBACA,oBACC"}

package/dist/store/identity.d.mts

@@ -0,0 +1,13 @@
+export declare function visitorSubject(visitorId: string): string;
+export declare function isVisitorSubject(subject: string): boolean;
+/** The visitor id inside a subject; undefined for a user. */
+export declare function visitorIdOf(subject: string): string | undefined;
+/**
+ * Who an instance belongs to now. A journey a visitor started moves to the user when they sign in,
+ * with its entry: read per use, because a wait can outlast the sign-in. An instance a user started
+ * never moves, so it costs no read.
+ */
+export declare function instanceOwner(store: {
+  entryOwner(instanceId: string): Promise<string | undefined>;
+}, instanceId: string, startedAs: string): Promise<string>;
+//# sourceMappingURL=identity.d.mts.map

package/dist/store/identity.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.mts","names":[],"sources":["../../src/store/identity.ts"],"mappings":"A,wBAQgB,eAAe;wBAIf,iBAAiB;;wBAKjB,YAAY;;;;;;wBASN,cACpB;EAAS,WAAW,qBAAqB;GACzC,oBACA,oBACC"}

package/dist/store/identity.mjs

@@ -0,0 +1,30 @@
+// src/store/identity.ts
+/**
+* Who the engine's rows are about: a user, or a visitor not signed in yet. A visitor is a user
+* with a reserved id, so journeys, events, profiles and opt-outs work the same for both; signing
+* in moves the visitor's rows to the user (`linkVisitor`). Callers never see the prefix: they
+* pass `userId` and `visitorId` as two fields.
+*/
+const VISITOR_PREFIX = "visitor:";
+function visitorSubject(visitorId) {
+	return `${VISITOR_PREFIX}${visitorId}`;
+}
+function isVisitorSubject(subject) {
+	return subject.startsWith(VISITOR_PREFIX);
+}
+/** The visitor id inside a subject; undefined for a user. */
+function visitorIdOf(subject) {
+	return isVisitorSubject(subject) ? subject.slice(8) : void 0;
+}
+/**
+* Who an instance belongs to now. A journey a visitor started moves to the user when they sign in,
+* with its entry: read per use, because a wait can outlast the sign-in. An instance a user started
+* never moves, so it costs no read.
+*/
+async function instanceOwner(store, instanceId, startedAs) {
+	if (!isVisitorSubject(startedAs)) return startedAs;
+	return await store.entryOwner(instanceId) ?? startedAs;
+}
+export { instanceOwner, isVisitorSubject, visitorIdOf, visitorSubject };
+
+//# sourceMappingURL=identity.mjs.map

package/dist/store/identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.mjs","names":[],"sources":["../../src/store/identity.ts"],"sourcesContent":["/**\n * Who the engine's rows are about: a user, or a visitor not signed in yet. A visitor is a user\n * with a reserved id, so journeys, events, profiles and opt-outs work the same for both; signing\n * in moves the visitor's rows to the user (`linkVisitor`). Callers never see the prefix: they\n * pass `userId` and `visitorId` as two fields.\n */\nconst VISITOR_PREFIX = 'visitor:';\n\nexport function visitorSubject(visitorId: string): string {\n  return `${VISITOR_PREFIX}${visitorId}`;\n}\n\nexport function isVisitorSubject(subject: string): boolean {\n  return subject.startsWith(VISITOR_PREFIX);\n}\n\n/** The visitor id inside a subject; undefined for a user. */\nexport function visitorIdOf(subject: string): string | undefined {\n  return isVisitorSubject(subject) ? subject.slice(VISITOR_PREFIX.length) : undefined;\n}\n\n/**\n * Who an instance belongs to now. A journey a visitor started moves to the user when they sign in,\n * with its entry: read per use, because a wait can outlast the sign-in. An instance a user started\n * never moves, so it costs no read.\n */\nexport async function instanceOwner(\n  store: { entryOwner(instanceId: string): Promise<string | undefined> },\n  instanceId: string,\n  startedAs: string\n): Promise<string> {\n  if (!isVisitorSubject(startedAs)) return startedAs;\n  return (await store.entryOwner(instanceId)) ?? startedAs;\n}\n"],"mappings":";;;;;;;AAMA,MAAM,iBAAiB;AAEvB,SAAgB,eAAe,WAA2B;CACxD,OAAO,GAAG,iBAAiB;AAC7B;AAEA,SAAgB,iBAAiB,SAA0B;CACzD,OAAO,QAAQ,WAAW,cAAc;AAC1C;;AAGA,SAAgB,YAAY,SAAqC;CAC/D,OAAO,iBAAiB,OAAO,IAAI,QAAQ,MAAM,CAAqB,IAAI,KAAA;AAC5E;;;;;;AAOA,eAAsB,cACpB,OACA,YACA,WACiB;CACjB,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO;CACzC,OAAQ,MAAM,MAAM,WAAW,UAAU,KAAM;AACjD"}

package/dist/store/index.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_store_facts = require("./facts.cjs");
 const require_store_erasure = require("./erasure.cjs");
+const require_store_identity = require("./identity.cjs");
 const require_store_postgres_reporting = require("./postgres-reporting.cjs");
 const require_store_tables = require("./tables.cjs");
 const require_store_postgres = require("./postgres.cjs");
@@ -24,7 +25,11 @@ exports.PostgresReporting = require_store_postgres_reporting.PostgresReporting;
 exports.SchemaMismatchError = SchemaMismatchError;
 exports.TABLES = require_store_tables.TABLES;
 exports.UserErasedError = require_store_erasure.UserErasedError;
+exports.instanceOwner = require_store_identity.instanceOwner;
+exports.isVisitorSubject = require_store_identity.isVisitorSubject;
 exports.renderDrizzleSchema = require_store_tables.renderDrizzleSchema;
 exports.renderPostgresDdl = require_store_tables.renderPostgresDdl;
+exports.visitorIdOf = require_store_identity.visitorIdOf;
+exports.visitorSubject = require_store_identity.visitorSubject;
 
 //# sourceMappingURL=index.cjs.map