@shware/workflow 9.0.2 → 9.1.0

package/dist/ir.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ir.mjs","names":[],"sources":["../src/ir.ts"],"sourcesContent":["import * as z from 'zod/mini';\n\n/**\n * IR (Intermediate Representation) — what the DSL compiles to: serializable\n * JSON. It is the three-way contract between the engine that interprets it,\n * the UI (react-flow) that renders it, and diff / audit tooling.\n *\n * Validation strategy: the zod/mini schemas are the authoritative definition.\n * TS types are either inferred from a schema or hand-written under the same\n * name (zod cannot infer recursive types; the hand-written type is anchored\n * with a ZodMiniType<T> annotation, so any drift fails to compile). IR crosses\n * process boundaries (database, network, UI), so runtime validation is a must.\n *\n * ## Versioning (two independent axes)\n *\n * 1. IR format version (irVersion): evolution of the IR schema itself. Adding\n *    optional fields does not bump it; only structurally incompatible changes\n *    do (changing a discriminant, dropping a field, altering semantics).\n *    Readers dispatch on irVersion to the matching schema/migrator; writers\n *    always write the current version.\n * 2. Content version (contentHash): a content-addressed id for a single\n *    definition's **execution semantics** — the canonical-JSON hash after\n *    metadata (meta / label / reason) is stripped, see hash.ts. It is used to:\n *    - pin a version when a user enters, so an in-flight journey runs the\n *      pinned version to completion (the default policy; compatible hot\n *      updates are a future explicit-migration topic). Known exception:\n *      segment conditions are resolved **by id at evaluation time** — a\n *      segment redeploy changes behaviour of in-flight journeys that\n *      reference it. Pinning covers the workflow's own structure; per-hash\n *      segment snapshots are future work;\n *    - diff on deploy: same hash means unchanged, skip publishing;\n *    - audit: answer \"which version was this user on\" at any point.\n *\n * ## Node ids\n *\n * Derived from the structural path at compile time — stable and deterministic:\n * root level '0', '1', …; the j-th child of a branch's i-th case is\n * '{branchId}.c{i}.{j}', the default arm '{branchId}.o.{j}'; cohort arms use\n * the arm name '{cohortId}.{armName}.{j}'; a waitUntil timeout flow '{id}.t.{j}'.\n * Editing a node's parameters keeps its id; inserting a node shifts the ids of\n * its later siblings (a known trade-off — locating in-flight users relies on\n * the pinned version rather than cross-version id alignment, and cross-version\n * mapping is an explicit migrator's job).\n */\n\nexport const IR_VERSION = 2;\n\n/* -------------------------------- Base values ------------------------------- */\n\nexport const ScalarIR = z.union([z.string(), z.number(), z.boolean()]);\nexport type ScalarIR = z.infer<typeof ScalarIR>;\n\n/** Duration: `value` keeps the DSL literal ('23 hours', for display), `ms` is what the engine uses. */\n/*\n * TODO: `value` is hashed alongside `ms`, so '7 days' / '1 week' / '168 hours'\n * — identical to the engine, which only reads ms — produce three different\n * contentHashes. Rewording a duration therefore reports as a semantic change in\n * plan and repins in-flight users. Moving `value` out of the hash (it is a\n * display string) would fix it; deferred because it changes existing hashes.\n */\nexport const DurationIR = z.object({ value: z.string(), ms: z.number() });\nexport type DurationIR = z.infer<typeof DurationIR>;\n\n/** User-property reference — isomorphic to the DSL's UserPropertyRef once serialized (phantom type dropped). */\nexport const UserPropertyRefIR = z.object({\n  type: z.literal('user_property'),\n  path: z.string(),\n});\nexport type UserPropertyRefIR = z.infer<typeof UserPropertyRefIR>;\n\n/** A message prop / event payload value: either a literal or a user-property reference. */\nexport const PropValueIR = z.union([ScalarIR, UserPropertyRefIR]);\nexport type PropValueIR = z.infer<typeof PropValueIR>;\n\nexport const ChannelIR = z.enum(['email', 'sms', 'push', 'in_app', 'slack', 'discord', 'survey']);\nexport type ChannelIR = z.infer<typeof ChannelIR>;\n\nexport const WeekdayIR = z.enum(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']);\nexport type WeekdayIR = z.infer<typeof WeekdayIR>;\n\n/* --------------------------------- Provenance -------------------------------- */\n\n/**\n * Source location of the builder call that produced a definition — the IR's\n * source map. Lives under `meta`, so it is **excluded from contentHash**\n * (see hash.ts): provenance never affects execution identity or plan.\n * `file` is cwd-relative when compiled under Node, a URL under Vite dev.\n */\nexport const SourceLocIR = z.object({\n  file: z.string(),\n  line: z.number(),\n  column: z.number(),\n});\nexport type SourceLocIR = z.infer<typeof SourceLocIR>;\n\n/** Node-level metadata: provenance only, for now. Excluded from contentHash. */\nexport const NodeMetaIR = z.object({\n  loc: z.optional(SourceLocIR),\n});\nexport type NodeMetaIR = z.infer<typeof NodeMetaIR>;\n\n/* -------------------------------- Conditions -------------------------------- */\n\nexport const PropertyOperatorIR = z.enum([\n  'eq',\n  'ne',\n  'gt',\n  'gte',\n  'lt',\n  'lte',\n  'between',\n  'not_between',\n  'in_array',\n  'not_in_array',\n  'exists',\n  'not_exists',\n  'contains',\n  'not_contains',\n]);\nexport type PropertyOperatorIR = z.infer<typeof PropertyOperatorIR>;\n\n/**\n * Condition expression tree. The shape of value/values follows `op`:\n * eq/ne/gt/gte/lt/lte/contains/not_contains → value; in_array/not_in_array →\n * values; between/not_between → values = [min, max]; exists/not_exists → neither.\n *\n * `payload` predicates test the payload of an event (dotted paths reach nested\n * fields). They are only valid inside a `where` subtree — `performed.where`\n * and the event trigger's `where` — where an event row is in scope; the\n * compiler (compileBundle) and the evaluator both enforce the placement.\n * TODO: runtime refinement narrowing by op.\n */\n/**\n * Provenance rides on conditions too, so the studio can point at the exact\n * `eq(...)` / `and(...)` that produced a node — same rule as nodes: `meta` is\n * dropped before hashing, so carrying it never affects execution identity.\n */\ninterface ConditionBaseIR {\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type ConditionIR =\n  | (ConditionBaseIR & { type: 'and'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'or'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'not'; condition: ConditionIR })\n  /** Reference a segment by id (defined in SegmentIR, versioned separately). */\n  | (ConditionBaseIR & { type: 'segment'; segment: string })\n  | (ConditionBaseIR & {\n      type: 'property';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      /** Event payload predicate; `path` is dotted for nested fields ('tags.utm_source'). */\n      type: 'payload';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      type: 'performed';\n      event: string;\n      /** Payload filter: only events matching it count (a payload-only subtree). */\n      where?: ConditionIR | undefined;\n      within?: DurationIR | undefined;\n      count?: number | undefined;\n    })\n  /**\n   * The user can be reached on the channel right now: for push, the host's\n   * device directory lists at least one device; for the others, the channel's\n   * recipient property (email, phone, …) is set.\n   */\n  | (ConditionBaseIR & { type: 'reachable'; channel: ChannelIR });\n\nconst conditionBase = { meta: z.optional(NodeMetaIR) };\n\nexport const ConditionIR: z.ZodMiniType<ConditionIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({ ...conditionBase, type: z.literal('and'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('or'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('not'), condition: ConditionIR }),\n    z.object({ ...conditionBase, type: z.literal('segment'), segment: z.string() }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('property'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('payload'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('performed'),\n      event: z.string(),\n      where: z.optional(ConditionIR),\n      within: z.optional(DurationIR),\n      count: z.optional(z.number()),\n    }),\n    z.object({ ...conditionBase, type: z.literal('reachable'), channel: ChannelIR }),\n  ])\n);\n\n/* --------------------------------- Triggers --------------------------------- */\n\n/**\n * Trigger shapes. The event trigger has two independent gates: `where` tests\n * the triggering event's payload (payload-only subtree, evaluated against the\n * incoming event before anything else), `filter` tests the user's profile.\n */\nexport const TriggerIR = z.discriminatedUnion('type', [\n  z.object({\n    type: z.literal('event'),\n    event: z.string(),\n    where: z.optional(ConditionIR),\n    filter: z.optional(ConditionIR),\n    visitors: z.optional(z.literal(true)),\n  }),\n  z.object({ type: z.literal('segment'), segment: z.string() }),\n  z.object({ type: z.literal('date'), at: z.string() }),\n  z.object({ type: z.literal('webhook') }),\n]);\nexport type TriggerIR = z.infer<typeof TriggerIR>;\n\n/* ----------------------------------- Nodes ---------------------------------- */\n\ninterface NodeBaseIR {\n  /** Stable id derived from the structural path (rules in the file header). */\n  id: string;\n  /** Optional node name: UI title / observability handle (branch's optional first argument lands here). */\n  label?: string | undefined;\n  /** Metadata (provenance); excluded from contentHash. */\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type NodeIR =\n  | (NodeBaseIR & {\n      type: 'message';\n      channel: ChannelIR;\n      template: string;\n      props: Record<string, PropValueIR>;\n      /**\n       * Push only: which of the user's devices get a copy. Absent means every\n       * device the directory lists; 'latest' only the most recently registered.\n       */\n      devices?: 'latest' | undefined;\n      /**\n       * Email and push: the template's subscription topic, or null for a transactional message\n       * (sent whatever the user opted out of). Absent for other channels, and in IR compiled\n       * before topics existed: such a step checks the channel-level opt-out only, as it always did.\n       */\n      topic?: string | null | undefined;\n    })\n  | (NodeBaseIR & { type: 'delay'; duration: DurationIR })\n  | (NodeBaseIR & { type: 'random_delay'; min: DurationIR; max: DurationIR })\n  | (NodeBaseIR & {\n      type: 'time_window';\n      days: WeekdayIR[];\n      between: [string, string];\n      tz: string;\n    })\n  | (NodeBaseIR & {\n      type: 'wait_until';\n      condition: ConditionIR;\n      timeout: DurationIR;\n      onTimeout: 'continue' | 'exit' | NodeIR[];\n    })\n  | (NodeBaseIR & {\n      type: 'branch';\n      cases: { label?: string | undefined; condition: ConditionIR; flow: NodeIR[] }[];\n      /** Default arm (the DSL's bare tail argument). Absent = fall through to the main line. */\n      otherwise?: NodeIR[] | undefined;\n    })\n  | (NodeBaseIR & {\n      type: 'filter';\n      /** Audit-log line for the users this gate drops. Metadata: excluded from contentHash. */\n      reason?: string | undefined;\n      condition: ConditionIR;\n    })\n  | (NodeBaseIR & {\n      type: 'cohort';\n      /**\n       * Explicit experiment key: bucketing hashes `userId:key` instead of the\n       * structural node id, so the assignment survives node insertion/moves and\n       * the experiment keeps one identity across workflow versions. Absent →\n       * the node id is used (fine for one-off splits).\n       */\n      key?: string | undefined;\n      /**\n       * Arms in authoring order — the order the interpreter accumulates weights\n       * in, so it decides which bucket range each arm owns. The DSL keeps that\n       * promise by rejecting integer-like arm names, which JavaScript would\n       * hoist to the front of the object in numeric order. Weights sum to 100.\n       */\n      arms: { name: string; weight: number; flow: NodeIR[] }[];\n    })\n  | (NodeBaseIR & {\n      /** `reason` is the audit-log line. Metadata: excluded from contentHash. */\n      type: 'exit';\n      reason?: string | undefined;\n    })\n  | (NodeBaseIR & { type: 'send_event'; event: string; payload: Record<string, PropValueIR> })\n  | (NodeBaseIR & {\n      type: 'action';\n      /** Registry name of the custom action; the code itself lives in the deployed Worker bundle. */\n      action: string;\n      /** Argument values; user_property references are resolved at run time, like message props. */\n      args: Record<string, PropValueIR>;\n    });\n\nconst nodeBase = { id: z.string(), label: z.optional(z.string()), meta: z.optional(NodeMetaIR) };\n\nexport const NodeIR: z.ZodMiniType<NodeIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({\n      ...nodeBase,\n      type: z.literal('message'),\n      channel: ChannelIR,\n      template: z.string(),\n      props: z.record(z.string(), PropValueIR),\n      devices: z.optional(z.literal('latest')),\n      topic: z.optional(z.nullable(z.string())),\n    }),\n    z.object({ ...nodeBase, type: z.literal('delay'), duration: DurationIR }),\n    z.object({ ...nodeBase, type: z.literal('random_delay'), min: DurationIR, max: DurationIR }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('time_window'),\n      days: z.array(WeekdayIR),\n      between: z.tuple([z.string(), z.string()]),\n      tz: z.string(),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('wait_until'),\n      condition: ConditionIR,\n      timeout: DurationIR,\n      onTimeout: z.union([z.literal('continue'), z.literal('exit'), z.array(NodeIR)]),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('branch'),\n      cases: z.array(\n        z.object({\n          label: z.optional(z.string()),\n          condition: ConditionIR,\n          flow: z.array(NodeIR),\n        })\n      ),\n      otherwise: z.optional(z.array(NodeIR)),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('filter'),\n      condition: ConditionIR,\n      reason: z.optional(z.string()),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('cohort'),\n      key: z.optional(z.string()),\n      arms: z.array(z.object({ name: z.string(), weight: z.number(), flow: z.array(NodeIR) })),\n    }),\n    z.object({ ...nodeBase, type: z.literal('exit'), reason: z.optional(z.string()) }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('send_event'),\n      event: z.string(),\n      payload: z.record(z.string(), PropValueIR),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('action'),\n      action: z.string(),\n      args: z.record(z.string(), PropValueIR),\n    }),\n  ])\n);\n\n/* ---------------------- Top-level definitions and bundle --------------------- */\n\nexport const GoalIR = z.object({\n  condition: ConditionIR,\n  within: z.optional(DurationIR),\n  exitOnMatch: z.boolean(),\n});\nexport type GoalIR = z.infer<typeof GoalIR>;\n\n/**\n * Human-facing metadata: **excluded from contentHash** (see hash.ts).\n * Editing a name or description does not touch execution semantics, so it never\n * invalidates the version in-flight users are pinned to, nor shows up in plan.\n */\nexport const MetaIR = z.object({\n  /**\n   * Human label. The asset's `id` is its identity — a wire key that routing\n   * tables and the entry ledger are built on — so it is not something to\n   * rename for readability. This is: it is metadata, dropped before hashing,\n   * and the studio shows it in place of the key wherever it is set.\n   */\n  name: z.optional(z.string()),\n  description: z.optional(z.string()),\n  loc: z.optional(SourceLocIR),\n});\nexport type MetaIR = z.infer<typeof MetaIR>;\n\nexport const WorkflowIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`workflow({ id })`): routing tables, the entry ledger and reporting are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  meta: z.optional(MetaIR),\n  trigger: TriggerIR,\n  goal: z.optional(GoalIR),\n  exitWhen: z.optional(ConditionIR),\n  flow: z.array(NodeIR),\n});\nexport type WorkflowIR = z.infer<typeof WorkflowIR>;\n\nexport const SegmentIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`segment({ id })`): segment references and the membership store are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  /** Provenance plus the human label — MetaIR, same as a workflow's. */\n  meta: z.optional(MetaIR),\n  condition: ConditionIR,\n});\nexport type SegmentIR = z.infer<typeof SegmentIR>;\n\n/** Template manifest entry: IR records only the reference; the body lives in the template system. */\nexport const TemplateIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  key: z.string(),\n  channel: ChannelIR,\n});\nexport type TemplateIR = z.infer<typeof TemplateIR>;\n\n/**\n * Action manifest entry: IR records the name; the implementation solidifies\n * into the Worker bundle at deploy time, never into IR (custom code stays out\n * of the data plane by design).\n */\nexport const ActionIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  name: z.string(),\n});\nexport type ActionIR = z.infer<typeof ActionIR>;\n\n/**\n * Deployment unit: the complete snapshot one `deploy` produces (terraform\n * apply, same mental model). The server diffs each definition's contentHash to\n * decide publish / skip / retire.\n */\n/**\n * The subscription topics the contract declares, carried by the bundle so the engine validates\n * `/subscriptions` and the templates' topics against the deployed list, not the SDK's word.\n */\nexport const SubscriptionsIR = z.object({\n  topics: z.array(z.string()),\n});\nexport type SubscriptionsIR = z.infer<typeof SubscriptionsIR>;\n\nexport const BundleIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  workflows: z.array(WorkflowIR),\n  segments: z.array(SegmentIR),\n  templates: z.array(TemplateIR),\n  actions: z.array(ActionIR),\n  /** Absent in a bundle compiled before topics existed: no topics. */\n  subscriptions: z.optional(SubscriptionsIR),\n});\nexport type BundleIR = z.infer<typeof BundleIR>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,aAAa;AAI1B,MAAa,WAAW,EAAE,MAAM;CAAC,EAAE,OAAO;CAAG,EAAE,OAAO;CAAG,EAAE,QAAQ;AAAC,CAAC;;AAWrE,MAAa,aAAa,EAAE,OAAO;CAAE,OAAO,EAAE,OAAO;CAAG,IAAI,EAAE,OAAO;AAAE,CAAC;;AAIxE,MAAa,oBAAoB,EAAE,OAAO;CACxC,MAAM,EAAE,QAAQ,eAAe;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;AAID,MAAa,cAAc,EAAE,MAAM,CAAC,UAAU,iBAAiB,CAAC;AAGhE,MAAa,YAAY,EAAE,KAAK;CAAC;CAAS;CAAO;CAAQ;CAAU;CAAS;CAAW;AAAQ,CAAC;AAGhG,MAAa,YAAY,EAAE,KAAK;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK,CAAC;;;;;;;AAWjF,MAAa,cAAc,EAAE,OAAO;CAClC,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO,EACjC,KAAK,EAAE,SAAS,WAAW,EAC7B,CAAC;AAKD,MAAa,qBAAqB,EAAE,KAAK;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AA2DD,MAAM,gBAAgB,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE;AAErD,MAAa,cAA0C,EAAE,WACvD,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACvF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,IAAI;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACtF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,WAAW;CAAY,CAAC;CAC7E,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC9E,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,UAAU;EAC1B,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,WAAW;EAC3B,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,UAAU;EAC7B,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAC9B,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,WAAW;EAAG,SAAS;CAAU,CAAC;AACjF,CAAC,CACH;;;;;;AASA,MAAa,YAAY,EAAE,mBAAmB,QAAQ;CACpD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,WAAW;EAC9B,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC5D,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,IAAI,EAAE,OAAO;CAAE,CAAC;CACpD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AACzC,CAAC;AAyFD,MAAM,WAAW;CAAE,IAAI,EAAE,OAAO;CAAG,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAAG,MAAM,EAAE,SAAS,UAAU;AAAE;AAE/F,MAAa,SAAgC,EAAE,WAC7C,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS;EACT,UAAU,EAAE,OAAO;EACnB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;EACvC,SAAS,EAAE,SAAS,EAAE,QAAQ,QAAQ,CAAC;EACvC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;CAC1C,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,OAAO;EAAG,UAAU;CAAW,CAAC;CACxE,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,cAAc;EAAG,KAAK;EAAY,KAAK;CAAW,CAAC;CAC3F,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,EAAE,MAAM,SAAS;EACvB,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC;EACzC,IAAI,EAAE,OAAO;CACf,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,WAAW;EACX,SAAS;EACT,WAAW,EAAE,MAAM;GAAC,EAAE,QAAQ,UAAU;GAAG,EAAE,QAAQ,MAAM;GAAG,EAAE,MAAM,MAAM;EAAC,CAAC;CAChF,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,OAAO,EAAE,MACP,EAAE,OAAO;GACP,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;GAC5B,WAAW;GACX,MAAM,EAAE,MAAM,MAAM;EACtB,CAAC,CACH;EACA,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;CACvC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,WAAW;EACX,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;EAC1B,MAAM,EAAE,MAAM,EAAE,OAAO;GAAE,MAAM,EAAE,OAAO;GAAG,QAAQ,EAAE,OAAO;GAAG,MAAM,EAAE,MAAM,MAAM;EAAE,CAAC,CAAC;CACzF,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,MAAM;EAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAAE,CAAC;CACjF,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,OAAO,EAAE,OAAO;EAChB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CAC3C,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,QAAQ,EAAE,OAAO;EACjB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CACxC,CAAC;AACH,CAAC,CACH;AAIA,MAAa,SAAS,EAAE,OAAO;CAC7B,WAAW;CACX,QAAQ,EAAE,SAAS,UAAU;CAC7B,aAAa,EAAE,QAAQ;AACzB,CAAC;;;;;;AAQD,MAAa,SAAS,EAAE,OAAO;;;;;;;CAO7B,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;CAC3B,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC;CAClC,KAAK,EAAE,SAAS,WAAW;AAC7B,CAAC;AAGD,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;CACtB,MAAM,EAAE,SAAS,MAAM;CACvB,SAAS;CACT,MAAM,EAAE,SAAS,MAAM;CACvB,UAAU,EAAE,SAAS,WAAW;CAChC,MAAM,EAAE,MAAM,MAAM;AACtB,CAAC;AAGD,MAAa,YAAY,EAAE,OAAO;CAChC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;;CAEtB,MAAM,EAAE,SAAS,MAAM;CACvB,WAAW;AACb,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;CAC/B,KAAK,EAAE,OAAO;CACd,SAAS;AACX,CAAC;;;;;;AAQD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;;;;;;;;;AAYD,MAAa,kBAAkB,EAAE,OAAO,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAC5B,CAAC;AAGD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,WAAW,EAAE,MAAM,UAAU;CAC7B,UAAU,EAAE,MAAM,SAAS;CAC3B,WAAW,EAAE,MAAM,UAAU;CAC7B,SAAS,EAAE,MAAM,QAAQ;;CAEzB,eAAe,EAAE,SAAS,eAAe;AAC3C,CAAC"}
+{"version":3,"file":"ir.mjs","names":[],"sources":["../src/ir.ts"],"sourcesContent":["import * as z from 'zod/mini';\n\n/**\n * IR (Intermediate Representation) — what the DSL compiles to: serializable\n * JSON. It is the three-way contract between the engine that interprets it,\n * the UI (react-flow) that renders it, and diff / audit tooling.\n *\n * Validation strategy: the zod/mini schemas are the authoritative definition.\n * TS types are either inferred from a schema or hand-written under the same\n * name (zod cannot infer recursive types; the hand-written type is anchored\n * with a ZodMiniType<T> annotation, so any drift fails to compile). IR crosses\n * process boundaries (database, network, UI), so runtime validation is a must.\n *\n * ## Versioning (two independent axes)\n *\n * 1. IR format version (irVersion): evolution of the IR schema itself. Adding\n *    optional fields does not bump it; only structurally incompatible changes\n *    do (changing a discriminant, dropping a field, altering semantics).\n *    Readers dispatch on irVersion to the matching schema/migrator; writers\n *    always write the current version.\n * 2. Content version (contentHash): a content-addressed id for a single\n *    definition's **execution semantics** — the canonical-JSON hash after\n *    metadata (meta / label / reason) is stripped, see hash.ts. It is used to:\n *    - pin a version when a user enters, so an in-flight journey runs the\n *      pinned version to completion (the default policy; compatible hot\n *      updates are a future explicit-migration topic). Known exception:\n *      segment conditions are resolved **by id at evaluation time** — a\n *      segment redeploy changes behaviour of in-flight journeys that\n *      reference it. Pinning covers the workflow's own structure; per-hash\n *      segment snapshots are future work;\n *    - diff on deploy: same hash means unchanged, skip publishing;\n *    - audit: answer \"which version was this user on\" at any point.\n *\n * ## Node ids\n *\n * Derived from the structural path at compile time — stable and deterministic:\n * root level '0', '1', …; the j-th child of a branch's i-th case is\n * '{branchId}.c{i}.{j}', the default arm '{branchId}.o.{j}'; cohort arms use\n * the arm name '{cohortId}.{armName}.{j}'; a waitUntil timeout flow '{id}.t.{j}'.\n * Editing a node's parameters keeps its id; inserting a node shifts the ids of\n * its later siblings (a known trade-off — locating in-flight users relies on\n * the pinned version rather than cross-version id alignment, and cross-version\n * mapping is an explicit migrator's job).\n */\n\nexport const IR_VERSION = 2;\n\n/* -------------------------------- Base values ------------------------------- */\n\nexport const ScalarIR = z.union([z.string(), z.number(), z.boolean()]);\nexport type ScalarIR = z.infer<typeof ScalarIR>;\n\n/** Duration: `value` keeps the DSL literal ('23 hours', for display), `ms` is what the engine uses. */\n/*\n * TODO: `value` is hashed alongside `ms`, so '7 days' / '1 week' / '168 hours'\n * — identical to the engine, which only reads ms — produce three different\n * contentHashes. Rewording a duration therefore reports as a semantic change in\n * plan and repins in-flight users. Moving `value` out of the hash (it is a\n * display string) would fix it; deferred because it changes existing hashes.\n */\nexport const DurationIR = z.object({ value: z.string(), ms: z.number() });\nexport type DurationIR = z.infer<typeof DurationIR>;\n\n/** User-property reference — isomorphic to the DSL's UserPropertyRef once serialized (phantom type dropped). */\nexport const UserPropertyRefIR = z.object({\n  type: z.literal('user_property'),\n  path: z.string(),\n});\nexport type UserPropertyRefIR = z.infer<typeof UserPropertyRefIR>;\n\n/** A message prop / event payload value: either a literal or a user-property reference. */\nexport const PropValueIR = z.union([ScalarIR, UserPropertyRefIR]);\nexport type PropValueIR = z.infer<typeof PropValueIR>;\n\nexport const ChannelIR = z.enum(['email', 'sms', 'push', 'in_app', 'slack', 'discord', 'survey']);\nexport type ChannelIR = z.infer<typeof ChannelIR>;\n\nexport const WeekdayIR = z.enum(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']);\nexport type WeekdayIR = z.infer<typeof WeekdayIR>;\n\n/* --------------------------------- Provenance -------------------------------- */\n\n/**\n * Source location of the builder call that produced a definition — the IR's\n * source map. Lives under `meta`, so it is **excluded from contentHash**\n * (see hash.ts): provenance never affects execution identity or plan.\n * `file` is cwd-relative when compiled under Node, a URL under Vite dev.\n */\nexport const SourceLocIR = z.object({\n  file: z.string(),\n  line: z.number(),\n  column: z.number(),\n});\nexport type SourceLocIR = z.infer<typeof SourceLocIR>;\n\n/** Node-level metadata: provenance only, for now. Excluded from contentHash. */\nexport const NodeMetaIR = z.object({\n  loc: z.optional(SourceLocIR),\n});\nexport type NodeMetaIR = z.infer<typeof NodeMetaIR>;\n\n/* -------------------------------- Conditions -------------------------------- */\n\nexport const PropertyOperatorIR = z.enum([\n  'eq',\n  'ne',\n  'gt',\n  'gte',\n  'lt',\n  'lte',\n  'between',\n  'not_between',\n  'in_array',\n  'not_in_array',\n  'exists',\n  'not_exists',\n  'contains',\n  'not_contains',\n]);\nexport type PropertyOperatorIR = z.infer<typeof PropertyOperatorIR>;\n\n/**\n * Condition expression tree. The shape of value/values follows `op`:\n * eq/ne/gt/gte/lt/lte/contains/not_contains → value; in_array/not_in_array →\n * values; between/not_between → values = [min, max]; exists/not_exists → neither.\n *\n * `payload` predicates test the payload of an event (dotted paths reach nested\n * fields). They are only valid inside a `where` subtree — `performed.where`\n * and the event trigger's `where` — where an event row is in scope; the\n * compiler (compileBundle) and the evaluator both enforce the placement.\n * TODO: runtime refinement narrowing by op.\n */\n/**\n * Provenance rides on conditions too, so the studio can point at the exact\n * `eq(...)` / `and(...)` that produced a node — same rule as nodes: `meta` is\n * dropped before hashing, so carrying it never affects execution identity.\n */\ninterface ConditionBaseIR {\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type ConditionIR =\n  | (ConditionBaseIR & { type: 'and'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'or'; conditions: ConditionIR[] })\n  | (ConditionBaseIR & { type: 'not'; condition: ConditionIR })\n  /** Reference a segment by id (defined in SegmentIR, versioned separately). */\n  | (ConditionBaseIR & { type: 'segment'; segment: string })\n  | (ConditionBaseIR & {\n      type: 'property';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      /** Event payload predicate; `path` is dotted for nested fields ('tags.utm_source'). */\n      type: 'payload';\n      path: string;\n      op: PropertyOperatorIR;\n      value?: ScalarIR | undefined;\n      values?: ScalarIR[] | undefined;\n    })\n  | (ConditionBaseIR & {\n      type: 'performed';\n      event: string;\n      /** Payload filter: only events matching it count (a payload-only subtree). */\n      where?: ConditionIR | undefined;\n      within?: DurationIR | undefined;\n      count?: number | undefined;\n    })\n  /**\n   * The user can be reached on the channel right now: for push, the host's\n   * device directory lists at least one device; for the others, the channel's\n   * recipient property (email, phone, …) is set.\n   */\n  | (ConditionBaseIR & { type: 'reachable'; channel: ChannelIR });\n\nconst conditionBase = { meta: z.optional(NodeMetaIR) };\n\nexport const ConditionIR: z.ZodMiniType<ConditionIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({ ...conditionBase, type: z.literal('and'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('or'), conditions: z.array(ConditionIR) }),\n    z.object({ ...conditionBase, type: z.literal('not'), condition: ConditionIR }),\n    z.object({ ...conditionBase, type: z.literal('segment'), segment: z.string() }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('property'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('payload'),\n      path: z.string(),\n      op: PropertyOperatorIR,\n      value: z.optional(ScalarIR),\n      values: z.optional(z.array(ScalarIR)),\n    }),\n    z.object({\n      ...conditionBase,\n      type: z.literal('performed'),\n      event: z.string(),\n      where: z.optional(ConditionIR),\n      within: z.optional(DurationIR),\n      count: z.optional(z.number()),\n    }),\n    z.object({ ...conditionBase, type: z.literal('reachable'), channel: ChannelIR }),\n  ])\n);\n\n/* --------------------------------- Triggers --------------------------------- */\n\n/**\n * Trigger shapes. The event trigger has two independent gates: `where` tests\n * the triggering event's payload (payload-only subtree, evaluated against the\n * incoming event before anything else), `filter` tests the user's profile.\n */\nexport const TriggerIR = z.discriminatedUnion('type', [\n  z.object({\n    type: z.literal('event'),\n    event: z.string(),\n    where: z.optional(ConditionIR),\n    filter: z.optional(ConditionIR),\n    visitors: z.optional(z.literal(true)),\n  }),\n  z.object({ type: z.literal('segment'), segment: z.string() }),\n  z.object({ type: z.literal('date'), at: z.string() }),\n  z.object({ type: z.literal('webhook') }),\n]);\nexport type TriggerIR = z.infer<typeof TriggerIR>;\n\n/* ----------------------------------- Nodes ---------------------------------- */\n\ninterface NodeBaseIR {\n  /** Stable id derived from the structural path (rules in the file header). */\n  id: string;\n  /** Optional node name: UI title / observability handle (branch's optional first argument lands here). */\n  label?: string | undefined;\n  /** Metadata (provenance); excluded from contentHash. */\n  meta?: NodeMetaIR | undefined;\n}\n\nexport type NodeIR =\n  | (NodeBaseIR & {\n      type: 'message';\n      channel: ChannelIR;\n      template: string;\n      props: Record<string, PropValueIR>;\n      /**\n       * Push only: which of the user's devices get a copy. Absent means every\n       * device the directory lists; 'latest' only the most recently registered.\n       */\n      devices?: 'latest' | undefined;\n      /**\n       * Email and push: the template's subscription topic, or null for a transactional message\n       * (sent whatever the user opted out of). Absent for other channels, and in IR compiled\n       * before topics existed: such a step checks the channel-level opt-out only, as it always did.\n       */\n      topic?: string | null | undefined;\n      /**\n       * The template opted into at-least-once: a replayed send step sends a copy an earlier run\n       * claimed but never settled again. Absent (the default, 'skip') the copy is not sent again\n       * — kept absent rather than written as 'skip', so adding the option changed no node hash.\n       */\n      redelivery?: 'resend' | undefined;\n    })\n  | (NodeBaseIR & { type: 'delay'; duration: DurationIR })\n  | (NodeBaseIR & { type: 'random_delay'; min: DurationIR; max: DurationIR })\n  | (NodeBaseIR & {\n      type: 'time_window';\n      days: WeekdayIR[];\n      between: [string, string];\n      tz: string;\n    })\n  | (NodeBaseIR & {\n      type: 'wait_until';\n      condition: ConditionIR;\n      timeout: DurationIR;\n      onTimeout: 'continue' | 'exit' | NodeIR[];\n    })\n  | (NodeBaseIR & {\n      type: 'branch';\n      cases: { label?: string | undefined; condition: ConditionIR; flow: NodeIR[] }[];\n      /** Default arm (the DSL's bare tail argument). Absent = fall through to the main line. */\n      otherwise?: NodeIR[] | undefined;\n    })\n  | (NodeBaseIR & {\n      type: 'filter';\n      /** Audit-log line for the users this gate drops. Metadata: excluded from contentHash. */\n      reason?: string | undefined;\n      condition: ConditionIR;\n    })\n  | (NodeBaseIR & {\n      type: 'cohort';\n      /**\n       * Explicit experiment key: bucketing hashes `userId:key` instead of the\n       * structural node id, so the assignment survives node insertion/moves and\n       * the experiment keeps one identity across workflow versions. Absent →\n       * the node id is used (fine for one-off splits).\n       */\n      key?: string | undefined;\n      /**\n       * Arms in authoring order — the order the interpreter accumulates weights\n       * in, so it decides which bucket range each arm owns. The DSL keeps that\n       * promise by rejecting integer-like arm names, which JavaScript would\n       * hoist to the front of the object in numeric order. Weights sum to 100.\n       */\n      arms: { name: string; weight: number; flow: NodeIR[] }[];\n    })\n  | (NodeBaseIR & {\n      /** `reason` is the audit-log line. Metadata: excluded from contentHash. */\n      type: 'exit';\n      reason?: string | undefined;\n    })\n  | (NodeBaseIR & { type: 'send_event'; event: string; payload: Record<string, PropValueIR> })\n  | (NodeBaseIR & {\n      type: 'action';\n      /** Registry name of the custom action; the code itself lives in the deployed Worker bundle. */\n      action: string;\n      /** Argument values; user_property references are resolved at run time, like message props. */\n      args: Record<string, PropValueIR>;\n    });\n\nconst nodeBase = { id: z.string(), label: z.optional(z.string()), meta: z.optional(NodeMetaIR) };\n\nexport const NodeIR: z.ZodMiniType<NodeIR> = z.lazy(() =>\n  z.discriminatedUnion('type', [\n    z.object({\n      ...nodeBase,\n      type: z.literal('message'),\n      channel: ChannelIR,\n      template: z.string(),\n      props: z.record(z.string(), PropValueIR),\n      devices: z.optional(z.literal('latest')),\n      topic: z.optional(z.nullable(z.string())),\n      redelivery: z.optional(z.literal('resend')),\n    }),\n    z.object({ ...nodeBase, type: z.literal('delay'), duration: DurationIR }),\n    z.object({ ...nodeBase, type: z.literal('random_delay'), min: DurationIR, max: DurationIR }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('time_window'),\n      days: z.array(WeekdayIR),\n      between: z.tuple([z.string(), z.string()]),\n      tz: z.string(),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('wait_until'),\n      condition: ConditionIR,\n      timeout: DurationIR,\n      onTimeout: z.union([z.literal('continue'), z.literal('exit'), z.array(NodeIR)]),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('branch'),\n      cases: z.array(\n        z.object({\n          label: z.optional(z.string()),\n          condition: ConditionIR,\n          flow: z.array(NodeIR),\n        })\n      ),\n      otherwise: z.optional(z.array(NodeIR)),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('filter'),\n      condition: ConditionIR,\n      reason: z.optional(z.string()),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('cohort'),\n      key: z.optional(z.string()),\n      arms: z.array(z.object({ name: z.string(), weight: z.number(), flow: z.array(NodeIR) })),\n    }),\n    z.object({ ...nodeBase, type: z.literal('exit'), reason: z.optional(z.string()) }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('send_event'),\n      event: z.string(),\n      payload: z.record(z.string(), PropValueIR),\n    }),\n    z.object({\n      ...nodeBase,\n      type: z.literal('action'),\n      action: z.string(),\n      args: z.record(z.string(), PropValueIR),\n    }),\n  ])\n);\n\n/* ---------------------- Top-level definitions and bundle --------------------- */\n\nexport const GoalIR = z.object({\n  condition: ConditionIR,\n  within: z.optional(DurationIR),\n  exitOnMatch: z.boolean(),\n});\nexport type GoalIR = z.infer<typeof GoalIR>;\n\n/**\n * Human-facing metadata: **excluded from contentHash** (see hash.ts).\n * Editing a name or description does not touch execution semantics, so it never\n * invalidates the version in-flight users are pinned to, nor shows up in plan.\n */\nexport const MetaIR = z.object({\n  /**\n   * Human label. The asset's `id` is its identity — a wire key that routing\n   * tables and the entry ledger are built on — so it is not something to\n   * rename for readability. This is: it is metadata, dropped before hashing,\n   * and the studio shows it in place of the key wherever it is set.\n   */\n  name: z.optional(z.string()),\n  description: z.optional(z.string()),\n  loc: z.optional(SourceLocIR),\n});\nexport type MetaIR = z.infer<typeof MetaIR>;\n\nexport const WorkflowIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`workflow({ id })`): routing tables, the entry ledger and reporting are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  meta: z.optional(MetaIR),\n  trigger: TriggerIR,\n  goal: z.optional(GoalIR),\n  exitWhen: z.optional(ConditionIR),\n  flow: z.array(NodeIR),\n});\nexport type WorkflowIR = z.infer<typeof WorkflowIR>;\n\nexport const SegmentIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  /** Wire identity (`segment({ id })`): segment references and the membership store are keyed on it. */\n  id: z.string(),\n  contentHash: z.string(),\n  /** Provenance plus the human label — MetaIR, same as a workflow's. */\n  meta: z.optional(MetaIR),\n  condition: ConditionIR,\n});\nexport type SegmentIR = z.infer<typeof SegmentIR>;\n\n/** Template manifest entry: IR records only the reference; the body lives in the template system. */\nexport const TemplateIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  key: z.string(),\n  channel: ChannelIR,\n});\nexport type TemplateIR = z.infer<typeof TemplateIR>;\n\n/**\n * Action manifest entry: IR records the name; the implementation solidifies\n * into the Worker bundle at deploy time, never into IR (custom code stays out\n * of the data plane by design).\n */\nexport const ActionIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  name: z.string(),\n});\nexport type ActionIR = z.infer<typeof ActionIR>;\n\n/**\n * Deployment unit: the complete snapshot one `deploy` produces (terraform\n * apply, same mental model). The server diffs each definition's contentHash to\n * decide publish / skip / retire.\n */\n/**\n * The subscription topics the contract declares, carried by the bundle so the engine validates\n * `/subscriptions` and the templates' topics against the deployed list, not the SDK's word.\n */\nexport const SubscriptionsIR = z.object({\n  topics: z.array(z.string()),\n});\nexport type SubscriptionsIR = z.infer<typeof SubscriptionsIR>;\n\nexport const BundleIR = z.object({\n  irVersion: z.literal(IR_VERSION),\n  workflows: z.array(WorkflowIR),\n  segments: z.array(SegmentIR),\n  templates: z.array(TemplateIR),\n  actions: z.array(ActionIR),\n  /** Absent in a bundle compiled before topics existed: no topics. */\n  subscriptions: z.optional(SubscriptionsIR),\n});\nexport type BundleIR = z.infer<typeof BundleIR>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,aAAa;AAI1B,MAAa,WAAW,EAAE,MAAM;CAAC,EAAE,OAAO;CAAG,EAAE,OAAO;CAAG,EAAE,QAAQ;AAAC,CAAC;;AAWrE,MAAa,aAAa,EAAE,OAAO;CAAE,OAAO,EAAE,OAAO;CAAG,IAAI,EAAE,OAAO;AAAE,CAAC;;AAIxE,MAAa,oBAAoB,EAAE,OAAO;CACxC,MAAM,EAAE,QAAQ,eAAe;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;AAID,MAAa,cAAc,EAAE,MAAM,CAAC,UAAU,iBAAiB,CAAC;AAGhE,MAAa,YAAY,EAAE,KAAK;CAAC;CAAS;CAAO;CAAQ;CAAU;CAAS;CAAW;AAAQ,CAAC;AAGhG,MAAa,YAAY,EAAE,KAAK;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK,CAAC;;;;;;;AAWjF,MAAa,cAAc,EAAE,OAAO;CAClC,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO,EACjC,KAAK,EAAE,SAAS,WAAW,EAC7B,CAAC;AAKD,MAAa,qBAAqB,EAAE,KAAK;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AA2DD,MAAM,gBAAgB,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE;AAErD,MAAa,cAA0C,EAAE,WACvD,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACvF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,IAAI;EAAG,YAAY,EAAE,MAAM,WAAW;CAAE,CAAC;CACtF,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,KAAK;EAAG,WAAW;CAAY,CAAC;CAC7E,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC9E,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,UAAU;EAC1B,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,MAAM,EAAE,OAAO;EACf,IAAI;EACJ,OAAO,EAAE,SAAS,QAAQ;EAC1B,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,WAAW;EAC3B,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,UAAU;EAC7B,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAC9B,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAe,MAAM,EAAE,QAAQ,WAAW;EAAG,SAAS;CAAU,CAAC;AACjF,CAAC,CACH;;;;;;AASA,MAAa,YAAY,EAAE,mBAAmB,QAAQ;CACpD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,SAAS,WAAW;EAC7B,QAAQ,EAAE,SAAS,WAAW;EAC9B,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;CACtC,CAAC;CACD,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,SAAS;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC;CAC5D,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,IAAI,EAAE,OAAO;CAAE,CAAC;CACpD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AACzC,CAAC;AA+FD,MAAM,WAAW;CAAE,IAAI,EAAE,OAAO;CAAG,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAAG,MAAM,EAAE,SAAS,UAAU;AAAE;AAE/F,MAAa,SAAgC,EAAE,WAC7C,EAAE,mBAAmB,QAAQ;CAC3B,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS;EACT,UAAU,EAAE,OAAO;EACnB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;EACvC,SAAS,EAAE,SAAS,EAAE,QAAQ,QAAQ,CAAC;EACvC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;EACxC,YAAY,EAAE,SAAS,EAAE,QAAQ,QAAQ,CAAC;CAC5C,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,OAAO;EAAG,UAAU;CAAW,CAAC;CACxE,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,cAAc;EAAG,KAAK;EAAY,KAAK;CAAW,CAAC;CAC3F,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,aAAa;EAC7B,MAAM,EAAE,MAAM,SAAS;EACvB,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC;EACzC,IAAI,EAAE,OAAO;CACf,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,WAAW;EACX,SAAS;EACT,WAAW,EAAE,MAAM;GAAC,EAAE,QAAQ,UAAU;GAAG,EAAE,QAAQ,MAAM;GAAG,EAAE,MAAM,MAAM;EAAC,CAAC;CAChF,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,OAAO,EAAE,MACP,EAAE,OAAO;GACP,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;GAC5B,WAAW;GACX,MAAM,EAAE,MAAM,MAAM;EACtB,CAAC,CACH;EACA,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;CACvC,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,WAAW;EACX,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;EAC1B,MAAM,EAAE,MAAM,EAAE,OAAO;GAAE,MAAM,EAAE,OAAO;GAAG,QAAQ,EAAE,OAAO;GAAG,MAAM,EAAE,MAAM,MAAM;EAAE,CAAC,CAAC;CACzF,CAAC;CACD,EAAE,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,QAAQ,MAAM;EAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAAE,CAAC;CACjF,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,YAAY;EAC5B,OAAO,EAAE,OAAO;EAChB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CAC3C,CAAC;CACD,EAAE,OAAO;EACP,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,QAAQ,EAAE,OAAO;EACjB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;CACxC,CAAC;AACH,CAAC,CACH;AAIA,MAAa,SAAS,EAAE,OAAO;CAC7B,WAAW;CACX,QAAQ,EAAE,SAAS,UAAU;CAC7B,aAAa,EAAE,QAAQ;AACzB,CAAC;;;;;;AAQD,MAAa,SAAS,EAAE,OAAO;;;;;;;CAO7B,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;CAC3B,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC;CAClC,KAAK,EAAE,SAAS,WAAW;AAC7B,CAAC;AAGD,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;CACtB,MAAM,EAAE,SAAS,MAAM;CACvB,SAAS;CACT,MAAM,EAAE,SAAS,MAAM;CACvB,UAAU,EAAE,SAAS,WAAW;CAChC,MAAM,EAAE,MAAM,MAAM;AACtB,CAAC;AAGD,MAAa,YAAY,EAAE,OAAO;CAChC,WAAW,EAAE,QAAA,CAAkB;;CAE/B,IAAI,EAAE,OAAO;CACb,aAAa,EAAE,OAAO;;CAEtB,MAAM,EAAE,SAAS,MAAM;CACvB,WAAW;AACb,CAAC;;AAID,MAAa,aAAa,EAAE,OAAO;CACjC,WAAW,EAAE,QAAA,CAAkB;CAC/B,KAAK,EAAE,OAAO;CACd,SAAS;AACX,CAAC;;;;;;AAQD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,MAAM,EAAE,OAAO;AACjB,CAAC;;;;;;;;;;AAYD,MAAa,kBAAkB,EAAE,OAAO,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAC5B,CAAC;AAGD,MAAa,WAAW,EAAE,OAAO;CAC/B,WAAW,EAAE,QAAA,CAAkB;CAC/B,WAAW,EAAE,MAAM,UAAU;CAC7B,UAAU,EAAE,MAAM,SAAS;CAC3B,WAAW,EAAE,MAAM,UAAU;CAC7B,SAAS,EAAE,MAAM,QAAQ;;CAEzB,eAAe,EAAE,SAAS,eAAe;AAC3C,CAAC"}

package/dist/reporting/observer.cjs

@@ -19,6 +19,8 @@ function reportingObserver(reporting, origin) {
 		started: (event) => reporting.instanceStarted(event),
 		nodeReached: (event) => reporting.nodeReached(event),
 		messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),
+		messageClaimed: (message) => reporting.claimMessage(message.idempotencyKey, Date.now()),
+		messageReleased: (message) => reporting.releaseMessage(message.idempotencyKey),
 		async messagePrepared(message) {
 			const id = await reporting.recordMessage({
 				idempotencyKey: message.idempotencyKey,

package/dist/reporting/observer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"observer.cjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,iBAAiB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE5E,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}
+{"version":3,"file":"observer.cjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),\n\n    messageClaimed: (message) => reporting.claimMessage(message.idempotencyKey, Date.now()),\n\n    messageReleased: (message) => reporting.releaseMessage(message.idempotencyKey),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,iBAAiB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE5E,iBAAiB,YAAY,UAAU,aAAa,QAAQ,gBAAgB,KAAK,IAAI,CAAC;EAEtF,kBAAkB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE7E,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}

package/dist/reporting/observer.mjs

@@ -18,6 +18,8 @@ function reportingObserver(reporting, origin) {
 		started: (event) => reporting.instanceStarted(event),
 		nodeReached: (event) => reporting.nodeReached(event),
 		messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),
+		messageClaimed: (message) => reporting.claimMessage(message.idempotencyKey, Date.now()),
+		messageReleased: (message) => reporting.releaseMessage(message.idempotencyKey),
 		async messagePrepared(message) {
 			const id = await reporting.recordMessage({
 				idempotencyKey: message.idempotencyKey,

package/dist/reporting/observer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"observer.mjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,iBAAiB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE5E,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}
+{"version":3,"file":"observer.mjs","names":[],"sources":["../../src/reporting/observer.ts"],"sourcesContent":["import type { JourneyObserver, OutboundMessage } from '../engine';\nimport type { JourneyReporting } from '../store';\n\n/**\n * The observer journeyWorker installs when the store keeps reporting: every node arrival, copy\n * and outcome recorded through `store.reporting`.\n *\n * A copy is recorded before it goes out, so its id can travel with it: with a tracking origin,\n * an email's links become `<origin>/t/l/<message>/<position>` — `/t/u/...` for its unsubscribe\n * link, so what a click means is fixed when it is sent — and an open pixel `<origin>/t/o/<message>`\n * (served by the Worker, ./tracking.ts); the renderer gets the id too, for the email's\n * preferences link (`email.preferencesUrl?m=<message>`), and a push carries\n * `message_id` in its payload for the app to report the tap (`JourneyClient.messageOpened`),\n * plus `delivered_url` / `opened_url` for a client that reports straight to the Worker.\n * The links are recorded when the sender commits the rewritten email, before it goes out.\n */\nexport function reportingObserver(\n  reporting: JourneyReporting,\n  origin: string | undefined\n): JourneyObserver {\n  const base = origin?.replace(/\\/$/, '');\n\n  return {\n    started: (event) => reporting.instanceStarted(event),\n\n    nodeReached: (event) => reporting.nodeReached(event),\n\n    messageSettled: (message) => reporting.messageSettled(message.idempotencyKey),\n\n    messageClaimed: (message) => reporting.claimMessage(message.idempotencyKey, Date.now()),\n\n    messageReleased: (message) => reporting.releaseMessage(message.idempotencyKey),\n\n    async messagePrepared(message) {\n      const id = await reporting.recordMessage({\n        idempotencyKey: message.idempotencyKey,\n        workflow: message.workflow,\n        instanceId: message.instanceId,\n        nodeId: message.nodeId,\n        template: message.template,\n        channel: channelOf(message),\n        userId: message.userId,\n        topic:\n          message.channel === 'email' || message.channel === 'push'\n            ? (message.topic ?? null)\n            : null,\n        sentAt: Date.now(),\n      });\n      if (message.channel === 'email' && base !== undefined) {\n        const urls: string[] = [];\n        return {\n          messageId: id,\n          link: (url, purpose) => {\n            urls.push(url);\n            return `${base}/t/${purpose === 'unsubscribe' ? 'u' : 'l'}/${id}/${urls.length - 1}`;\n          },\n          pixel: `${base}/t/o/${id}`,\n          unsubscribe: `${base}/t/u/${id}`,\n          // Before the transport takes it, so no click can reach a link not yet recorded\n          commit: () => reporting.recordLinks(id, urls),\n        };\n      }\n      if (message.channel === 'push') {\n        // The app reports the tap with `message_id`; a client that can reach the Worker on its\n        // own (iOS's notification service extension, a browser's service worker) posts to these\n        return {\n          data: {\n            message_id: id,\n            ...(base === undefined\n              ? {}\n              : { delivered_url: `${base}/t/d/${id}`, opened_url: `${base}/t/p/${id}` }),\n          },\n        };\n      }\n      return undefined;\n    },\n\n    async messageSent(message, result) {\n      await reporting.settleMessage(message.idempotencyKey, result, Date.now());\n    },\n\n    finished: (event) => reporting.instanceFinished(event),\n  };\n}\n\n/** Where the copy lands — the Studio's metric channel: a push is reported per platform. */\nfunction channelOf(message: OutboundMessage): string {\n  if (message.channel !== 'push') return message.channel;\n  return `push_${message.device?.platform ?? 'unknown'}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,SAAgB,kBACd,WACA,QACiB;CACjB,MAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;CAEtC,OAAO;EACL,UAAU,UAAU,UAAU,gBAAgB,KAAK;EAEnD,cAAc,UAAU,UAAU,YAAY,KAAK;EAEnD,iBAAiB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE5E,iBAAiB,YAAY,UAAU,aAAa,QAAQ,gBAAgB,KAAK,IAAI,CAAC;EAEtF,kBAAkB,YAAY,UAAU,eAAe,QAAQ,cAAc;EAE7E,MAAM,gBAAgB,SAAS;GAC7B,MAAM,KAAK,MAAM,UAAU,cAAc;IACvC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,SAAS,UAAU,OAAO;IAC1B,QAAQ,QAAQ;IAChB,OACE,QAAQ,YAAY,WAAW,QAAQ,YAAY,SAC9C,QAAQ,SAAS,OAClB;IACN,QAAQ,KAAK,IAAI;GACnB,CAAC;GACD,IAAI,QAAQ,YAAY,WAAW,SAAS,KAAA,GAAW;IACrD,MAAM,OAAiB,CAAC;IACxB,OAAO;KACL,WAAW;KACX,OAAO,KAAK,YAAY;MACtB,KAAK,KAAK,GAAG;MACb,OAAO,GAAG,KAAK,KAAK,YAAY,gBAAgB,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,SAAS;KACnF;KACA,OAAO,GAAG,KAAK,OAAO;KACtB,aAAa,GAAG,KAAK,OAAO;KAE5B,cAAc,UAAU,YAAY,IAAI,IAAI;IAC9C;GACF;GACA,IAAI,QAAQ,YAAY,QAGtB,OAAO,EACL,MAAM;IACJ,YAAY;IACZ,GAAI,SAAS,KAAA,IACT,CAAC,IACD;KAAE,eAAe,GAAG,KAAK,OAAO;KAAM,YAAY,GAAG,KAAK,OAAO;IAAK;GAC5E,EACF;EAGJ;EAEA,MAAM,YAAY,SAAS,QAAQ;GACjC,MAAM,UAAU,cAAc,QAAQ,gBAAgB,QAAQ,KAAK,IAAI,CAAC;EAC1E;EAEA,WAAW,UAAU,UAAU,iBAAiB,KAAK;CACvD;AACF;;AAGA,SAAS,UAAU,SAAkC;CACnD,IAAI,QAAQ,YAAY,QAAQ,OAAO,QAAQ;CAC/C,OAAO,QAAQ,QAAQ,QAAQ,YAAY;AAC7C"}

package/dist/store/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../src/store/index.ts"],"sourcesContent":["import type { PushDevice } from '../engine/ports';\nimport type { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from '../ir';\n\n/**\n * The journey engine's data plane. Postgres is the store (`PostgresJourneyStore`); this\n * interface is the port the host, the runner and the fact source use to persist or look\n * anything up, and what a test stub implements in its place. Execution (durable steps,\n * sleeps, wake-ups) is the workflow runtime's job and stays out of here.\n *\n * Timestamps are epoch milliseconds throughout; a store may persist them in\n * its native type as long as `sinceMs` comparisons behave.\n */\n\n/**\n * A profile patch or a stored profile. On the way in, `null` means \"remove\n * this property\" (RFC 7386 merge-patch, the only way the API has to unset\n * one); a stored profile never contains null.\n */\nexport type ProfileProps = Record<string, ScalarIR | null | undefined>;\n\nexport interface EventInput {\n  /** The occurrence's identity, chosen by the sender; a second insert with the same id is a no-op. */\n  id: string;\n  userId: string;\n  event: string;\n  ts: number;\n  payload: Record<string, unknown>;\n}\n\nexport interface TriggerRoute {\n  workflow: string;\n  hash: string;\n  /** Payload gate (payload-only condition tree), or null when the trigger has none. */\n  where: ConditionIR | null;\n  /** Profile gate, or null. */\n  filter: ConditionIR | null;\n  /** Whether a visitor not signed in may enter. */\n  visitors: boolean;\n  /**\n   * The code version that applied these routes; absent after a hand-posted `POST /deploy`. Read\n   * in the same row as the hash, so the pair is always one deploy's.\n   */\n  version?: string | undefined;\n}\n\nexport interface SegmentTriggerRoute {\n  workflow: string;\n  hash: string;\n  segment: string;\n  /** As `TriggerRoute.version`. */\n  version?: string | undefined;\n}\n\n/**\n * A Worker version, as Cloudflare's version metadata binding names it: the bundle compiled into\n * that version goes live only over an older one (`replaceRoutesIfNewer`).\n */\nexport interface BundleVersion {\n  id: string;\n  /** When the version was created (epoch ms): later versions are newer. */\n  createdAt: number;\n}\n\nexport interface EntryInput {\n  workflow: string;\n  userId: string;\n  instanceId: string;\n  hash: string;\n  ts: number;\n  /**\n   * The instance's start, recorded in the same transaction as the entry — for a runtime whose\n   * start is an asynchronous submit (AWS) that may have to be retried.\n   */\n  execution?: ExecutionStart | undefined;\n}\n\n/** How an instance is started on a runtime that submits it: replayed as is on every retry. */\nexport interface ExecutionStart {\n  /** The runtime's idempotency key (the durable execution name). */\n  name: string;\n  /** What is invoked: a qualified function ARN, its version included. */\n  target: string;\n  /** The exact payload: a retried submit must send the same bytes, or the runtime refuses it. */\n  input: string;\n}\n\nexport interface ExecutionRecord extends ExecutionStart {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n  createdAt: number;\n  submittedAt?: number | undefined;\n  arn?: string | undefined;\n  unresolvedAt?: number | undefined;\n  callbackId?: string | undefined;\n  /** Bumped by every wait the instance arms: a wake or a cleanup of an older one leaves it alone. */\n  generation: number;\n  deadlineAt?: number | undefined;\n  checkedAt?: number | undefined;\n  stoppedAt?: number | undefined;\n}\n\n/**\n * What a runtime that submits its starts and parks waits on one-shot callbacks (AWS) keeps\n * beside the entry ledger. The runtime holds the execution history; this holds only the\n * mapping from the engine's instance id to it.\n */\nexport interface ExecutionRegistry {\n  get(instanceId: string): Promise<ExecutionRecord | undefined>;\n  /**\n   * Starts not yet confirmed and not given up on, oldest first: of one (workflow, user) entry\n   * still running, or every one created before `createdBefore`.\n   */\n  pendingStarts(filter: {\n    workflow?: string;\n    userId?: string;\n    createdBefore?: number;\n    limit: number;\n  }): Promise<ExecutionRecord[]>;\n  markSubmitted(instanceId: string, arn: string | undefined, at: number): Promise<void>;\n  markUnresolved(instanceId: string, at: number): Promise<void>;\n  setArn(instanceId: string, arn: string): Promise<void>;\n  /** Record the callback a wait parks on; false when a newer generation is already armed. */\n  armCallback(\n    instanceId: string,\n    callback: { id: string; generation: number; deadlineAt?: number | undefined }\n  ): Promise<boolean>;\n  /** Forget the callback — only if it is still that generation's. */\n  clearCallback(instanceId: string, generation: number): Promise<void>;\n  /** Submitted executions whose entry is still running, least recently checked first. */\n  toReconcile(limit: number, checkedBefore: number): Promise<ExecutionRecord[]>;\n  markChecked(instanceId: string, at: number): Promise<void>;\n  /** Record the first stop; a later one keeps it. */\n  markStopped(instanceId: string, at: number): Promise<void>;\n}\n\n/**\n * How an entry attempt ended: a fresh row, a 'failed' row of a dead instance\n * taken over (the once policy does not bar a user over one outage), or\n * refused because the pair already entered and is still alive.\n */\nexport type EntryOutcome = 'entered' | 'reclaimed' | null;\n\n/** A device registered for pushes: its provider token belongs to the user who registered it last. */\nexport interface DeviceInput {\n  deviceId?: string | undefined;\n  /** Null until the device's visitor signs in. */\n  userId: string | null;\n  visitorId?: string | undefined;\n  token: string;\n  /** `ios` (APNs) or `android` (FCM): which provider the token belongs to. */\n  platform: string;\n  at: number;\n}\n\n/** What linking a visitor to a user did; null when it was already linked, or to another user. */\nexport interface VisitorMerge {\n  /** Instances dropped because the user is already in the same workflow: to stop. */\n  dropped: string[];\n  /** The event names and profile properties the user gained: their waits must wake. */\n  events: string[];\n  props: string[];\n}\n\n/** An instance of a user still in the ledger, and whether its runner was admitted (see `admitInstance`). */\nexport interface RunningInstance {\n  instanceId: string;\n  /** False until the runner admitted itself: nothing has run, and the tombstone keeps it that way. */\n  admitted: boolean;\n}\n\n/** One (workflow, user) entry: the attempt it records and how far that attempt got. */\nexport interface EntryState {\n  instanceId: string;\n  /** 'running' until the run finalizes it ('completed', 'goal', 'failed', …). */\n  status: string;\n  /** The runner admitted itself (`admitInstance`): the instance did reach the runtime. */\n  admitted: boolean;\n}\n\n/** An entry still waiting for its first admission (`unadmittedEntries`). */\nexport interface UnadmittedEntry {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n}\n\n/** A store plus how to release what opening it acquired (a connection, say). */\nexport interface StoreLease {\n  store: JourneyStore;\n  close?: () => Promise<void>;\n}\n\nimport type { ErasureState } from './erasure';\n\nexport { type ErasureState, UserErasedError } from './erasure';\nexport { instanceOwner, isVisitorSubject, visitorIdOf, visitorSubject } from './identity';\n\n/**\n * The live database lacks tables or columns the engine reads (an SDK upgrade added them, or the\n * host never ran the migration). Raised before a deploy writes anything.\n */\nexport class SchemaMismatchError extends Error {\n  override readonly name = 'SchemaMismatchError';\n\n  constructor(readonly problems: readonly string[]) {\n    super(\n      `the database does not match @shware/workflow's tables — regenerate the drizzle schema (workflow-ui generate) and run your migrations:\\n  ${problems.join('\\n  ')}`\n    );\n  }\n}\n\n/** A message copy as reporting records it, before it goes out. */\nexport interface MessageRecord {\n  idempotencyKey: string;\n  workflow: string;\n  instanceId: string;\n  nodeId: string;\n  template: string;\n  /** Where the copy lands: `email`, `push_ios`, `push_android`. */\n  channel: string;\n  userId: string;\n  /** An email's subscription topic; null for a transactional email and for every other channel. */\n  topic: string | null;\n  sentAt: number;\n}\n\n/** What is known of a copy without its engagement: whose it is, where it went, its topic. */\nexport interface MessageSummary {\n  userId: string;\n  channel: string;\n  topic: string | null;\n}\n\n/** One opt-out to set or clear: a topic of the channel, or the whole channel (`topic: null`). */\nexport interface SuppressionChange {\n  topic: string | null;\n  suppressed: boolean;\n}\n\n/** What a click is judged by. */\nexport interface ClickContext {\n  url: string;\n  deliveredAt: number;\n  linkCount: number;\n  /** The copy's clicks in the window before this one. */\n  recent: { position: number; at: number }[];\n}\n\n/** An open or a click, with the verdict on who made it and where it came from. */\nexport interface Engagement {\n  at: number;\n  machine: boolean;\n  /** The rule that called it a machine; null for a person. */\n  reason: string | null;\n  userAgent: string | null;\n  /** The network the request came from (Cloudflare's `cf.asn`, `cf.asOrganization`, `cf.country`), never the address. */\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\n/**\n * Journey reporting: where each instance stands, every copy and how it was engaged with, segment\n * sizes. The store exposes it as `reporting`; the host records it and serves email tracking.\n * Every write is idempotent — a retried step reports again.\n */\n/** Bounds on when an event happened, both inclusive (epoch ms); an absent side is open. */\nexport interface EventWindow {\n  sinceMs?: number;\n  untilMs?: number;\n}\n\n/**\n * Where a page of events ended: the last row's timestamp and id, the keyset `(ts, id)` the next\n * page starts after. Opaque to callers; `ts` is the store's own rendering of the timestamp, so a\n * round trip loses no precision.\n */\nexport interface EventCursor {\n  ts: string;\n  id: string;\n}\n\nexport interface JourneyReporting {\n  /** The instance entered: its row exists from here, so one a guard ends at once still counts. */\n  instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void>;\n  nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void>;\n  instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void>;\n  /** The copy's row id; the row a retry already wrote, when there is one. */\n  recordMessage(message: MessageRecord): Promise<string>;\n  /**\n   * Whether the copy was settled (`settleMessage`: delivered, or settled undelivered) — read from\n   * the database itself, so a replayed send step never trusts a cache that missed the settle.\n   */\n  messageSettled(idempotencyKey: string): Promise<boolean>;\n  settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void>;\n  /** An email's tracked links, in document order. */\n  recordLinks(messageId: string, urls: readonly string[]): Promise<void>;\n  /**\n   * Record an open of the copy, judged by `judge` against the copy (its recipient and when it was\n   * delivered — when it was sent, before the transport answered); `undefined` from the judge\n   * records nothing. Read and written in one transaction. False for an unknown copy.\n   */\n  recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean>;\n  /**\n   * Record a click on the copy's link at `position`, judged by `judge` against the link, how\n   * many links the copy has and its clicks of the last `windowMs`. The copy is locked for the\n   * transaction, so clicks arriving together (a scanner following every link at once) are\n   * judged one after another, each seeing the ones before. When the judge asks to `backdate`,\n   * the window's earlier clicks are reclassified with this one's verdict. A click implies an\n   * open. Undefined for an unknown link.\n   */\n  recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined>;\n  /**\n   * The email copy's recipient opted out: of the copy's topic, or with `scope: 'all'` of every\n   * email. Recorded on the copy and as a suppression (the topic's row, or the channel-wide\n   * null-topic row), in one transaction, which also yields who the recipient is and the topic —\n   * so the caller acts on the unsubscribe without a second read. A transactional copy\n   * (`topic: null`) has nothing to opt out of: nothing is recorded, and the answer says so.\n   * Undefined for an unknown copy.\n   */\n  recordUnsubscribe(\n    messageId: string,\n    at: number,\n    scope?: 'topic' | 'all'\n  ): Promise<{ userId: string; topic: string | null } | undefined>;\n  /** The copy's owner, channel and topic; undefined for an unknown copy. */\n  lookupMessage(messageId: string): Promise<MessageSummary | undefined>;\n  /** A push copy the device reported it received. False for an unknown copy. */\n  recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;\n  /** Drop members of segments no longer deployed, then record every deployed segment's size. */\n  snapshotSegments(at: number): Promise<{ segment: string; size: number }[]>;\n}\n\n/** A user the segment sweep has to evaluate, and for which segments. */\nexport interface SegmentCandidate {\n  userId: string;\n  segments: string[];\n}\n\nexport interface JourneyStore {\n  /** Where instances stand, every copy and its engagement, segment sizes. */\n  readonly reporting: JourneyReporting;\n\n  /**\n   * Record that the user's data must go (a deleted account): the tombstone every write about\n   * the user is conditional on, from here on and for good. Committed before anything is\n   * stopped or erased, so an entry that got in before it is found by the erasure and none gets\n   * in after it. Idempotent: a second request, or one for a user already erased, changes nothing.\n   */\n  requestErasure(userId: string, at: number): Promise<void>;\n  /** Users whose erasure was requested and not carried out yet (`'erasing'`), oldest first. */\n  pendingErasures(): Promise<string[]>;\n  /**\n   * Where the user stands: `'none'` (no tombstone), `'erasing'` (requested, their instances\n   * being stopped, data still there) or `'erased'` (`forgetUser` went through). Both\n   * tombstone states refuse every write about the user; the entry points read this for a fast\n   * answer, and the store's conditional writes are the gate itself.\n   */\n  erasureState(userId: string): Promise<ErasureState>;\n  /** The user's journey instances still running, by the entry ledger. */\n  runningInstances(userId: string): Promise<RunningInstance[]>;\n  /**\n   * The runner's admission, before its first observable effect: records that the instance runs\n   * (`admitted_at`, kept on replay) — unless the user has an erasure tombstone, in which case\n   * nothing is recorded and the runner must not run. Mutually exclusive with `requestErasure`\n   * and `forgetUser` for that user (Postgres: the user's advisory lock), so an erasure either\n   * finds the instance admitted and stops it, or commits its tombstone first and the admission\n   * is refused — never neither.\n   *\n   * A first admission needs the entry running. An instance already admitted is admitted again\n   * whatever the entry's status — the legitimate replay of an instance whose finalisation was\n   * cut short after the entry reached its terminal status, which resumes on its own checkpoint\n   * and finishes what is left. Never a new attempt's way in: false for a terminal entry never\n   * admitted, for an entry no longer in the ledger, for another user's entry, and for an\n   * instance whose entry was reclaimed since (`enterJourney` resets the admission with the\n   * instance id, so a superseded attempt cannot pass under the id it lost).\n   */\n  admitInstance(instanceId: string, userId: string): Promise<boolean>;\n  /**\n   * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment\n   * memberships, entries and reporting — and mark the tombstone erased (`erased_at`), which\n   * stays: a write that was in flight when the data went cannot bring the user back, and the\n   * same id is never reactivated by ingest — which is also why the suppressions go with the\n   * rest: nothing is ever sent to the id again, so no opt-out needs keeping. Run only once no\n   * instance of theirs runs any more, or one could write some of it back. Idempotent. Mutually\n   * exclusive with every write about the user (the user's advisory lock), so the data is gone\n   * when this returns — nothing of theirs lands afterwards.\n   */\n  forgetUser(userId: string, at: number): Promise<void>;\n\n  /**\n   * The user opted out of the channel (recorded by an unsubscribe, or set through\n   * `/subscriptions`): with a `topic`, an opt-out of that topic or of the whole channel; without\n   * one, only the whole channel.\n   */\n  isSuppressed(userId: string, channel: string, topic?: string): Promise<boolean>;\n  /** Every opt-out of the user on the channel: the topics, and `null` for the whole channel. */\n  listSuppressions(userId: string, channel: string): Promise<(string | null)[]>;\n  /**\n   * Set or clear opt-outs, all in one transaction: a suppressed change inserts the row (keeping\n   * the time of one already there), an unsuppressed one deletes it. Written whatever the user's\n   * erasure state — the caller refuses an erased user first — since an opt-out is never refused.\n   */\n  updateSuppressions(\n    userId: string,\n    channel: string,\n    changes: readonly SuppressionChange[],\n    at: number\n  ): Promise<void>;\n\n  /**\n   * What the live database lacks against the engine's tables (read-only); a deploy refuses to\n   * run while it lists anything.\n   */\n  checkSchema(): Promise<string[]>;\n\n  /* ---------------------------------- events --------------------------------- */\n  /**\n   * Append the occurrence; false when its id was already in the log (nothing written). Throws\n   * `UserErasedError` for a user with a tombstone, like every write about a user below.\n   */\n  insertEvent(input: EventInput): Promise<boolean>;\n  /**\n   * Occurrences of `event` for the user, optionally only those within the window. With\n   * `atLeast`, counting may stop there: the result is exact below it and some number ≥ it\n   * otherwise — all a `performed(…, { count })` check needs, without counting a heavy user's\n   * whole history.\n   */\n  countEvents(\n    userId: string,\n    event: string,\n    window?: EventWindow,\n    atLeast?: number\n  ): Promise<number>;\n  /**\n   * One page of those occurrences' payloads, oldest first — the caller filters them with the\n   * shared evaluator and pages on with `next` only while it still needs matches, so a `where`\n   * never loads a user's whole history at once. `next` is absent on the last page.\n   */\n  pageEventPayloads(\n    userId: string,\n    event: string,\n    window: EventWindow | undefined,\n    page: { limit: number; after?: EventCursor | undefined }\n  ): Promise<{ payloads: Record<string, unknown>[]; next?: EventCursor | undefined }>;\n\n  /* -------------------------------- visitors --------------------------------- */\n  /** The user a visitor became, if they did. */\n  linkedUser(visitorId: string): Promise<string | undefined>;\n  /** The visitor was heard from: who they are now, the user they became or their own subject. */\n  touchVisitor(visitorId: string, at: number): Promise<string>;\n  /**\n   * Forget visitors who never signed in and were last heard from before `before`, with no journey\n   * running: up to `limit` of them, leaving no tombstone. Answers how many.\n   */\n  pruneVisitors(before: number, limit: number): Promise<number>;\n  /**\n   * The visitor became the user: their events, profile, devices, opt-outs and journeys move to the\n   * user, once. A visitor already linked keeps its first user. The user's own entry wins over the\n   * visitor's in the same workflow, and the visitor's instance is dropped.\n   */\n  linkVisitor(visitorId: string, userId: string, at: number): Promise<VisitorMerge | null>;\n  /** Who an instance's entry belongs to now. */\n  entryOwner(instanceId: string): Promise<string | undefined>;\n\n  /* --------------------------------- profiles -------------------------------- */\n  getProfile(userId: string): Promise<ProfileProps | undefined>;\n  /**\n   * Merge-patch `props` into the stored profile (a null removes the property) and return the\n   * result, atomically: two concurrent identifies cannot lose each other's keys. `at` is when the\n   * values were read (now by default): a property written with a later `at` keeps its value, so\n   * a redelivered patch cannot undo a newer one.\n   */\n  mergeProfile(userId: string, props: ProfileProps, at?: number): Promise<ProfileProps>;\n\n  /**\n   * Who the segment sweep has to evaluate: for each user the engine knows (a profile, an event or\n   * a membership), the segments whose membership may have to change, or whose entry still owes a\n   * start. It may name a user whose membership turns out right, since `evaluateCondition` decides;\n   * it must not leave out one whose membership is wrong. Users come in ascending order; `after`\n   * resumes past the last id of the previous page, and users with nothing to do are left out.\n   */\n  listSegmentCandidates(page: {\n    segments: readonly { id: string; condition: ConditionIR }[];\n    now: number;\n    after?: string | undefined;\n    limit: number;\n  }): Promise<SegmentCandidate[]>;\n\n  /* ---------------------------------- devices --------------------------------- */\n  /** The push devices a user or visitor holds now, most recently registered first. */\n  listDevices(subject: string): Promise<PushDevice[]>;\n  /**\n   * Register a device: one row per token and per device, holding only its current owner. A token\n   * registered again moves to whoever registered it last (a phone signed into another account) and\n   * to the front of their list; a device's new token replaces its old one. Answers the previous\n   * owners, whose device waits must wake.\n   */\n  upsertDevice(device: DeviceInput): Promise<string[]>;\n  /** Forget a token (reported dead by APNs / FCM); the user or visitor it belonged to, if any. */\n  removeDevice(token: string): Promise<string | undefined>;\n  /**\n   * The user signed out on the device: the token is kept, bound to nobody, until the next\n   * registration binds it again. Who it belonged to, if anyone.\n   */\n  unbindDevice(token: string): Promise<string | undefined>;\n\n  /* ---------------------------- deployed definitions -------------------------- */\n  getSegmentCondition(id: string): Promise<ConditionIR | undefined>;\n  /** Every deployed segment with its definition: what the segment sweep evaluates. */\n  listSegments(): Promise<{ id: string; condition: ConditionIR }[]>;\n  findTriggers(event: string): Promise<TriggerRoute[]>;\n  listSegmentTriggers(): Promise<SegmentTriggerRoute[]>;\n  putWorkflowIR(workflow: WorkflowIR): Promise<void>;\n  getWorkflowIR(contentHash: string): Promise<WorkflowIR | undefined>;\n  /**\n   * Swap the routing tables (segments, event triggers, segment triggers) for\n   * the bundle's — atomically, so a concurrent ingest never sees them half\n   * empty. Workflow bodies are stored separately (`putWorkflowIR`) because they\n   * are content-addressed and outlive the routes that point at them.\n   *\n   * With `version` — a forced apply of the code's own bundle (`POST /bundle/deploy`) — the\n   * version is recorded too, unconditionally and in the same transaction, so the live version\n   * always names the code the routes came from. Without it (a hand-posted `POST /deploy`) the\n   * recorded version stays as it was: that bundle holds until a newer code version applies its own.\n   */\n  replaceRoutes(bundle: BundleIR, version?: BundleVersion): Promise<void>;\n  /**\n   * The Worker version whose bundle the routes came from, when one put them there (through\n   * `replaceRoutesIfNewer`, or a forced `replaceRoutes` with a version). Read from the database\n   * itself, not a cache in front of it.\n   */\n  liveBundleVersion(): Promise<BundleVersion | undefined>;\n  /**\n   * `replaceRoutes`, only when `version` is newer than the live one, recorded in the same\n   * transaction: two versions serving side by side during a rollout cannot leave the older one's\n   * routes in force. False, with nothing written, when a version as new or newer is live.\n   */\n  replaceRoutesIfNewer(bundle: BundleIR, version: BundleVersion): Promise<boolean>;\n\n  /* ----------------------------- segment membership --------------------------- */\n  isSegmentMember(segment: string, userId: string): Promise<boolean>;\n  /** Record the membership, with the workflows its entry has to start (see segment_start). */\n  addSegmentMember(\n    segment: string,\n    userId: string,\n    ts: number,\n    workflows: readonly string[]\n  ): Promise<void>;\n  /** The workflows the member's entry has not started yet. */\n  pendingSegmentStarts(segment: string, userId: string): Promise<string[]>;\n  completeSegmentStart(segment: string, userId: string, workflow: string): Promise<void>;\n  /** Drop the membership and any start it still owed. */\n  removeSegmentMember(segment: string, userId: string): Promise<void>;\n\n  /* ------------------------------- entry ledger ------------------------------- */\n  /**\n   * Record the entry (the once policy). Atomic under concurrent ingests: of\n   * two racing attempts exactly one is 'entered' (or 'reclaimed', when the\n   * pair's previous instance is recorded as 'failed') and the other null.\n   */\n  enterJourney(entry: EntryInput): Promise<EntryOutcome>;\n  removeEntry(instanceId: string): Promise<void>;\n  setEntryStatus(instanceId: string, status: string): Promise<void>;\n  /** The (workflow, user) entry as it stands, read from the database itself; undefined if none. */\n  getEntry(workflow: string, userId: string): Promise<EntryState | undefined>;\n  /**\n   * Running entries no runner has admitted, claimed before `claimedBefore` (epoch ms), oldest\n   * first: candidates for a start that was lost between the claim and the platform's create.\n   */\n  unadmittedEntries(claimedBefore: number, limit: number): Promise<UnadmittedEntry[]>;\n  /**\n   * Mark a lost start `failed`, so the pair's next trigger reclaims it. Only while the entry is\n   * still running and unadmitted under this instance id; false when it moved on meanwhile.\n   */\n  failUnadmittedEntry(instanceId: string): Promise<boolean>;\n  /** Execution starts and wake callbacks, for a runtime that submits its starts (AWS). */\n  readonly executions: ExecutionRegistry;\n\n  /* ------------------------------ wake subscriptions --------------------------- */\n  /** Distinct wake handles registered for (user, event). */\n  findWakeHandles(userId: string, event: string): Promise<string[]>;\n  /** Register the handle for each event; repeated registrations are idempotent. */\n  subscribe(handle: string, userId: string, events: readonly string[], ts: number): Promise<void>;\n  /** Drop every registration the handle holds. */\n  unsubscribe(handle: string): Promise<void>;\n}\n\nexport { JourneyFactSource } from './facts';\nexport { PostgresJourneyStore } from './postgres';\nexport { PostgresReporting } from './postgres-reporting';\nexport {\n  DEFAULT_SCHEMA,\n  TABLES,\n  renderDrizzleSchema,\n  renderPostgresDdl,\n  type TableSpec,\n  type UniqueConstraintSpec,\n} from './tables';\nexport type { PostgresJourneyStoreOptions, SqlClientLike } from './postgres';\n"],"mappings":";;;;;;;;;;;;AA0MA,IAAa,sBAAb,cAAyC,MAAM;CAGxB;CAFrB,OAAyB;CAEzB,YAAY,UAAsC;EAChD,MACE,4IAA4I,SAAS,KAAK,MAAM,GAClK;EAHmB,KAAA,WAAA;CAIrB;AACF"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/store/index.ts"],"sourcesContent":["import type { PushDevice } from '../engine/ports';\nimport type { BundleIR, ConditionIR, ScalarIR, WorkflowIR } from '../ir';\n\n/**\n * The journey engine's data plane. Postgres is the store (`PostgresJourneyStore`); this\n * interface is the port the host, the runner and the fact source use to persist or look\n * anything up, and what a test stub implements in its place. Execution (durable steps,\n * sleeps, wake-ups) is the workflow runtime's job and stays out of here.\n *\n * Timestamps are epoch milliseconds throughout; a store may persist them in\n * its native type as long as `sinceMs` comparisons behave.\n */\n\n/**\n * A profile patch or a stored profile. On the way in, `null` means \"remove\n * this property\" (RFC 7386 merge-patch, the only way the API has to unset\n * one); a stored profile never contains null.\n */\nexport type ProfileProps = Record<string, ScalarIR | null | undefined>;\n\nexport interface EventInput {\n  /** The occurrence's identity, chosen by the sender; a second insert with the same id is a no-op. */\n  id: string;\n  userId: string;\n  event: string;\n  ts: number;\n  payload: Record<string, unknown>;\n}\n\nexport interface TriggerRoute {\n  workflow: string;\n  hash: string;\n  /** Payload gate (payload-only condition tree), or null when the trigger has none. */\n  where: ConditionIR | null;\n  /** Profile gate, or null. */\n  filter: ConditionIR | null;\n  /** Whether a visitor not signed in may enter. */\n  visitors: boolean;\n  /**\n   * The code version that applied these routes; absent after a hand-posted `POST /deploy`. Read\n   * in the same row as the hash, so the pair is always one deploy's.\n   */\n  version?: string | undefined;\n}\n\nexport interface SegmentTriggerRoute {\n  workflow: string;\n  hash: string;\n  segment: string;\n  /** As `TriggerRoute.version`. */\n  version?: string | undefined;\n}\n\n/**\n * A Worker version, as Cloudflare's version metadata binding names it: the bundle compiled into\n * that version goes live only over an older one (`replaceRoutesIfNewer`).\n */\nexport interface BundleVersion {\n  id: string;\n  /** When the version was created (epoch ms): later versions are newer. */\n  createdAt: number;\n}\n\nexport interface EntryInput {\n  workflow: string;\n  userId: string;\n  instanceId: string;\n  hash: string;\n  ts: number;\n  /**\n   * The instance's start, recorded in the same transaction as the entry — for a runtime whose\n   * start is an asynchronous submit (AWS) that may have to be retried.\n   */\n  execution?: ExecutionStart | undefined;\n}\n\n/** How an instance is started on a runtime that submits it: replayed as is on every retry. */\nexport interface ExecutionStart {\n  /** The runtime's idempotency key (the durable execution name). */\n  name: string;\n  /** What is invoked: a qualified function ARN, its version included. */\n  target: string;\n  /** The exact payload: a retried submit must send the same bytes, or the runtime refuses it. */\n  input: string;\n}\n\nexport interface ExecutionRecord extends ExecutionStart {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n  createdAt: number;\n  submittedAt?: number | undefined;\n  arn?: string | undefined;\n  unresolvedAt?: number | undefined;\n  callbackId?: string | undefined;\n  /** Bumped by every wait the instance arms: a wake or a cleanup of an older one leaves it alone. */\n  generation: number;\n  deadlineAt?: number | undefined;\n  checkedAt?: number | undefined;\n  stoppedAt?: number | undefined;\n}\n\n/**\n * What a runtime that submits its starts and parks waits on one-shot callbacks (AWS) keeps\n * beside the entry ledger. The runtime holds the execution history; this holds only the\n * mapping from the engine's instance id to it.\n */\nexport interface ExecutionRegistry {\n  get(instanceId: string): Promise<ExecutionRecord | undefined>;\n  /**\n   * Starts not yet confirmed and not given up on, oldest first: of one (workflow, user) entry\n   * still running, or every one created before `createdBefore`.\n   */\n  pendingStarts(filter: {\n    workflow?: string;\n    userId?: string;\n    createdBefore?: number;\n    limit: number;\n  }): Promise<ExecutionRecord[]>;\n  markSubmitted(instanceId: string, arn: string | undefined, at: number): Promise<void>;\n  markUnresolved(instanceId: string, at: number): Promise<void>;\n  setArn(instanceId: string, arn: string): Promise<void>;\n  /** Record the callback a wait parks on; false when a newer generation is already armed. */\n  armCallback(\n    instanceId: string,\n    callback: { id: string; generation: number; deadlineAt?: number | undefined }\n  ): Promise<boolean>;\n  /** Forget the callback — only if it is still that generation's. */\n  clearCallback(instanceId: string, generation: number): Promise<void>;\n  /** Submitted executions whose entry is still running, least recently checked first. */\n  toReconcile(limit: number, checkedBefore: number): Promise<ExecutionRecord[]>;\n  markChecked(instanceId: string, at: number): Promise<void>;\n  /** Record the first stop; a later one keeps it. */\n  markStopped(instanceId: string, at: number): Promise<void>;\n}\n\n/**\n * How an entry attempt ended: a fresh row, a 'failed' row of a dead instance\n * taken over (the once policy does not bar a user over one outage), or\n * refused because the pair already entered and is still alive.\n */\nexport type EntryOutcome = 'entered' | 'reclaimed' | null;\n\n/** A device registered for pushes: its provider token belongs to the user who registered it last. */\nexport interface DeviceInput {\n  deviceId?: string | undefined;\n  /** Null until the device's visitor signs in. */\n  userId: string | null;\n  visitorId?: string | undefined;\n  token: string;\n  /** `ios` (APNs) or `android` (FCM): which provider the token belongs to. */\n  platform: string;\n  at: number;\n}\n\n/** What linking a visitor to a user did; null when it was already linked, or to another user. */\nexport interface VisitorMerge {\n  /** Instances dropped because the user is already in the same workflow: to stop. */\n  dropped: string[];\n  /** The event names and profile properties the user gained: their waits must wake. */\n  events: string[];\n  props: string[];\n}\n\n/** An instance of a user still in the ledger, and whether its runner was admitted (see `admitInstance`). */\nexport interface RunningInstance {\n  instanceId: string;\n  /** False until the runner admitted itself: nothing has run, and the tombstone keeps it that way. */\n  admitted: boolean;\n}\n\n/** One (workflow, user) entry: the attempt it records and how far that attempt got. */\nexport interface EntryState {\n  instanceId: string;\n  /** 'running' until the run finalizes it ('completed', 'goal', 'failed', …). */\n  status: string;\n  /** The runner admitted itself (`admitInstance`): the instance did reach the runtime. */\n  admitted: boolean;\n}\n\n/** An entry still waiting for its first admission (`unadmittedEntries`). */\nexport interface UnadmittedEntry {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n}\n\n/** A running entry whose runner admitted itself (`admittedEntries`). */\nexport interface AdmittedEntry {\n  instanceId: string;\n  workflow: string;\n  userId: string;\n}\n\n/** A store plus how to release what opening it acquired (a connection, say). */\nexport interface StoreLease {\n  store: JourneyStore;\n  close?: () => Promise<void>;\n}\n\nimport type { ErasureState } from './erasure';\n\nexport { type ErasureState, UserErasedError } from './erasure';\nexport { instanceOwner, isVisitorSubject, visitorIdOf, visitorSubject } from './identity';\n\n/**\n * The live database lacks tables or columns the engine reads (an SDK upgrade added them, or the\n * host never ran the migration). Raised before a deploy writes anything.\n */\nexport class SchemaMismatchError extends Error {\n  override readonly name = 'SchemaMismatchError';\n\n  constructor(readonly problems: readonly string[]) {\n    super(\n      `the database does not match @shware/workflow's tables — regenerate the drizzle schema (workflow-ui generate) and run your migrations:\\n  ${problems.join('\\n  ')}`\n    );\n  }\n}\n\n/** A message copy as reporting records it, before it goes out. */\nexport interface MessageRecord {\n  idempotencyKey: string;\n  workflow: string;\n  instanceId: string;\n  nodeId: string;\n  template: string;\n  /** Where the copy lands: `email`, `push_ios`, `push_android`. */\n  channel: string;\n  userId: string;\n  /** An email's subscription topic; null for a transactional email and for every other channel. */\n  topic: string | null;\n  sentAt: number;\n}\n\n/** What is known of a copy without its engagement: whose it is, where it went, its topic. */\nexport interface MessageSummary {\n  userId: string;\n  channel: string;\n  topic: string | null;\n}\n\n/** One opt-out to set or clear: a topic of the channel, or the whole channel (`topic: null`). */\nexport interface SuppressionChange {\n  topic: string | null;\n  suppressed: boolean;\n}\n\n/** What a click is judged by. */\nexport interface ClickContext {\n  url: string;\n  deliveredAt: number;\n  linkCount: number;\n  /** The copy's clicks in the window before this one. */\n  recent: { position: number; at: number }[];\n}\n\n/** An open or a click, with the verdict on who made it and where it came from. */\nexport interface Engagement {\n  at: number;\n  machine: boolean;\n  /** The rule that called it a machine; null for a person. */\n  reason: string | null;\n  userAgent: string | null;\n  /** The network the request came from (Cloudflare's `cf.asn`, `cf.asOrganization`, `cf.country`), never the address. */\n  asn: number | null;\n  organization: string | null;\n  country: string | null;\n}\n\n/**\n * Journey reporting: where each instance stands, every copy and how it was engaged with, segment\n * sizes. The store exposes it as `reporting`; the host records it and serves email tracking.\n * Every write is idempotent — a retried step reports again.\n */\n/** Bounds on when an event happened, both inclusive (epoch ms); an absent side is open. */\nexport interface EventWindow {\n  sinceMs?: number;\n  untilMs?: number;\n}\n\n/**\n * Where a page of events ended: the last row's timestamp and id, the keyset `(ts, id)` the next\n * page starts after. Opaque to callers; `ts` is the store's own rendering of the timestamp, so a\n * round trip loses no precision.\n */\nexport interface EventCursor {\n  ts: string;\n  id: string;\n}\n\nexport interface JourneyReporting {\n  /** The instance entered: its row exists from here, so one a guard ends at once still counts. */\n  instanceStarted(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    at: number;\n  }): Promise<void>;\n  nodeReached(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    nodeId: string;\n    at: number;\n  }): Promise<void>;\n  instanceFinished(input: {\n    workflow: string;\n    instanceId: string;\n    userId: string;\n    status: string;\n    at: number;\n    convertedAt?: number;\n  }): Promise<void>;\n  /** The copy's row id; the row a retry already wrote, when there is one. */\n  recordMessage(message: MessageRecord): Promise<string>;\n  /**\n   * Whether the copy was settled (`settleMessage`: delivered, or settled undelivered) — read from\n   * the database itself, so a replayed send step never trusts a cache that missed the settle.\n   */\n  messageSettled(idempotencyKey: string): Promise<boolean>;\n  /**\n   * Mark the copy as handed to the transport, committed before the send: true when this call\n   * made the claim, false when an earlier run of the step already held it — the copy may have\n   * gone out then, and the engine does not send it again (see `OutboundMessage.redelivery`).\n   */\n  claimMessage(idempotencyKey: string, at: number): Promise<boolean>;\n  /** The transport threw before taking the copy: clear the claim, so the step's retry sends it. */\n  releaseMessage(idempotencyKey: string): Promise<void>;\n  settleMessage(\n    idempotencyKey: string,\n    result: { delivered: true } | { delivered: false; reason: string },\n    at: number\n  ): Promise<void>;\n  /** An email's tracked links, in document order. */\n  recordLinks(messageId: string, urls: readonly string[]): Promise<void>;\n  /**\n   * Record an open of the copy, judged by `judge` against the copy (its recipient and when it was\n   * delivered — when it was sent, before the transport answered); `undefined` from the judge\n   * records nothing. Read and written in one transaction. False for an unknown copy.\n   */\n  recordOpen(\n    messageId: string,\n    judge: (message: { userId: string; deliveredAt: number }) => Engagement | undefined\n  ): Promise<boolean>;\n  /**\n   * Record a click on the copy's link at `position`, judged by `judge` against the link, how\n   * many links the copy has and its clicks of the last `windowMs`. The copy is locked for the\n   * transaction, so clicks arriving together (a scanner following every link at once) are\n   * judged one after another, each seeing the ones before. When the judge asks to `backdate`,\n   * the window's earlier clicks are reclassified with this one's verdict. A click implies an\n   * open. Undefined for an unknown link.\n   */\n  recordClick(\n    messageId: string,\n    position: number,\n    at: number,\n    windowMs: number,\n    judge: (link: ClickContext) => { engagement: Engagement; backdate: boolean }\n  ): Promise<{ url: string; engagement: Engagement } | undefined>;\n  /**\n   * The email copy's recipient opted out: of the copy's topic, or with `scope: 'all'` of every\n   * email. Recorded on the copy and as a suppression (the topic's row, or the channel-wide\n   * null-topic row), in one transaction, which also yields who the recipient is and the topic —\n   * so the caller acts on the unsubscribe without a second read. A transactional copy\n   * (`topic: null`) has nothing to opt out of: nothing is recorded, and the answer says so.\n   * Undefined for an unknown copy.\n   */\n  recordUnsubscribe(\n    messageId: string,\n    at: number,\n    scope?: 'topic' | 'all'\n  ): Promise<{ userId: string; topic: string | null } | undefined>;\n  /** The copy's owner, channel and topic; undefined for an unknown copy. */\n  lookupMessage(messageId: string): Promise<MessageSummary | undefined>;\n  /** A push copy the device reported it received. False for an unknown copy. */\n  recordDeviceDelivered(messageId: string, at: number): Promise<boolean>;\n  /** Drop members of segments no longer deployed, then record every deployed segment's size. */\n  snapshotSegments(at: number): Promise<{ segment: string; size: number }[]>;\n}\n\n/** A user the segment sweep has to evaluate, and for which segments. */\nexport interface SegmentCandidate {\n  userId: string;\n  segments: string[];\n}\n\nexport interface JourneyStore {\n  /** Where instances stand, every copy and its engagement, segment sizes. */\n  readonly reporting: JourneyReporting;\n\n  /**\n   * Record that the user's data must go (a deleted account): the tombstone every write about\n   * the user is conditional on, from here on and for good. Committed before anything is\n   * stopped or erased, so an entry that got in before it is found by the erasure and none gets\n   * in after it. Idempotent: a second request, or one for a user already erased, changes nothing.\n   */\n  requestErasure(userId: string, at: number): Promise<void>;\n  /** Users whose erasure was requested and not carried out yet (`'erasing'`), oldest first. */\n  pendingErasures(): Promise<string[]>;\n  /**\n   * Where the user stands: `'none'` (no tombstone), `'erasing'` (requested, their instances\n   * being stopped, data still there) or `'erased'` (`forgetUser` went through). Both\n   * tombstone states refuse every write about the user; the entry points read this for a fast\n   * answer, and the store's conditional writes are the gate itself.\n   */\n  erasureState(userId: string): Promise<ErasureState>;\n  /** The user's journey instances still running, by the entry ledger. */\n  runningInstances(userId: string): Promise<RunningInstance[]>;\n  /**\n   * The runner's admission, before its first observable effect: records that the instance runs\n   * (`admitted_at`, kept on replay) — unless the user has an erasure tombstone, in which case\n   * nothing is recorded and the runner must not run. Mutually exclusive with `requestErasure`\n   * and `forgetUser` for that user (Postgres: the user's advisory lock), so an erasure either\n   * finds the instance admitted and stops it, or commits its tombstone first and the admission\n   * is refused — never neither.\n   *\n   * A first admission needs the entry running. An instance already admitted is admitted again\n   * whatever the entry's status — the legitimate replay of an instance whose finalisation was\n   * cut short after the entry reached its terminal status, which resumes on its own checkpoint\n   * and finishes what is left. Never a new attempt's way in: false for a terminal entry never\n   * admitted, for an entry no longer in the ledger, for another user's entry, and for an\n   * instance whose entry was reclaimed since (`enterJourney` resets the admission with the\n   * instance id, so a superseded attempt cannot pass under the id it lost).\n   */\n  admitInstance(instanceId: string, userId: string): Promise<boolean>;\n  /**\n   * Erase everything kept about the user — profile, devices, events, wake subscriptions, segment\n   * memberships, entries and reporting — and mark the tombstone erased (`erased_at`), which\n   * stays: a write that was in flight when the data went cannot bring the user back, and the\n   * same id is never reactivated by ingest — which is also why the suppressions go with the\n   * rest: nothing is ever sent to the id again, so no opt-out needs keeping. Run only once no\n   * instance of theirs runs any more, or one could write some of it back. Idempotent. Mutually\n   * exclusive with every write about the user (the user's advisory lock), so the data is gone\n   * when this returns — nothing of theirs lands afterwards.\n   */\n  forgetUser(userId: string, at: number): Promise<void>;\n\n  /**\n   * The user opted out of the channel (recorded by an unsubscribe, or set through\n   * `/subscriptions`): with a `topic`, an opt-out of that topic or of the whole channel; without\n   * one, only the whole channel.\n   */\n  isSuppressed(userId: string, channel: string, topic?: string): Promise<boolean>;\n  /** Every opt-out of the user on the channel: the topics, and `null` for the whole channel. */\n  listSuppressions(userId: string, channel: string): Promise<(string | null)[]>;\n  /**\n   * Set or clear opt-outs, all in one transaction: a suppressed change inserts the row (keeping\n   * the time of one already there), an unsuppressed one deletes it. Written whatever the user's\n   * erasure state — the caller refuses an erased user first — since an opt-out is never refused.\n   */\n  updateSuppressions(\n    userId: string,\n    channel: string,\n    changes: readonly SuppressionChange[],\n    at: number\n  ): Promise<void>;\n\n  /**\n   * What the live database lacks against the engine's tables (read-only); a deploy refuses to\n   * run while it lists anything.\n   */\n  checkSchema(): Promise<string[]>;\n\n  /* ---------------------------------- events --------------------------------- */\n  /**\n   * Append the occurrence; false when its id was already in the log (nothing written). Throws\n   * `UserErasedError` for a user with a tombstone, like every write about a user below.\n   */\n  insertEvent(input: EventInput): Promise<boolean>;\n  /**\n   * Occurrences of `event` for the user, optionally only those within the window. With\n   * `atLeast`, counting may stop there: the result is exact below it and some number ≥ it\n   * otherwise — all a `performed(…, { count })` check needs, without counting a heavy user's\n   * whole history.\n   */\n  countEvents(\n    userId: string,\n    event: string,\n    window?: EventWindow,\n    atLeast?: number\n  ): Promise<number>;\n  /**\n   * One page of those occurrences' payloads, oldest first — the caller filters them with the\n   * shared evaluator and pages on with `next` only while it still needs matches, so a `where`\n   * never loads a user's whole history at once. `next` is absent on the last page.\n   */\n  pageEventPayloads(\n    userId: string,\n    event: string,\n    window: EventWindow | undefined,\n    page: { limit: number; after?: EventCursor | undefined }\n  ): Promise<{ payloads: Record<string, unknown>[]; next?: EventCursor | undefined }>;\n\n  /* -------------------------------- visitors --------------------------------- */\n  /** The user a visitor became, if they did. */\n  linkedUser(visitorId: string): Promise<string | undefined>;\n  /** The visitor was heard from: who they are now, the user they became or their own subject. */\n  touchVisitor(visitorId: string, at: number): Promise<string>;\n  /**\n   * Forget visitors who never signed in and were last heard from before `before`, with no journey\n   * running: up to `limit` of them, leaving no tombstone. Answers how many.\n   */\n  pruneVisitors(before: number, limit: number): Promise<number>;\n  /**\n   * The visitor became the user: their events, profile, devices, opt-outs and journeys move to the\n   * user, once. A visitor already linked keeps its first user. The user's own entry wins over the\n   * visitor's in the same workflow, and the visitor's instance is dropped.\n   */\n  linkVisitor(visitorId: string, userId: string, at: number): Promise<VisitorMerge | null>;\n  /** Who an instance's entry belongs to now. */\n  entryOwner(instanceId: string): Promise<string | undefined>;\n\n  /* --------------------------------- profiles -------------------------------- */\n  getProfile(userId: string): Promise<ProfileProps | undefined>;\n  /**\n   * Merge-patch `props` into the stored profile (a null removes the property) and return the\n   * result, atomically: two concurrent identifies cannot lose each other's keys. `at` is when the\n   * values were read (now by default): a property written with a later `at` keeps its value, so\n   * a redelivered patch cannot undo a newer one.\n   */\n  mergeProfile(userId: string, props: ProfileProps, at?: number): Promise<ProfileProps>;\n\n  /**\n   * Who the segment sweep has to evaluate: for each user the engine knows (a profile, an event or\n   * a membership), the segments whose membership may have to change, or whose entry still owes a\n   * start. It may name a user whose membership turns out right, since `evaluateCondition` decides;\n   * it must not leave out one whose membership is wrong. Users come in ascending order; `after`\n   * resumes past the last id of the previous page, and users with nothing to do are left out.\n   */\n  listSegmentCandidates(page: {\n    segments: readonly { id: string; condition: ConditionIR }[];\n    now: number;\n    after?: string | undefined;\n    limit: number;\n  }): Promise<SegmentCandidate[]>;\n\n  /* ---------------------------------- devices --------------------------------- */\n  /** The push devices a user or visitor holds now, most recently registered first. */\n  listDevices(subject: string): Promise<PushDevice[]>;\n  /**\n   * Register a device: one row per token and per device, holding only its current owner. A token\n   * registered again moves to whoever registered it last (a phone signed into another account) and\n   * to the front of their list; a device's new token replaces its old one. Answers the previous\n   * owners, whose device waits must wake.\n   */\n  upsertDevice(device: DeviceInput): Promise<string[]>;\n  /** Forget a token (reported dead by APNs / FCM); the user or visitor it belonged to, if any. */\n  removeDevice(token: string): Promise<string | undefined>;\n  /**\n   * The user signed out on the device: the token is kept, bound to nobody, until the next\n   * registration binds it again. Who it belonged to, if anyone.\n   */\n  unbindDevice(token: string): Promise<string | undefined>;\n\n  /* ---------------------------- deployed definitions -------------------------- */\n  getSegmentCondition(id: string): Promise<ConditionIR | undefined>;\n  /** Every deployed segment with its definition: what the segment sweep evaluates. */\n  listSegments(): Promise<{ id: string; condition: ConditionIR }[]>;\n  findTriggers(event: string): Promise<TriggerRoute[]>;\n  listSegmentTriggers(): Promise<SegmentTriggerRoute[]>;\n  putWorkflowIR(workflow: WorkflowIR): Promise<void>;\n  getWorkflowIR(contentHash: string): Promise<WorkflowIR | undefined>;\n  /**\n   * Swap the routing tables (segments, event triggers, segment triggers) for\n   * the bundle's — atomically, so a concurrent ingest never sees them half\n   * empty. Workflow bodies are stored separately (`putWorkflowIR`) because they\n   * are content-addressed and outlive the routes that point at them.\n   *\n   * With `version` — a forced apply of the code's own bundle (`POST /bundle/deploy`) — the\n   * version is recorded too, unconditionally and in the same transaction, so the live version\n   * always names the code the routes came from. Without it (a hand-posted `POST /deploy`) the\n   * recorded version stays as it was: that bundle holds until a newer code version applies its own.\n   */\n  replaceRoutes(bundle: BundleIR, version?: BundleVersion): Promise<void>;\n  /**\n   * The Worker version whose bundle the routes came from, when one put them there (through\n   * `replaceRoutesIfNewer`, or a forced `replaceRoutes` with a version). Read from the database\n   * itself, not a cache in front of it.\n   */\n  liveBundleVersion(): Promise<BundleVersion | undefined>;\n  /**\n   * `replaceRoutes`, only when `version` is newer than the live one, recorded in the same\n   * transaction: two versions serving side by side during a rollout cannot leave the older one's\n   * routes in force. False, with nothing written, when a version as new or newer is live.\n   */\n  replaceRoutesIfNewer(bundle: BundleIR, version: BundleVersion): Promise<boolean>;\n\n  /* ----------------------------- segment membership --------------------------- */\n  isSegmentMember(segment: string, userId: string): Promise<boolean>;\n  /** Record the membership, with the workflows its entry has to start (see segment_start). */\n  addSegmentMember(\n    segment: string,\n    userId: string,\n    ts: number,\n    workflows: readonly string[]\n  ): Promise<void>;\n  /** The workflows the member's entry has not started yet. */\n  pendingSegmentStarts(segment: string, userId: string): Promise<string[]>;\n  completeSegmentStart(segment: string, userId: string, workflow: string): Promise<void>;\n  /** Drop the membership and any start it still owed. */\n  removeSegmentMember(segment: string, userId: string): Promise<void>;\n\n  /* ------------------------------- entry ledger ------------------------------- */\n  /**\n   * Record the entry (the once policy). Atomic under concurrent ingests: of\n   * two racing attempts exactly one is 'entered' (or 'reclaimed', when the\n   * pair's previous instance is recorded as 'failed') and the other null.\n   */\n  enterJourney(entry: EntryInput): Promise<EntryOutcome>;\n  removeEntry(instanceId: string): Promise<void>;\n  setEntryStatus(instanceId: string, status: string): Promise<void>;\n  /** The (workflow, user) entry as it stands, read from the database itself; undefined if none. */\n  getEntry(workflow: string, userId: string): Promise<EntryState | undefined>;\n  /**\n   * Running entries no runner has admitted, claimed before `claimedBefore` (epoch ms), oldest\n   * first: candidates for a start that was lost between the claim and the platform's create.\n   */\n  unadmittedEntries(claimedBefore: number, limit: number): Promise<UnadmittedEntry[]>;\n  /**\n   * Mark a lost start `failed`, so the pair's next trigger reclaims it. Only while the entry is\n   * still running and unadmitted under this instance id; false when it moved on meanwhile.\n   */\n  failUnadmittedEntry(instanceId: string): Promise<boolean>;\n  /**\n   * Running entries whose runner admitted itself before `admittedBefore` (epoch ms): candidates\n   * for an instance the platform ended without the run finalizing its entry. A sample of at most\n   * `limit`, in no fixed order — ordered by age, the oldest entries still legitimately running\n   * (a long wait) would fill every batch and a lost one behind them would never be reached.\n   */\n  admittedEntries(admittedBefore: number, limit: number): Promise<AdmittedEntry[]>;\n  /**\n   * Mark an admitted entry whose instance ended without finalizing `failed`, so the pair's next\n   * trigger reclaims it. Only while the entry is still running and admitted under this instance\n   * id: a run that finalized meanwhile keeps its status, and a reclaim its new attempt; false\n   * then.\n   */\n  failAdmittedEntry(instanceId: string): Promise<boolean>;\n  /** Execution starts and wake callbacks, for a runtime that submits its starts (AWS). */\n  readonly executions: ExecutionRegistry;\n\n  /* ------------------------------ wake subscriptions --------------------------- */\n  /** Distinct wake handles registered for (user, event). */\n  findWakeHandles(userId: string, event: string): Promise<string[]>;\n  /** Register the handle for each event; repeated registrations are idempotent. */\n  subscribe(handle: string, userId: string, events: readonly string[], ts: number): Promise<void>;\n  /** Drop every registration the handle holds. */\n  unsubscribe(handle: string): Promise<void>;\n}\n\nexport { JourneyFactSource } from './facts';\nexport { PostgresJourneyStore } from './postgres';\nexport { PostgresReporting } from './postgres-reporting';\nexport {\n  DEFAULT_SCHEMA,\n  TABLES,\n  renderDrizzleSchema,\n  renderPostgresDdl,\n  type TableSpec,\n  type UniqueConstraintSpec,\n} from './tables';\nexport type { PostgresJourneyStoreOptions, SqlClientLike } from './postgres';\n"],"mappings":";;;;;;;;;;;;AAiNA,IAAa,sBAAb,cAAyC,MAAM;CAGxB;CAFrB,OAAyB;CAEzB,YAAY,UAAsC;EAChD,MACE,4IAA4I,SAAS,KAAK,MAAM,GAClK;EAHmB,KAAA,WAAA;CAIrB;AACF"}

package/dist/store/index.d.cts

@@ -176,6 +176,12 @@ export interface UnadmittedEntry {
   workflow: string;
   userId: string;
 }
+/** A running entry whose runner admitted itself (`admittedEntries`). */
+export interface AdmittedEntry {
+  instanceId: string;
+  workflow: string;
+  userId: string;
+}
 /** A store plus how to release what opening it acquired (a connection, say). */
 export interface StoreLease {
   store: JourneyStore;
@@ -287,6 +293,14 @@ export interface JourneyReporting {
    * the database itself, so a replayed send step never trusts a cache that missed the settle.
    */
   messageSettled(idempotencyKey: string): Promise<boolean>;
+  /**
+   * Mark the copy as handed to the transport, committed before the send: true when this call
+   * made the claim, false when an earlier run of the step already held it — the copy may have
+   * gone out then, and the engine does not send it again (see `OutboundMessage.redelivery`).
+   */
+  claimMessage(idempotencyKey: string, at: number): Promise<boolean>;
+  /** The transport threw before taking the copy: clear the claim, so the step's retry sends it. */
+  releaseMessage(idempotencyKey: string): Promise<void>;
   settleMessage(idempotencyKey: string, result: {
     delivered: true;
   } | {
@@ -557,6 +571,20 @@ export interface JourneyStore {
    * still running and unadmitted under this instance id; false when it moved on meanwhile.
    */
   failUnadmittedEntry(instanceId: string): Promise<boolean>;
+  /**
+   * Running entries whose runner admitted itself before `admittedBefore` (epoch ms): candidates
+   * for an instance the platform ended without the run finalizing its entry. A sample of at most
+   * `limit`, in no fixed order — ordered by age, the oldest entries still legitimately running
+   * (a long wait) would fill every batch and a lost one behind them would never be reached.
+   */
+  admittedEntries(admittedBefore: number, limit: number): Promise<AdmittedEntry[]>;
+  /**
+   * Mark an admitted entry whose instance ended without finalizing `failed`, so the pair's next
+   * trigger reclaims it. Only while the entry is still running and admitted under this instance
+   * id: a run that finalized meanwhile keeps its status, and a reclaim its new attempt; false
+   * then.
+   */
+  failAdmittedEntry(instanceId: string): Promise<boolean>;
   /** Execution starts and wake callbacks, for a runtime that submits its starts (AWS). */
   readonly executions: ExecutionRegistry;
   /** Distinct wake handles registered for (user, event). */

package/dist/store/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAkBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;EAER;;;;;EAKA;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;EAKA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;;EAEA;EACA;EACA;;EAEA;EACA;;;iBAIe;;EAEf;;EAEA;EACA;;;iBAIe;EACf;;EAEA;;;iBAIe;EACf;;EAEA;;EAEA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAYH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;;EAEA;EACA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;;;;;;iBAQe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;;;;;EAKvC,eAAe,yBAAyB;EACxC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;;;;;;;;EAStC,kBACE,mBACA,YACA,0BACC;IAAU;IAAgB;;;EAE7B,cAAc,oBAAoB,QAAQ;;EAE1C,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;;iBAI1C;EACf;EACA;;iBAGe;;WAEN,WAAW;;;;;;;EAQpB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;;;;;;EAOnB,aAAa,iBAAiB,QAAQ;;EAEtC,iBAAiB,iBAAiB,QAAQ;;;;;;;;;;;;;;;;;EAiB1C,cAAc,oBAAoB,iBAAiB;;;;;;;;;;;EAWnD,WAAW,gBAAgB,aAAa;;;;;;EAOxC,aAAa,gBAAgB,iBAAiB,iBAAiB;;EAE/D,iBAAiB,gBAAgB,kBAAkB;;;;;;EAMnD,mBACE,gBACA,iBACA,kBAAkB,qBAClB,aACC;;;;;EAMH,eAAe;;;;;EAOf,YAAY,OAAO,aAAa;;;;;;;EAOhC,YACE,gBACA,eACA,SAAS,aACT,mBACC;;;;;;EAMH,kBACE,gBACA,eACA,QAAQ,yBACR;IAAQ;IAAe,QAAQ;MAC9B;IAAU,UAAU;IAA2B,OAAO;;;EAIzD,WAAW,oBAAoB;;EAE/B,aAAa,mBAAmB,aAAa;;;;;EAK7C,cAAc,gBAAgB,gBAAgB;;;;;;EAM9C,YAAY,mBAAmB,gBAAgB,aAAa,QAAQ;;EAEpE,WAAW,qBAAqB;EAGhC,WAAW,iBAAiB,QAAQ;;;;;;;EAOpC,aAAa,gBAAgB,OAAO,cAAc,cAAc,QAAQ;;;;;;;;EASxE,sBAAsB;IACpB;MAAqB;MAAY,WAAW;;IAC5C;IACA;IACA;MACE,QAAQ;;EAIZ,YAAY,kBAAkB,QAAQ;;;;;;;EAOtC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;;;;;;EAY5C,cAAc,QAAQ,UAAU,UAAU,gBAAgB;;;;;;EAM1D,qBAAqB,QAAQ;;;;;;EAM7B,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;EAGhE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;EAEpD,SAAS,kBAAkB,iBAAiB,QAAQ;;;;;EAKpD,kBAAkB,uBAAuB,gBAAgB,QAAQ;;;;;EAKjE,oBAAoB,qBAAqB;;WAEhC,YAAY;;EAIrB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAkBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;EAER;;;;;EAKA;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;EAKA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;;EAEA;EACA;EACA;;EAEA;EACA;;;iBAIe;;EAEf;;EAEA;EACA;;;iBAIe;EACf;;EAEA;;;iBAIe;EACf;;EAEA;;EAEA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAYH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;;EAEA;EACA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;;;;;;iBAQe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;;;;;EAKvC,eAAe,yBAAyB;;;;;;EAMxC,aAAa,wBAAwB,aAAa;;EAElD,eAAe,yBAAyB;EACxC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;;;;;;;;EAStC,kBACE,mBACA,YACA,0BACC;IAAU;IAAgB;;;EAE7B,cAAc,oBAAoB,QAAQ;;EAE1C,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;;iBAI1C;EACf;EACA;;iBAGe;;WAEN,WAAW;;;;;;;EAQpB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;;;;;;EAOnB,aAAa,iBAAiB,QAAQ;;EAEtC,iBAAiB,iBAAiB,QAAQ;;;;;;;;;;;;;;;;;EAiB1C,cAAc,oBAAoB,iBAAiB;;;;;;;;;;;EAWnD,WAAW,gBAAgB,aAAa;;;;;;EAOxC,aAAa,gBAAgB,iBAAiB,iBAAiB;;EAE/D,iBAAiB,gBAAgB,kBAAkB;;;;;;EAMnD,mBACE,gBACA,iBACA,kBAAkB,qBAClB,aACC;;;;;EAMH,eAAe;;;;;EAOf,YAAY,OAAO,aAAa;;;;;;;EAOhC,YACE,gBACA,eACA,SAAS,aACT,mBACC;;;;;;EAMH,kBACE,gBACA,eACA,QAAQ,yBACR;IAAQ;IAAe,QAAQ;MAC9B;IAAU,UAAU;IAA2B,OAAO;;;EAIzD,WAAW,oBAAoB;;EAE/B,aAAa,mBAAmB,aAAa;;;;;EAK7C,cAAc,gBAAgB,gBAAgB;;;;;;EAM9C,YAAY,mBAAmB,gBAAgB,aAAa,QAAQ;;EAEpE,WAAW,qBAAqB;EAGhC,WAAW,iBAAiB,QAAQ;;;;;;;EAOpC,aAAa,gBAAgB,OAAO,cAAc,cAAc,QAAQ;;;;;;;;EASxE,sBAAsB;IACpB;MAAqB;MAAY,WAAW;;IAC5C;IACA;IACA;MACE,QAAQ;;EAIZ,YAAY,kBAAkB,QAAQ;;;;;;;EAOtC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;;;;;;EAY5C,cAAc,QAAQ,UAAU,UAAU,gBAAgB;;;;;;EAM1D,qBAAqB,QAAQ;;;;;;EAM7B,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;EAGhE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;EAEpD,SAAS,kBAAkB,iBAAiB,QAAQ;;;;;EAKpD,kBAAkB,uBAAuB,gBAAgB,QAAQ;;;;;EAKjE,oBAAoB,qBAAqB;;;;;;;EAOzC,gBAAgB,wBAAwB,gBAAgB,QAAQ;;;;;;;EAOhE,kBAAkB,qBAAqB;;WAE9B,YAAY;;EAIrB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}

package/dist/store/index.d.mts

@@ -176,6 +176,12 @@ export interface UnadmittedEntry {
   workflow: string;
   userId: string;
 }
+/** A running entry whose runner admitted itself (`admittedEntries`). */
+export interface AdmittedEntry {
+  instanceId: string;
+  workflow: string;
+  userId: string;
+}
 /** A store plus how to release what opening it acquired (a connection, say). */
 export interface StoreLease {
   store: JourneyStore;
@@ -287,6 +293,14 @@ export interface JourneyReporting {
    * the database itself, so a replayed send step never trusts a cache that missed the settle.
    */
   messageSettled(idempotencyKey: string): Promise<boolean>;
+  /**
+   * Mark the copy as handed to the transport, committed before the send: true when this call
+   * made the claim, false when an earlier run of the step already held it — the copy may have
+   * gone out then, and the engine does not send it again (see `OutboundMessage.redelivery`).
+   */
+  claimMessage(idempotencyKey: string, at: number): Promise<boolean>;
+  /** The transport threw before taking the copy: clear the claim, so the step's retry sends it. */
+  releaseMessage(idempotencyKey: string): Promise<void>;
   settleMessage(idempotencyKey: string, result: {
     delivered: true;
   } | {
@@ -557,6 +571,20 @@ export interface JourneyStore {
    * still running and unadmitted under this instance id; false when it moved on meanwhile.
    */
   failUnadmittedEntry(instanceId: string): Promise<boolean>;
+  /**
+   * Running entries whose runner admitted itself before `admittedBefore` (epoch ms): candidates
+   * for an instance the platform ended without the run finalizing its entry. A sample of at most
+   * `limit`, in no fixed order — ordered by age, the oldest entries still legitimately running
+   * (a long wait) would fill every batch and a lost one behind them would never be reached.
+   */
+  admittedEntries(admittedBefore: number, limit: number): Promise<AdmittedEntry[]>;
+  /**
+   * Mark an admitted entry whose instance ended without finalizing `failed`, so the pair's next
+   * trigger reclaims it. Only while the entry is still running and admitted under this instance
+   * id: a run that finalized meanwhile keeps its status, and a reclaim its new attempt; false
+   * then.
+   */
+  failAdmittedEntry(instanceId: string): Promise<boolean>;
   /** Execution starts and wake callbacks, for a runtime that submits its starts (AWS). */
   readonly executions: ExecutionRegistry;
   /** Distinct wake handles registered for (user, event). */

package/dist/store/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAkBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;EAER;;;;;EAKA;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;EAKA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;;EAEA;EACA;EACA;;EAEA;EACA;;;iBAIe;;EAEf;;EAEA;EACA;;;iBAIe;EACf;;EAEA;;;iBAIe;EACf;;EAEA;;EAEA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAYH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;;EAEA;EACA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;;;;;;iBAQe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;;;;;EAKvC,eAAe,yBAAyB;EACxC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;;;;;;;;EAStC,kBACE,mBACA,YACA,0BACC;IAAU;IAAgB;;;EAE7B,cAAc,oBAAoB,QAAQ;;EAE1C,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;;iBAI1C;EACf;EACA;;iBAGe;;WAEN,WAAW;;;;;;;EAQpB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;;;;;;EAOnB,aAAa,iBAAiB,QAAQ;;EAEtC,iBAAiB,iBAAiB,QAAQ;;;;;;;;;;;;;;;;;EAiB1C,cAAc,oBAAoB,iBAAiB;;;;;;;;;;;EAWnD,WAAW,gBAAgB,aAAa;;;;;;EAOxC,aAAa,gBAAgB,iBAAiB,iBAAiB;;EAE/D,iBAAiB,gBAAgB,kBAAkB;;;;;;EAMnD,mBACE,gBACA,iBACA,kBAAkB,qBAClB,aACC;;;;;EAMH,eAAe;;;;;EAOf,YAAY,OAAO,aAAa;;;;;;;EAOhC,YACE,gBACA,eACA,SAAS,aACT,mBACC;;;;;;EAMH,kBACE,gBACA,eACA,QAAQ,yBACR;IAAQ;IAAe,QAAQ;MAC9B;IAAU,UAAU;IAA2B,OAAO;;;EAIzD,WAAW,oBAAoB;;EAE/B,aAAa,mBAAmB,aAAa;;;;;EAK7C,cAAc,gBAAgB,gBAAgB;;;;;;EAM9C,YAAY,mBAAmB,gBAAgB,aAAa,QAAQ;;EAEpE,WAAW,qBAAqB;EAGhC,WAAW,iBAAiB,QAAQ;;;;;;;EAOpC,aAAa,gBAAgB,OAAO,cAAc,cAAc,QAAQ;;;;;;;;EASxE,sBAAsB;IACpB;MAAqB;MAAY,WAAW;;IAC5C;IACA;IACA;MACE,QAAQ;;EAIZ,YAAY,kBAAkB,QAAQ;;;;;;;EAOtC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;;;;;;EAY5C,cAAc,QAAQ,UAAU,UAAU,gBAAgB;;;;;;EAM1D,qBAAqB,QAAQ;;;;;;EAM7B,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;EAGhE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;EAEpD,SAAS,kBAAkB,iBAAiB,QAAQ;;;;;EAKpD,kBAAkB,uBAAuB,gBAAgB,QAAQ;;;;;EAKjE,oBAAoB,qBAAqB;;WAEhC,YAAY;;EAIrB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/store/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAkBY,eAAe,eAAe;iBAEzB;;EAEf;EACA;EACA;EACA;EACA,SAAS;;iBAGM;EACf;EACA;;EAEA,OAAO;;EAEP,QAAQ;;EAER;;;;;EAKA;;iBAGe;EACf;EACA;EACA;;EAEA;;;;;;iBAOe;EACf;;EAEA;;iBAGe;EACf;EACA;EACA;EACA;EACA;;;;;EAKA,YAAY;;;iBAIG;;EAEf;;EAEA;;EAEA;;iBAGe,wBAAwB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;;;;;;;iBAQe;EACf,IAAI,qBAAqB,QAAQ;;;;;EAKjC,cAAc;IACZ;IACA;IACA;IACA;MACE,QAAQ;EACZ,cAAc,oBAAoB,yBAAyB,aAAa;EACxE,eAAe,oBAAoB,aAAa;EAChD,OAAO,oBAAoB,cAAc;;EAEzC,YACE,oBACA;IAAY;IAAY;IAAoB;MAC3C;;EAEH,cAAc,oBAAoB,qBAAqB;;EAEvD,YAAY,eAAe,wBAAwB,QAAQ;EAC3D,YAAY,oBAAoB,aAAa;;EAE7C,YAAY,oBAAoB,aAAa;;;;;;;YAQnC;;iBAGK;EACf;;EAEA;EACA;EACA;;EAEA;EACA;;;iBAIe;;EAEf;;EAEA;EACA;;;iBAIe;EACf;;EAEA;;;iBAIe;EACf;;EAEA;;EAEA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf,OAAO;EACP,cAAc;;;;;;qBAYH,4BAA4B;WAGlB;WAFH;EAElB,YAAqB;;;iBAQN;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;;EAEA;EACA;;;iBAIe;EACf;EACA;EACA;;;iBAIe;EACf;EACA;;;iBAIe;EACf;EACA;EACA;;EAEA;IAAU;IAAkB;;;;iBAIb;EACf;EACA;;EAEA;EACA;;EAEA;EACA;EACA;;;;;;;;iBASe;EACf;EACA;;;;;;;iBAQe;EACf;EACA;;iBAGe;;EAEf,gBAAgB;IACd;IACA;IACA;IACA;MACE;EACJ,YAAY;IACV;IACA;IACA;IACA;IACA;MACE;EACJ,iBAAiB;IACf;IACA;IACA;IACA;IACA;IACA;MACE;;EAEJ,cAAc,SAAS,gBAAgB;;;;;EAKvC,eAAe,yBAAyB;;;;;;EAMxC,aAAa,wBAAwB,aAAa;;EAElD,eAAe,yBAAyB;EACxC,cACE,wBACA;IAAU;;IAAsB;IAAkB;KAClD,aACC;;EAEH,YAAY,mBAAmB,0BAA0B;;;;;;EAMzD,WACE,mBACA,QAAQ;IAAW;IAAgB;QAA0B,yBAC5D;;;;;;;;;EASH,YACE,mBACA,kBACA,YACA,kBACA,QAAQ,MAAM;IAAmB,YAAY;IAAY;MACxD;IAAU;IAAa,YAAY;;;;;;;;;;EAStC,kBACE,mBACA,YACA,0BACC;IAAU;IAAgB;;;EAE7B,cAAc,oBAAoB,QAAQ;;EAE1C,sBAAsB,mBAAmB,aAAa;;EAEtD,iBAAiB,aAAa;IAAU;IAAiB;;;;iBAI1C;EACf;EACA;;iBAGe;;WAEN,WAAW;;;;;;;EAQpB,eAAe,gBAAgB,aAAa;;EAE5C,mBAAmB;;;;;;;EAOnB,aAAa,iBAAiB,QAAQ;;EAEtC,iBAAiB,iBAAiB,QAAQ;;;;;;;;;;;;;;;;;EAiB1C,cAAc,oBAAoB,iBAAiB;;;;;;;;;;;EAWnD,WAAW,gBAAgB,aAAa;;;;;;EAOxC,aAAa,gBAAgB,iBAAiB,iBAAiB;;EAE/D,iBAAiB,gBAAgB,kBAAkB;;;;;;EAMnD,mBACE,gBACA,iBACA,kBAAkB,qBAClB,aACC;;;;;EAMH,eAAe;;;;;EAOf,YAAY,OAAO,aAAa;;;;;;;EAOhC,YACE,gBACA,eACA,SAAS,aACT,mBACC;;;;;;EAMH,kBACE,gBACA,eACA,QAAQ,yBACR;IAAQ;IAAe,QAAQ;MAC9B;IAAU,UAAU;IAA2B,OAAO;;;EAIzD,WAAW,oBAAoB;;EAE/B,aAAa,mBAAmB,aAAa;;;;;EAK7C,cAAc,gBAAgB,gBAAgB;;;;;;EAM9C,YAAY,mBAAmB,gBAAgB,aAAa,QAAQ;;EAEpE,WAAW,qBAAqB;EAGhC,WAAW,iBAAiB,QAAQ;;;;;;;EAOpC,aAAa,gBAAgB,OAAO,cAAc,cAAc,QAAQ;;;;;;;;EASxE,sBAAsB;IACpB;MAAqB;MAAY,WAAW;;IAC5C;IACA;IACA;MACE,QAAQ;;EAIZ,YAAY,kBAAkB,QAAQ;;;;;;;EAOtC,aAAa,QAAQ,cAAc;;EAEnC,aAAa,gBAAgB;;;;;EAK7B,aAAa,gBAAgB;EAG7B,oBAAoB,aAAa,QAAQ;;EAEzC,gBAAgB;IAAU;IAAY,WAAW;;EACjD,aAAa,gBAAgB,QAAQ;EACrC,uBAAuB,QAAQ;EAC/B,cAAc,UAAU,aAAa;EACrC,cAAc,sBAAsB,QAAQ;;;;;;;;;;;;EAY5C,cAAc,QAAQ,UAAU,UAAU,gBAAgB;;;;;;EAM1D,qBAAqB,QAAQ;;;;;;EAM7B,qBAAqB,QAAQ,UAAU,SAAS,gBAAgB;EAGhE,gBAAgB,iBAAiB,iBAAiB;;EAElD,iBACE,iBACA,gBACA,YACA,+BACC;;EAEH,qBAAqB,iBAAiB,iBAAiB;EACvD,qBAAqB,iBAAiB,gBAAgB,mBAAmB;;EAEzE,oBAAoB,iBAAiB,iBAAiB;;;;;;EAQtD,aAAa,OAAO,aAAa,QAAQ;EACzC,YAAY,qBAAqB;EACjC,eAAe,oBAAoB,iBAAiB;;EAEpD,SAAS,kBAAkB,iBAAiB,QAAQ;;;;;EAKpD,kBAAkB,uBAAuB,gBAAgB,QAAQ;;;;;EAKjE,oBAAoB,qBAAqB;;;;;;;EAOzC,gBAAgB,wBAAwB,gBAAgB,QAAQ;;;;;;;EAOhE,kBAAkB,qBAAqB;;WAE9B,YAAY;;EAIrB,gBAAgB,gBAAgB,gBAAgB;;EAEhD,UAAU,gBAAgB,gBAAgB,2BAA2B,aAAa;;EAElF,YAAY,iBAAiB"}