@aglyn/tenant-data-admin 1.0.0-beta.230 → 1.0.0-beta.232

package/src/lib/server/push-delivery.d.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The native apps' push delivery (AGL-3651): a notification the fan-out
+ * wrote goes to each recipient's registered devices, grouped by transport —
+ * APNs for iOS and macOS (`push-apns.ts`), FCM for Android (`push-fcm.ts`).
+ *
+ * Server-only. `registerNativePushSenders` (`native-push.ts`) registers
+ * `nativePushSender` with the fan-out and imports this file only when a
+ * notification has push recipients, and this file imports each transport
+ * only when a device needs it.
+ *
+ * A row the registry no longer accepts is pruned here: an Expo row from the
+ * React Native app, a row with no transport, a token that does not fit its
+ * transport, and a device not seen for `MOBILE_DEVICE_STALE_MS`. A token a
+ * transport reports as gone is pruned after the send.
+ */
+import { type ApnsEnvironment, type MobileDeviceApp, type MobilePushData, type MobilePushTransport } from '@aglyn/aglyn/app-utils/notification-push';
+import type { Firestore } from 'firebase-admin/firestore';
+import type { MobilePushPayload, MobilePushSender } from './mobile-push-switch';
+/** One device a transport sends to. */
+export interface PushTarget {
+    token: string;
+    app: MobileDeviceApp;
+    /** APNs: the app's bundle id, which is the push topic. */
+    topic: string;
+    apnsEnvironment?: ApnsEnvironment;
+}
+/** What every device of one notification is sent. */
+export interface PushMessage {
+    title: string;
+    body?: string;
+    data: MobilePushData;
+    /** Critical and warning notifications ask the platform to deliver now. */
+    urgent: boolean;
+}
+/** A transport's verdict for each target, in order. `prune`: the token is gone; forget the row. */
+export type PushOutcome = 'sent' | 'prune' | 'failed';
+export interface PushTransport {
+    send(targets: readonly PushTarget[], message: PushMessage): Promise<PushOutcome[]>;
+}
+export interface PushDeliveryDeps {
+    db: Firestore;
+    /** Each transport, or null when the deployment has none configured. Resolved only when a device needs it. */
+    transport: (kind: MobilePushTransport) => Promise<PushTransport | null>;
+    now?: () => number;
+}
+export interface PushDeliveryResult {
+    sent: number;
+    /** Rows removed: stale, Expo or malformed rows, and tokens a transport reported gone. */
+    pruned: number;
+    failed: number;
+    /** Devices not sent to because their transport is not configured. */
+    skipped: number;
+}
+export declare function pushMessage(payload: MobilePushPayload, link: string | undefined): PushMessage;
+/**
+ * Sends one notification to every live device of `uids`, each through its
+ * own transport. Never throws: the console notification is the record, and a
+ * push is a courtesy beside it.
+ */
+export declare function deliverNativePush(uids: readonly string[], payload: MobilePushPayload, deps: PushDeliveryDeps): Promise<PushDeliveryResult>;
+/** The sender `registerNativePushSenders` hands the fan-out. */
+export declare const nativePushSender: MobilePushSender;

package/src/lib/server/push-delivery.js

@@ -0,0 +1,176 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The native apps' push delivery (AGL-3651): a notification the fan-out
+ * wrote goes to each recipient's registered devices, grouped by transport —
+ * APNs for iOS and macOS (`push-apns.ts`), FCM for Android (`push-fcm.ts`).
+ *
+ * Server-only. `registerNativePushSenders` (`native-push.ts`) registers
+ * `nativePushSender` with the fan-out and imports this file only when a
+ * notification has push recipients, and this file imports each transport
+ * only when a device needs it.
+ *
+ * A row the registry no longer accepts is pruned here: an Expo row from the
+ * React Native app, a row with no transport, a token that does not fit its
+ * transport, and a device not seen for `MOBILE_DEVICE_STALE_MS`. A token a
+ * transport reports as gone is pruned after the send.
+ */ import { isMobilePushToken, MOBILE_APP_BUNDLES, MOBILE_DEVICE_STALE_MS, MOBILE_DEVICES_COLLECTION, MOBILE_DEVICES_PER_USER, mobilePushData } from "@aglyn/aglyn/app-utils/notification-push";
+import { normalizeNotificationLink } from "@aglyn/aglyn/server";
+/** The most devices one notification is sent to, whatever the audience. */ const MAX_DEVICES = 1000;
+/** A stored timestamp as epoch millis, or null when there is none. */ function millis(value) {
+    if (!value) return null;
+    if (typeof value === 'number') return value;
+    const withMillis = value;
+    return typeof withMillis.toMillis === 'function' ? withMillis.toMillis() : null;
+}
+export function pushMessage(payload, link) {
+    return _extends({
+        title: payload.title
+    }, payload.body ? {
+        body: payload.body
+    } : {}, {
+        data: mobilePushData(_extends({}, payload, {
+            link
+        })),
+        urgent: payload.level === 'critical' || payload.level === 'warning'
+    });
+}
+/** The link the app opens: the stored one, rewritten onto today's console routes. */ async function pushLink(db, payload) {
+    if (!payload.link) return undefined;
+    if (!payload.orgId) return normalizeNotificationLink(payload.link, {});
+    try {
+        var _payload_hostId;
+        const [org, host] = await Promise.all([
+            db.collection('orgs').doc(payload.orgId).get(),
+            payload.hostId ? db.collection('hosts').doc(payload.hostId).get() : Promise.resolve(null)
+        ]);
+        const slug = org.get('slug');
+        const subdomain = host == null ? void 0 : host.get('subdomain');
+        return normalizeNotificationLink(payload.link, {
+            orgSlug: typeof slug === 'string' ? slug : null,
+            hostId: (_payload_hostId = payload.hostId) != null ? _payload_hostId : null,
+            hostSubdomain: typeof subdomain === 'string' ? subdomain : null
+        });
+    } catch (unused) {
+        return normalizeNotificationLink(payload.link, {});
+    }
+}
+const isApp = (value)=>value === 'aglyn' || value === 'aglyn-pos';
+/**
+ * Sends one notification to every live device of `uids`, each through its
+ * own transport. Never throws: the console notification is the record, and a
+ * push is a courtesy beside it.
+ */ export async function deliverNativePush(uids, payload, deps) {
+    var _deps_now;
+    const result = {
+        sent: 0,
+        pruned: 0,
+        failed: 0,
+        skipped: 0
+    };
+    if (!uids.length) return result;
+    const now = ((_deps_now = deps.now) != null ? _deps_now : Date.now)();
+    const prune = async (ref)=>{
+        await ref.delete().catch(()=>undefined);
+        result.pruned += 1;
+    };
+    try {
+        const { db } = deps;
+        const groups = new Map();
+        const seen = new Set();
+        let total = 0;
+        for (const uid of uids){
+            const devices = await db.collection('users').doc(uid).collection(MOBILE_DEVICES_COLLECTION).limit(MOBILE_DEVICES_PER_USER).get();
+            for (const device of devices.docs){
+                var _groups_get;
+                const transport = device.get('transport');
+                const token = device.get('token');
+                const app = device.get('app');
+                if (!isMobilePushToken(transport, token) || !isApp(app)) {
+                    await prune(device.ref);
+                    continue;
+                }
+                const lastSeen = millis(device.get('lastSeen'));
+                if (lastSeen !== null && now - lastSeen > MOBILE_DEVICE_STALE_MS) {
+                    await prune(device.ref);
+                    continue;
+                }
+                if (seen.has(token) || total >= MAX_DEVICES) continue;
+                seen.add(token);
+                total += 1;
+                const environment = device.get('apnsEnvironment');
+                const target = _extends({
+                    token,
+                    app,
+                    topic: MOBILE_APP_BUNDLES[app]
+                }, transport === 'apns' && (environment === 'sandbox' || environment === 'production') ? {
+                    apnsEnvironment: environment
+                } : {});
+                const group = (_groups_get = groups.get(transport)) != null ? _groups_get : [];
+                group.push({
+                    target,
+                    ref: device.ref
+                });
+                groups.set(transport, group);
+            }
+        }
+        if (!groups.size) return result;
+        const message = pushMessage(payload, await pushLink(db, payload));
+        for (const [kind, entries] of groups){
+            let transport = null;
+            try {
+                transport = await deps.transport(kind);
+            } catch (error) {
+                console.error(`push transport ${kind} failed to load`, error);
+            }
+            if (!transport) {
+                result.skipped += entries.length;
+                continue;
+            }
+            let outcomes;
+            try {
+                outcomes = await transport.send(entries.map((entry)=>entry.target), message);
+            } catch (error) {
+                console.error(`push transport ${kind} failed`, error);
+                result.failed += entries.length;
+                continue;
+            }
+            for (const [index, entry] of entries.entries()){
+                var _outcomes_index;
+                const outcome = (_outcomes_index = outcomes[index]) != null ? _outcomes_index : 'failed';
+                if (outcome === 'sent') result.sent += 1;
+                else if (outcome === 'prune') await prune(entry.ref);
+                else result.failed += 1;
+            }
+        }
+    } catch (error) {
+        console.error('push delivery failed', error);
+    }
+    return result;
+}
+/** The deployment's transports, each imported the first time a device needs it. */ async function deploymentTransport(kind) {
+    if (kind === 'apns') return (await import("./push-apns.js")).apnsTransport();
+    return (await import("./push-fcm.js")).fcmTransport();
+}
+/** The sender `registerNativePushSenders` hands the fan-out. */ export const nativePushSender = async (uids, payload, { db })=>{
+    await deliverNativePush(uids, payload, {
+        db,
+        transport: deploymentTransport
+    });
+};
+
+//# sourceMappingURL=push-delivery.js.map

package/src/lib/server/push-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/push-delivery.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The native apps' push delivery (AGL-3651): a notification the fan-out\n * wrote goes to each recipient's registered devices, grouped by transport —\n * APNs for iOS and macOS (`push-apns.ts`), FCM for Android (`push-fcm.ts`).\n *\n * Server-only. `registerNativePushSenders` (`native-push.ts`) registers\n * `nativePushSender` with the fan-out and imports this file only when a\n * notification has push recipients, and this file imports each transport\n * only when a device needs it.\n *\n * A row the registry no longer accepts is pruned here: an Expo row from the\n * React Native app, a row with no transport, a token that does not fit its\n * transport, and a device not seen for `MOBILE_DEVICE_STALE_MS`. A token a\n * transport reports as gone is pruned after the send.\n */\n\nimport {\n  isMobilePushToken,\n  MOBILE_APP_BUNDLES,\n  MOBILE_DEVICE_STALE_MS,\n  MOBILE_DEVICES_COLLECTION,\n  MOBILE_DEVICES_PER_USER,\n  mobilePushData,\n  type ApnsEnvironment,\n  type MobileDeviceApp,\n  type MobilePushData,\n  type MobilePushTransport,\n} from '@aglyn/aglyn/app-utils/notification-push'\nimport { normalizeNotificationLink } from '@aglyn/aglyn/server'\nimport type { DocumentReference, Firestore } from 'firebase-admin/firestore'\nimport type { MobilePushPayload, MobilePushSender } from './mobile-push-switch'\n\n/** The most devices one notification is sent to, whatever the audience. */\nconst MAX_DEVICES = 1000\n\n/** One device a transport sends to. */\nexport interface PushTarget {\n  token: string\n  app: MobileDeviceApp\n  /** APNs: the app's bundle id, which is the push topic. */\n  topic: string\n  apnsEnvironment?: ApnsEnvironment\n}\n\n/** What every device of one notification is sent. */\nexport interface PushMessage {\n  title: string\n  body?: string\n  data: MobilePushData\n  /** Critical and warning notifications ask the platform to deliver now. */\n  urgent: boolean\n}\n\n/** A transport's verdict for each target, in order. `prune`: the token is gone; forget the row. */\nexport type PushOutcome = 'sent' | 'prune' | 'failed'\n\nexport interface PushTransport {\n  send(targets: readonly PushTarget[], message: PushMessage): Promise<PushOutcome[]>\n}\n\nexport interface PushDeliveryDeps {\n  db: Firestore\n  /** Each transport, or null when the deployment has none configured. Resolved only when a device needs it. */\n  transport: (kind: MobilePushTransport) => Promise<PushTransport | null>\n  now?: () => number\n}\n\nexport interface PushDeliveryResult {\n  sent: number\n  /** Rows removed: stale, Expo or malformed rows, and tokens a transport reported gone. */\n  pruned: number\n  failed: number\n  /** Devices not sent to because their transport is not configured. */\n  skipped: number\n}\n\n/** A stored timestamp as epoch millis, or null when there is none. */\nfunction millis(value: unknown): number | null {\n  if (!value) return null\n  if (typeof value === 'number') return value\n  const withMillis = value as { toMillis?: () => number }\n  return typeof withMillis.toMillis === 'function' ? withMillis.toMillis() : null\n}\n\nexport function pushMessage(payload: MobilePushPayload, link: string | undefined): PushMessage {\n  return {\n    title: payload.title,\n    ...(payload.body ? { body: payload.body } : {}),\n    data: mobilePushData({ ...payload, link }),\n    urgent: payload.level === 'critical' || payload.level === 'warning',\n  }\n}\n\n/** The link the app opens: the stored one, rewritten onto today's console routes. */\nasync function pushLink(db: Firestore, payload: MobilePushPayload): Promise<string | undefined> {\n  if (!payload.link) return undefined\n  if (!payload.orgId) return normalizeNotificationLink(payload.link, {})\n  try {\n    const [org, host] = await Promise.all([\n      db.collection('orgs').doc(payload.orgId).get(),\n      payload.hostId ? db.collection('hosts').doc(payload.hostId).get() : Promise.resolve(null),\n    ])\n    const slug = org.get('slug')\n    const subdomain = host?.get('subdomain')\n    return normalizeNotificationLink(payload.link, {\n      orgSlug: typeof slug === 'string' ? slug : null,\n      hostId: payload.hostId ?? null,\n      hostSubdomain: typeof subdomain === 'string' ? subdomain : null,\n    })\n  } catch {\n    return normalizeNotificationLink(payload.link, {})\n  }\n}\n\nconst isApp = (value: unknown): value is MobileDeviceApp => value === 'aglyn' || value === 'aglyn-pos'\n\n/**\n * Sends one notification to every live device of `uids`, each through its\n * own transport. Never throws: the console notification is the record, and a\n * push is a courtesy beside it.\n */\nexport async function deliverNativePush(\n  uids: readonly string[],\n  payload: MobilePushPayload,\n  deps: PushDeliveryDeps,\n): Promise<PushDeliveryResult> {\n  const result: PushDeliveryResult = { sent: 0, pruned: 0, failed: 0, skipped: 0 }\n  if (!uids.length) return result\n  const now = (deps.now ?? Date.now)()\n  const prune = async (ref: DocumentReference) => {\n    await ref.delete().catch(() => undefined)\n    result.pruned += 1\n  }\n  try {\n    const { db } = deps\n    const groups = new Map<MobilePushTransport, Array<{ target: PushTarget; ref: DocumentReference }>>()\n    const seen = new Set<string>()\n    let total = 0\n    for (const uid of uids) {\n      const devices = await db\n        .collection('users')\n        .doc(uid)\n        .collection(MOBILE_DEVICES_COLLECTION)\n        .limit(MOBILE_DEVICES_PER_USER)\n        .get()\n      for (const device of devices.docs) {\n        const transport = device.get('transport')\n        const token = device.get('token')\n        const app = device.get('app')\n        if (!isMobilePushToken(transport, token) || !isApp(app)) {\n          await prune(device.ref)\n          continue\n        }\n        const lastSeen = millis(device.get('lastSeen'))\n        if (lastSeen !== null && now - lastSeen > MOBILE_DEVICE_STALE_MS) {\n          await prune(device.ref)\n          continue\n        }\n        if (seen.has(token) || total >= MAX_DEVICES) continue\n        seen.add(token)\n        total += 1\n        const environment = device.get('apnsEnvironment')\n        const target: PushTarget = {\n          token,\n          app,\n          topic: MOBILE_APP_BUNDLES[app],\n          ...(transport === 'apns' && (environment === 'sandbox' || environment === 'production')\n            ? { apnsEnvironment: environment }\n            : {}),\n        }\n        const group = groups.get(transport) ?? []\n        group.push({ target, ref: device.ref })\n        groups.set(transport, group)\n      }\n    }\n    if (!groups.size) return result\n    const message = pushMessage(payload, await pushLink(db, payload))\n    for (const [kind, entries] of groups) {\n      let transport: PushTransport | null = null\n      try {\n        transport = await deps.transport(kind)\n      } catch (error) {\n        console.error(`push transport ${kind} failed to load`, error)\n      }\n      if (!transport) {\n        result.skipped += entries.length\n        continue\n      }\n      let outcomes: PushOutcome[]\n      try {\n        outcomes = await transport.send(\n          entries.map((entry) => entry.target),\n          message,\n        )\n      } catch (error) {\n        console.error(`push transport ${kind} failed`, error)\n        result.failed += entries.length\n        continue\n      }\n      for (const [index, entry] of entries.entries()) {\n        const outcome = outcomes[index] ?? 'failed'\n        if (outcome === 'sent') result.sent += 1\n        else if (outcome === 'prune') await prune(entry.ref)\n        else result.failed += 1\n      }\n    }\n  } catch (error) {\n    console.error('push delivery failed', error)\n  }\n  return result\n}\n\n/** The deployment's transports, each imported the first time a device needs it. */\nasync function deploymentTransport(kind: MobilePushTransport): Promise<PushTransport | null> {\n  if (kind === 'apns') return (await import('./push-apns')).apnsTransport()\n  return (await import('./push-fcm')).fcmTransport()\n}\n\n/** The sender `registerNativePushSenders` hands the fan-out. */\nexport const nativePushSender: MobilePushSender = async (uids, payload, { db }) => {\n  await deliverNativePush(uids, payload, { db, transport: deploymentTransport })\n}\n"],"names":["isMobilePushToken","MOBILE_APP_BUNDLES","MOBILE_DEVICE_STALE_MS","MOBILE_DEVICES_COLLECTION","MOBILE_DEVICES_PER_USER","mobilePushData","normalizeNotificationLink","MAX_DEVICES","millis","value","withMillis","toMillis","pushMessage","payload","link","title","body","data","urgent","level","pushLink","db","undefined","orgId","org","host","Promise","all","collection","doc","get","hostId","resolve","slug","subdomain","orgSlug","hostSubdomain","isApp","deliverNativePush","uids","deps","result","sent","pruned","failed","skipped","length","now","Date","prune","ref","delete","catch","groups","Map","seen","Set","total","uid","devices","limit","device","docs","transport","token","app","lastSeen","has","add","environment","target","topic","apnsEnvironment","group","push","set","size","message","kind","entries","error","console","outcomes","send","map","entry","index","outcome","deploymentTransport","apnsTransport","fcmTransport","nativePushSender"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;CAcC,GAED,SACEA,iBAAiB,EACjBC,kBAAkB,EAClBC,sBAAsB,EACtBC,yBAAyB,EACzBC,uBAAuB,EACvBC,cAAc,QAKT,2CAA0C;AACjD,SAASC,yBAAyB,QAAQ,sBAAqB;AAI/D,yEAAyE,GACzE,MAAMC,cAAc;AA2CpB,oEAAoE,GACpE,SAASC,OAAOC,KAAc;IAC5B,IAAI,CAACA,OAAO,OAAO;IACnB,IAAI,OAAOA,UAAU,UAAU,OAAOA;IACtC,MAAMC,aAAaD;IACnB,OAAO,OAAOC,WAAWC,QAAQ,KAAK,aAAaD,WAAWC,QAAQ,KAAK;AAC7E;AAEA,OAAO,SAASC,YAAYC,OAA0B,EAAEC,IAAwB;IAC9E,OAAO;QACLC,OAAOF,QAAQE,KAAK;OAChBF,QAAQG,IAAI,GAAG;QAAEA,MAAMH,QAAQG,IAAI;IAAC,IAAI,CAAC;QAC7CC,MAAMZ,eAAe,aAAKQ;YAASC;;QACnCI,QAAQL,QAAQM,KAAK,KAAK,cAAcN,QAAQM,KAAK,KAAK;;AAE9D;AAEA,mFAAmF,GACnF,eAAeC,SAASC,EAAa,EAAER,OAA0B;IAC/D,IAAI,CAACA,QAAQC,IAAI,EAAE,OAAOQ;IAC1B,IAAI,CAACT,QAAQU,KAAK,EAAE,OAAOjB,0BAA0BO,QAAQC,IAAI,EAAE,CAAC;IACpE,IAAI;YASQD;QARV,MAAM,CAACW,KAAKC,KAAK,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACpCN,GAAGO,UAAU,CAAC,QAAQC,GAAG,CAAChB,QAAQU,KAAK,EAAEO,GAAG;YAC5CjB,QAAQkB,MAAM,GAAGV,GAAGO,UAAU,CAAC,SAASC,GAAG,CAAChB,QAAQkB,MAAM,EAAED,GAAG,KAAKJ,QAAQM,OAAO,CAAC;SACrF;QACD,MAAMC,OAAOT,IAAIM,GAAG,CAAC;QACrB,MAAMI,YAAYT,wBAAAA,KAAMK,GAAG,CAAC;QAC5B,OAAOxB,0BAA0BO,QAAQC,IAAI,EAAE;YAC7CqB,SAAS,OAAOF,SAAS,WAAWA,OAAO;YAC3CF,MAAM,GAAElB,kBAAAA,QAAQkB,MAAM,YAAdlB,kBAAkB;YAC1BuB,eAAe,OAAOF,cAAc,WAAWA,YAAY;QAC7D;IACF,EAAE,eAAM;QACN,OAAO5B,0BAA0BO,QAAQC,IAAI,EAAE,CAAC;IAClD;AACF;AAEA,MAAMuB,QAAQ,CAAC5B,QAA6CA,UAAU,WAAWA,UAAU;AAE3F;;;;CAIC,GACD,OAAO,eAAe6B,kBACpBC,IAAuB,EACvB1B,OAA0B,EAC1B2B,IAAsB;QAITA;IAFb,MAAMC,SAA6B;QAAEC,MAAM;QAAGC,QAAQ;QAAGC,QAAQ;QAAGC,SAAS;IAAE;IAC/E,IAAI,CAACN,KAAKO,MAAM,EAAE,OAAOL;IACzB,MAAMM,MAAM,EAACP,YAAAA,KAAKO,GAAG,YAARP,YAAYQ,KAAKD,GAAG;IACjC,MAAME,QAAQ,OAAOC;QACnB,MAAMA,IAAIC,MAAM,GAAGC,KAAK,CAAC,IAAM9B;QAC/BmB,OAAOE,MAAM,IAAI;IACnB;IACA,IAAI;QACF,MAAM,EAAEtB,EAAE,EAAE,GAAGmB;QACf,MAAMa,SAAS,IAAIC;QACnB,MAAMC,OAAO,IAAIC;QACjB,IAAIC,QAAQ;QACZ,KAAK,MAAMC,OAAOnB,KAAM;YACtB,MAAMoB,UAAU,MAAMtC,GACnBO,UAAU,CAAC,SACXC,GAAG,CAAC6B,KACJ9B,UAAU,CAACzB,2BACXyD,KAAK,CAACxD,yBACN0B,GAAG;YACN,KAAK,MAAM+B,UAAUF,QAAQG,IAAI,CAAE;oBAyBnBT;gBAxBd,MAAMU,YAAYF,OAAO/B,GAAG,CAAC;gBAC7B,MAAMkC,QAAQH,OAAO/B,GAAG,CAAC;gBACzB,MAAMmC,MAAMJ,OAAO/B,GAAG,CAAC;gBACvB,IAAI,CAAC9B,kBAAkB+D,WAAWC,UAAU,CAAC3B,MAAM4B,MAAM;oBACvD,MAAMhB,MAAMY,OAAOX,GAAG;oBACtB;gBACF;gBACA,MAAMgB,WAAW1D,OAAOqD,OAAO/B,GAAG,CAAC;gBACnC,IAAIoC,aAAa,QAAQnB,MAAMmB,WAAWhE,wBAAwB;oBAChE,MAAM+C,MAAMY,OAAOX,GAAG;oBACtB;gBACF;gBACA,IAAIK,KAAKY,GAAG,CAACH,UAAUP,SAASlD,aAAa;gBAC7CgD,KAAKa,GAAG,CAACJ;gBACTP,SAAS;gBACT,MAAMY,cAAcR,OAAO/B,GAAG,CAAC;gBAC/B,MAAMwC,SAAqB;oBACzBN;oBACAC;oBACAM,OAAOtE,kBAAkB,CAACgE,IAAI;mBAC1BF,cAAc,UAAWM,CAAAA,gBAAgB,aAAaA,gBAAgB,YAAW,IACjF;oBAAEG,iBAAiBH;gBAAY,IAC/B,CAAC;gBAEP,MAAMI,SAAQpB,cAAAA,OAAOvB,GAAG,CAACiC,sBAAXV,cAAyB,EAAE;gBACzCoB,MAAMC,IAAI,CAAC;oBAAEJ;oBAAQpB,KAAKW,OAAOX,GAAG;gBAAC;gBACrCG,OAAOsB,GAAG,CAACZ,WAAWU;YACxB;QACF;QACA,IAAI,CAACpB,OAAOuB,IAAI,EAAE,OAAOnC;QACzB,MAAMoC,UAAUjE,YAAYC,SAAS,MAAMO,SAASC,IAAIR;QACxD,KAAK,MAAM,CAACiE,MAAMC,QAAQ,IAAI1B,OAAQ;YACpC,IAAIU,YAAkC;YACtC,IAAI;gBACFA,YAAY,MAAMvB,KAAKuB,SAAS,CAACe;YACnC,EAAE,OAAOE,OAAO;gBACdC,QAAQD,KAAK,CAAC,CAAC,eAAe,EAAEF,KAAK,eAAe,CAAC,EAAEE;YACzD;YACA,IAAI,CAACjB,WAAW;gBACdtB,OAAOI,OAAO,IAAIkC,QAAQjC,MAAM;gBAChC;YACF;YACA,IAAIoC;YACJ,IAAI;gBACFA,WAAW,MAAMnB,UAAUoB,IAAI,CAC7BJ,QAAQK,GAAG,CAAC,CAACC,QAAUA,MAAMf,MAAM,GACnCO;YAEJ,EAAE,OAAOG,OAAO;gBACdC,QAAQD,KAAK,CAAC,CAAC,eAAe,EAAEF,KAAK,OAAO,CAAC,EAAEE;gBAC/CvC,OAAOG,MAAM,IAAImC,QAAQjC,MAAM;gBAC/B;YACF;YACA,KAAK,MAAM,CAACwC,OAAOD,MAAM,IAAIN,QAAQA,OAAO,GAAI;oBAC9BG;gBAAhB,MAAMK,WAAUL,kBAAAA,QAAQ,CAACI,MAAM,YAAfJ,kBAAmB;gBACnC,IAAIK,YAAY,QAAQ9C,OAAOC,IAAI,IAAI;qBAClC,IAAI6C,YAAY,SAAS,MAAMtC,MAAMoC,MAAMnC,GAAG;qBAC9CT,OAAOG,MAAM,IAAI;YACxB;QACF;IACF,EAAE,OAAOoC,OAAO;QACdC,QAAQD,KAAK,CAAC,wBAAwBA;IACxC;IACA,OAAOvC;AACT;AAEA,iFAAiF,GACjF,eAAe+C,oBAAoBV,IAAyB;IAC1D,IAAIA,SAAS,QAAQ,OAAO,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGW,aAAa;IACvE,OAAO,AAAC,CAAA,MAAM,MAAM,CAAC,gBAAY,EAAGC,YAAY;AAClD;AAEA,8DAA8D,GAC9D,OAAO,MAAMC,mBAAqC,OAAOpD,MAAM1B,SAAS,EAAEQ,EAAE,EAAE;IAC5E,MAAMiB,kBAAkBC,MAAM1B,SAAS;QAAEQ;QAAI0C,WAAWyB;IAAoB;AAC9E,EAAC"}

package/src/lib/server/push-fcm.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type BatchResponse, type TokenMessage } from 'firebase-admin/messaging';
+import './firebase-admin';
+import type { PushMessage, PushTransport } from './push-delivery';
+/** `sendEach` takes at most 500 messages. */
+export declare const FCM_BATCH = 500;
+/** The slice of firebase-admin's Messaging this transport uses; injected in tests. */
+export interface FcmMessaging {
+    sendEach(messages: TokenMessage[]): Promise<BatchResponse>;
+}
+export declare function fcmMessage(token: string, message: PushMessage): TokenMessage;
+export declare function createFcmTransport(messaging: FcmMessaging): PushTransport;
+/** The deployment's FCM transport, on the firebase-admin default app. */
+export declare function fcmTransport(): PushTransport;

package/src/lib/server/push-fcm.js

@@ -0,0 +1,83 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Firebase Cloud Messaging for the Android app (AGL-3651), through
+ * firebase-admin's `getMessaging().sendEach` with the project credentials
+ * the server already holds, so it needs no secret of its own. The
+ * notification is shown by the system; the tap data rides in `data`, and
+ * Android delivers it at high priority.
+ *
+ * A token FCM reports unregistered or invalid is gone, and the row is pruned.
+ *
+ * Server-only, imported by `push-delivery.ts` only when a device is on FCM.
+ */ import { getApp } from "firebase-admin/app";
+import { getMessaging } from "firebase-admin/messaging";
+import "./firebase-admin.js";
+/** `sendEach` takes at most 500 messages. */ export const FCM_BATCH = 500;
+const GONE = new Set([
+    'messaging/registration-token-not-registered',
+    'messaging/invalid-registration-token',
+    'messaging/invalid-argument'
+]);
+export function fcmMessage(token, message) {
+    return {
+        token,
+        notification: _extends({
+            title: message.title
+        }, message.body ? {
+            body: message.body
+        } : {}),
+        // FCM data values are strings; MobilePushData's are.
+        data: _extends({}, message.data),
+        android: {
+            priority: 'high',
+            notification: {
+                sound: 'default'
+            }
+        }
+    };
+}
+export function createFcmTransport(messaging) {
+    return {
+        async send (targets, message) {
+            const outcomes = [];
+            for(let start = 0; start < targets.length; start += FCM_BATCH){
+                const batch = targets.slice(start, start + FCM_BATCH);
+                try {
+                    const { responses } = await messaging.sendEach(batch.map((target)=>fcmMessage(target.token, message)));
+                    for (const [index] of batch.entries()){
+                        var _ref;
+                        var _response_error;
+                        const response = responses[index];
+                        if (response == null ? void 0 : response.success) outcomes.push('sent');
+                        else outcomes.push(GONE.has((_ref = response == null ? void 0 : (_response_error = response.error) == null ? void 0 : _response_error.code) != null ? _ref : '') ? 'prune' : 'failed');
+                    }
+                } catch (unused) {
+                    outcomes.push(...batch.map(()=>'failed'));
+                }
+            }
+            return outcomes;
+        }
+    };
+}
+let configured = null;
+/** The deployment's FCM transport, on the firebase-admin default app. */ export function fcmTransport() {
+    configured != null ? configured : configured = createFcmTransport(getMessaging(getApp()));
+    return configured;
+}
+
+//# sourceMappingURL=push-fcm.js.map

package/src/lib/server/push-fcm.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/push-fcm.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Firebase Cloud Messaging for the Android app (AGL-3651), through\n * firebase-admin's `getMessaging().sendEach` with the project credentials\n * the server already holds, so it needs no secret of its own. The\n * notification is shown by the system; the tap data rides in `data`, and\n * Android delivers it at high priority.\n *\n * A token FCM reports unregistered or invalid is gone, and the row is pruned.\n *\n * Server-only, imported by `push-delivery.ts` only when a device is on FCM.\n */\n\nimport { getApp } from 'firebase-admin/app'\nimport { getMessaging, type BatchResponse, type TokenMessage } from 'firebase-admin/messaging'\nimport './firebase-admin'\nimport type { PushMessage, PushOutcome, PushTarget, PushTransport } from './push-delivery'\n\n/** `sendEach` takes at most 500 messages. */\nexport const FCM_BATCH = 500\n\nconst GONE = new Set([\n  'messaging/registration-token-not-registered',\n  'messaging/invalid-registration-token',\n  'messaging/invalid-argument',\n])\n\n/** The slice of firebase-admin's Messaging this transport uses; injected in tests. */\nexport interface FcmMessaging {\n  sendEach(messages: TokenMessage[]): Promise<BatchResponse>\n}\n\nexport function fcmMessage(token: string, message: PushMessage): TokenMessage {\n  return {\n    token,\n    notification: { title: message.title, ...(message.body ? { body: message.body } : {}) },\n    // FCM data values are strings; MobilePushData's are.\n    data: { ...message.data },\n    android: { priority: 'high', notification: { sound: 'default' } },\n  }\n}\n\nexport function createFcmTransport(messaging: FcmMessaging): PushTransport {\n  return {\n    async send(targets: readonly PushTarget[], message: PushMessage): Promise<PushOutcome[]> {\n      const outcomes: PushOutcome[] = []\n      for (let start = 0; start < targets.length; start += FCM_BATCH) {\n        const batch = targets.slice(start, start + FCM_BATCH)\n        try {\n          const { responses } = await messaging.sendEach(batch.map((target) => fcmMessage(target.token, message)))\n          for (const [index] of batch.entries()) {\n            const response = responses[index]\n            if (response?.success) outcomes.push('sent')\n            else outcomes.push(GONE.has(response?.error?.code ?? '') ? 'prune' : 'failed')\n          }\n        } catch {\n          outcomes.push(...batch.map((): PushOutcome => 'failed'))\n        }\n      }\n      return outcomes\n    },\n  }\n}\n\nlet configured: PushTransport | null = null\n\n/** The deployment's FCM transport, on the firebase-admin default app. */\nexport function fcmTransport(): PushTransport {\n  configured ??= createFcmTransport(getMessaging(getApp()))\n  return configured\n}\n"],"names":["getApp","getMessaging","FCM_BATCH","GONE","Set","fcmMessage","token","message","notification","title","body","data","android","priority","sound","createFcmTransport","messaging","send","targets","outcomes","start","length","batch","slice","responses","sendEach","map","target","index","entries","response","success","push","has","error","code","configured","fcmTransport"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;CAUC,GAED,SAASA,MAAM,QAAQ,qBAAoB;AAC3C,SAASC,YAAY,QAA+C,2BAA0B;AAC9F,OAAO,sBAAkB;AAGzB,2CAA2C,GAC3C,OAAO,MAAMC,YAAY,IAAG;AAE5B,MAAMC,OAAO,IAAIC,IAAI;IACnB;IACA;IACA;CACD;AAOD,OAAO,SAASC,WAAWC,KAAa,EAAEC,OAAoB;IAC5D,OAAO;QACLD;QACAE,cAAc;YAAEC,OAAOF,QAAQE,KAAK;WAAMF,QAAQG,IAAI,GAAG;YAAEA,MAAMH,QAAQG,IAAI;QAAC,IAAI,CAAC;QACnF,qDAAqD;QACrDC,MAAM,aAAKJ,QAAQI,IAAI;QACvBC,SAAS;YAAEC,UAAU;YAAQL,cAAc;gBAAEM,OAAO;YAAU;QAAE;IAClE;AACF;AAEA,OAAO,SAASC,mBAAmBC,SAAuB;IACxD,OAAO;QACL,MAAMC,MAAKC,OAA8B,EAAEX,OAAoB;YAC7D,MAAMY,WAA0B,EAAE;YAClC,IAAK,IAAIC,QAAQ,GAAGA,QAAQF,QAAQG,MAAM,EAAED,SAASlB,UAAW;gBAC9D,MAAMoB,QAAQJ,QAAQK,KAAK,CAACH,OAAOA,QAAQlB;gBAC3C,IAAI;oBACF,MAAM,EAAEsB,SAAS,EAAE,GAAG,MAAMR,UAAUS,QAAQ,CAACH,MAAMI,GAAG,CAAC,CAACC,SAAWtB,WAAWsB,OAAOrB,KAAK,EAAEC;oBAC9F,KAAK,MAAM,CAACqB,MAAM,IAAIN,MAAMO,OAAO,GAAI;;4BAGTC;wBAF5B,MAAMA,WAAWN,SAAS,CAACI,MAAM;wBACjC,IAAIE,4BAAAA,SAAUC,OAAO,EAAEZ,SAASa,IAAI,CAAC;6BAChCb,SAASa,IAAI,CAAC7B,KAAK8B,GAAG,SAACH,6BAAAA,kBAAAA,SAAUI,KAAK,qBAAfJ,gBAAiBK,IAAI,mBAAI,MAAM,UAAU;oBACvE;gBACF,EAAE,eAAM;oBACNhB,SAASa,IAAI,IAAIV,MAAMI,GAAG,CAAC,IAAmB;gBAChD;YACF;YACA,OAAOP;QACT;IACF;AACF;AAEA,IAAIiB,aAAmC;AAEvC,uEAAuE,GACvE,OAAO,SAASC;IACdD,qBAAAA,aAAAA,aAAerB,mBAAmBd,aAAaD;IAC/C,OAAOoC;AACT"}

package/src/lib/server/serve-media-cdn.d.ts

@@ -180,6 +180,12 @@ export declare function mediaCdnVersionIsCurrent(options: {
     /** The document's {@link MEDIA_VARIANT_ENCODER_VERSION_FIELD}. */
     documentEncoderVersion: unknown;
 }): boolean;
+/**
+ * Whether an asset of this type is only ever served as its own bytes — no
+ * `?w=` variant, display copy, poster or rendition (AGL-3656). A web font is
+ * the case: a versioned URL that names its hash names everything served.
+ */
+export declare function mediaCdnHasNoDerivedForms(contentType: unknown): boolean;
 /** The immutable content-hashed URL's policy for edge-cacheable (image) types. */
 export declare const MEDIA_CDN_IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
 /**

package/src/lib/server/serve-media-cdn.js

@@ -221,6 +221,13 @@ const SEGMENT = MEDIA_CDN_SEGMENT;
     const generation = typeof recorded === 'number' && Number.isInteger(recorded) && recorded > 0 ? recorded : 1;
     return token.encoderVersion === MEDIA_VARIANT_ENCODER_VERSION && generation === token.encoderVersion;
 }
+/**
+ * Whether an asset of this type is only ever served as its own bytes — no
+ * `?w=` variant, display copy, poster or rendition (AGL-3656). A web font is
+ * the case: a versioned URL that names its hash names everything served.
+ */ export function mediaCdnHasNoDerivedForms(contentType) {
+    return String(contentType != null ? contentType : '').split(';')[0].trim().toLowerCase() === 'font/woff2';
+}
 /** The immutable content-hashed URL's policy for edge-cacheable (image) types. */ export const MEDIA_CDN_IMMUTABLE_CACHE_CONTROL = 'public, max-age=31536000, immutable';
 /**
  * The immutable URL's policy for edge-bypassing types (AGL-1515): the
@@ -246,7 +253,12 @@ const SEGMENT = MEDIA_CDN_SEGMENT;
  *
  * Unknown or absent types return false: correctness over cache.
  */ export function mediaCdnEdgeCacheable(contentType) {
-    return String(contentType != null ? contentType : '').split(';')[0].trim().toLowerCase().startsWith('image/');
+    const type = String(contentType != null ? contentType : '').split(';')[0].trim().toLowerCase();
+    // A web font (AGL-3656) is fetched the way an image is — one plain GET
+    // from an `@font-face` rule, never a range — and it is part of the page
+    // weight the band already measures, so it takes the image policy: the
+    // edge holds it, and a versioned URL a page names is kept for a year.
+    return type.startsWith('image/') || type === 'font/woff2';
 }
 /**
  * The CDN's OWN Content-Security-Policy (AGL-1474).
@@ -337,7 +349,9 @@ const SEGMENT = MEDIA_CDN_SEGMENT;
  * decision back without adding to it.
  */ function servesInline(contentType) {
     const type = String(contentType != null ? contentType : '').split(';')[0].trim().toLowerCase();
-    return type.startsWith('image/') || type.startsWith('video/') || type.startsWith('audio/') || type === 'application/pdf';
+    return type.startsWith('image/') || type.startsWith('video/') || type.startsWith('audio/') || type === 'application/pdf' || // A web font (AGL-3656): an `@font-face` rule loads it, and a font is
+    // inert outside a stylesheet, so a top-level open has nothing to run.
+    type === 'font/woff2';
 }
 /** The `Content-Security-Policy` for a response serving `contentType`. */ export function mediaCdnContentSecurityPolicy(contentType) {
     const type = String(contentType != null ? contentType : '').split(';')[0].trim().toLowerCase();
@@ -1311,7 +1325,10 @@ export function parseMediaCdnRange(header, size) {
             widthRequested: Boolean(width),
             variantServed: exactVariant,
             otherRepresentation: usePoster || Boolean(rendition),
-            documentEncoderVersion: snapshot.get(MEDIA_VARIANT_ENCODER_VERSION_FIELD)
+            // A web font has no derived form for an encoder to have made, so no
+            // generation can be behind (AGL-3656): only its bytes are named, and
+            // a library on a plan without generated variants records none.
+            documentEncoderVersion: mediaCdnHasNoDerivedForms(snapshot.get('contentType')) ? MEDIA_VARIANT_ENCODER_VERSION : snapshot.get(MEDIA_VARIANT_ENCODER_VERSION_FIELD)
         });
         const stableCacheControlFor = (type)=>mediaCdnEdgeCacheable(type) ? versionCurrent ? MEDIA_CDN_VERSIONED_CACHE_CONTROL : MEDIA_CDN_STABLE_CACHE_CONTROL : MEDIA_CDN_STABLE_EDGE_BYPASS_CACHE_CONTROL;
         // A poster is `image/webp` and therefore edge-cacheable through the rule