@shware/workflow 7.0.0 → 8.0.0

package/dist/host/execute.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"execute.cjs","names":["resolveRuntime","checkEvent","ContractValidationError","ingestEvent","readWithRetry","scaleDurations","runJourney","JourneyFactSource"],"sources":["../../src/host/execute.ts"],"sourcesContent":["import { type Contract, ContractValidationError, checkEvent } from '../contract';\nimport { runJourney } from '../engine/interpreter';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  EventSink,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { scaleDurations } from '../engine/time-scale';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport { JourneyFactSource } from '../store/facts';\nimport type { JourneyStore } from '../store/index';\nimport { readWithRetry } from './fresh-read';\nimport { ingestEvent } from './ingest';\nimport type { JourneyEnv, JourneyParams } from './platform';\n\n/**\n * One journey instance run to its end, on whatever durable runtime supplies the `EngineStep`:\n * the runner admitted against the user's erasure tombstone, the IR loaded by the hash pinned at\n * entry, the outlets wired, the interpreter run, and the ledger finalized. Cloudflare's runner\n * and the Lambda handler both come through here; only their EngineStep differs.\n */\n\n/** Everything a run is wired to, assembled by the host. */\nexport interface JourneyRunParts {\n  store: JourneyStore;\n  /**\n   * The env the emitted events are ingested with: its `JOURNEY` starts and wakes instances on\n   * this runtime.\n   */\n  env: JourneyEnv;\n  runtime: JourneyRuntimeOptions;\n  messages: MessageSender;\n  actions: ActionInvoker;\n  contract?: Contract | undefined;\n  validator?: MessageValidator | undefined;\n  observer?: JourneyObserver | undefined;\n}\n\nexport interface JourneyRunInput {\n  instanceId: string;\n  params: JourneyParams;\n  /** When the trigger happened: replay-stable, never Date.now() at run time. */\n  enteredAtMs: number;\n  step: EngineStep;\n}\n\n/** Development aid: echo each outbound message before handing it to the real sender. */\nfunction logging(sender: MessageSender): MessageSender {\n  return {\n    async send(message) {\n      console.log(\n        `[journey] ${message.channel} ${message.template} → ${message.recipient ?? message.userId} ${JSON.stringify(message.props)}`\n      );\n      return sender.send(message);\n    },\n  };\n}\n\nexport async function executeJourney(\n  input: JourneyRunInput,\n  parts: JourneyRunParts\n): Promise<JourneyOutcome> {\n  const { instanceId, params, step } = input;\n  const { workflowId, contentHash, userId } = params;\n  const { store, env, observer, contract } = parts;\n\n  const runtime = resolveRuntime({ current: parts.runtime }, 'current');\n\n  const finished = (status: JourneyOutcome['status'] | 'failed', convertedAt?: number) =>\n    observer?.finished?.({\n      workflow: workflowId,\n      instanceId,\n      userId,\n      status,\n      at: Date.now(),\n      ...(convertedAt === undefined ? {} : { convertedAt }),\n    });\n\n  const messages = runtime.logMessages ? logging(parts.messages) : parts.messages;\n\n  // send_event feeds straight back into the router logic — an in-process call\n  // forming the event edge between workflows. The step's identity travels as\n  // the event id, so a retried emit records the occurrence once.\n  // An emitted event passes the same contract check as one arriving over HTTP.\n  const events: EventSink = {\n    emit: async (name, payload, id) => {\n      let accepted: Record<string, unknown> = payload;\n      if (contract !== undefined) {\n        const verdict = checkEvent(contract, name, payload);\n        if (!verdict.ok) throw new ContractValidationError(name, verdict.issues);\n        accepted = verdict.data;\n      }\n      await ingestEvent(env, { id, userId, event: name, payload: accepted }, store);\n    },\n  };\n\n  /*\n   * Admission: the ledger entry was committed before the runtime was asked to create this\n   * instance, so an erasure can land in between (the entry is not found by `get`, the erase\n   * goes through, and then the create lands). The runner is the only one who can refuse that\n   * late run, and it must do so before its first observable effect — `observer.started`, the\n   * IR read, any action or send.\n   *\n   * Outside any durable step, on purpose: a step would checkpoint the first invocation's\n   * \"admitted\" and replay it on every wake and every rebuild after an eviction, which is\n   * exactly when the tombstone may have arrived since. `admitInstance` is idempotent — the\n   * entry's `admitted_at` keeps its first value — so a replay re-admits the same instance, and\n   * the store makes the admission mutually exclusive with the erasure: either the entry is\n   * admitted first and the erasure finds it and stops it, or the tombstone commits first and\n   * this read answers false. Only the read itself is retried, briefly, when the database\n   * stumbled; one that keeps failing throws, so the instance errors without running anything,\n   * its entry stays, and the erasure protocol (or a later wake) decides what becomes of it.\n   */\n  const admitted = await readWithRetry(() => store.admitInstance(instanceId, userId), {\n    what: 'admission',\n    instanceId,\n  });\n  if (!admitted) {\n    /*\n     * No finalize either way: the entry is gone (erased, or never ours to run) or is being\n     * erased, and the finalize steps would write it back — a status on an entry the erasure\n     * deletes, a `finished` the reporting records as a new row of an erased user. The\n     * subscriptions, if any, go with the user's data.\n     */\n    console.warn(`[workflow] instance ${instanceId} of ${userId} refused admission: not running`);\n    return { status: 'exited', reason: 'erased' };\n  }\n\n  let outcome: JourneyOutcome;\n  try {\n    // In a step: a read that fails is retried like any other, and one that keeps failing ends\n    // the instance through the failure path below rather than leaving its entry 'running'.\n    // Content addressing makes the IR immutable, so the checkpointed copy is the one to replay\n    const stored = await step.do('$workflow:ir', async () => {\n      const found = await store.getWorkflowIR(contentHash);\n      if (found === undefined)\n        throw new Error(`WorkflowIR not found: ${workflowId}@${contentHash}`);\n      return found;\n    });\n    // Development runs the journey in fast-forward; the pinned hash still names the version.\n    const ir = scaleDurations(stored, runtime.timeScale);\n    outcome = await runJourney(ir, {\n      userId,\n      instanceId,\n      enteredAtMs: input.enteredAtMs,\n      step,\n      facts: new JourneyFactSource(store, userId),\n      messages,\n      events,\n      actions: parts.actions,\n      validator: parts.validator,\n      observer,\n    });\n  } catch (error) {\n    /*\n     * An error escaping run() ends the instance, and the ledger is the only\n     * place anyone looks afterwards: leaving it at 'running' meant a dead\n     * journey stayed indistinguishable from a waiting one, in the dashboard\n     * and in the once-policy, forever.\n     *\n     * Subscriptions go too, as on every ordinary ending: left behind, the\n     * rows would only make every later event of the user poke a dead\n     * instance (one wake call to the runtime each, refused every time).\n     *\n     * A paused instance never gets here: a durable wait suspends the run\n     * without throwing through it.\n     */\n    await step.do('finalize:failed', async () => {\n      await store.setEntryStatus(instanceId, 'failed');\n      await store.unsubscribe(instanceId);\n      await finished('failed');\n    });\n    throw error;\n  }\n\n  await step.do('finalize', async () => {\n    await store.setEntryStatus(instanceId, outcome.status);\n    await store.unsubscribe(instanceId);\n    await finished(outcome.status, outcome.convertedAt);\n  });\n\n  return outcome;\n}\n"],"mappings":";;;;;;;;;;AAmDA,SAAS,QAAQ,QAAsC;CACrD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,QAAQ,IACN,aAAa,QAAQ,QAAQ,GAAG,QAAQ,SAAS,KAAK,QAAQ,aAAa,QAAQ,OAAO,GAAG,KAAK,UAAU,QAAQ,KAAK,GAC3H;EACA,OAAO,OAAO,KAAK,OAAO;CAC5B,EACF;AACF;AAEA,eAAsB,eACpB,OACA,OACyB;CACzB,MAAM,EAAE,YAAY,QAAQ,SAAS;CACrC,MAAM,EAAE,YAAY,aAAa,WAAW;CAC5C,MAAM,EAAE,OAAO,KAAK,UAAU,aAAa;CAE3C,MAAM,UAAUA,gBAAAA,eAAe,EAAE,SAAS,MAAM,QAAQ,GAAG,SAAS;CAEpE,MAAM,YAAY,QAA6C,gBAC7D,UAAU,WAAW;EACnB,UAAU;EACV;EACA;EACA;EACA,IAAI,KAAK,IAAI;EACb,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CACrD,CAAC;CAEH,MAAM,WAAW,QAAQ,cAAc,QAAQ,MAAM,QAAQ,IAAI,MAAM;CAMvE,MAAM,SAAoB,EACxB,MAAM,OAAO,MAAM,SAAS,OAAO;EACjC,IAAI,WAAoC;EACxC,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,UAAUC,iBAAAA,WAAW,UAAU,MAAM,OAAO;GAClD,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAIC,iBAAAA,wBAAwB,MAAM,QAAQ,MAAM;GACvE,WAAW,QAAQ;EACrB;EACA,MAAMC,oBAAAA,YAAY,KAAK;GAAE;GAAI;GAAQ,OAAO;GAAM,SAAS;EAAS,GAAG,KAAK;CAC9E,EACF;CAuBA,IAAI,CAAC,MAJkBC,wBAAAA,oBAAoB,MAAM,cAAc,YAAY,MAAM,GAAG;EAClF,MAAM;EACN;CACF,CAAC,GACc;EAOb,QAAQ,KAAK,uBAAuB,WAAW,MAAM,OAAO,gCAAgC;EAC5F,OAAO;GAAE,QAAQ;GAAU,QAAQ;EAAS;CAC9C;CAEA,IAAI;CACJ,IAAI;EAIF,MAAM,SAAS,MAAM,KAAK,GAAG,gBAAgB,YAAY;GACvD,MAAM,QAAQ,MAAM,MAAM,cAAc,WAAW;GACnD,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,yBAAyB,WAAW,GAAG,aAAa;GACtE,OAAO;EACT,CAAC;EAED,MAAM,KAAKC,0BAAAA,eAAe,QAAQ,QAAQ,SAAS;EACnD,UAAU,MAAMC,2BAAAA,WAAW,IAAI;GAC7B;GACA;GACA,aAAa,MAAM;GACnB;GACA,OAAO,IAAIC,oBAAAA,kBAAkB,OAAO,MAAM;GAC1C;GACA;GACA,SAAS,MAAM;GACf,WAAW,MAAM;GACjB;EACF,CAAC;CACH,SAAS,OAAO;EAcd,MAAM,KAAK,GAAG,mBAAmB,YAAY;GAC3C,MAAM,MAAM,eAAe,YAAY,QAAQ;GAC/C,MAAM,MAAM,YAAY,UAAU;GAClC,MAAM,SAAS,QAAQ;EACzB,CAAC;EACD,MAAM;CACR;CAEA,MAAM,KAAK,GAAG,YAAY,YAAY;EACpC,MAAM,MAAM,eAAe,YAAY,QAAQ,MAAM;EACrD,MAAM,MAAM,YAAY,UAAU;EAClC,MAAM,SAAS,QAAQ,QAAQ,QAAQ,WAAW;CACpD,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"execute.cjs","names":["resolveRuntime","instanceOwner","checkEvent","ContractValidationError","ingestEvent","readWithRetry","scaleDurations","runJourney","JourneyFactSource"],"sources":["../../src/host/execute.ts"],"sourcesContent":["import { type Contract, ContractValidationError, checkEvent } from '../contract';\nimport { runJourney } from '../engine/interpreter';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  EventSink,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { scaleDurations } from '../engine/time-scale';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport { JourneyFactSource } from '../store/facts';\nimport { type JourneyStore, instanceOwner } from '../store/index';\nimport { readWithRetry } from './fresh-read';\nimport { ingestEvent } from './ingest';\nimport type { JourneyEnv, JourneyParams } from './platform';\n\n/**\n * One journey instance run to its end, on whatever durable runtime supplies the `EngineStep`:\n * the runner admitted against the user's erasure tombstone, the IR loaded by the hash pinned at\n * entry, the outlets wired, the interpreter run, and the ledger finalized. Cloudflare's runner\n * and the Lambda handler both come through here; only their EngineStep differs.\n */\n\n/** Everything a run is wired to, assembled by the host. */\nexport interface JourneyRunParts {\n  store: JourneyStore;\n  /**\n   * The env the emitted events are ingested with: its `JOURNEY` starts and wakes instances on\n   * this runtime.\n   */\n  env: JourneyEnv;\n  runtime: JourneyRuntimeOptions;\n  messages: MessageSender;\n  actions: ActionInvoker;\n  contract?: Contract | undefined;\n  validator?: MessageValidator | undefined;\n  observer?: JourneyObserver | undefined;\n}\n\nexport interface JourneyRunInput {\n  instanceId: string;\n  params: JourneyParams;\n  /** When the trigger happened: replay-stable, never Date.now() at run time. */\n  enteredAtMs: number;\n  step: EngineStep;\n}\n\n/** Development aid: echo each outbound message before handing it to the real sender. */\nfunction logging(sender: MessageSender): MessageSender {\n  return {\n    async send(message) {\n      console.log(\n        `[journey] ${message.channel} ${message.template} → ${message.recipient ?? message.userId} ${JSON.stringify(message.props)}`\n      );\n      return sender.send(message);\n    },\n  };\n}\n\nexport async function executeJourney(\n  input: JourneyRunInput,\n  parts: JourneyRunParts\n): Promise<JourneyOutcome> {\n  const { instanceId, params, step } = input;\n  const { workflowId, contentHash, userId } = params;\n  const { store, env, observer, contract } = parts;\n\n  const runtime = resolveRuntime({ current: parts.runtime }, 'current');\n  const owner = () => instanceOwner(store, instanceId, userId);\n\n  const finished = async (status: JourneyOutcome['status'] | 'failed', convertedAt?: number) =>\n    observer?.finished?.({\n      workflow: workflowId,\n      instanceId,\n      userId: await owner(),\n      status,\n      at: Date.now(),\n      ...(convertedAt === undefined ? {} : { convertedAt }),\n    });\n\n  const messages = runtime.logMessages ? logging(parts.messages) : parts.messages;\n\n  // send_event feeds straight back into the router logic — an in-process call\n  // forming the event edge between workflows. The step's identity travels as\n  // the event id, so a retried emit records the occurrence once.\n  // An emitted event passes the same contract check as one arriving over HTTP.\n  const events: EventSink = {\n    emit: async (name, payload, id) => {\n      let accepted: Record<string, unknown> = payload;\n      if (contract !== undefined) {\n        const verdict = checkEvent(contract, name, payload);\n        if (!verdict.ok) throw new ContractValidationError(name, verdict.issues);\n        accepted = verdict.data;\n      }\n      await ingestEvent(env, { id, userId: await owner(), event: name, payload: accepted }, store);\n    },\n  };\n\n  /*\n   * Admission: the ledger entry was committed before the runtime was asked to create this\n   * instance, so an erasure can land in between (the entry is not found by `get`, the erase\n   * goes through, and then the create lands). The runner is the only one who can refuse that\n   * late run, and it must do so before its first observable effect — `observer.started`, the\n   * IR read, any action or send.\n   *\n   * Outside any durable step, on purpose: a step would checkpoint the first invocation's\n   * \"admitted\" and replay it on every wake and every rebuild after an eviction, which is\n   * exactly when the tombstone may have arrived since. `admitInstance` is idempotent — the\n   * entry's `admitted_at` keeps its first value — so a replay re-admits the same instance, and\n   * the store makes the admission mutually exclusive with the erasure: either the entry is\n   * admitted first and the erasure finds it and stops it, or the tombstone commits first and\n   * this read answers false. Only the read itself is retried, briefly, when the database\n   * stumbled; one that keeps failing throws, so the instance errors without running anything,\n   * its entry stays, and the erasure protocol (or a later wake) decides what becomes of it.\n   */\n  const admitted = await readWithRetry(async () => store.admitInstance(instanceId, await owner()), {\n    what: 'admission',\n    instanceId,\n  });\n  if (!admitted) {\n    /*\n     * No finalize either way: the entry is gone (erased, or never ours to run) or is being\n     * erased, and the finalize steps would write it back — a status on an entry the erasure\n     * deletes, a `finished` the reporting records as a new row of an erased user. The\n     * subscriptions, if any, go with the user's data.\n     */\n    console.warn(`[workflow] instance ${instanceId} of ${userId} refused admission: not running`);\n    return { status: 'exited', reason: 'erased' };\n  }\n\n  let outcome: JourneyOutcome;\n  try {\n    // In a step: a read that fails is retried like any other, and one that keeps failing ends\n    // the instance through the failure path below rather than leaving its entry 'running'.\n    // Content addressing makes the IR immutable, so the checkpointed copy is the one to replay\n    const stored = await step.do('$workflow:ir', async () => {\n      const found = await store.getWorkflowIR(contentHash);\n      if (found === undefined)\n        throw new Error(`WorkflowIR not found: ${workflowId}@${contentHash}`);\n      return found;\n    });\n    // Development runs the journey in fast-forward; the pinned hash still names the version.\n    const ir = scaleDurations(stored, runtime.timeScale);\n    outcome = await runJourney(ir, {\n      userId,\n      instanceId,\n      currentUserId: owner,\n      // A delivery that arrives late still enters when the trigger happened: a purchase made\n      // while the begin_checkout was being retried is the goal, not history from before entry\n      enteredAtMs: Math.min(input.enteredAtMs, input.params.trigger.ts ?? input.enteredAtMs),\n      step,\n      facts: new JourneyFactSource(store, userId, owner),\n      messages,\n      events,\n      actions: parts.actions,\n      validator: parts.validator,\n      observer,\n    });\n  } catch (error) {\n    /*\n     * An error escaping run() ends the instance, and the ledger is the only\n     * place anyone looks afterwards: leaving it at 'running' meant a dead\n     * journey stayed indistinguishable from a waiting one, in the dashboard\n     * and in the once-policy, forever.\n     *\n     * Subscriptions go too, as on every ordinary ending: left behind, the\n     * rows would only make every later event of the user poke a dead\n     * instance (one wake call to the runtime each, refused every time).\n     *\n     * A paused instance never gets here: a durable wait suspends the run\n     * without throwing through it.\n     */\n    await step.do('finalize:failed', async () => {\n      await store.setEntryStatus(instanceId, 'failed');\n      await store.unsubscribe(instanceId);\n      await finished('failed');\n    });\n    throw error;\n  }\n\n  await step.do('finalize', async () => {\n    await store.setEntryStatus(instanceId, outcome.status);\n    await store.unsubscribe(instanceId);\n    await finished(outcome.status, outcome.convertedAt);\n  });\n\n  return outcome;\n}\n"],"mappings":";;;;;;;;;;;;AAmDA,SAAS,QAAQ,QAAsC;CACrD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,QAAQ,IACN,aAAa,QAAQ,QAAQ,GAAG,QAAQ,SAAS,KAAK,QAAQ,aAAa,QAAQ,OAAO,GAAG,KAAK,UAAU,QAAQ,KAAK,GAC3H;EACA,OAAO,OAAO,KAAK,OAAO;CAC5B,EACF;AACF;AAEA,eAAsB,eACpB,OACA,OACyB;CACzB,MAAM,EAAE,YAAY,QAAQ,SAAS;CACrC,MAAM,EAAE,YAAY,aAAa,WAAW;CAC5C,MAAM,EAAE,OAAO,KAAK,UAAU,aAAa;CAE3C,MAAM,UAAUA,gBAAAA,eAAe,EAAE,SAAS,MAAM,QAAQ,GAAG,SAAS;CACpE,MAAM,cAAcC,uBAAAA,cAAc,OAAO,YAAY,MAAM;CAE3D,MAAM,WAAW,OAAO,QAA6C,gBACnE,UAAU,WAAW;EACnB,UAAU;EACV;EACA,QAAQ,MAAM,MAAM;EACpB;EACA,IAAI,KAAK,IAAI;EACb,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CACrD,CAAC;CAEH,MAAM,WAAW,QAAQ,cAAc,QAAQ,MAAM,QAAQ,IAAI,MAAM;CAMvE,MAAM,SAAoB,EACxB,MAAM,OAAO,MAAM,SAAS,OAAO;EACjC,IAAI,WAAoC;EACxC,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,UAAUC,iBAAAA,WAAW,UAAU,MAAM,OAAO;GAClD,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAIC,iBAAAA,wBAAwB,MAAM,QAAQ,MAAM;GACvE,WAAW,QAAQ;EACrB;EACA,MAAMC,oBAAAA,YAAY,KAAK;GAAE;GAAI,QAAQ,MAAM,MAAM;GAAG,OAAO;GAAM,SAAS;EAAS,GAAG,KAAK;CAC7F,EACF;CAuBA,IAAI,CAAC,MAJkBC,wBAAAA,cAAc,YAAY,MAAM,cAAc,YAAY,MAAM,MAAM,CAAC,GAAG;EAC/F,MAAM;EACN;CACF,CAAC,GACc;EAOb,QAAQ,KAAK,uBAAuB,WAAW,MAAM,OAAO,gCAAgC;EAC5F,OAAO;GAAE,QAAQ;GAAU,QAAQ;EAAS;CAC9C;CAEA,IAAI;CACJ,IAAI;EAIF,MAAM,SAAS,MAAM,KAAK,GAAG,gBAAgB,YAAY;GACvD,MAAM,QAAQ,MAAM,MAAM,cAAc,WAAW;GACnD,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,yBAAyB,WAAW,GAAG,aAAa;GACtE,OAAO;EACT,CAAC;EAED,MAAM,KAAKC,0BAAAA,eAAe,QAAQ,QAAQ,SAAS;EACnD,UAAU,MAAMC,2BAAAA,WAAW,IAAI;GAC7B;GACA;GACA,eAAe;GAGf,aAAa,KAAK,IAAI,MAAM,aAAa,MAAM,OAAO,QAAQ,MAAM,MAAM,WAAW;GACrF;GACA,OAAO,IAAIC,oBAAAA,kBAAkB,OAAO,QAAQ,KAAK;GACjD;GACA;GACA,SAAS,MAAM;GACf,WAAW,MAAM;GACjB;EACF,CAAC;CACH,SAAS,OAAO;EAcd,MAAM,KAAK,GAAG,mBAAmB,YAAY;GAC3C,MAAM,MAAM,eAAe,YAAY,QAAQ;GAC/C,MAAM,MAAM,YAAY,UAAU;GAClC,MAAM,SAAS,QAAQ;EACzB,CAAC;EACD,MAAM;CACR;CAEA,MAAM,KAAK,GAAG,YAAY,YAAY;EACpC,MAAM,MAAM,eAAe,YAAY,QAAQ,MAAM;EACrD,MAAM,MAAM,YAAY,UAAU;EAClC,MAAM,SAAS,QAAQ,QAAQ,QAAQ,WAAW;CACpD,CAAC;CAED,OAAO;AACT"}

package/dist/host/execute.mjs

@@ -1,4 +1,6 @@
 import { JourneyFactSource } from "../store/facts.mjs";
+import { instanceOwner } from "../store/identity.mjs";
+import "../store/index.mjs";
 import { ingestEvent } from "./ingest.mjs";
 import { ContractValidationError, checkEvent } from "../contract.mjs";
 import { resolveRuntime } from "../runtime.mjs";
@@ -18,10 +20,11 @@ async function executeJourney(input, parts) {
 	const { workflowId, contentHash, userId } = params;
 	const { store, env, observer, contract } = parts;
 	const runtime = resolveRuntime({ current: parts.runtime }, "current");
-	const finished = (status, convertedAt) => observer?.finished?.({
+	const owner = () => instanceOwner(store, instanceId, userId);
+	const finished = async (status, convertedAt) => observer?.finished?.({
 		workflow: workflowId,
 		instanceId,
-		userId,
+		userId: await owner(),
 		status,
 		at: Date.now(),
 		...convertedAt === void 0 ? {} : { convertedAt }
@@ -36,12 +39,12 @@ async function executeJourney(input, parts) {
 		}
 		await ingestEvent(env, {
 			id,
-			userId,
+			userId: await owner(),
 			event: name,
 			payload: accepted
 		}, store);
 	} };
-	if (!await readWithRetry(() => store.admitInstance(instanceId, userId), {
+	if (!await readWithRetry(async () => store.admitInstance(instanceId, await owner()), {
 		what: "admission",
 		instanceId
 	})) {
@@ -62,9 +65,10 @@ async function executeJourney(input, parts) {
 		outcome = await runJourney(ir, {
 			userId,
 			instanceId,
-			enteredAtMs: input.enteredAtMs,
+			currentUserId: owner,
+			enteredAtMs: Math.min(input.enteredAtMs, input.params.trigger.ts ?? input.enteredAtMs),
 			step,
-			facts: new JourneyFactSource(store, userId),
+			facts: new JourneyFactSource(store, userId, owner),
 			messages,
 			events,
 			actions: parts.actions,

package/dist/host/execute.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"execute.mjs","names":[],"sources":["../../src/host/execute.ts"],"sourcesContent":["import { type Contract, ContractValidationError, checkEvent } from '../contract';\nimport { runJourney } from '../engine/interpreter';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  EventSink,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { scaleDurations } from '../engine/time-scale';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport { JourneyFactSource } from '../store/facts';\nimport type { JourneyStore } from '../store/index';\nimport { readWithRetry } from './fresh-read';\nimport { ingestEvent } from './ingest';\nimport type { JourneyEnv, JourneyParams } from './platform';\n\n/**\n * One journey instance run to its end, on whatever durable runtime supplies the `EngineStep`:\n * the runner admitted against the user's erasure tombstone, the IR loaded by the hash pinned at\n * entry, the outlets wired, the interpreter run, and the ledger finalized. Cloudflare's runner\n * and the Lambda handler both come through here; only their EngineStep differs.\n */\n\n/** Everything a run is wired to, assembled by the host. */\nexport interface JourneyRunParts {\n  store: JourneyStore;\n  /**\n   * The env the emitted events are ingested with: its `JOURNEY` starts and wakes instances on\n   * this runtime.\n   */\n  env: JourneyEnv;\n  runtime: JourneyRuntimeOptions;\n  messages: MessageSender;\n  actions: ActionInvoker;\n  contract?: Contract | undefined;\n  validator?: MessageValidator | undefined;\n  observer?: JourneyObserver | undefined;\n}\n\nexport interface JourneyRunInput {\n  instanceId: string;\n  params: JourneyParams;\n  /** When the trigger happened: replay-stable, never Date.now() at run time. */\n  enteredAtMs: number;\n  step: EngineStep;\n}\n\n/** Development aid: echo each outbound message before handing it to the real sender. */\nfunction logging(sender: MessageSender): MessageSender {\n  return {\n    async send(message) {\n      console.log(\n        `[journey] ${message.channel} ${message.template} → ${message.recipient ?? message.userId} ${JSON.stringify(message.props)}`\n      );\n      return sender.send(message);\n    },\n  };\n}\n\nexport async function executeJourney(\n  input: JourneyRunInput,\n  parts: JourneyRunParts\n): Promise<JourneyOutcome> {\n  const { instanceId, params, step } = input;\n  const { workflowId, contentHash, userId } = params;\n  const { store, env, observer, contract } = parts;\n\n  const runtime = resolveRuntime({ current: parts.runtime }, 'current');\n\n  const finished = (status: JourneyOutcome['status'] | 'failed', convertedAt?: number) =>\n    observer?.finished?.({\n      workflow: workflowId,\n      instanceId,\n      userId,\n      status,\n      at: Date.now(),\n      ...(convertedAt === undefined ? {} : { convertedAt }),\n    });\n\n  const messages = runtime.logMessages ? logging(parts.messages) : parts.messages;\n\n  // send_event feeds straight back into the router logic — an in-process call\n  // forming the event edge between workflows. The step's identity travels as\n  // the event id, so a retried emit records the occurrence once.\n  // An emitted event passes the same contract check as one arriving over HTTP.\n  const events: EventSink = {\n    emit: async (name, payload, id) => {\n      let accepted: Record<string, unknown> = payload;\n      if (contract !== undefined) {\n        const verdict = checkEvent(contract, name, payload);\n        if (!verdict.ok) throw new ContractValidationError(name, verdict.issues);\n        accepted = verdict.data;\n      }\n      await ingestEvent(env, { id, userId, event: name, payload: accepted }, store);\n    },\n  };\n\n  /*\n   * Admission: the ledger entry was committed before the runtime was asked to create this\n   * instance, so an erasure can land in between (the entry is not found by `get`, the erase\n   * goes through, and then the create lands). The runner is the only one who can refuse that\n   * late run, and it must do so before its first observable effect — `observer.started`, the\n   * IR read, any action or send.\n   *\n   * Outside any durable step, on purpose: a step would checkpoint the first invocation's\n   * \"admitted\" and replay it on every wake and every rebuild after an eviction, which is\n   * exactly when the tombstone may have arrived since. `admitInstance` is idempotent — the\n   * entry's `admitted_at` keeps its first value — so a replay re-admits the same instance, and\n   * the store makes the admission mutually exclusive with the erasure: either the entry is\n   * admitted first and the erasure finds it and stops it, or the tombstone commits first and\n   * this read answers false. Only the read itself is retried, briefly, when the database\n   * stumbled; one that keeps failing throws, so the instance errors without running anything,\n   * its entry stays, and the erasure protocol (or a later wake) decides what becomes of it.\n   */\n  const admitted = await readWithRetry(() => store.admitInstance(instanceId, userId), {\n    what: 'admission',\n    instanceId,\n  });\n  if (!admitted) {\n    /*\n     * No finalize either way: the entry is gone (erased, or never ours to run) or is being\n     * erased, and the finalize steps would write it back — a status on an entry the erasure\n     * deletes, a `finished` the reporting records as a new row of an erased user. The\n     * subscriptions, if any, go with the user's data.\n     */\n    console.warn(`[workflow] instance ${instanceId} of ${userId} refused admission: not running`);\n    return { status: 'exited', reason: 'erased' };\n  }\n\n  let outcome: JourneyOutcome;\n  try {\n    // In a step: a read that fails is retried like any other, and one that keeps failing ends\n    // the instance through the failure path below rather than leaving its entry 'running'.\n    // Content addressing makes the IR immutable, so the checkpointed copy is the one to replay\n    const stored = await step.do('$workflow:ir', async () => {\n      const found = await store.getWorkflowIR(contentHash);\n      if (found === undefined)\n        throw new Error(`WorkflowIR not found: ${workflowId}@${contentHash}`);\n      return found;\n    });\n    // Development runs the journey in fast-forward; the pinned hash still names the version.\n    const ir = scaleDurations(stored, runtime.timeScale);\n    outcome = await runJourney(ir, {\n      userId,\n      instanceId,\n      enteredAtMs: input.enteredAtMs,\n      step,\n      facts: new JourneyFactSource(store, userId),\n      messages,\n      events,\n      actions: parts.actions,\n      validator: parts.validator,\n      observer,\n    });\n  } catch (error) {\n    /*\n     * An error escaping run() ends the instance, and the ledger is the only\n     * place anyone looks afterwards: leaving it at 'running' meant a dead\n     * journey stayed indistinguishable from a waiting one, in the dashboard\n     * and in the once-policy, forever.\n     *\n     * Subscriptions go too, as on every ordinary ending: left behind, the\n     * rows would only make every later event of the user poke a dead\n     * instance (one wake call to the runtime each, refused every time).\n     *\n     * A paused instance never gets here: a durable wait suspends the run\n     * without throwing through it.\n     */\n    await step.do('finalize:failed', async () => {\n      await store.setEntryStatus(instanceId, 'failed');\n      await store.unsubscribe(instanceId);\n      await finished('failed');\n    });\n    throw error;\n  }\n\n  await step.do('finalize', async () => {\n    await store.setEntryStatus(instanceId, outcome.status);\n    await store.unsubscribe(instanceId);\n    await finished(outcome.status, outcome.convertedAt);\n  });\n\n  return outcome;\n}\n"],"mappings":";;;;;;;;;AAmDA,SAAS,QAAQ,QAAsC;CACrD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,QAAQ,IACN,aAAa,QAAQ,QAAQ,GAAG,QAAQ,SAAS,KAAK,QAAQ,aAAa,QAAQ,OAAO,GAAG,KAAK,UAAU,QAAQ,KAAK,GAC3H;EACA,OAAO,OAAO,KAAK,OAAO;CAC5B,EACF;AACF;AAEA,eAAsB,eACpB,OACA,OACyB;CACzB,MAAM,EAAE,YAAY,QAAQ,SAAS;CACrC,MAAM,EAAE,YAAY,aAAa,WAAW;CAC5C,MAAM,EAAE,OAAO,KAAK,UAAU,aAAa;CAE3C,MAAM,UAAU,eAAe,EAAE,SAAS,MAAM,QAAQ,GAAG,SAAS;CAEpE,MAAM,YAAY,QAA6C,gBAC7D,UAAU,WAAW;EACnB,UAAU;EACV;EACA;EACA;EACA,IAAI,KAAK,IAAI;EACb,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CACrD,CAAC;CAEH,MAAM,WAAW,QAAQ,cAAc,QAAQ,MAAM,QAAQ,IAAI,MAAM;CAMvE,MAAM,SAAoB,EACxB,MAAM,OAAO,MAAM,SAAS,OAAO;EACjC,IAAI,WAAoC;EACxC,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,UAAU,WAAW,UAAU,MAAM,OAAO;GAClD,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,wBAAwB,MAAM,QAAQ,MAAM;GACvE,WAAW,QAAQ;EACrB;EACA,MAAM,YAAY,KAAK;GAAE;GAAI;GAAQ,OAAO;GAAM,SAAS;EAAS,GAAG,KAAK;CAC9E,EACF;CAuBA,IAAI,CAAC,MAJkB,oBAAoB,MAAM,cAAc,YAAY,MAAM,GAAG;EAClF,MAAM;EACN;CACF,CAAC,GACc;EAOb,QAAQ,KAAK,uBAAuB,WAAW,MAAM,OAAO,gCAAgC;EAC5F,OAAO;GAAE,QAAQ;GAAU,QAAQ;EAAS;CAC9C;CAEA,IAAI;CACJ,IAAI;EAIF,MAAM,SAAS,MAAM,KAAK,GAAG,gBAAgB,YAAY;GACvD,MAAM,QAAQ,MAAM,MAAM,cAAc,WAAW;GACnD,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,yBAAyB,WAAW,GAAG,aAAa;GACtE,OAAO;EACT,CAAC;EAED,MAAM,KAAK,eAAe,QAAQ,QAAQ,SAAS;EACnD,UAAU,MAAM,WAAW,IAAI;GAC7B;GACA;GACA,aAAa,MAAM;GACnB;GACA,OAAO,IAAI,kBAAkB,OAAO,MAAM;GAC1C;GACA;GACA,SAAS,MAAM;GACf,WAAW,MAAM;GACjB;EACF,CAAC;CACH,SAAS,OAAO;EAcd,MAAM,KAAK,GAAG,mBAAmB,YAAY;GAC3C,MAAM,MAAM,eAAe,YAAY,QAAQ;GAC/C,MAAM,MAAM,YAAY,UAAU;GAClC,MAAM,SAAS,QAAQ;EACzB,CAAC;EACD,MAAM;CACR;CAEA,MAAM,KAAK,GAAG,YAAY,YAAY;EACpC,MAAM,MAAM,eAAe,YAAY,QAAQ,MAAM;EACrD,MAAM,MAAM,YAAY,UAAU;EAClC,MAAM,SAAS,QAAQ,QAAQ,QAAQ,WAAW;CACpD,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"execute.mjs","names":[],"sources":["../../src/host/execute.ts"],"sourcesContent":["import { type Contract, ContractValidationError, checkEvent } from '../contract';\nimport { runJourney } from '../engine/interpreter';\nimport type {\n  ActionInvoker,\n  EngineStep,\n  EventSink,\n  JourneyObserver,\n  JourneyOutcome,\n  MessageSender,\n  MessageValidator,\n} from '../engine/ports';\nimport { scaleDurations } from '../engine/time-scale';\nimport { type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport { JourneyFactSource } from '../store/facts';\nimport { type JourneyStore, instanceOwner } from '../store/index';\nimport { readWithRetry } from './fresh-read';\nimport { ingestEvent } from './ingest';\nimport type { JourneyEnv, JourneyParams } from './platform';\n\n/**\n * One journey instance run to its end, on whatever durable runtime supplies the `EngineStep`:\n * the runner admitted against the user's erasure tombstone, the IR loaded by the hash pinned at\n * entry, the outlets wired, the interpreter run, and the ledger finalized. Cloudflare's runner\n * and the Lambda handler both come through here; only their EngineStep differs.\n */\n\n/** Everything a run is wired to, assembled by the host. */\nexport interface JourneyRunParts {\n  store: JourneyStore;\n  /**\n   * The env the emitted events are ingested with: its `JOURNEY` starts and wakes instances on\n   * this runtime.\n   */\n  env: JourneyEnv;\n  runtime: JourneyRuntimeOptions;\n  messages: MessageSender;\n  actions: ActionInvoker;\n  contract?: Contract | undefined;\n  validator?: MessageValidator | undefined;\n  observer?: JourneyObserver | undefined;\n}\n\nexport interface JourneyRunInput {\n  instanceId: string;\n  params: JourneyParams;\n  /** When the trigger happened: replay-stable, never Date.now() at run time. */\n  enteredAtMs: number;\n  step: EngineStep;\n}\n\n/** Development aid: echo each outbound message before handing it to the real sender. */\nfunction logging(sender: MessageSender): MessageSender {\n  return {\n    async send(message) {\n      console.log(\n        `[journey] ${message.channel} ${message.template} → ${message.recipient ?? message.userId} ${JSON.stringify(message.props)}`\n      );\n      return sender.send(message);\n    },\n  };\n}\n\nexport async function executeJourney(\n  input: JourneyRunInput,\n  parts: JourneyRunParts\n): Promise<JourneyOutcome> {\n  const { instanceId, params, step } = input;\n  const { workflowId, contentHash, userId } = params;\n  const { store, env, observer, contract } = parts;\n\n  const runtime = resolveRuntime({ current: parts.runtime }, 'current');\n  const owner = () => instanceOwner(store, instanceId, userId);\n\n  const finished = async (status: JourneyOutcome['status'] | 'failed', convertedAt?: number) =>\n    observer?.finished?.({\n      workflow: workflowId,\n      instanceId,\n      userId: await owner(),\n      status,\n      at: Date.now(),\n      ...(convertedAt === undefined ? {} : { convertedAt }),\n    });\n\n  const messages = runtime.logMessages ? logging(parts.messages) : parts.messages;\n\n  // send_event feeds straight back into the router logic — an in-process call\n  // forming the event edge between workflows. The step's identity travels as\n  // the event id, so a retried emit records the occurrence once.\n  // An emitted event passes the same contract check as one arriving over HTTP.\n  const events: EventSink = {\n    emit: async (name, payload, id) => {\n      let accepted: Record<string, unknown> = payload;\n      if (contract !== undefined) {\n        const verdict = checkEvent(contract, name, payload);\n        if (!verdict.ok) throw new ContractValidationError(name, verdict.issues);\n        accepted = verdict.data;\n      }\n      await ingestEvent(env, { id, userId: await owner(), event: name, payload: accepted }, store);\n    },\n  };\n\n  /*\n   * Admission: the ledger entry was committed before the runtime was asked to create this\n   * instance, so an erasure can land in between (the entry is not found by `get`, the erase\n   * goes through, and then the create lands). The runner is the only one who can refuse that\n   * late run, and it must do so before its first observable effect — `observer.started`, the\n   * IR read, any action or send.\n   *\n   * Outside any durable step, on purpose: a step would checkpoint the first invocation's\n   * \"admitted\" and replay it on every wake and every rebuild after an eviction, which is\n   * exactly when the tombstone may have arrived since. `admitInstance` is idempotent — the\n   * entry's `admitted_at` keeps its first value — so a replay re-admits the same instance, and\n   * the store makes the admission mutually exclusive with the erasure: either the entry is\n   * admitted first and the erasure finds it and stops it, or the tombstone commits first and\n   * this read answers false. Only the read itself is retried, briefly, when the database\n   * stumbled; one that keeps failing throws, so the instance errors without running anything,\n   * its entry stays, and the erasure protocol (or a later wake) decides what becomes of it.\n   */\n  const admitted = await readWithRetry(async () => store.admitInstance(instanceId, await owner()), {\n    what: 'admission',\n    instanceId,\n  });\n  if (!admitted) {\n    /*\n     * No finalize either way: the entry is gone (erased, or never ours to run) or is being\n     * erased, and the finalize steps would write it back — a status on an entry the erasure\n     * deletes, a `finished` the reporting records as a new row of an erased user. The\n     * subscriptions, if any, go with the user's data.\n     */\n    console.warn(`[workflow] instance ${instanceId} of ${userId} refused admission: not running`);\n    return { status: 'exited', reason: 'erased' };\n  }\n\n  let outcome: JourneyOutcome;\n  try {\n    // In a step: a read that fails is retried like any other, and one that keeps failing ends\n    // the instance through the failure path below rather than leaving its entry 'running'.\n    // Content addressing makes the IR immutable, so the checkpointed copy is the one to replay\n    const stored = await step.do('$workflow:ir', async () => {\n      const found = await store.getWorkflowIR(contentHash);\n      if (found === undefined)\n        throw new Error(`WorkflowIR not found: ${workflowId}@${contentHash}`);\n      return found;\n    });\n    // Development runs the journey in fast-forward; the pinned hash still names the version.\n    const ir = scaleDurations(stored, runtime.timeScale);\n    outcome = await runJourney(ir, {\n      userId,\n      instanceId,\n      currentUserId: owner,\n      // A delivery that arrives late still enters when the trigger happened: a purchase made\n      // while the begin_checkout was being retried is the goal, not history from before entry\n      enteredAtMs: Math.min(input.enteredAtMs, input.params.trigger.ts ?? input.enteredAtMs),\n      step,\n      facts: new JourneyFactSource(store, userId, owner),\n      messages,\n      events,\n      actions: parts.actions,\n      validator: parts.validator,\n      observer,\n    });\n  } catch (error) {\n    /*\n     * An error escaping run() ends the instance, and the ledger is the only\n     * place anyone looks afterwards: leaving it at 'running' meant a dead\n     * journey stayed indistinguishable from a waiting one, in the dashboard\n     * and in the once-policy, forever.\n     *\n     * Subscriptions go too, as on every ordinary ending: left behind, the\n     * rows would only make every later event of the user poke a dead\n     * instance (one wake call to the runtime each, refused every time).\n     *\n     * A paused instance never gets here: a durable wait suspends the run\n     * without throwing through it.\n     */\n    await step.do('finalize:failed', async () => {\n      await store.setEntryStatus(instanceId, 'failed');\n      await store.unsubscribe(instanceId);\n      await finished('failed');\n    });\n    throw error;\n  }\n\n  await step.do('finalize', async () => {\n    await store.setEntryStatus(instanceId, outcome.status);\n    await store.unsubscribe(instanceId);\n    await finished(outcome.status, outcome.convertedAt);\n  });\n\n  return outcome;\n}\n"],"mappings":";;;;;;;;;;;AAmDA,SAAS,QAAQ,QAAsC;CACrD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,QAAQ,IACN,aAAa,QAAQ,QAAQ,GAAG,QAAQ,SAAS,KAAK,QAAQ,aAAa,QAAQ,OAAO,GAAG,KAAK,UAAU,QAAQ,KAAK,GAC3H;EACA,OAAO,OAAO,KAAK,OAAO;CAC5B,EACF;AACF;AAEA,eAAsB,eACpB,OACA,OACyB;CACzB,MAAM,EAAE,YAAY,QAAQ,SAAS;CACrC,MAAM,EAAE,YAAY,aAAa,WAAW;CAC5C,MAAM,EAAE,OAAO,KAAK,UAAU,aAAa;CAE3C,MAAM,UAAU,eAAe,EAAE,SAAS,MAAM,QAAQ,GAAG,SAAS;CACpE,MAAM,cAAc,cAAc,OAAO,YAAY,MAAM;CAE3D,MAAM,WAAW,OAAO,QAA6C,gBACnE,UAAU,WAAW;EACnB,UAAU;EACV;EACA,QAAQ,MAAM,MAAM;EACpB;EACA,IAAI,KAAK,IAAI;EACb,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CACrD,CAAC;CAEH,MAAM,WAAW,QAAQ,cAAc,QAAQ,MAAM,QAAQ,IAAI,MAAM;CAMvE,MAAM,SAAoB,EACxB,MAAM,OAAO,MAAM,SAAS,OAAO;EACjC,IAAI,WAAoC;EACxC,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,UAAU,WAAW,UAAU,MAAM,OAAO;GAClD,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,wBAAwB,MAAM,QAAQ,MAAM;GACvE,WAAW,QAAQ;EACrB;EACA,MAAM,YAAY,KAAK;GAAE;GAAI,QAAQ,MAAM,MAAM;GAAG,OAAO;GAAM,SAAS;EAAS,GAAG,KAAK;CAC7F,EACF;CAuBA,IAAI,CAAC,MAJkB,cAAc,YAAY,MAAM,cAAc,YAAY,MAAM,MAAM,CAAC,GAAG;EAC/F,MAAM;EACN;CACF,CAAC,GACc;EAOb,QAAQ,KAAK,uBAAuB,WAAW,MAAM,OAAO,gCAAgC;EAC5F,OAAO;GAAE,QAAQ;GAAU,QAAQ;EAAS;CAC9C;CAEA,IAAI;CACJ,IAAI;EAIF,MAAM,SAAS,MAAM,KAAK,GAAG,gBAAgB,YAAY;GACvD,MAAM,QAAQ,MAAM,MAAM,cAAc,WAAW;GACnD,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,yBAAyB,WAAW,GAAG,aAAa;GACtE,OAAO;EACT,CAAC;EAED,MAAM,KAAK,eAAe,QAAQ,QAAQ,SAAS;EACnD,UAAU,MAAM,WAAW,IAAI;GAC7B;GACA;GACA,eAAe;GAGf,aAAa,KAAK,IAAI,MAAM,aAAa,MAAM,OAAO,QAAQ,MAAM,MAAM,WAAW;GACrF;GACA,OAAO,IAAI,kBAAkB,OAAO,QAAQ,KAAK;GACjD;GACA;GACA,SAAS,MAAM;GACf,WAAW,MAAM;GACjB;EACF,CAAC;CACH,SAAS,OAAO;EAcd,MAAM,KAAK,GAAG,mBAAmB,YAAY;GAC3C,MAAM,MAAM,eAAe,YAAY,QAAQ;GAC/C,MAAM,MAAM,YAAY,UAAU;GAClC,MAAM,SAAS,QAAQ;EACzB,CAAC;EACD,MAAM;CACR;CAEA,MAAM,KAAK,GAAG,YAAY,YAAY;EACpC,MAAM,MAAM,eAAe,YAAY,QAAQ,MAAM;EACrD,MAAM,MAAM,YAAY,UAAU;EAClC,MAAM,SAAS,QAAQ,QAAQ,QAAQ,WAAW;CACpD,CAAC;CAED,OAAO;AACT"}

package/dist/host/http.cjs

@@ -2,11 +2,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_store_erasure = require("../store/erasure.cjs");
+const require_store_identity = require("../store/identity.cjs");
 const require_store_index = require("../store/index.cjs");
 const require_host_ingest = require("./ingest.cjs");
 const require_email = require("../email.cjs");
 const require_templates = require("../templates.cjs");
-const require_contract = require("../contract.cjs");
+const require_host_batch = require("./batch.cjs");
 const require_host_channels = require("./channels.cjs");
 const require_host_auth = require("./auth.cjs");
 let zod_mini = require("zod/mini");
@@ -35,41 +36,7 @@ async function readJson(request) {
 */
 async function readBody(request) {
 	const body = await readJson(request);
-	return isPlainObject(body) ? body : {};
-}
-function isPlainObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNonEmptyString(value) {
-	return typeof value === "string" && value.length > 0;
-}
-/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */
-function isScalarOrNull(value) {
-	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-}
-/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */
-const TS_FUTURE_TOLERANCE_MS = 3e5;
-const TS_ERROR = "ts must be a non-negative integer no later than 5 minutes in the future";
-/**
-* A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.
-* A far-future ts would put the event ahead of everything a window condition reads, and a
-* fractional or unsafe one does not survive the store.
-*/
-function isValidTs(ts) {
-	return typeof ts === "number" && Number.isSafeInteger(ts) && ts >= 0 && ts <= Date.now() + TS_FUTURE_TOLERANCE_MS;
-}
-/** The contract's verdict: the value to use, or the response refusing the request. */
-function checked(validation, result, original, what) {
-	if (result.ok) return { value: result.data };
-	const issues = result.issues.map((i) => `${i.path || "(root)"}: ${i.message}`);
-	if (validation.mode === "report") {
-		console.warn(`[workflow http] contract would refuse ${what}: ${issues.join("; ")}`);
-		return { value: original };
-	}
-	return { refused: json({
-		error: `${what} refused by the contract`,
-		issues: result.issues
-	}, 400) };
+	return require_host_batch.isPlainObject(body) ? body : {};
 }
 /**
 * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the
@@ -106,46 +73,18 @@ const routes = [
 	},
 	{
 		method: "POST",
-		path: "/events",
-		auth: "api",
-		async handle({ request, env, store, validation }) {
-			const { id, userId, event, payload, ts } = await readBody(request);
-			if (!isNonEmptyString(userId) || !isNonEmptyString(event)) return json({ error: "userId and event required" }, 400);
-			if (event.startsWith("$")) return json({ error: "event names starting with $ are reserved" }, 400);
-			if (id !== void 0 && !isNonEmptyString(id)) return json({ error: "id must be a non-empty string" }, 400);
-			if (ts !== void 0 && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);
-			if (payload !== void 0 && !isPlainObject(payload)) return json({ error: "payload must be an object" }, 400);
-			let accepted = payload;
-			if (validation.contract !== void 0) {
-				const verdict = checked(validation, require_contract.checkEvent(validation.contract, event, payload ?? {}), accepted ?? {}, `event '${event}'${typeof id === "string" ? ` (${id})` : ""}`);
-				if ("refused" in verdict) return verdict.refused;
-				accepted = verdict.value;
-			}
-			return json(await require_host_ingest.ingestEvent(env, {
-				id,
-				userId,
-				event,
-				payload: accepted,
-				ts
-			}, store));
-		}
-	},
-	{
-		method: "POST",
-		path: "/identify",
+		path: "/ingest",
 		auth: "api",
 		async handle({ request, env, store, validation }) {
-			const { userId, props } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
-			if (!isPlainObject(props)) return json({ error: "props must be an object" }, 400);
-			if (!Object.values(props).every(isScalarOrNull)) return json({ error: "props values must be scalars (string, number, boolean) or null" }, 400);
-			let patch = props;
-			if (validation.contract !== void 0) {
-				const verdict = checked(validation, validation.contract.parseProfilePatch(props), patch, "identify");
-				if ("refused" in verdict) return verdict.refused;
-				patch = verdict.value;
+			const parsed = require_host_batch.parseBatch(await readJson(request), validation);
+			if (!parsed.ok) {
+				const { error, issues } = parsed;
+				return json({
+					error,
+					...issues === void 0 ? {} : { issues }
+				}, 400);
 			}
-			return json(await require_host_ingest.identifyUser(env, userId, patch, store));
+			return json(await require_host_batch.ingestBatch(env, parsed.batch, store));
 		}
 	},
 	{
@@ -153,18 +92,19 @@ const routes = [
 		path: "/devices",
 		auth: "api",
 		async handle({ request, env, store }) {
-			const { userId, token, platform, ts } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
-			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
+			const { deviceId, userId, visitorId, token, platform } = await readBody(request);
+			const refused = require_host_batch.identityError(userId, visitorId);
+			if (refused !== void 0) return json({ error: refused }, 400);
+			if (deviceId !== void 0 && !require_host_batch.isNonEmptyString(deviceId)) return json({ error: "deviceId must be a non-empty string" }, 400);
+			if (!require_host_batch.isNonEmptyString(token)) return json({ error: "token required" }, 400);
 			if (platform !== "ios" && platform !== "android" && platform !== "web") return json({ error: "platform must be 'ios', 'android' or 'web'" }, 400);
-			if (ts !== void 0 && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);
-			const device = {
+			return json(await require_host_ingest.registerDevice(env, {
+				deviceId,
 				userId,
+				visitorId,
 				token,
-				platform,
-				...ts === void 0 ? {} : { ts }
-			};
-			return json(await require_host_ingest.registerDevice(env, device, store));
+				platform
+			}, store));
 		}
 	},
 	{
@@ -173,7 +113,7 @@ const routes = [
 		auth: "api",
 		async handle({ request, env, store }) {
 			const { token } = await readBody(request);
-			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
+			if (!require_host_batch.isNonEmptyString(token)) return json({ error: "token required" }, 400);
 			return json(await require_host_ingest.unbindDevice(env, token, store));
 		}
 	},
@@ -183,7 +123,7 @@ const routes = [
 		auth: "api",
 		async handle({ request, env, store }) {
 			const { token } = await readBody(request);
-			if (!isNonEmptyString(token)) return json({ error: "token required" }, 400);
+			if (!require_host_batch.isNonEmptyString(token)) return json({ error: "token required" }, 400);
 			return json(await require_host_ingest.removeDevice(env, token, store));
 		}
 	},
@@ -193,8 +133,8 @@ const routes = [
 		auth: "api",
 		async handle({ request, store }) {
 			const { userId, messageId } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
-			if (!isNonEmptyString(messageId)) return json({ error: "messageId required" }, 400);
+			if (!require_host_batch.isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
+			if (!require_host_batch.isNonEmptyString(messageId)) return json({ error: "messageId required" }, 400);
 			const recorded = await require_reporting_tracking.recordPushOpen(store.reporting, userId, messageId);
 			return json({
 				ok: true,
@@ -259,8 +199,9 @@ const routes = [
 		path: "/users/forget",
 		auth: "api",
 		async handle({ request, env, store }) {
-			const { userId } = await readBody(request);
-			if (!isNonEmptyString(userId)) return json({ error: "userId required" }, 400);
+			const { userId, visitorId } = await readBody(request);
+			if (require_host_batch.isNonEmptyString(visitorId)) return json(await require_host_ingest.forgetUser(env, require_store_identity.visitorSubject(visitorId), store));
+			if (!require_host_batch.isNonEmptyString(userId)) return json({ error: "userId or visitorId required" }, 400);
 			return json(await require_host_ingest.forgetUser(env, userId, store));
 		}
 	},
@@ -312,7 +253,7 @@ const routes = [
 			} catch {
 				return json({ error: "props must be a JSON object" }, 400);
 			}
-			if (!isPlainObject(props)) return json({ error: "props must be a JSON object" }, 400);
+			if (!require_host_batch.isPlainObject(props)) return json({ error: "props must be a JSON object" }, 400);
 			const { subject, html } = await preview.render(key, props, { messageId: require_email.PREVIEW_MESSAGE_ID });
 			return new Response(html, { headers: {
 				"content-type": "text/html; charset=utf-8",

package/dist/host/http.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"http.cjs","names":["handleTracking","checkEvent","ingestEvent","identifyUser","registerDevice","unbindDevice","removeDevice","recordPushOpen","getSubscriptions","parseSubscriptionsPatch","setSubscriptions","getSubscriptionsByMessage","setSubscriptionsByMessage","forgetUser","deployBundle","PREVIEW_MESSAGE_ID","journeyMode","authorized","z","BundleIntegrityError","TemplateValidationError","UserErasedError","SchemaMismatchError"],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport { type Contract, type ContractResult, checkEvent } from '../contract';\nimport { PREVIEW_MESSAGE_ID } from '../email';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  type ProfileProps,\n  SchemaMismatchError,\n  UserErasedError,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  getSubscriptions,\n  getSubscriptionsByMessage,\n  identifyUser,\n  ingestEvent,\n  parseSubscriptionsPatch,\n  registerDevice,\n  removeDevice,\n  setSubscriptions,\n  setSubscriptionsByMessage,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** The code version serving this request, recorded as live by `POST /bundle/deploy`. */\n  bundleVersion?: BundleVersion | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | 'PUT' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\n/** A profile value: a scalar or null (which removes the property). Nested values are not profile data. */\nfunction isScalarOrNull(value: unknown): value is string | number | boolean | null {\n  return (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  );\n}\n\n/** How far ahead of the server's clock an event or device `ts` may be: clock skew, not the future. */\nconst TS_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst TS_ERROR = 'ts must be a non-negative integer no later than 5 minutes in the future';\n\n/**\n * A caller's timestamp: epoch milliseconds, whole, not negative, and not past the skew tolerance.\n * A far-future ts would put the event ahead of everything a window condition reads, and a\n * fractional or unsafe one does not survive the store.\n */\nfunction isValidTs(ts: unknown): ts is number {\n  return (\n    typeof ts === 'number' &&\n    Number.isSafeInteger(ts) &&\n    ts >= 0 &&\n    ts <= Date.now() + TS_FUTURE_TOLERANCE_MS\n  );\n}\n\n/** The contract's verdict: the value to use, or the response refusing the request. */\nfunction checked<T>(\n  validation: IngestValidation,\n  result: ContractResult<T>,\n  original: T,\n  what: string\n): { value: T } | { refused: Response } {\n  if (result.ok) return { value: result.data };\n  const issues = result.issues.map((i) => `${i.path || '(root)'}: ${i.message}`);\n  if (validation.mode === 'report') {\n    console.warn(`[workflow http] contract would refuse ${what}: ${issues.join('; ')}`);\n    return { value: original };\n  }\n  return {\n    refused: json({ error: `${what} refused by the contract`, issues: result.issues }, 400),\n  };\n}\n\n/**\n * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the\n * contract's when the bare API runs without a host — never the caller's.\n */\nfunction declaredTopics(ctx: Pick<RouteContext, 'host' | 'validation'>): readonly string[] {\n  return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];\n}\n\nconst SUBSCRIPTIONS = /^\\/subscriptions\\/[^/]+$/;\nconst subscriptionsUser = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/'.length));\n/**\n * The same record, reached by one of the user's copies instead of their id: for the app's\n * preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The\n * message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still\n * guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.\n */\nconst SUBSCRIPTIONS_BY_MESSAGE = /^\\/subscriptions\\/by-message\\/[^/]+$/;\nconst subscriptionsMessage = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/by-message/'.length));\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/events',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { id, userId, event, payload, ts } = await readBody(request);\n      if (!isNonEmptyString(userId) || !isNonEmptyString(event)) {\n        return json({ error: 'userId and event required' }, 400);\n      }\n      if (event.startsWith('$')) {\n        return json({ error: 'event names starting with $ are reserved' }, 400);\n      }\n      // An empty id is rejected rather than treated as absent: a caller that\n      // sent one meant to identify the occurrence, and silently minting a\n      // different one would turn their retry into a duplicate.\n      if (id !== undefined && !isNonEmptyString(id)) {\n        return json({ error: 'id must be a non-empty string' }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      if (payload !== undefined && !isPlainObject(payload)) {\n        return json({ error: 'payload must be an object' }, 400);\n      }\n      let accepted = payload;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          checkEvent(validation.contract, event, payload ?? {}),\n          accepted ?? {},\n          `event '${event}'${typeof id === 'string' ? ` (${id})` : ''}`\n        );\n        if ('refused' in verdict) return verdict.refused;\n        accepted = verdict.value;\n      }\n      return json(await ingestEvent(env, { id, userId, event, payload: accepted, ts }, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/identify',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const { userId, props } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isPlainObject(props)) return json({ error: 'props must be an object' }, 400);\n      // Profiles hold scalars only (both stores merge at the top level; a nested object would\n      // be merged differently by each): refused here, contract or not\n      if (!Object.values(props).every(isScalarOrNull)) {\n        return json(\n          { error: 'props values must be scalars (string, number, boolean) or null' },\n          400\n        );\n      }\n      let patch = props as ProfileProps;\n      if (validation.contract !== undefined) {\n        const verdict = checked(\n          validation,\n          validation.contract.parseProfilePatch(props),\n          patch,\n          'identify'\n        );\n        if ('refused' in verdict) return verdict.refused;\n        patch = verdict.value as ProfileProps;\n      }\n      return json(await identifyUser(env, userId, patch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, token, platform, ts } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      if (ts !== undefined && !isValidTs(ts)) return json({ error: TS_ERROR }, 400);\n      const device = { userId, token, platform, ...(ts === undefined ? {} : { ts }) };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      return json(await getSubscriptions(ctx.store, userId, declaredTopics(ctx)));\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const found = await getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      const found = await setSubscriptionsByMessage(\n        ctx.env,\n        ctx.store,\n        messageId,\n        parsed.patch,\n        topics\n      );\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      // Forced, and recording the serving version: otherwise an older version still serving\n      // during a rollout would put its routes live while the row kept naming the newer one —\n      // which then never re-applies its own bundle\n      return json(await deployBundle(env, host.bundle(), store, host.bundleVersion, true));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      // A preview is no copy, but it shows the footer a sent one has: the preferences link\n      // renders with a placeholder message id\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>, {\n        messageId: PREVIEW_MESSAGE_ID,\n      });\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;;;;;AAkGA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAO,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;AAEA,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;;AAGA,SAAS,eAAe,OAA2D;CACjF,OACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AAErB;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,WAAW;;;;;;AAOjB,SAAS,UAAU,IAA2B;CAC5C,OACE,OAAO,OAAO,YACd,OAAO,cAAc,EAAE,KACvB,MAAM,KACN,MAAM,KAAK,IAAI,IAAI;AAEvB;;AAGA,SAAS,QACP,YACA,QACA,UACA,MACsC;CACtC,IAAI,OAAO,IAAI,OAAO,EAAE,OAAO,OAAO,KAAK;CAC3C,MAAM,SAAS,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,SAAS,IAAI,EAAE,SAAS;CAC7E,IAAI,WAAW,SAAS,UAAU;EAChC,QAAQ,KAAK,yCAAyC,KAAK,IAAI,OAAO,KAAK,IAAI,GAAG;EAClF,OAAO,EAAE,OAAO,SAAS;CAC3B;CACA,OAAO,EACL,SAAS,KAAK;EAAE,OAAO,GAAG,KAAK;EAA2B,QAAQ,OAAO;CAAO,GAAG,GAAG,EACxF;AACF;;;;;AAMA,SAAS,eAAe,KAAmE;CACzF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,eAAe,UAAU,IAAI,WAAW,UAAU,UAAU,CAAC;AAC1F;AAEA,MAAM,gBAAgB;AACtB,MAAM,qBAAqB,QACzB,mBAAmB,IAAI,SAAS,MAAM,EAAwB,CAAC;;;;;;;AAOjE,MAAM,2BAA2B;AACjC,MAAM,wBAAwB,QAC5B,mBAAmB,IAAI,SAAS,MAAM,EAAmC,CAAC;AAI5E,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAMA,2BAAAA,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,MAAM,SAAS,OAAO;GACjE,IAAI,CAAC,iBAAiB,MAAM,KAAK,CAAC,iBAAiB,KAAK,GACtD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,MAAM,WAAW,GAAG,GACtB,OAAO,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;GAKxE,IAAI,OAAO,KAAA,KAAa,CAAC,iBAAiB,EAAE,GAC1C,OAAO,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;GAE7D,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,IAAI,YAAY,KAAA,KAAa,CAAC,cAAc,OAAO,GACjD,OAAO,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;GAEzD,IAAI,WAAW;GACf,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACAC,iBAAAA,WAAW,WAAW,UAAU,OAAO,WAAW,CAAC,CAAC,GACpD,YAAY,CAAC,GACb,UAAU,MAAM,GAAG,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,IAC3D;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,WAAW,QAAQ;GACrB;GACA,OAAO,KAAK,MAAMC,oBAAAA,YAAY,KAAK;IAAE;IAAI;IAAQ;IAAO,SAAS;IAAU;GAAG,GAAG,KAAK,CAAC;EACzF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,EAAE,QAAQ,UAAU,MAAM,SAAS,OAAO;GAChD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;GAGhF,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,cAAc,GAC5C,OAAO,KACL,EAAE,OAAO,iEAAiE,GAC1E,GACF;GAEF,IAAI,QAAQ;GACZ,IAAI,WAAW,aAAa,KAAA,GAAW;IACrC,MAAM,UAAU,QACd,YACA,WAAW,SAAS,kBAAkB,KAAK,GAC3C,OACA,UACF;IACA,IAAI,aAAa,SAAS,OAAO,QAAQ;IACzC,QAAQ,QAAQ;GAClB;GACA,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,KAAK,CAAC;EAC3D;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,OAAO,UAAU,OAAO,MAAM,SAAS,OAAO;GAC9D,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAE1E,IAAI,OAAO,KAAA,KAAa,CAAC,UAAU,EAAE,GAAG,OAAO,KAAK,EAAE,OAAO,SAAS,GAAG,GAAG;GAC5E,MAAM,SAAS;IAAE;IAAQ;IAAO;IAAU,GAAI,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,GAAG;GAAG;GAC9E,OAAO,KAAK,MAAMC,oBAAAA,eAAe,KAAK,QAAQ,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAAC,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAMC,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,OAAO,QAAQ,eAAe,GAAG,CAAC,CAAC;EAC5E;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASC,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,OAAO,MAAM,CAAC;EACtF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,QAAQ,MAAMC,oBAAAA,0BAA0B,IAAI,OAAO,WAAW,eAAe,GAAG,CAAC;GACvF,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASF,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,MAAM,QAAQ,MAAMG,oBAAAA,0BAClB,IAAI,KACJ,IAAI,OACJ,WACA,OAAO,OACP,MACF;GACA,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;GACzC,IAAI,CAAC,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,OAAO,KAAK,MAAMC,oBAAAA,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAMC,oBAAAA,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAI/C,OAAO,KAAK,MAAMA,oBAAAA,aAAa,KAAK,KAAK,OAAO,GAAG,OAAO,KAAK,eAAe,IAAI,CAAC;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAGpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,OAAmC,EACrF,WAAWC,cAAAA,mBACb,CAAC;GAGD,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtBC,sBAAAA,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAOC,kBAAAA,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,oBAAAA,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,sBAAAA,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiBC,oBAAAA,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,YAAY,SAAS,KAAK,IAAI,QAAQ,GACxC,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}
+{"version":3,"file":"http.cjs","names":["isPlainObject","handleTracking","parseBatch","ingestBatch","identityError","isNonEmptyString","registerDevice","unbindDevice","removeDevice","recordPushOpen","getSubscriptions","parseSubscriptionsPatch","setSubscriptions","getSubscriptionsByMessage","setSubscriptionsByMessage","forgetUser","visitorSubject","deployBundle","PREVIEW_MESSAGE_ID","journeyMode","authorized","z","BundleIntegrityError","TemplateValidationError","UserErasedError","SchemaMismatchError"],"sources":["../../src/host/http.ts"],"sourcesContent":["import * as z from 'zod/mini';\nimport type { Contract } from '../contract';\nimport { PREVIEW_MESSAGE_ID } from '../email';\nimport type { EmailRenderer } from '../email-sender';\nimport type { BundleIR, ScalarIR } from '../ir';\nimport { type TrackingOptions, handleTracking, recordPushOpen } from '../reporting/tracking';\nimport {\n  type BundleVersion,\n  type JourneyStore,\n  SchemaMismatchError,\n  UserErasedError,\n  visitorSubject,\n} from '../store/index';\nimport { TemplateValidationError } from '../templates';\nimport { type Authorize, authorized } from './auth';\nimport { identityError, ingestBatch, isNonEmptyString, isPlainObject, parseBatch } from './batch';\nimport { journeyMode } from './channels';\nimport {\n  BundleIntegrityError,\n  type SweepResult,\n  deployBundle,\n  forgetUser,\n  getSubscriptions,\n  getSubscriptionsByMessage,\n  parseSubscriptionsPatch,\n  registerDevice,\n  removeDevice,\n  setSubscriptions,\n  setSubscriptionsByMessage,\n  unbindDevice,\n} from './ingest';\nimport type { JourneyEnv } from './platform';\n\n/**\n * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes\n * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A\n * route whose part is absent answers 404, so the two share the table, the bearer check, the\n * body validation and the error mapping.\n */\n\n/**\n * How the ingest API applies a contract: 'enforce' refuses an invalid event or\n * patch with a 400 before anything is stored, woken or started; 'report' logs\n * the issues (event id, name, field paths — never the payload) and accepts it,\n * for checking real producers before turning enforcement on.\n */\nexport interface IngestValidation {\n  contract?: Contract | undefined;\n  mode?: 'enforce' | 'report' | undefined;\n}\n\n/** What the full host serves beyond the ingest API. A route whose part is absent answers 404. */\nexport interface HostParts {\n  /** The bundle compiled into the code: `GET /bundle` shows it, `POST /bundle/deploy` makes it live. */\n  bundle?: (() => BundleIR) | undefined;\n  /** The code version serving this request, recorded as live by `POST /bundle/deploy`. */\n  bundleVersion?: BundleVersion | undefined;\n  /** `GET /preview/:id?props=<JSON>`: the email templates, rendered. */\n  preview?: { has(id: string): boolean; render: EmailRenderer } | undefined;\n  /** `/t/*`, what recipients open (no bearer): served on a store that keeps reporting. */\n  tracking?: TrackingOptions | undefined;\n  /** `POST /segments/sweep`. */\n  sweep?: (() => Promise<SweepResult>) | undefined;\n}\n\nexport interface ServeContext {\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation?: IngestValidation | undefined;\n  /**\n   * The host's parts. Their presence is what makes this a deployed host rather than the bare\n   * API: production then refuses to serve without `API_TOKEN` — unless the host authorizes\n   * callers itself (`authorize`).\n   */\n  host?: HostParts | undefined;\n  /** The host's own authorization for the API routes; the env's `API_TOKEN` bearer without one. */\n  authorize?: Authorize<JourneyEnv> | undefined;\n}\n\ninterface RouteContext {\n  request: Request;\n  url: URL;\n  env: JourneyEnv;\n  store: JourneyStore;\n  validation: IngestValidation;\n  host: HostParts;\n}\n\ninterface Route {\n  /** '*' takes every method (the tracking routes answer GET, HEAD and POST themselves). */\n  method: 'GET' | 'POST' | 'PUT' | '*';\n  path: string | RegExp | ((pathname: string) => boolean);\n  /** `api`: the caller must be authorized (the host's `authorize`, or the bearer); `none`: public. */\n  auth: 'none' | 'api';\n  handle(ctx: RouteContext): Promise<Response>;\n}\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nconst notFound = () => json({ error: 'not found' }, 404);\n\n/* --------------------------------- bodies ---------------------------------- */\n\n/** The request body is not JSON: the caller's to fix (a 400), not a server fault. */\nclass InvalidJsonError extends Error {\n  override readonly name = 'InvalidJsonError';\n}\n\nasync function readJson(request: Request): Promise<unknown> {\n  try {\n    return await request.json();\n  } catch (error) {\n    throw new InvalidJsonError('invalid JSON body', { cause: error });\n  }\n}\n\n/**\n * Request bodies are untrusted JSON. They are read as unknown fields and\n * checked, never cast into the shape they are supposed to have: a cast only\n * silences the compiler, and what arrives here reaches SQL parameters.\n */\nasync function readBody(request: Request): Promise<Record<string, unknown>> {\n  const body = await readJson(request);\n  return isPlainObject(body) ? body : {};\n}\n\n/**\n * The topics the engine knows: the deployed bundle's list (compiled from the contract), or the\n * contract's when the bare API runs without a host — never the caller's.\n */\nfunction declaredTopics(ctx: Pick<RouteContext, 'host' | 'validation'>): readonly string[] {\n  return ctx.host.bundle?.().subscriptions?.topics ?? ctx.validation.contract?.topics ?? [];\n}\n\nconst SUBSCRIPTIONS = /^\\/subscriptions\\/[^/]+$/;\nconst subscriptionsUser = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/'.length));\n/**\n * The same record, reached by one of the user's copies instead of their id: for the app's\n * preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The\n * message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still\n * guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.\n */\nconst SUBSCRIPTIONS_BY_MESSAGE = /^\\/subscriptions\\/by-message\\/[^/]+$/;\nconst subscriptionsMessage = (url: URL) =>\n  decodeURIComponent(url.pathname.slice('/subscriptions/by-message/'.length));\n\n/* --------------------------------- routes ---------------------------------- */\n\nconst routes: readonly Route[] = [\n  { method: 'GET', path: '/health', auth: 'none', handle: async () => json({ ok: true }) },\n  {\n    // Opened by recipients, so no bearer: the routes only record, and redirect to recorded URLs\n    method: '*',\n    path: /^\\/t\\//,\n    auth: 'none',\n    async handle({ request, store, host }) {\n      if (host.tracking === undefined) return notFound();\n      return (await handleTracking(request, store.reporting, host.tracking)) ?? notFound();\n    },\n  },\n  {\n    method: 'POST',\n    path: '/ingest',\n    auth: 'api',\n    async handle({ request, env, store, validation }) {\n      const parsed = parseBatch(await readJson(request), validation);\n      if (!parsed.ok) {\n        const { error, issues } = parsed;\n        return json({ error, ...(issues === undefined ? {} : { issues }) }, 400);\n      }\n      return json(await ingestBatch(env, parsed.batch, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { deviceId, userId, visitorId, token, platform } = await readBody(request);\n      const refused = identityError(userId, visitorId);\n      if (refused !== undefined) return json({ error: refused }, 400);\n      if (deviceId !== undefined && !isNonEmptyString(deviceId)) {\n        return json({ error: 'deviceId must be a non-empty string' }, 400);\n      }\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      if (platform !== 'ios' && platform !== 'android' && platform !== 'web') {\n        return json({ error: \"platform must be 'ios', 'android' or 'web'\" }, 400);\n      }\n      const device = {\n        deviceId,\n        userId: userId as string | undefined,\n        visitorId: visitorId as string | undefined,\n        token,\n        platform,\n      };\n      return json(await registerDevice(env, device, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/unbind',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await unbindDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/devices/remove',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { token } = await readBody(request);\n      if (!isNonEmptyString(token)) return json({ error: 'token required' }, 400);\n      return json(await removeDevice(env, token, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/messages/opened',\n    auth: 'api',\n    async handle({ request, store }) {\n      const { userId, messageId } = await readBody(request);\n      if (!isNonEmptyString(userId)) return json({ error: 'userId required' }, 400);\n      if (!isNonEmptyString(messageId)) return json({ error: 'messageId required' }, 400);\n      const recorded = await recordPushOpen(store.reporting, userId, messageId);\n      return json({ ok: true, recorded });\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      return json(await getSubscriptions(ctx.store, userId, declaredTopics(ctx)));\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS,\n    auth: 'api',\n    async handle(ctx) {\n      const userId = subscriptionsUser(ctx.url);\n      if (userId === '') return json({ error: 'userId required' }, 400);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      return json(await setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));\n    },\n  },\n  {\n    method: 'GET',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const found = await getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'PUT',\n    path: SUBSCRIPTIONS_BY_MESSAGE,\n    auth: 'api',\n    async handle(ctx) {\n      const messageId = subscriptionsMessage(ctx.url);\n      const topics = declaredTopics(ctx);\n      const parsed = parseSubscriptionsPatch(await readJson(ctx.request), topics);\n      if (!parsed.ok) return json({ error: 'subscriptions refused', issues: parsed.issues }, 400);\n      const found = await setSubscriptionsByMessage(\n        ctx.env,\n        ctx.store,\n        messageId,\n        parsed.patch,\n        topics\n      );\n      return found === undefined ? json({ error: 'unknown message' }, 404) : json(found);\n    },\n  },\n  {\n    method: 'POST',\n    path: '/users/forget',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      const { userId, visitorId } = await readBody(request);\n      if (isNonEmptyString(visitorId)) {\n        return json(await forgetUser(env, visitorSubject(visitorId), store));\n      }\n      if (!isNonEmptyString(userId)) return json({ error: 'userId or visitorId required' }, 400);\n      return json(await forgetUser(env, userId, store));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/deploy',\n    auth: 'api',\n    async handle({ request, env, store }) {\n      return json(await deployBundle(env, await readJson(request), store));\n    },\n  },\n  {\n    method: 'GET',\n    path: '/bundle',\n    auth: 'api',\n    async handle({ host }) {\n      return host.bundle === undefined ? notFound() : json(host.bundle());\n    },\n  },\n  {\n    method: 'POST',\n    path: '/bundle/deploy',\n    auth: 'api',\n    async handle({ env, store, host }) {\n      if (host.bundle === undefined) return notFound();\n      // Forced, and recording the serving version: otherwise an older version still serving\n      // during a rollout would put its routes live while the row kept naming the newer one —\n      // which then never re-applies its own bundle\n      return json(await deployBundle(env, host.bundle(), store, host.bundleVersion, true));\n    },\n  },\n  {\n    method: 'POST',\n    path: '/segments/sweep',\n    auth: 'api',\n    async handle({ host }) {\n      return host.sweep === undefined ? notFound() : json(await host.sweep());\n    },\n  },\n  {\n    method: 'GET',\n    path: /^\\/preview\\//,\n    auth: 'api',\n    async handle({ url, host }) {\n      const { preview } = host;\n      if (preview === undefined) return notFound();\n      const key = url.pathname.slice('/preview/'.length);\n      if (!preview.has(key)) return json({ error: `unknown email template: ${key}` }, 404);\n      // `?props=<JSON object>`: JSON keeps numbers and booleans typed, which query strings cannot\n      let props: unknown;\n      try {\n        props = JSON.parse(url.searchParams.get('props') ?? '{}');\n      } catch {\n        return json({ error: 'props must be a JSON object' }, 400);\n      }\n      if (!isPlainObject(props)) return json({ error: 'props must be a JSON object' }, 400);\n      // A preview is no copy, but it shows the footer a sent one has: the preferences link\n      // renders with a placeholder message id\n      const { subject, html } = await preview.render(key, props as Record<string, ScalarIR>, {\n        messageId: PREVIEW_MESSAGE_ID,\n      });\n      // A header holds bytes, not text: a subject with a non-Latin-1 character would throw\n      // here, so it travels percent-encoded (the reader `decodeURIComponent`s it)\n      return new Response(html, {\n        headers: {\n          'content-type': 'text/html; charset=utf-8',\n          'x-subject': encodeURIComponent(subject),\n        },\n      });\n    },\n  },\n];\n\nfunction matches(path: Route['path'], pathname: string): boolean {\n  if (typeof path === 'string') return path === pathname;\n  if (path instanceof RegExp) return path.test(pathname);\n  return path(pathname);\n}\n\n/**\n * Production without a bearer token (and no authorizer of the host's own) is not an open\n * instance, it is a mistake: anyone could ingest, identify and deploy. Only what recipients open\n * (`/t/*`) and the health check stay up.\n */\nfunction refusesOpen(request: Request, ctx: ServeContext, pathname: string): boolean {\n  return (\n    ctx.authorize === undefined &&\n    ctx.env.API_TOKEN === undefined &&\n    journeyMode(ctx.env) === 'production' &&\n    !pathname.startsWith('/t/') &&\n    !(request.method === 'GET' && pathname === '/health')\n  );\n}\n\n/**\n * Whether the caller may use an API route: the host's authorizer on a copy of the request (so a\n * body it verifies is still there for the route), or the env's `API_TOKEN` as a bearer. An\n * authorizer that throws is a failure, never an admission.\n */\nasync function allowed(request: Request, ctx: ServeContext): Promise<boolean> {\n  if (ctx.authorize === undefined) return authorized(request, ctx.env);\n  return ctx.authorize(request.clone(), ctx.env);\n}\n\n/**\n * What a failed request answers. Validation problems are the caller's to fix (a 400, saying\n * what); anything else stays out of the response body (internals are logged, not leaked).\n */\nfunction failure(error: unknown): Response {\n  if (error instanceof InvalidJsonError) return json({ error: 'invalid JSON body' }, 400);\n  if (error instanceof z.core.$ZodError) {\n    return json({ error: `invalid payload: ${error.message}` }, 400);\n  }\n  // The caller sent a self-inconsistent bundle: their problem to fix, so say what is wrong\n  if (error instanceof BundleIntegrityError) return json({ error: error.message }, 400);\n  // The query string is the props: a refusal is the caller's to fix, with the field paths\n  if (error instanceof TemplateValidationError) {\n    return json({ error: error.message, issues: error.issues }, 400);\n  }\n  // The user has an erasure tombstone: gone, and nothing about them is taken, now or later\n  if (error instanceof UserErasedError) return json({ error: 'user is erased' }, 410);\n  // The operator's to fix (run the migrations), so the response says what is missing\n  if (error instanceof SchemaMismatchError) {\n    return json({ error: error.message, problems: error.problems }, 503);\n  }\n  console.error('[workflow http]', error);\n  return json({ error: 'internal error' }, 500);\n}\n\n/** One request through the table: the production gate, the bearer, the route, the error mapping. */\nexport async function serve(request: Request, ctx: ServeContext): Promise<Response> {\n  const url = new URL(request.url);\n  if (refusesOpen(request, ctx, url.pathname)) {\n    return json(\n      {\n        error:\n          'API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)',\n      },\n      503\n    );\n  }\n  const candidates = routes.filter((route) => matches(route.path, url.pathname));\n  if (candidates.length === 0) return notFound();\n  // Every API route asks the authorizer; the health check and the recipients' routes never do.\n  // An unset token and no authorizer means an open dev instance (see JourneyEnv.API_TOKEN);\n  // production refuses to run that way\n  if (candidates.some((route) => route.auth === 'api')) {\n    let ok: boolean;\n    try {\n      ok = await allowed(request, ctx);\n    } catch (error) {\n      console.error('[workflow http] authorize failed', error);\n      return json({ error: 'internal error' }, 500);\n    }\n    if (!ok) return json({ error: 'unauthorized' }, 401);\n  }\n  const route = candidates.find((r) => r.method === '*' || r.method === request.method);\n  if (route === undefined) return json({ error: 'method not allowed' }, 405);\n  try {\n    return await route.handle({\n      request,\n      url,\n      env: ctx.env,\n      store: ctx.store,\n      validation: ctx.validation ?? {},\n      host: ctx.host ?? {},\n    });\n  } catch (error) {\n    return failure(error);\n  }\n}\n\n/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */\nexport function handleRequest(\n  request: Request,\n  env: JourneyEnv,\n  store: JourneyStore,\n  validation: IngestValidation = {}\n): Promise<Response> {\n  return serve(request, { env, store, validation });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiGA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AAEH,MAAM,iBAAiB,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;;AAKvD,IAAM,mBAAN,cAA+B,MAAM;CACnC,OAAyB;AAC3B;AAEA,eAAe,SAAS,SAAoC;CAC1D,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,SAAS,OAAO;EACd,MAAM,IAAI,iBAAiB,qBAAqB,EAAE,OAAO,MAAM,CAAC;CAClE;AACF;;;;;;AAOA,eAAe,SAAS,SAAoD;CAC1E,MAAM,OAAO,MAAM,SAAS,OAAO;CACnC,OAAOA,mBAAAA,cAAc,IAAI,IAAI,OAAO,CAAC;AACvC;;;;;AAMA,SAAS,eAAe,KAAmE;CACzF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,eAAe,UAAU,IAAI,WAAW,UAAU,UAAU,CAAC;AAC1F;AAEA,MAAM,gBAAgB;AACtB,MAAM,qBAAqB,QACzB,mBAAmB,IAAI,SAAS,MAAM,EAAwB,CAAC;;;;;;;AAOjE,MAAM,2BAA2B;AACjC,MAAM,wBAAwB,QAC5B,mBAAmB,IAAI,SAAS,MAAM,EAAmC,CAAC;AAI5E,MAAM,SAA2B;CAC/B;EAAE,QAAQ;EAAO,MAAM;EAAW,MAAM;EAAQ,QAAQ,YAAY,KAAK,EAAE,IAAI,KAAK,CAAC;CAAE;CACvF;EAEE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,OAAO,QAAQ;GACrC,IAAI,KAAK,aAAa,KAAA,GAAW,OAAO,SAAS;GACjD,OAAQ,MAAMC,2BAAAA,eAAe,SAAS,MAAM,WAAW,KAAK,QAAQ,KAAM,SAAS;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,OAAO,cAAc;GAChD,MAAM,SAASC,mBAAAA,WAAW,MAAM,SAAS,OAAO,GAAG,UAAU;GAC7D,IAAI,CAAC,OAAO,IAAI;IACd,MAAM,EAAE,OAAO,WAAW;IAC1B,OAAO,KAAK;KAAE;KAAO,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;IAAG,GAAG,GAAG;GACzE;GACA,OAAO,KAAK,MAAMC,mBAAAA,YAAY,KAAK,OAAO,OAAO,KAAK,CAAC;EACzD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,QAAQ,WAAW,OAAO,aAAa,MAAM,SAAS,OAAO;GAC/E,MAAM,UAAUC,mBAAAA,cAAc,QAAQ,SAAS;GAC/C,IAAI,YAAY,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;GAC9D,IAAI,aAAa,KAAA,KAAa,CAACC,mBAAAA,iBAAiB,QAAQ,GACtD,OAAO,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;GAEnE,IAAI,CAACA,mBAAAA,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,IAAI,aAAa,SAAS,aAAa,aAAa,aAAa,OAC/D,OAAO,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;GAS1E,OAAO,KAAK,MAAMC,oBAAAA,eAAe,KAAK;IANpC;IACQ;IACG;IACX;IACA;GAEyC,GAAG,KAAK,CAAC;EACtD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAACD,mBAAAA,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAME,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,UAAU,MAAM,SAAS,OAAO;GACxC,IAAI,CAACF,mBAAAA,iBAAiB,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAC1E,OAAO,KAAK,MAAMG,oBAAAA,aAAa,KAAK,OAAO,KAAK,CAAC;EACnD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,SAAS;GAC/B,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAI,CAACH,mBAAAA,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAC5E,IAAI,CAACA,mBAAAA,iBAAiB,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,MAAM,WAAW,MAAMI,2BAAAA,eAAe,MAAM,WAAW,QAAQ,SAAS;GACxE,OAAO,KAAK;IAAE,IAAI;IAAM;GAAS,CAAC;EACpC;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,OAAO,QAAQ,eAAe,GAAG,CAAC,CAAC;EAC5E;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,SAAS,kBAAkB,IAAI,GAAG;GACxC,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAChE,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASC,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,OAAO,KAAK,MAAMC,oBAAAA,iBAAiB,IAAI,KAAK,IAAI,OAAO,QAAQ,OAAO,OAAO,MAAM,CAAC;EACtF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,QAAQ,MAAMC,oBAAAA,0BAA0B,IAAI,OAAO,WAAW,eAAe,GAAG,CAAC;GACvF,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,KAAK;GAChB,MAAM,YAAY,qBAAqB,IAAI,GAAG;GAC9C,MAAM,SAAS,eAAe,GAAG;GACjC,MAAM,SAASF,oBAAAA,wBAAwB,MAAM,SAAS,IAAI,OAAO,GAAG,MAAM;GAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK;IAAE,OAAO;IAAyB,QAAQ,OAAO;GAAO,GAAG,GAAG;GAC1F,MAAM,QAAQ,MAAMG,oBAAAA,0BAClB,IAAI,KACJ,IAAI,OACJ,WACA,OAAO,OACP,MACF;GACA,OAAO,UAAU,KAAA,IAAY,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG,IAAI,KAAK,KAAK;EACnF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,MAAM,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO;GACpD,IAAIT,mBAAAA,iBAAiB,SAAS,GAC5B,OAAO,KAAK,MAAMU,oBAAAA,WAAW,KAAKC,uBAAAA,eAAe,SAAS,GAAG,KAAK,CAAC;GAErE,IAAI,CAACX,mBAAAA,iBAAiB,MAAM,GAAG,OAAO,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;GACzF,OAAO,KAAK,MAAMU,oBAAAA,WAAW,KAAK,QAAQ,KAAK,CAAC;EAClD;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,SAAS,KAAK,SAAS;GACpC,OAAO,KAAK,MAAME,oBAAAA,aAAa,KAAK,MAAM,SAAS,OAAO,GAAG,KAAK,CAAC;EACrE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,WAAW,KAAA,IAAY,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;EACpE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,OAAO,QAAQ;GACjC,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO,SAAS;GAI/C,OAAO,KAAK,MAAMA,oBAAAA,aAAa,KAAK,KAAK,OAAO,GAAG,OAAO,KAAK,eAAe,IAAI,CAAC;EACrF;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,QAAQ;GACrB,OAAO,KAAK,UAAU,KAAA,IAAY,SAAS,IAAI,KAAK,MAAM,KAAK,MAAM,CAAC;EACxE;CACF;CACA;EACE,QAAQ;EACR,MAAM;EACN,MAAM;EACN,MAAM,OAAO,EAAE,KAAK,QAAQ;GAC1B,MAAM,EAAE,YAAY;GACpB,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS;GAC3C,MAAM,MAAM,IAAI,SAAS,MAAM,CAAkB;GACjD,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,OAAO,KAAK,EAAE,OAAO,2BAA2B,MAAM,GAAG,GAAG;GAEnF,IAAI;GACJ,IAAI;IACF,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;GAC1D,QAAQ;IACN,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAC3D;GACA,IAAI,CAACjB,mBAAAA,cAAc,KAAK,GAAG,OAAO,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;GAGpF,MAAM,EAAE,SAAS,SAAS,MAAM,QAAQ,OAAO,KAAK,OAAmC,EACrF,WAAWkB,cAAAA,mBACb,CAAC;GAGD,OAAO,IAAI,SAAS,MAAM,EACxB,SAAS;IACP,gBAAgB;IAChB,aAAa,mBAAmB,OAAO;GACzC,EACF,CAAC;EACH;CACF;AACF;AAEA,SAAS,QAAQ,MAAqB,UAA2B;CAC/D,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS;CAC9C,IAAI,gBAAgB,QAAQ,OAAO,KAAK,KAAK,QAAQ;CACrD,OAAO,KAAK,QAAQ;AACtB;;;;;;AAOA,SAAS,YAAY,SAAkB,KAAmB,UAA2B;CACnF,OACE,IAAI,cAAc,KAAA,KAClB,IAAI,IAAI,cAAc,KAAA,KACtBC,sBAAAA,YAAY,IAAI,GAAG,MAAM,gBACzB,CAAC,SAAS,WAAW,KAAK,KAC1B,EAAE,QAAQ,WAAW,SAAS,aAAa;AAE/C;;;;;;AAOA,eAAe,QAAQ,SAAkB,KAAqC;CAC5E,IAAI,IAAI,cAAc,KAAA,GAAW,OAAOC,kBAAAA,WAAW,SAAS,IAAI,GAAG;CACnE,OAAO,IAAI,UAAU,QAAQ,MAAM,GAAG,IAAI,GAAG;AAC/C;;;;;AAMA,SAAS,QAAQ,OAA0B;CACzC,IAAI,iBAAiB,kBAAkB,OAAO,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;CACtF,IAAI,iBAAiBC,SAAE,KAAK,WAC1B,OAAO,KAAK,EAAE,OAAO,oBAAoB,MAAM,UAAU,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,oBAAAA,sBAAsB,OAAO,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,GAAG;CAEpF,IAAI,iBAAiBC,kBAAAA,yBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,QAAQ,MAAM;CAAO,GAAG,GAAG;CAGjE,IAAI,iBAAiBC,sBAAAA,iBAAiB,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAElF,IAAI,iBAAiBC,oBAAAA,qBACnB,OAAO,KAAK;EAAE,OAAO,MAAM;EAAS,UAAU,MAAM;CAAS,GAAG,GAAG;CAErE,QAAQ,MAAM,mBAAmB,KAAK;CACtC,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAC9C;;AAGA,eAAsB,MAAM,SAAkB,KAAsC;CAClF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,IAAI,YAAY,SAAS,KAAK,IAAI,QAAQ,GACxC,OAAO,KACL,EACE,OACE,yGACJ,GACA,GACF;CAEF,MAAM,aAAa,OAAO,QAAQ,UAAU,QAAQ,MAAM,MAAM,IAAI,QAAQ,CAAC;CAC7E,IAAI,WAAW,WAAW,GAAG,OAAO,SAAS;CAI7C,IAAI,WAAW,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG;EACpD,IAAI;EACJ,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,GAAG;EACjC,SAAS,OAAO;GACd,QAAQ,MAAM,oCAAoC,KAAK;GACvD,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;EAC9C;EACA,IAAI,CAAC,IAAI,OAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;CACrD;CACA,MAAM,QAAQ,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,WAAW,QAAQ,MAAM;CACpF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;CACzE,IAAI;EACF,OAAO,MAAM,MAAM,OAAO;GACxB;GACA;GACA,KAAK,IAAI;GACT,OAAO,IAAI;GACX,YAAY,IAAI,cAAc,CAAC;GAC/B,MAAM,IAAI,QAAQ,CAAC;EACrB,CAAC;CACH,SAAS,OAAO;EACd,OAAO,QAAQ,KAAK;CACtB;AACF;;AAGA,SAAgB,cACd,SACA,KACA,OACA,aAA+B,CAAC,GACb;CACnB,OAAO,MAAM,SAAS;EAAE;EAAK;EAAO;CAAW,CAAC;AAClD"}

package/dist/host/http.d.cts

@@ -3,9 +3,9 @@ import { Contract } from "../contract.cjs";
 import { BundleVersion, JourneyStore } from "../store/index.cjs";
 import { EmailRenderer } from "../email-sender.cjs";
 import { Authorize } from "./auth.cjs";
+import { TrackingOptions } from "../reporting/tracking.cjs";
 import { JourneyEnv } from "./platform.cjs";
 import { SweepResult } from "./ingest.cjs";
-import { TrackingOptions } from "../reporting/tracking.cjs";
 /**
  * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes
  * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A

package/dist/host/http.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.cts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA+CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBA8bF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}
+{"version":3,"file":"http.d.cts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA8CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBA+VF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}

package/dist/host/http.d.mts

@@ -3,9 +3,9 @@ import { Contract } from "../contract.mjs";
 import { BundleVersion, JourneyStore } from "../store/index.mjs";
 import { EmailRenderer } from "../email-sender.mjs";
 import { Authorize } from "./auth.mjs";
+import { TrackingOptions } from "../reporting/tracking.mjs";
 import { JourneyEnv } from "./platform.mjs";
 import { SweepResult } from "./ingest.mjs";
-import { TrackingOptions } from "../reporting/tracking.mjs";
 /**
  * The HTTP surface, as one route table: the bare ingest API (`handleRequest`) and the routes
  * the full host adds (`serve` with its parts — the bundle, previews, tracking, the sweep). A

package/dist/host/http.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.mts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA+CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBA8bF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}
+{"version":3,"file":"http.d.mts","names":[],"sources":["../../src/host/http.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBA8CiB;EACf,WAAW;EACX;;;iBAIe;;EAEf,gBAAgB;;EAEhB,gBAAgB;;EAEhB;IAAY,IAAI;IAAsB,QAAQ;;;EAE9C,WAAW;;EAEX,eAAe,QAAQ;;iBAGR;EACf,KAAK;EACL,OAAO;EACP,aAAa;;;;;;EAMb,OAAO;;EAEP,YAAY,UAAU;;;wBA+VF,MAAM,SAAS,SAAS,KAAK,eAAe,QAAQ;;wBA2C1D,cACd,SAAS,SACT,KAAK,YACL,OAAO,cACP,aAAY,mBACX,QAAQ"}