npm - @cronwatch/sdk - Versions diffs - 0.3.0 → 0.4.0 - Mend

@cronwatch/sdk 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (136) hide show

package/README.md +8 -7
package/dist/anthropic.d.cts +1 -1
package/dist/anthropic.d.ts +1 -1
package/dist/bugsnag.cjs +108 -0
package/dist/bugsnag.cjs.map +1 -0
package/dist/bugsnag.d.cts +26 -0
package/dist/bugsnag.d.ts +26 -0
package/dist/bugsnag.js +106 -0
package/dist/bugsnag.js.map +1 -0
package/dist/client-B7bqnkI5.d.cts +450 -0
package/dist/client-pmqH3apS.d.ts +450 -0
package/dist/d1.cjs +214 -0
package/dist/d1.cjs.map +1 -0
package/dist/d1.d.cts +42 -0
package/dist/d1.d.ts +42 -0
package/dist/d1.js +212 -0
package/dist/d1.js.map +1 -0
package/dist/datadog.cjs +95 -0
package/dist/datadog.cjs.map +1 -0
package/dist/datadog.d.cts +24 -0
package/dist/datadog.d.ts +24 -0
package/dist/datadog.js +93 -0
package/dist/datadog.js.map +1 -0
package/dist/discord.cjs +2 -0
package/dist/discord.cjs.map +1 -1
package/dist/discord.d.cts +1 -1
package/dist/discord.d.ts +1 -1
package/dist/discord.js +2 -0
package/dist/discord.js.map +1 -1
package/dist/email-BJ-z_epD.d.cts +21 -0
package/dist/email-_H0faCh3.d.ts +21 -0
package/dist/honeybadger.cjs +101 -0
package/dist/honeybadger.cjs.map +1 -0
package/dist/honeybadger.d.cts +23 -0
package/dist/honeybadger.d.ts +23 -0
package/dist/honeybadger.js +99 -0
package/dist/honeybadger.js.map +1 -0
package/dist/index.cjs +692 -124
package/dist/index.cjs.map +1 -1
package/dist/index.d.cts +5 -228
package/dist/index.d.ts +5 -228
package/dist/index.js +692 -124
package/dist/index.js.map +1 -1
package/dist/mailgun.cjs +115 -0
package/dist/mailgun.cjs.map +1 -0
package/dist/mailgun.d.cts +21 -0
package/dist/mailgun.d.ts +21 -0
package/dist/mailgun.js +113 -0
package/dist/mailgun.js.map +1 -0
package/dist/newrelic.cjs +88 -0
package/dist/newrelic.cjs.map +1 -0
package/dist/newrelic.d.cts +25 -0
package/dist/newrelic.d.ts +25 -0
package/dist/newrelic.js +86 -0
package/dist/newrelic.js.map +1 -0
package/dist/node.cjs +191 -0
package/dist/node.cjs.map +1 -0
package/dist/node.d.cts +97 -0
package/dist/node.d.ts +97 -0
package/dist/node.js +186 -0
package/dist/node.js.map +1 -0
package/dist/pg-cron.cjs +286 -0
package/dist/pg-cron.cjs.map +1 -0
package/dist/pg-cron.d.cts +93 -0
package/dist/pg-cron.d.ts +93 -0
package/dist/pg-cron.js +280 -0
package/dist/pg-cron.js.map +1 -0
package/dist/postgres.cjs +33 -1
package/dist/postgres.cjs.map +1 -1
package/dist/postgres.d.cts +1 -1
package/dist/postgres.d.ts +1 -1
package/dist/postgres.js +33 -1
package/dist/postgres.js.map +1 -1
package/dist/postmark.cjs +106 -0
package/dist/postmark.cjs.map +1 -0
package/dist/postmark.d.cts +18 -0
package/dist/postmark.d.ts +18 -0
package/dist/postmark.js +104 -0
package/dist/postmark.js.map +1 -0
package/dist/resend.cjs +114 -0
package/dist/resend.cjs.map +1 -0
package/dist/resend.d.cts +16 -0
package/dist/resend.d.ts +16 -0
package/dist/resend.js +112 -0
package/dist/resend.js.map +1 -0
package/dist/rollbar.cjs +108 -0
package/dist/rollbar.cjs.map +1 -0
package/dist/rollbar.d.cts +20 -0
package/dist/rollbar.d.ts +20 -0
package/dist/rollbar.js +106 -0
package/dist/rollbar.js.map +1 -0
package/dist/sendgrid.cjs +114 -0
package/dist/sendgrid.cjs.map +1 -0
package/dist/sendgrid.d.cts +19 -0
package/dist/sendgrid.d.ts +19 -0
package/dist/sendgrid.js +112 -0
package/dist/sendgrid.js.map +1 -0
package/dist/sentry.cjs +130 -0
package/dist/sentry.cjs.map +1 -0
package/dist/sentry.d.cts +28 -0
package/dist/sentry.d.ts +28 -0
package/dist/sentry.js +127 -0
package/dist/sentry.js.map +1 -0
package/dist/ses.cjs +170 -0
package/dist/ses.cjs.map +1 -0
package/dist/ses.d.cts +25 -0
package/dist/ses.d.ts +25 -0
package/dist/ses.js +168 -0
package/dist/ses.js.map +1 -0
package/dist/slack.cjs +2 -0
package/dist/slack.cjs.map +1 -1
package/dist/slack.d.cts +1 -1
package/dist/slack.d.ts +1 -1
package/dist/slack.js +2 -0
package/dist/slack.js.map +1 -1
package/dist/sqlite.cjs +62 -5
package/dist/sqlite.cjs.map +1 -1
package/dist/sqlite.d.cts +1 -1
package/dist/sqlite.d.ts +1 -1
package/dist/sqlite.js +62 -5
package/dist/sqlite.js.map +1 -1
package/dist/twilio.cjs +168 -0
package/dist/twilio.cjs.map +1 -0
package/dist/twilio.d.cts +52 -0
package/dist/twilio.d.ts +52 -0
package/dist/twilio.js +162 -0
package/dist/twilio.js.map +1 -0
package/dist/{types-C1PyRjI5.d.cts → types-Ddq1MUPL.d.cts} +50 -4
package/dist/{types-C1PyRjI5.d.ts → types-Ddq1MUPL.d.ts} +50 -4
package/dist/webhook.cjs +11 -5
package/dist/webhook.cjs.map +1 -1
package/dist/webhook.d.cts +6 -3
package/dist/webhook.d.ts +6 -3
package/dist/webhook.js +11 -6
package/dist/webhook.js.map +1 -1
package/package.json +211 -5

package/dist/ses.cjs ADDED Viewed

@@ -0,0 +1,170 @@
+'use strict';
+// src/alerts/shared.ts
+var TIMEOUT_MS = 1e4;
+function origin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return "(invalid URL)";
+  }
+}
+var ERROR_BODY_MAX = 200;
+async function post(provider, url, init, secrets = []) {
+  const response = await fetch(url, { method: "POST", headers: init.headers, body: init.body, redirect: "error", signal: AbortSignal.timeout(TIMEOUT_MS) });
+  if (!response.ok) {
+    let text = "";
+    try {
+      text = await response.text();
+    } catch {
+    }
+    throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : ""}`);
+  }
+  return response;
+}
+function errorBody(text, secrets = []) {
+  const kept = secrets.filter((s) => typeof s === "string" && s.length >= 4);
+  const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);
+  let head = cut(text, ERROR_BODY_MAX + longest);
+  for (const secret of kept) head = head.split(secret).join("[redacted]");
+  return cut(head, ERROR_BODY_MAX);
+}
+function trimmed(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function hex(bytes) {
+  return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(text) {
+  return hex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text)));
+}
+function cut(text, max) {
+  if (text.length <= max) return text;
+  let end = max;
+  const code = text.charCodeAt(end - 1);
+  if (code >= 55296 && code <= 56319) end -= 1;
+  return text.slice(0, end);
+}
+function plainText(alert, link) {
+  return [alert.title, "", alert.message, ...alert.triage ? ["", `Triage: ${alert.triage}`] : [], ...link ? ["", `Open: ${link}`] : []].join("\n");
+}
+// src/alerts/email.ts
+function recipients(name, options) {
+  if (!options.from) throw new Error(`${name}() needs a from address`);
+  const to = (Array.isArray(options.to) ? options.to : [options.to]).filter((a) => typeof a === "string" && a.trim() !== "");
+  if (to.length === 0) throw new Error(`${name}() needs at least one to address`);
+  return to.map((a) => a.trim());
+}
+function composeEmail(alert, options, to) {
+  const link = safeLink(options.link?.(alert));
+  const subject = cut(`${options.subjectPrefix ? `${options.subjectPrefix} ` : ""}${alert.title}`.replace(/[\r\n]+/g, " "), 250);
+  return { from: options.from, to, subject, text: plainText(alert, link), html: html(alert, link) };
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function safeLink(link) {
+  if (!link) return void 0;
+  return /^https?:\/\//i.test(link) ? link : void 0;
+}
+function html(alert, link) {
+  const parts = [
+    `<!doctype html>`,
+    `<html><body style="margin:0;padding:16px;font-family:Georgia,serif;color:#1d1b16;background:#ffffff">`,
+    `<p style="margin:0 0 12px;font-size:18px"><strong>${escapeHtml(alert.title)}</strong></p>`,
+    `<pre style="margin:0 0 12px;padding:12px;background:#f6f3ec;white-space:pre-wrap;word-break:break-word;font:13px/1.45 Menlo,Consolas,monospace">${escapeHtml(alert.message)}</pre>`
+  ];
+  if (alert.triage) parts.push(`<p style="margin:0 0 12px"><em>Triage:</em> ${escapeHtml(alert.triage)}</p>`);
+  if (link) parts.push(`<p style="margin:0"><a href="${escapeHtml(link)}">Open ${escapeHtml(alert.job)}</a></p>`);
+  parts.push(`</body></html>`);
+  return parts.join("\n");
+}
+// src/alerts/sigv4.ts
+async function signV4(request, credentials) {
+  const url = new URL(request.url);
+  const amzDate = new Date(request.now).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+  const day = amzDate.slice(0, 8);
+  const headers = {};
+  for (const [name, value] of Object.entries(request.headers)) headers[name.toLowerCase()] = value;
+  headers["x-amz-date"] = amzDate;
+  if (credentials.sessionToken) headers["x-amz-security-token"] = credentials.sessionToken;
+  const signed = { ...headers, host: url.host };
+  const names = Object.keys(signed).sort();
+  const canonicalHeaders = names.map((n) => `${n}:${signed[n].trim().replace(/\s+/g, " ")}
+`).join("");
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    request.method.toUpperCase(),
+    canonicalUri(url.pathname),
+    canonicalQuery(url.searchParams),
+    canonicalHeaders,
+    signedHeaders,
+    await sha256Hex(request.body)
+  ].join("\n");
+  const scope = `${day}/${request.region}/${request.service}/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", amzDate, scope, await sha256Hex(canonicalRequest)].join("\n");
+  let key = await hmac(new TextEncoder().encode(`AWS4${credentials.secretAccessKey}`), day);
+  key = await hmac(key, request.region);
+  key = await hmac(key, request.service);
+  key = await hmac(key, "aws4_request");
+  const signature = hex(await hmac(key, stringToSign));
+  headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  return headers;
+}
+async function hmac(key, data) {
+  const cryptoKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(data)));
+}
+function uriEncode(text) {
+  return encodeURIComponent(text).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function canonicalUri(path) {
+  if (!path) return "/";
+  return path.split("/").map(uriEncode).join("/");
+}
+function canonicalQuery(params) {
+  const pairs = [];
+  params.forEach((value, name) => pairs.push([uriEncode(name), uriEncode(value)]));
+  pairs.sort(([a, av], [b, bv]) => a < b ? -1 : a > b ? 1 : av < bv ? -1 : av > bv ? 1 : 0);
+  return pairs.map(([n, v]) => `${n}=${v}`).join("&");
+}
+// src/alerts/ses.ts
+function ses(options) {
+  if (!options.region) throw new Error("ses() needs a region");
+  if (!/^[a-z0-9-]+$/.test(options.region)) throw new Error("ses() needs a region like us-east-1");
+  const credentials = { accessKeyId: trimmed(options.accessKeyId), secretAccessKey: trimmed(options.secretAccessKey), sessionToken: trimmed(options.sessionToken) || void 0 };
+  if (!credentials.accessKeyId || !credentials.secretAccessKey) throw new Error("ses() needs an accessKeyId and secretAccessKey");
+  const to = recipients("ses", options);
+  const url = `https://email.${options.region}.amazonaws.com/v2/email/outbound-emails`;
+  const now = options.now ?? Date.now;
+  return {
+    name: "ses",
+    async send(alert) {
+      const email = composeEmail(alert, options, to);
+      const body = JSON.stringify({
+        FromEmailAddress: email.from,
+        Destination: { ToAddresses: email.to },
+        Content: {
+          Simple: {
+            Subject: { Data: email.subject, Charset: "UTF-8" },
+            Body: { Text: { Data: email.text, Charset: "UTF-8" }, Html: { Data: email.html, Charset: "UTF-8" } }
+          }
+        },
+        ...options.configurationSetName ? { ConfigurationSetName: options.configurationSetName } : {},
+        EmailTags: [{ Name: "source", Value: "cronwatch" }]
+      });
+      const headers = await signV4(
+        { method: "POST", url, headers: { "content-type": "application/json" }, body, region: options.region, service: "ses", now: now() },
+        credentials
+      );
+      await post("SES", url, { headers, body }, [credentials.secretAccessKey, credentials.sessionToken]);
+    }
+  };
+}
+exports.ses = ses;
+//# sourceMappingURL=ses.cjs.map
+//# sourceMappingURL=ses.cjs.map

package/dist/ses.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/alerts/shared.ts","../src/alerts/email.ts","../src/alerts/sigv4.ts","../src/alerts/ses.ts"],"names":[],"mappings":";;;AAOO,IAAM,UAAA,GAAa,GAAA;AAYnB,SAAS,OAAO,GAAA,EAAqB;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAGO,IAAM,cAAA,GAAiB,GAAA;AAW9B,eAAsB,KAAK,QAAA,EAAkB,GAAA,EAAa,IAAA,EAAyD,OAAA,GAAkC,EAAC,EAAsB;AAC1K,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAS,IAAA,CAAK,OAAA,EAAS,MAAM,IAAA,CAAK,IAAA,EAAM,UAAU,OAAA,EAAS,MAAA,EAAQ,YAAY,OAAA,CAAQ,UAAU,GAAG,CAAA;AACxJ,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,QAAQ,IAAI,MAAA,CAAO,GAAG,CAAC,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,EAAG,IAAA,GAAO,KAAK,SAAA,CAAU,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACxH;AACA,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,SAAA,CAAU,IAAA,EAAc,OAAA,GAAkC,EAAC,EAAW;AACpF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,IAAU,CAAC,CAAA;AACtF,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,EAAG,CAAA,KAAM,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,MAAM,CAAA,EAAG,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,GAAO,GAAA,CAAI,IAAA,EAAM,cAAA,GAAiB,OAAO,CAAA;AAC7C,EAAA,KAAA,MAAW,MAAA,IAAU,MAAM,IAAA,GAAO,IAAA,CAAK,MAAM,MAAM,CAAA,CAAE,KAAK,YAAY,CAAA;AACtE,EAAA,OAAO,GAAA,CAAI,MAAM,cAAc,CAAA;AACjC;AAGO,SAAS,QAAQ,KAAA,EAAwB;AAC9C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,CAAM,MAAK,GAAI,EAAA;AACpD;AAaO,SAAS,IAAI,KAAA,EAAyC;AAC3D,EAAA,OAAO,KAAA,CAAM,KAAK,KAAA,YAAiB,UAAA,GAAa,QAAQ,IAAI,UAAA,CAAW,KAAK,CAAA,EAAG,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA;AAChI;AAEA,eAAsB,UAAU,IAAA,EAA+B;AAC7D,EAAA,OAAO,GAAA,CAAI,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AAClF;AAiBO,SAAS,GAAA,CAAI,MAAc,GAAA,EAAqB;AACrD,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,GAAA,EAAK,OAAO,IAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,GAAA,GAAM,CAAC,CAAA;AACpC,EAAA,IAAI,IAAA,IAAQ,KAAA,IAAU,IAAA,IAAQ,KAAA,EAAQ,GAAA,IAAO,CAAA;AAC7C,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B;AAUO,SAAS,SAAA,CAAU,OAAc,IAAA,EAAkC;AACxE,EAAA,OAAO,CAAC,KAAA,CAAM,KAAA,EAAO,EAAA,EAAI,KAAA,CAAM,OAAA,EAAS,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,EAAA,EAAI,CAAA,QAAA,EAAW,MAAM,MAAM,CAAA,CAAE,CAAA,GAAI,EAAC,EAAI,GAAI,IAAA,GAAO,CAAC,EAAA,EAAI,CAAA,MAAA,EAAS,IAAI,CAAA,CAAE,CAAA,GAAI,EAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACrJ;;;AC1FO,SAAS,UAAA,CAAW,MAAc,OAAA,EAAiC;AACxE,EAAA,IAAI,CAAC,QAAQ,IAAA,EAAM,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,uBAAA,CAAyB,CAAA;AACnE,EAAA,MAAM,EAAA,GAAA,CAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,EAAE,CAAA,GAAI,OAAA,CAAQ,KAAK,CAAC,OAAA,CAAQ,EAAE,CAAA,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,OAAO,MAAM,QAAA,IAAY,CAAA,CAAE,IAAA,EAAK,KAAM,EAAE,CAAA;AACzH,EAAA,IAAI,EAAA,CAAG,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,gCAAA,CAAkC,CAAA;AAC9E,EAAA,OAAO,GAAG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAA;AAC/B;AAEO,SAAS,YAAA,CAAa,KAAA,EAAc,OAAA,EAAuB,EAAA,EAAqB;AACrF,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAC,CAAA;AAE3C,EAAA,MAAM,UAAU,GAAA,CAAI,CAAA,EAAG,QAAQ,aAAA,GAAgB,CAAA,EAAG,QAAQ,aAAa,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,EAAG,MAAM,KAAK,CAAA,CAAA,CAAG,QAAQ,UAAA,EAAY,GAAG,GAAG,GAAG,CAAA;AAC7H,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAA,EAAM,IAAI,OAAA,EAAS,IAAA,EAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA,EAAG,IAAA,EAAM,IAAA,CAAK,KAAA,EAAO,IAAI,CAAA,EAAE;AAClG;AAGO,SAAS,WAAW,IAAA,EAAsB;AAC/C,EAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAM,MAAM,CAAA,CAAE,QAAQ,IAAA,EAAM,MAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CAAE,OAAA,CAAQ,MAAM,OAAO,CAAA;AAC9H;AAGA,SAAS,SAAS,IAAA,EAA8C;AAC9D,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA,GAAO,MAAA;AAC7C;AAEA,SAAS,IAAA,CAAK,OAAc,IAAA,EAAkC;AAC5D,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,CAAA,eAAA,CAAA;AAAA,IACA,CAAA,qGAAA,CAAA;AAAA,IACA,CAAA,kDAAA,EAAqD,UAAA,CAAW,KAAA,CAAM,KAAK,CAAC,CAAA,aAAA,CAAA;AAAA,IAC5E,CAAA,gJAAA,EAAmJ,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA,MAAA;AAAA,GAC9K;AACA,EAAA,IAAI,KAAA,CAAM,QAAQ,KAAA,CAAM,IAAA,CAAK,+CAA+C,UAAA,CAAW,KAAA,CAAM,MAAM,CAAC,CAAA,IAAA,CAAM,CAAA;AAC1G,EAAA,IAAI,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,CAAA,6BAAA,EAAgC,UAAA,CAAW,IAAI,CAAC,CAAA,OAAA,EAAU,UAAA,CAAW,KAAA,CAAM,GAAG,CAAC,CAAA,QAAA,CAAU,CAAA;AAC9G,EAAA,KAAA,CAAM,KAAK,CAAA,cAAA,CAAgB,CAAA;AAC3B,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;;;AClCA,eAAsB,MAAA,CAAO,SAAuB,WAAA,EAAgE;AAClH,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CAAE,OAAA,CAAQ,WAAW,EAAE,CAAA;AAC9F,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAC9B,EAAA,MAAM,UAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAa,CAAA,GAAI,KAAA;AAC3F,EAAA,OAAA,CAAQ,YAAY,CAAA,GAAI,OAAA;AACxB,EAAA,IAAI,WAAA,CAAY,YAAA,EAAc,OAAA,CAAQ,sBAAsB,IAAI,WAAA,CAAY,YAAA;AAE5E,EAAA,MAAM,SAAiC,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,IAAI,IAAA,EAAK;AACpE,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,IAAA,EAAK;AACvC,EAAA,MAAM,mBAAmB,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,CAAC,EAAG,IAAA,EAAK,CAAE,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAC;AAAA,CAAI,CAAA,CAAE,KAAK,EAAE,CAAA;AACrG,EAAA,MAAM,aAAA,GAAgB,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AACpC,EAAA,MAAM,gBAAA,GAAmB;AAAA,IACvB,OAAA,CAAQ,OAAO,WAAA,EAAY;AAAA,IAC3B,YAAA,CAAa,IAAI,QAAQ,CAAA;AAAA,IACzB,cAAA,CAAe,IAAI,YAAY,CAAA;AAAA,IAC/B,gBAAA;AAAA,IACA,aAAA;AAAA,IACA,MAAM,SAAA,CAAU,OAAA,CAAQ,IAAI;AAAA,GAC9B,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,MAAM,KAAA,GAAQ,GAAG,GAAG,CAAA,CAAA,EAAI,QAAQ,MAAM,CAAA,CAAA,EAAI,QAAQ,OAAO,CAAA,aAAA,CAAA;AACzD,EAAA,MAAM,YAAA,GAAe,CAAC,kBAAA,EAAoB,OAAA,EAAS,KAAA,EAAO,MAAM,SAAA,CAAU,gBAAgB,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAEtG,EAAA,IAAI,GAAA,GAAM,MAAM,IAAA,CAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAA,IAAA,EAAO,WAAA,CAAY,eAAe,CAAA,CAAE,CAAA,EAAG,GAAG,CAAA;AACxF,EAAA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,MAAM,CAAA;AACpC,EAAA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAA;AACrC,EAAA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACpC,EAAA,MAAM,YAAY,GAAA,CAAI,MAAM,IAAA,CAAK,GAAA,EAAK,YAAY,CAAC,CAAA;AAEnD,EAAA,OAAA,CAAQ,aAAA,GAAgB,+BAA+B,WAAA,CAAY,WAAW,IAAI,KAAK,CAAA,gBAAA,EAAmB,aAAa,CAAA,YAAA,EAAe,SAAS,CAAA,CAAA;AAC/I,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,IAAA,CAAK,KAAiB,IAAA,EAAmC;AACtE,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,GAAA,EAAgC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AACzI,EAAA,OAAO,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACnG;AAGA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,OAAO,mBAAmB,IAAI,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,CAAC,CAAA,KAAM,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA,CAAE,CAAA;AAC7G;AAEA,SAAS,aAAa,IAAA,EAAsB;AAC1C,EAAA,IAAI,CAAC,MAAM,OAAO,GAAA;AAElB,EAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA,CAAE,IAAI,SAAS,CAAA,CAAE,KAAK,GAAG,CAAA;AAChD;AAEA,SAAS,eAAe,MAAA,EAAiC;AACvD,EAAA,MAAM,QAA4B,EAAC;AACnC,EAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,IAAA,KAAS,MAAM,IAAA,CAAK,CAAC,SAAA,CAAU,IAAI,CAAA,EAAG,SAAA,CAAU,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/E,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,EAAG,EAAE,CAAA,EAAG,CAAC,CAAA,EAAG,EAAE,CAAA,KAAO,CAAA,GAAI,IAAI,EAAA,GAAK,CAAA,GAAI,IAAI,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,CAAA,GAAI,CAAE,CAAA;AAC1F,EAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,CAAC,GAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AACpD;;;AC9DO,SAAS,IAAI,OAAA,EAAmC;AACrD,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAC3D,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAE/F,EAAA,MAAM,cAAc,EAAE,WAAA,EAAa,OAAA,CAAQ,OAAA,CAAQ,WAAW,CAAA,EAAG,eAAA,EAAiB,OAAA,CAAQ,OAAA,CAAQ,eAAe,CAAA,EAAG,YAAA,EAAc,QAAQ,OAAA,CAAQ,YAAY,KAAK,MAAA,EAAU;AAC7K,EAAA,IAAI,CAAC,YAAY,WAAA,IAAe,CAAC,YAAY,eAAA,EAAiB,MAAM,IAAI,KAAA,CAAM,gDAAgD,CAAA;AAC9H,EAAA,MAAM,EAAA,GAAK,UAAA,CAAW,KAAA,EAAO,OAAO,CAAA;AACpC,EAAA,MAAM,GAAA,GAAM,CAAA,cAAA,EAAiB,OAAA,CAAQ,MAAM,CAAA,uCAAA,CAAA;AAC3C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAChC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,KAAA,EAAO,OAAA,EAAS,EAAE,CAAA;AAC7C,MAAA,MAAM,IAAA,GAAO,KAAK,SAAA,CAAU;AAAA,QAC1B,kBAAkB,KAAA,CAAM,IAAA;AAAA,QACxB,WAAA,EAAa,EAAE,WAAA,EAAa,KAAA,CAAM,EAAA,EAAG;AAAA,QACrC,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ;AAAA,YACN,SAAS,EAAE,IAAA,EAAM,KAAA,CAAM,OAAA,EAAS,SAAS,OAAA,EAAQ;AAAA,YACjD,MAAM,EAAE,IAAA,EAAM,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,OAAA,EAAS,OAAA,EAAQ,EAAG,MAAM,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,OAAA,EAAS,SAAQ;AAAE;AACrG,SACF;AAAA,QACA,GAAI,QAAQ,oBAAA,GAAuB,EAAE,sBAAsB,OAAA,CAAQ,oBAAA,KAAyB,EAAC;AAAA,QAC7F,WAAW,CAAC,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,aAAa;AAAA,OACnD,CAAA;AACD,MAAA,MAAM,UAAU,MAAM,MAAA;AAAA,QACpB,EAAE,MAAA,EAAQ,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB,EAAG,IAAA,EAAM,QAAQ,OAAA,CAAQ,MAAA,EAAQ,SAAS,KAAA,EAAO,GAAA,EAAK,KAAI,EAAE;AAAA,QACjI;AAAA,OACF;AACA,MAAA,MAAM,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,EAAE,OAAA,EAAS,IAAA,EAAK,EAAG,CAAC,WAAA,CAAY,eAAA,EAAiB,WAAA,CAAY,YAAY,CAAC,CAAA;AAAA,IACnG;AAAA,GACF;AACF","file":"ses.cjs","sourcesContent":["/**\n * Helpers shared by the provider channels. Only fetch and Web Crypto, so the\n * channels run on Node, Cloudflare Workers, Deno and Bun alike. Not an entry\n * point: each channel bundles its own copy.\n */\nimport type { Alert } from \"../types.js\";\n\nexport const TIMEOUT_MS = 10_000;\n\n/** Severity for trackers that have levels. Recovered is informational. */\nexport type Severity = \"error\" | \"warning\" | \"info\";\n\nexport function severity(type: Alert[\"type\"]): Severity {\n if (type === \"recovered\") return \"info\";\n if (type === \"slow\" || type === \"over_budget\") return \"warning\";\n return \"error\";\n}\n\n/** The scheme, host and port only. A URL's path or query can hold a credential. */\nexport function origin(url: string): string {\n try {\n return new URL(url).origin;\n } catch {\n return \"(invalid URL)\";\n }\n}\n\n/** How much of a provider's error body goes into the error message. */\nexport const ERROR_BODY_MAX = 200;\n\n/**\n * POSTs and throws on a non-2xx answer. The error names the provider and the\n * URL's origin, plus the start of the response body with every secret the\n * channel holds cut out, in case a provider echoes one back. Secrets are cut\n * from a prefix long enough to hold one that starts inside the first\n * ERROR_BODY_MAX characters, and only then is it cut to that length, so no\n * part of a secret survives at the edge. A redirect is refused rather than\n * followed: the credential headers would go with it to wherever it points.\n */\nexport async function post(provider: string, url: string, init: { headers: Record<string, string>; body: string }, secrets: (string | undefined)[] = []): Promise<Response> {\n const response = await fetch(url, { method: \"POST\", headers: init.headers, body: init.body, redirect: \"error\", signal: AbortSignal.timeout(TIMEOUT_MS) });\n if (!response.ok) {\n let text = \"\";\n try {\n text = await response.text();\n } catch {\n // The status is enough.\n }\n throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : \"\"}`);\n }\n return response;\n}\n\n/** The start of an error body, secrets cut out first, then cut to ERROR_BODY_MAX on a code point. */\nexport function errorBody(text: string, secrets: (string | undefined)[] = []): string {\n const kept = secrets.filter((s): s is string => typeof s === \"string\" && s.length >= 4);\n const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);\n let head = cut(text, ERROR_BODY_MAX + longest);\n for (const secret of kept) head = head.split(secret).join(\"[redacted]\");\n return cut(head, ERROR_BODY_MAX);\n}\n\n/** A credential with the spaces and newlines a paste leaves around it taken off. Anything not a string is empty. */\nexport function trimmed(value: unknown): string {\n return typeof value === \"string\" ? value.trim() : \"\";\n}\n\n/** Base64 of UTF-8, without Buffer. */\nexport function base64(text: string): string {\n let binary = \"\";\n for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);\n return btoa(binary);\n}\n\nexport function basicAuth(user: string, password: string): string {\n return `Basic ${base64(`${user}:${password}`)}`;\n}\n\nexport function hex(bytes: ArrayBuffer | Uint8Array): string {\n return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport async function sha256Hex(text: string): Promise<string> {\n return hex(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text)));\n}\n\n/**\n * A stable 32 hex character id for one alert: the same job, type and time\n * always give the same id, so a provider that deduplicates on it drops a\n * resend of an alert it already took.\n */\nexport async function alertId(alert: Alert): Promise<string> {\n return (await sha256Hex(`${alert.job}\\n${alert.type}\\n${alert.at}`)).slice(0, 32);\n}\n\n/** The same id laid out as a UUID, for APIs that ask for one. */\nexport function asUuid(id: string): string {\n return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20, 32)}`;\n}\n\n/** Cuts to at most `max` UTF-16 units without splitting a surrogate pair. */\nexport function cut(text: string, max: number): string {\n if (text.length <= max) return text;\n let end = max;\n const code = text.charCodeAt(end - 1);\n if (code >= 0xd800 && code <= 0xdbff) end -= 1;\n return text.slice(0, end);\n}\n\n/** The run fields worth attaching to a tracker event. */\nexport function runSummary(alert: Alert): Record<string, unknown> | null {\n const run = alert.run;\n if (!run) return null;\n return { id: run.id, status: run.status, startedAt: new Date(run.startedAt).toISOString(), durationMs: run.durationMs, trigger: run.trigger };\n}\n\n/** Title, message, triage and link as one plain text block, the way every channel reads. */\nexport function plainText(alert: Alert, link: string | undefined): string {\n return [alert.title, \"\", alert.message, ...(alert.triage ? [\"\", `Triage: ${alert.triage}`] : []), ...(link ? [\"\", `Open: ${link}`] : [])].join(\"\\n\");\n}\n","/**\n * What every email channel sends: one subject, a plain text body and a small\n * HTML body, so an alert reads the same whichever provider carries it. Not an\n * entry point; resend, postmark, sendgrid, mailgun and ses each bundle it.\n */\nimport type { Alert } from \"../types.js\";\nimport { cut, plainText } from \"./shared.js\";\n\n/** The options every email channel takes. */\nexport interface EmailOptions {\n /** The sender, \"alerts@example.com\" or \"CronWatch <alerts@example.com>\". The provider must allow it. */\n from: string;\n /** One address or several. */\n to: string | string[];\n /** Put in front of the title in the subject, \"[prod]\" say. */\n subjectPrefix?: string;\n /** Link back to the job in your dashboard: (alert) => `https://app.example.com/cronwatch/jobs/${alert.job}`. */\n link?: (alert: Alert) => string;\n}\n\nexport interface Email {\n from: string;\n to: string[];\n subject: string;\n text: string;\n html: string;\n}\n\n/** Checks the shared options once, when the channel is made. */\nexport function recipients(name: string, options: EmailOptions): string[] {\n if (!options.from) throw new Error(`${name}() needs a from address`);\n const to = (Array.isArray(options.to) ? options.to : [options.to]).filter((a) => typeof a === \"string\" && a.trim() !== \"\");\n if (to.length === 0) throw new Error(`${name}() needs at least one to address`);\n return to.map((a) => a.trim());\n}\n\nexport function composeEmail(alert: Alert, options: EmailOptions, to: string[]): Email {\n const link = safeLink(options.link?.(alert));\n // One line: a newline in a subject is a header injection or a rejected send.\n const subject = cut(`${options.subjectPrefix ? `${options.subjectPrefix} ` : \"\"}${alert.title}`.replace(/[\\r\\n]+/g, \" \"), 250);\n return { from: options.from, to, subject, text: plainText(alert, link), html: html(alert, link) };\n}\n\n/** Escapes text for HTML content and double quoted attributes. */\nexport function escapeHtml(text: string): string {\n return text.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\").replace(/'/g, \"'\");\n}\n\n/** Only http and https links are put in a mail; anything else is dropped. */\nfunction safeLink(link: string | undefined): string | undefined {\n if (!link) return undefined;\n return /^https?:\\/\\//i.test(link) ? link : undefined;\n}\n\nfunction html(alert: Alert, link: string | undefined): string {\n const parts = [\n `<!doctype html>`,\n `<html><body style=\"margin:0;padding:16px;font-family:Georgia,serif;color:#1d1b16;background:#ffffff\">`,\n `${escapeHtml(alert.title)}`,\n `<pre style=\"margin:0 0 12px;padding:12px;background:#f6f3ec;white-space:pre-wrap;word-break:break-word;font:13px/1.45 Menlo,Consolas,monospace\">${escapeHtml(alert.message)}</pre>`,\n ];\n if (alert.triage) parts.push(`Triage: ${escapeHtml(alert.triage)}`);\n if (link) parts.push(`<a href=\"${escapeHtml(link)}\">Open ${escapeHtml(alert.job)}</a>`);\n parts.push(`</body></html>`);\n return parts.join(\"\\n\");\n}\n\n/** Splits \"Name <a@b.c>\" into its parts; a bare address has no name. */\nexport function parseAddress(address: string): { email: string; name?: string } {\n const match = /^\\s*(.*?)\\s*<([^<>]+)>\\s*$/.exec(address);\n if (!match) return { email: address.trim() };\n const name = match[1]!.replace(/^\"(.*)\"$/, \"$1\");\n return name ? { email: match[2]!.trim(), name } : { email: match[2]!.trim() };\n}\n","/**\n * AWS Signature Version 4 with Web Crypto, for the SES channel.\n * Spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html\n * Checked against the AWS SigV4 test suite (test/sigv4.test.ts).\n */\nimport { hex, sha256Hex } from \"./shared.js\";\n\nexport interface SigV4Credentials {\n accessKeyId: string;\n secretAccessKey: string;\n /** For temporary credentials (STS, an IAM role). Sent and signed as X-Amz-Security-Token. */\n sessionToken?: string;\n}\n\nexport interface SigV4Request {\n method: string;\n url: string;\n /** Headers to send and sign. Host is taken from the URL, and X-Amz-Date from `now`. */\n headers: Record<string, string>;\n body: string;\n region: string;\n service: string;\n /** Epoch milliseconds. */\n now: number;\n}\n\n/**\n * Returns the headers to send: the given ones plus x-amz-date, the session\n * token when there is one, and authorization. Host is signed but not\n * returned, because fetch sets it.\n */\nexport async function signV4(request: SigV4Request, credentials: SigV4Credentials): Promise<Record<string, string>> {\n const url = new URL(request.url);\n const amzDate = new Date(request.now).toISOString().replace(/[-:]/g, \"\").replace(/\\.\\d{3}/, \"\");\n const day = amzDate.slice(0, 8);\n const headers: Record<string, string> = {};\n for (const [name, value] of Object.entries(request.headers)) headers[name.toLowerCase()] = value;\n headers[\"x-amz-date\"] = amzDate;\n if (credentials.sessionToken) headers[\"x-amz-security-token\"] = credentials.sessionToken;\n\n const signed: Record<string, string> = { ...headers, host: url.host };\n const names = Object.keys(signed).sort();\n const canonicalHeaders = names.map((n) => `${n}:${signed[n]!.trim().replace(/\\s+/g, \" \")}\\n`).join(\"\");\n const signedHeaders = names.join(\";\");\n const canonicalRequest = [\n request.method.toUpperCase(),\n canonicalUri(url.pathname),\n canonicalQuery(url.searchParams),\n canonicalHeaders,\n signedHeaders,\n await sha256Hex(request.body),\n ].join(\"\\n\");\n const scope = `${day}/${request.region}/${request.service}/aws4_request`;\n const stringToSign = [\"AWS4-HMAC-SHA256\", amzDate, scope, await sha256Hex(canonicalRequest)].join(\"\\n\");\n\n let key = await hmac(new TextEncoder().encode(`AWS4${credentials.secretAccessKey}`), day);\n key = await hmac(key, request.region);\n key = await hmac(key, request.service);\n key = await hmac(key, \"aws4_request\");\n const signature = hex(await hmac(key, stringToSign));\n\n headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;\n return headers;\n}\n\nasync function hmac(key: Uint8Array, data: string): Promise<Uint8Array> {\n const cryptoKey = await crypto.subtle.importKey(\"raw\", key as Uint8Array<ArrayBuffer>, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n return new Uint8Array(await crypto.subtle.sign(\"HMAC\", cryptoKey, new TextEncoder().encode(data)));\n}\n\n/** RFC 3986 encoding of every byte but the unreserved characters. */\nfunction uriEncode(text: string): string {\n return encodeURIComponent(text).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);\n}\n\nfunction canonicalUri(path: string): string {\n if (!path) return \"/\";\n // URL.pathname is already encoded once; every AWS service but S3 expects each segment encoded again.\n return path.split(\"/\").map(uriEncode).join(\"/\");\n}\n\nfunction canonicalQuery(params: URLSearchParams): string {\n const pairs: [string, string][] = [];\n params.forEach((value, name) => pairs.push([uriEncode(name), uriEncode(value)]));\n pairs.sort(([a, av], [b, bv]) => (a b ? 1 : av < bv ? -1 : av > bv ? 1 : 0));\n return pairs.map(([n, v]) => `${n}=${v}`).join(\"&\");\n}\n","/**\n * Amazon SES, API v2 SendEmail. API reference: https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.html\n * POST https://email.<region>.amazonaws.com/v2/email/outbound-emails, signed\n * with AWS Signature Version 4 (see sigv4.ts), so no AWS SDK is needed.\n */\nimport type { AlertChannel } from \"../types.js\";\nimport { composeEmail, recipients, type EmailOptions } from \"./email.js\";\nimport { post, trimmed } from \"./shared.js\";\nimport { signV4 } from \"./sigv4.js\";\n\nexport interface SesOptions extends EmailOptions {\n /** The SES region, \"us-east-1\" say. The from identity must be verified there. */\n region: string;\n accessKeyId: string;\n secretAccessKey: string;\n /** For temporary credentials, an assumed role say. */\n sessionToken?: string;\n /** A configuration set for event publishing, if you use one. */\n configurationSetName?: string;\n /** The clock used to sign requests, in epoch milliseconds. For tests. */\n now?: () => number;\n}\n\n/** Sends alerts as email through Amazon SES. */\nexport function ses(options: SesOptions): AlertChannel {\n if (!options.region) throw new Error(\"ses() needs a region\");\n if (!/^[a-z0-9-]+$/.test(options.region)) throw new Error(\"ses() needs a region like us-east-1\");\n // A pasted credential often carries a stray space or newline, which would spoil the signature.\n const credentials = { accessKeyId: trimmed(options.accessKeyId), secretAccessKey: trimmed(options.secretAccessKey), sessionToken: trimmed(options.sessionToken) || undefined };\n if (!credentials.accessKeyId || !credentials.secretAccessKey) throw new Error(\"ses() needs an accessKeyId and secretAccessKey\");\n const to = recipients(\"ses\", options);\n const url = `https://email.${options.region}.amazonaws.com/v2/email/outbound-emails`;\n const now = options.now ?? Date.now;\n return {\n name: \"ses\",\n async send(alert) {\n const email = composeEmail(alert, options, to);\n const body = JSON.stringify({\n FromEmailAddress: email.from,\n Destination: { ToAddresses: email.to },\n Content: {\n Simple: {\n Subject: { Data: email.subject, Charset: \"UTF-8\" },\n Body: { Text: { Data: email.text, Charset: \"UTF-8\" }, Html: { Data: email.html, Charset: \"UTF-8\" } },\n },\n },\n ...(options.configurationSetName ? { ConfigurationSetName: options.configurationSetName } : {}),\n EmailTags: [{ Name: \"source\", Value: \"cronwatch\" }],\n });\n const headers = await signV4(\n { method: \"POST\", url, headers: { \"content-type\": \"application/json\" }, body, region: options.region, service: \"ses\", now: now() },\n credentials,\n );\n await post(\"SES\", url, { headers, body }, [credentials.secretAccessKey, credentials.sessionToken]);\n },\n };\n}\n"]}

package/dist/ses.d.cts ADDED Viewed

@@ -0,0 +1,25 @@
+import { a as AlertChannel } from './types-Ddq1MUPL.cjs';
+import { E as EmailOptions } from './email-BJ-z_epD.cjs';
+/**
+ * Amazon SES, API v2 SendEmail. API reference: https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.html
+ * POST https://email.<region>.amazonaws.com/v2/email/outbound-emails, signed
+ * with AWS Signature Version 4 (see sigv4.ts), so no AWS SDK is needed.
+ */
+interface SesOptions extends EmailOptions {
+    /** The SES region, "us-east-1" say. The from identity must be verified there. */
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** For temporary credentials, an assumed role say. */
+    sessionToken?: string;
+    /** A configuration set for event publishing, if you use one. */
+    configurationSetName?: string;
+    /** The clock used to sign requests, in epoch milliseconds. For tests. */
+    now?: () => number;
+}
+/** Sends alerts as email through Amazon SES. */
+declare function ses(options: SesOptions): AlertChannel;
+export { type SesOptions, ses };

package/dist/ses.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+import { a as AlertChannel } from './types-Ddq1MUPL.js';
+import { E as EmailOptions } from './email-_H0faCh3.js';
+/**
+ * Amazon SES, API v2 SendEmail. API reference: https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.html
+ * POST https://email.<region>.amazonaws.com/v2/email/outbound-emails, signed
+ * with AWS Signature Version 4 (see sigv4.ts), so no AWS SDK is needed.
+ */
+interface SesOptions extends EmailOptions {
+    /** The SES region, "us-east-1" say. The from identity must be verified there. */
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** For temporary credentials, an assumed role say. */
+    sessionToken?: string;
+    /** A configuration set for event publishing, if you use one. */
+    configurationSetName?: string;
+    /** The clock used to sign requests, in epoch milliseconds. For tests. */
+    now?: () => number;
+}
+/** Sends alerts as email through Amazon SES. */
+declare function ses(options: SesOptions): AlertChannel;
+export { type SesOptions, ses };

package/dist/ses.js ADDED Viewed

@@ -0,0 +1,168 @@
+// src/alerts/shared.ts
+var TIMEOUT_MS = 1e4;
+function origin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return "(invalid URL)";
+  }
+}
+var ERROR_BODY_MAX = 200;
+async function post(provider, url, init, secrets = []) {
+  const response = await fetch(url, { method: "POST", headers: init.headers, body: init.body, redirect: "error", signal: AbortSignal.timeout(TIMEOUT_MS) });
+  if (!response.ok) {
+    let text = "";
+    try {
+      text = await response.text();
+    } catch {
+    }
+    throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : ""}`);
+  }
+  return response;
+}
+function errorBody(text, secrets = []) {
+  const kept = secrets.filter((s) => typeof s === "string" && s.length >= 4);
+  const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);
+  let head = cut(text, ERROR_BODY_MAX + longest);
+  for (const secret of kept) head = head.split(secret).join("[redacted]");
+  return cut(head, ERROR_BODY_MAX);
+}
+function trimmed(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function hex(bytes) {
+  return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(text) {
+  return hex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text)));
+}
+function cut(text, max) {
+  if (text.length <= max) return text;
+  let end = max;
+  const code = text.charCodeAt(end - 1);
+  if (code >= 55296 && code <= 56319) end -= 1;
+  return text.slice(0, end);
+}
+function plainText(alert, link) {
+  return [alert.title, "", alert.message, ...alert.triage ? ["", `Triage: ${alert.triage}`] : [], ...link ? ["", `Open: ${link}`] : []].join("\n");
+}
+// src/alerts/email.ts
+function recipients(name, options) {
+  if (!options.from) throw new Error(`${name}() needs a from address`);
+  const to = (Array.isArray(options.to) ? options.to : [options.to]).filter((a) => typeof a === "string" && a.trim() !== "");
+  if (to.length === 0) throw new Error(`${name}() needs at least one to address`);
+  return to.map((a) => a.trim());
+}
+function composeEmail(alert, options, to) {
+  const link = safeLink(options.link?.(alert));
+  const subject = cut(`${options.subjectPrefix ? `${options.subjectPrefix} ` : ""}${alert.title}`.replace(/[\r\n]+/g, " "), 250);
+  return { from: options.from, to, subject, text: plainText(alert, link), html: html(alert, link) };
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function safeLink(link) {
+  if (!link) return void 0;
+  return /^https?:\/\//i.test(link) ? link : void 0;
+}
+function html(alert, link) {
+  const parts = [
+    `<!doctype html>`,
+    `<html><body style="margin:0;padding:16px;font-family:Georgia,serif;color:#1d1b16;background:#ffffff">`,
+    `<p style="margin:0 0 12px;font-size:18px"><strong>${escapeHtml(alert.title)}</strong></p>`,
+    `<pre style="margin:0 0 12px;padding:12px;background:#f6f3ec;white-space:pre-wrap;word-break:break-word;font:13px/1.45 Menlo,Consolas,monospace">${escapeHtml(alert.message)}</pre>`
+  ];
+  if (alert.triage) parts.push(`<p style="margin:0 0 12px"><em>Triage:</em> ${escapeHtml(alert.triage)}</p>`);
+  if (link) parts.push(`<p style="margin:0"><a href="${escapeHtml(link)}">Open ${escapeHtml(alert.job)}</a></p>`);
+  parts.push(`</body></html>`);
+  return parts.join("\n");
+}
+// src/alerts/sigv4.ts
+async function signV4(request, credentials) {
+  const url = new URL(request.url);
+  const amzDate = new Date(request.now).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+  const day = amzDate.slice(0, 8);
+  const headers = {};
+  for (const [name, value] of Object.entries(request.headers)) headers[name.toLowerCase()] = value;
+  headers["x-amz-date"] = amzDate;
+  if (credentials.sessionToken) headers["x-amz-security-token"] = credentials.sessionToken;
+  const signed = { ...headers, host: url.host };
+  const names = Object.keys(signed).sort();
+  const canonicalHeaders = names.map((n) => `${n}:${signed[n].trim().replace(/\s+/g, " ")}
+`).join("");
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    request.method.toUpperCase(),
+    canonicalUri(url.pathname),
+    canonicalQuery(url.searchParams),
+    canonicalHeaders,
+    signedHeaders,
+    await sha256Hex(request.body)
+  ].join("\n");
+  const scope = `${day}/${request.region}/${request.service}/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", amzDate, scope, await sha256Hex(canonicalRequest)].join("\n");
+  let key = await hmac(new TextEncoder().encode(`AWS4${credentials.secretAccessKey}`), day);
+  key = await hmac(key, request.region);
+  key = await hmac(key, request.service);
+  key = await hmac(key, "aws4_request");
+  const signature = hex(await hmac(key, stringToSign));
+  headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  return headers;
+}
+async function hmac(key, data) {
+  const cryptoKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(data)));
+}
+function uriEncode(text) {
+  return encodeURIComponent(text).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function canonicalUri(path) {
+  if (!path) return "/";
+  return path.split("/").map(uriEncode).join("/");
+}
+function canonicalQuery(params) {
+  const pairs = [];
+  params.forEach((value, name) => pairs.push([uriEncode(name), uriEncode(value)]));
+  pairs.sort(([a, av], [b, bv]) => a < b ? -1 : a > b ? 1 : av < bv ? -1 : av > bv ? 1 : 0);
+  return pairs.map(([n, v]) => `${n}=${v}`).join("&");
+}
+// src/alerts/ses.ts
+function ses(options) {
+  if (!options.region) throw new Error("ses() needs a region");
+  if (!/^[a-z0-9-]+$/.test(options.region)) throw new Error("ses() needs a region like us-east-1");
+  const credentials = { accessKeyId: trimmed(options.accessKeyId), secretAccessKey: trimmed(options.secretAccessKey), sessionToken: trimmed(options.sessionToken) || void 0 };
+  if (!credentials.accessKeyId || !credentials.secretAccessKey) throw new Error("ses() needs an accessKeyId and secretAccessKey");
+  const to = recipients("ses", options);
+  const url = `https://email.${options.region}.amazonaws.com/v2/email/outbound-emails`;
+  const now = options.now ?? Date.now;
+  return {
+    name: "ses",
+    async send(alert) {
+      const email = composeEmail(alert, options, to);
+      const body = JSON.stringify({
+        FromEmailAddress: email.from,
+        Destination: { ToAddresses: email.to },
+        Content: {
+          Simple: {
+            Subject: { Data: email.subject, Charset: "UTF-8" },
+            Body: { Text: { Data: email.text, Charset: "UTF-8" }, Html: { Data: email.html, Charset: "UTF-8" } }
+          }
+        },
+        ...options.configurationSetName ? { ConfigurationSetName: options.configurationSetName } : {},
+        EmailTags: [{ Name: "source", Value: "cronwatch" }]
+      });
+      const headers = await signV4(
+        { method: "POST", url, headers: { "content-type": "application/json" }, body, region: options.region, service: "ses", now: now() },
+        credentials
+      );
+      await post("SES", url, { headers, body }, [credentials.secretAccessKey, credentials.sessionToken]);
+    }
+  };
+}
+export { ses };
+//# sourceMappingURL=ses.js.map
+//# sourceMappingURL=ses.js.map

package/dist/ses.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/alerts/shared.ts","../src/alerts/email.ts","../src/alerts/sigv4.ts","../src/alerts/ses.ts"],"names":[],"mappings":";AAOO,IAAM,UAAA,GAAa,GAAA;AAYnB,SAAS,OAAO,GAAA,EAAqB;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAGO,IAAM,cAAA,GAAiB,GAAA;AAW9B,eAAsB,KAAK,QAAA,EAAkB,GAAA,EAAa,IAAA,EAAyD,OAAA,GAAkC,EAAC,EAAsB;AAC1K,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAS,IAAA,CAAK,OAAA,EAAS,MAAM,IAAA,CAAK,IAAA,EAAM,UAAU,OAAA,EAAS,MAAA,EAAQ,YAAY,OAAA,CAAQ,UAAU,GAAG,CAAA;AACxJ,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,QAAQ,IAAI,MAAA,CAAO,GAAG,CAAC,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,EAAG,IAAA,GAAO,KAAK,SAAA,CAAU,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACxH;AACA,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,SAAA,CAAU,IAAA,EAAc,OAAA,GAAkC,EAAC,EAAW;AACpF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,IAAU,CAAC,CAAA;AACtF,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,EAAG,CAAA,KAAM,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,MAAM,CAAA,EAAG,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,GAAO,GAAA,CAAI,IAAA,EAAM,cAAA,GAAiB,OAAO,CAAA;AAC7C,EAAA,KAAA,MAAW,MAAA,IAAU,MAAM,IAAA,GAAO,IAAA,CAAK,MAAM,MAAM,CAAA,CAAE,KAAK,YAAY,CAAA;AACtE,EAAA,OAAO,GAAA,CAAI,MAAM,cAAc,CAAA;AACjC;AAGO,SAAS,QAAQ,KAAA,EAAwB;AAC9C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,CAAM,MAAK,GAAI,EAAA;AACpD;AAaO,SAAS,IAAI,KAAA,EAAyC;AAC3D,EAAA,OAAO,KAAA,CAAM,KAAK,KAAA,YAAiB,UAAA,GAAa,QAAQ,IAAI,UAAA,CAAW,KAAK,CAAA,EAAG,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA;AAChI;AAEA,eAAsB,UAAU,IAAA,EAA+B;AAC7D,EAAA,OAAO,GAAA,CAAI,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AAClF;AAiBO,SAAS,GAAA,CAAI,MAAc,GAAA,EAAqB;AACrD,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,GAAA,EAAK,OAAO,IAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,GAAA,GAAM,CAAC,CAAA;AACpC,EAAA,IAAI,IAAA,IAAQ,KAAA,IAAU,IAAA,IAAQ,KAAA,EAAQ,GAAA,IAAO,CAAA;AAC7C,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B;AAUO,SAAS,SAAA,CAAU,OAAc,IAAA,EAAkC;AACxE,EAAA,OAAO,CAAC,KAAA,CAAM,KAAA,EAAO,EAAA,EAAI,KAAA,CAAM,OAAA,EAAS,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,EAAA,EAAI,CAAA,QAAA,EAAW,MAAM,MAAM,CAAA,CAAE,CAAA,GAAI,EAAC,EAAI,GAAI,IAAA,GAAO,CAAC,EAAA,EAAI,CAAA,MAAA,EAAS,IAAI,CAAA,CAAE,CAAA,GAAI,EAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACrJ;;;AC1FO,SAAS,UAAA,CAAW,MAAc,OAAA,EAAiC;AACxE,EAAA,IAAI,CAAC,QAAQ,IAAA,EAAM,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,uBAAA,CAAyB,CAAA;AACnE,EAAA,MAAM,EAAA,GAAA,CAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,EAAE,CAAA,GAAI,OAAA,CAAQ,KAAK,CAAC,OAAA,CAAQ,EAAE,CAAA,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,OAAO,MAAM,QAAA,IAAY,CAAA,CAAE,IAAA,EAAK,KAAM,EAAE,CAAA;AACzH,EAAA,IAAI,EAAA,CAAG,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,gCAAA,CAAkC,CAAA;AAC9E,EAAA,OAAO,GAAG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAA;AAC/B;AAEO,SAAS,YAAA,CAAa,KAAA,EAAc,OAAA,EAAuB,EAAA,EAAqB;AACrF,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAC,CAAA;AAE3C,EAAA,MAAM,UAAU,GAAA,CAAI,CAAA,EAAG,QAAQ,aAAA,GAAgB,CAAA,EAAG,QAAQ,aAAa,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,EAAG,MAAM,KAAK,CAAA,CAAA,CAAG,QAAQ,UAAA,EAAY,GAAG,GAAG,GAAG,CAAA;AAC7H,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAA,EAAM,IAAI,OAAA,EAAS,IAAA,EAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA,EAAG,IAAA,EAAM,IAAA,CAAK,KAAA,EAAO,IAAI,CAAA,EAAE;AAClG;AAGO,SAAS,WAAW,IAAA,EAAsB;AAC/C,EAAA,OAAO,KAAK,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAM,MAAM,CAAA,CAAE,QAAQ,IAAA,EAAM,MAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CAAE,OAAA,CAAQ,MAAM,OAAO,CAAA;AAC9H;AAGA,SAAS,SAAS,IAAA,EAA8C;AAC9D,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA,GAAO,MAAA;AAC7C;AAEA,SAAS,IAAA,CAAK,OAAc,IAAA,EAAkC;AAC5D,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,CAAA,eAAA,CAAA;AAAA,IACA,CAAA,qGAAA,CAAA;AAAA,IACA,CAAA,kDAAA,EAAqD,UAAA,CAAW,KAAA,CAAM,KAAK,CAAC,CAAA,aAAA,CAAA;AAAA,IAC5E,CAAA,gJAAA,EAAmJ,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA,MAAA;AAAA,GAC9K;AACA,EAAA,IAAI,KAAA,CAAM,QAAQ,KAAA,CAAM,IAAA,CAAK,+CAA+C,UAAA,CAAW,KAAA,CAAM,MAAM,CAAC,CAAA,IAAA,CAAM,CAAA;AAC1G,EAAA,IAAI,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,CAAA,6BAAA,EAAgC,UAAA,CAAW,IAAI,CAAC,CAAA,OAAA,EAAU,UAAA,CAAW,KAAA,CAAM,GAAG,CAAC,CAAA,QAAA,CAAU,CAAA;AAC9G,EAAA,KAAA,CAAM,KAAK,CAAA,cAAA,CAAgB,CAAA;AAC3B,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;;;AClCA,eAAsB,MAAA,CAAO,SAAuB,WAAA,EAAgE;AAClH,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CAAE,OAAA,CAAQ,WAAW,EAAE,CAAA;AAC9F,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAC9B,EAAA,MAAM,UAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,WAAA,EAAa,CAAA,GAAI,KAAA;AAC3F,EAAA,OAAA,CAAQ,YAAY,CAAA,GAAI,OAAA;AACxB,EAAA,IAAI,WAAA,CAAY,YAAA,EAAc,OAAA,CAAQ,sBAAsB,IAAI,WAAA,CAAY,YAAA;AAE5E,EAAA,MAAM,SAAiC,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,IAAI,IAAA,EAAK;AACpE,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,IAAA,EAAK;AACvC,EAAA,MAAM,mBAAmB,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,CAAC,EAAG,IAAA,EAAK,CAAE,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAC;AAAA,CAAI,CAAA,CAAE,KAAK,EAAE,CAAA;AACrG,EAAA,MAAM,aAAA,GAAgB,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AACpC,EAAA,MAAM,gBAAA,GAAmB;AAAA,IACvB,OAAA,CAAQ,OAAO,WAAA,EAAY;AAAA,IAC3B,YAAA,CAAa,IAAI,QAAQ,CAAA;AAAA,IACzB,cAAA,CAAe,IAAI,YAAY,CAAA;AAAA,IAC/B,gBAAA;AAAA,IACA,aAAA;AAAA,IACA,MAAM,SAAA,CAAU,OAAA,CAAQ,IAAI;AAAA,GAC9B,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,MAAM,KAAA,GAAQ,GAAG,GAAG,CAAA,CAAA,EAAI,QAAQ,MAAM,CAAA,CAAA,EAAI,QAAQ,OAAO,CAAA,aAAA,CAAA;AACzD,EAAA,MAAM,YAAA,GAAe,CAAC,kBAAA,EAAoB,OAAA,EAAS,KAAA,EAAO,MAAM,SAAA,CAAU,gBAAgB,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAEtG,EAAA,IAAI,GAAA,GAAM,MAAM,IAAA,CAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAA,IAAA,EAAO,WAAA,CAAY,eAAe,CAAA,CAAE,CAAA,EAAG,GAAG,CAAA;AACxF,EAAA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,MAAM,CAAA;AACpC,EAAA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAA;AACrC,EAAA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACpC,EAAA,MAAM,YAAY,GAAA,CAAI,MAAM,IAAA,CAAK,GAAA,EAAK,YAAY,CAAC,CAAA;AAEnD,EAAA,OAAA,CAAQ,aAAA,GAAgB,+BAA+B,WAAA,CAAY,WAAW,IAAI,KAAK,CAAA,gBAAA,EAAmB,aAAa,CAAA,YAAA,EAAe,SAAS,CAAA,CAAA;AAC/I,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,IAAA,CAAK,KAAiB,IAAA,EAAmC;AACtE,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,GAAA,EAAgC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AACzI,EAAA,OAAO,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACnG;AAGA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,OAAO,mBAAmB,IAAI,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,CAAC,CAAA,KAAM,CAAA,CAAA,EAAI,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA,CAAE,CAAA;AAC7G;AAEA,SAAS,aAAa,IAAA,EAAsB;AAC1C,EAAA,IAAI,CAAC,MAAM,OAAO,GAAA;AAElB,EAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA,CAAE,IAAI,SAAS,CAAA,CAAE,KAAK,GAAG,CAAA;AAChD;AAEA,SAAS,eAAe,MAAA,EAAiC;AACvD,EAAA,MAAM,QAA4B,EAAC;AACnC,EAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,IAAA,KAAS,MAAM,IAAA,CAAK,CAAC,SAAA,CAAU,IAAI,CAAA,EAAG,SAAA,CAAU,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/E,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,EAAG,EAAE,CAAA,EAAG,CAAC,CAAA,EAAG,EAAE,CAAA,KAAO,CAAA,GAAI,IAAI,EAAA,GAAK,CAAA,GAAI,IAAI,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,CAAA,GAAI,CAAE,CAAA;AAC1F,EAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,CAAC,GAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AACpD;;;AC9DO,SAAS,IAAI,OAAA,EAAmC;AACrD,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAC3D,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAE/F,EAAA,MAAM,cAAc,EAAE,WAAA,EAAa,OAAA,CAAQ,OAAA,CAAQ,WAAW,CAAA,EAAG,eAAA,EAAiB,OAAA,CAAQ,OAAA,CAAQ,eAAe,CAAA,EAAG,YAAA,EAAc,QAAQ,OAAA,CAAQ,YAAY,KAAK,MAAA,EAAU;AAC7K,EAAA,IAAI,CAAC,YAAY,WAAA,IAAe,CAAC,YAAY,eAAA,EAAiB,MAAM,IAAI,KAAA,CAAM,gDAAgD,CAAA;AAC9H,EAAA,MAAM,EAAA,GAAK,UAAA,CAAW,KAAA,EAAO,OAAO,CAAA;AACpC,EAAA,MAAM,GAAA,GAAM,CAAA,cAAA,EAAiB,OAAA,CAAQ,MAAM,CAAA,uCAAA,CAAA;AAC3C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAChC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,KAAA,EAAO,OAAA,EAAS,EAAE,CAAA;AAC7C,MAAA,MAAM,IAAA,GAAO,KAAK,SAAA,CAAU;AAAA,QAC1B,kBAAkB,KAAA,CAAM,IAAA;AAAA,QACxB,WAAA,EAAa,EAAE,WAAA,EAAa,KAAA,CAAM,EAAA,EAAG;AAAA,QACrC,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ;AAAA,YACN,SAAS,EAAE,IAAA,EAAM,KAAA,CAAM,OAAA,EAAS,SAAS,OAAA,EAAQ;AAAA,YACjD,MAAM,EAAE,IAAA,EAAM,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,OAAA,EAAS,OAAA,EAAQ,EAAG,MAAM,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,OAAA,EAAS,SAAQ;AAAE;AACrG,SACF;AAAA,QACA,GAAI,QAAQ,oBAAA,GAAuB,EAAE,sBAAsB,OAAA,CAAQ,oBAAA,KAAyB,EAAC;AAAA,QAC7F,WAAW,CAAC,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,aAAa;AAAA,OACnD,CAAA;AACD,MAAA,MAAM,UAAU,MAAM,MAAA;AAAA,QACpB,EAAE,MAAA,EAAQ,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB,EAAG,IAAA,EAAM,QAAQ,OAAA,CAAQ,MAAA,EAAQ,SAAS,KAAA,EAAO,GAAA,EAAK,KAAI,EAAE;AAAA,QACjI;AAAA,OACF;AACA,MAAA,MAAM,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,EAAE,OAAA,EAAS,IAAA,EAAK,EAAG,CAAC,WAAA,CAAY,eAAA,EAAiB,WAAA,CAAY,YAAY,CAAC,CAAA;AAAA,IACnG;AAAA,GACF;AACF","file":"ses.js","sourcesContent":["/**\n * Helpers shared by the provider channels. Only fetch and Web Crypto, so the\n * channels run on Node, Cloudflare Workers, Deno and Bun alike. Not an entry\n * point: each channel bundles its own copy.\n */\nimport type { Alert } from \"../types.js\";\n\nexport const TIMEOUT_MS = 10_000;\n\n/** Severity for trackers that have levels. Recovered is informational. */\nexport type Severity = \"error\" | \"warning\" | \"info\";\n\nexport function severity(type: Alert[\"type\"]): Severity {\n if (type === \"recovered\") return \"info\";\n if (type === \"slow\" || type === \"over_budget\") return \"warning\";\n return \"error\";\n}\n\n/** The scheme, host and port only. A URL's path or query can hold a credential. */\nexport function origin(url: string): string {\n try {\n return new URL(url).origin;\n } catch {\n return \"(invalid URL)\";\n }\n}\n\n/** How much of a provider's error body goes into the error message. */\nexport const ERROR_BODY_MAX = 200;\n\n/**\n * POSTs and throws on a non-2xx answer. The error names the provider and the\n * URL's origin, plus the start of the response body with every secret the\n * channel holds cut out, in case a provider echoes one back. Secrets are cut\n * from a prefix long enough to hold one that starts inside the first\n * ERROR_BODY_MAX characters, and only then is it cut to that length, so no\n * part of a secret survives at the edge. A redirect is refused rather than\n * followed: the credential headers would go with it to wherever it points.\n */\nexport async function post(provider: string, url: string, init: { headers: Record<string, string>; body: string }, secrets: (string | undefined)[] = []): Promise<Response> {\n const response = await fetch(url, { method: \"POST\", headers: init.headers, body: init.body, redirect: \"error\", signal: AbortSignal.timeout(TIMEOUT_MS) });\n if (!response.ok) {\n let text = \"\";\n try {\n text = await response.text();\n } catch {\n // The status is enough.\n }\n throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : \"\"}`);\n }\n return response;\n}\n\n/** The start of an error body, secrets cut out first, then cut to ERROR_BODY_MAX on a code point. */\nexport function errorBody(text: string, secrets: (string | undefined)[] = []): string {\n const kept = secrets.filter((s): s is string => typeof s === \"string\" && s.length >= 4);\n const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);\n let head = cut(text, ERROR_BODY_MAX + longest);\n for (const secret of kept) head = head.split(secret).join(\"[redacted]\");\n return cut(head, ERROR_BODY_MAX);\n}\n\n/** A credential with the spaces and newlines a paste leaves around it taken off. Anything not a string is empty. */\nexport function trimmed(value: unknown): string {\n return typeof value === \"string\" ? value.trim() : \"\";\n}\n\n/** Base64 of UTF-8, without Buffer. */\nexport function base64(text: string): string {\n let binary = \"\";\n for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);\n return btoa(binary);\n}\n\nexport function basicAuth(user: string, password: string): string {\n return `Basic ${base64(`${user}:${password}`)}`;\n}\n\nexport function hex(bytes: ArrayBuffer | Uint8Array): string {\n return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport async function sha256Hex(text: string): Promise<string> {\n return hex(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text)));\n}\n\n/**\n * A stable 32 hex character id for one alert: the same job, type and time\n * always give the same id, so a provider that deduplicates on it drops a\n * resend of an alert it already took.\n */\nexport async function alertId(alert: Alert): Promise<string> {\n return (await sha256Hex(`${alert.job}\\n${alert.type}\\n${alert.at}`)).slice(0, 32);\n}\n\n/** The same id laid out as a UUID, for APIs that ask for one. */\nexport function asUuid(id: string): string {\n return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20, 32)}`;\n}\n\n/** Cuts to at most `max` UTF-16 units without splitting a surrogate pair. */\nexport function cut(text: string, max: number): string {\n if (text.length <= max) return text;\n let end = max;\n const code = text.charCodeAt(end - 1);\n if (code >= 0xd800 && code <= 0xdbff) end -= 1;\n return text.slice(0, end);\n}\n\n/** The run fields worth attaching to a tracker event. */\nexport function runSummary(alert: Alert): Record<string, unknown> | null {\n const run = alert.run;\n if (!run) return null;\n return { id: run.id, status: run.status, startedAt: new Date(run.startedAt).toISOString(), durationMs: run.durationMs, trigger: run.trigger };\n}\n\n/** Title, message, triage and link as one plain text block, the way every channel reads. */\nexport function plainText(alert: Alert, link: string | undefined): string {\n return [alert.title, \"\", alert.message, ...(alert.triage ? [\"\", `Triage: ${alert.triage}`] : []), ...(link ? [\"\", `Open: ${link}`] : [])].join(\"\\n\");\n}\n","/**\n * What every email channel sends: one subject, a plain text body and a small\n * HTML body, so an alert reads the same whichever provider carries it. Not an\n * entry point; resend, postmark, sendgrid, mailgun and ses each bundle it.\n */\nimport type { Alert } from \"../types.js\";\nimport { cut, plainText } from \"./shared.js\";\n\n/** The options every email channel takes. */\nexport interface EmailOptions {\n /** The sender, \"alerts@example.com\" or \"CronWatch <alerts@example.com>\". The provider must allow it. */\n from: string;\n /** One address or several. */\n to: string | string[];\n /** Put in front of the title in the subject, \"[prod]\" say. */\n subjectPrefix?: string;\n /** Link back to the job in your dashboard: (alert) => `https://app.example.com/cronwatch/jobs/${alert.job}`. */\n link?: (alert: Alert) => string;\n}\n\nexport interface Email {\n from: string;\n to: string[];\n subject: string;\n text: string;\n html: string;\n}\n\n/** Checks the shared options once, when the channel is made. */\nexport function recipients(name: string, options: EmailOptions): string[] {\n if (!options.from) throw new Error(`${name}() needs a from address`);\n const to = (Array.isArray(options.to) ? options.to : [options.to]).filter((a) => typeof a === \"string\" && a.trim() !== \"\");\n if (to.length === 0) throw new Error(`${name}() needs at least one to address`);\n return to.map((a) => a.trim());\n}\n\nexport function composeEmail(alert: Alert, options: EmailOptions, to: string[]): Email {\n const link = safeLink(options.link?.(alert));\n // One line: a newline in a subject is a header injection or a rejected send.\n const subject = cut(`${options.subjectPrefix ? `${options.subjectPrefix} ` : \"\"}${alert.title}`.replace(/[\\r\\n]+/g, \" \"), 250);\n return { from: options.from, to, subject, text: plainText(alert, link), html: html(alert, link) };\n}\n\n/** Escapes text for HTML content and double quoted attributes. */\nexport function escapeHtml(text: string): string {\n return text.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\").replace(/'/g, \"'\");\n}\n\n/** Only http and https links are put in a mail; anything else is dropped. */\nfunction safeLink(link: string | undefined): string | undefined {\n if (!link) return undefined;\n return /^https?:\\/\\//i.test(link) ? link : undefined;\n}\n\nfunction html(alert: Alert, link: string | undefined): string {\n const parts = [\n `<!doctype html>`,\n `<html><body style=\"margin:0;padding:16px;font-family:Georgia,serif;color:#1d1b16;background:#ffffff\">`,\n `${escapeHtml(alert.title)}`,\n `<pre style=\"margin:0 0 12px;padding:12px;background:#f6f3ec;white-space:pre-wrap;word-break:break-word;font:13px/1.45 Menlo,Consolas,monospace\">${escapeHtml(alert.message)}</pre>`,\n ];\n if (alert.triage) parts.push(`Triage: ${escapeHtml(alert.triage)}`);\n if (link) parts.push(`<a href=\"${escapeHtml(link)}\">Open ${escapeHtml(alert.job)}</a>`);\n parts.push(`</body></html>`);\n return parts.join(\"\\n\");\n}\n\n/** Splits \"Name <a@b.c>\" into its parts; a bare address has no name. */\nexport function parseAddress(address: string): { email: string; name?: string } {\n const match = /^\\s*(.*?)\\s*<([^<>]+)>\\s*$/.exec(address);\n if (!match) return { email: address.trim() };\n const name = match[1]!.replace(/^\"(.*)\"$/, \"$1\");\n return name ? { email: match[2]!.trim(), name } : { email: match[2]!.trim() };\n}\n","/**\n * AWS Signature Version 4 with Web Crypto, for the SES channel.\n * Spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html\n * Checked against the AWS SigV4 test suite (test/sigv4.test.ts).\n */\nimport { hex, sha256Hex } from \"./shared.js\";\n\nexport interface SigV4Credentials {\n accessKeyId: string;\n secretAccessKey: string;\n /** For temporary credentials (STS, an IAM role). Sent and signed as X-Amz-Security-Token. */\n sessionToken?: string;\n}\n\nexport interface SigV4Request {\n method: string;\n url: string;\n /** Headers to send and sign. Host is taken from the URL, and X-Amz-Date from `now`. */\n headers: Record<string, string>;\n body: string;\n region: string;\n service: string;\n /** Epoch milliseconds. */\n now: number;\n}\n\n/**\n * Returns the headers to send: the given ones plus x-amz-date, the session\n * token when there is one, and authorization. Host is signed but not\n * returned, because fetch sets it.\n */\nexport async function signV4(request: SigV4Request, credentials: SigV4Credentials): Promise<Record<string, string>> {\n const url = new URL(request.url);\n const amzDate = new Date(request.now).toISOString().replace(/[-:]/g, \"\").replace(/\\.\\d{3}/, \"\");\n const day = amzDate.slice(0, 8);\n const headers: Record<string, string> = {};\n for (const [name, value] of Object.entries(request.headers)) headers[name.toLowerCase()] = value;\n headers[\"x-amz-date\"] = amzDate;\n if (credentials.sessionToken) headers[\"x-amz-security-token\"] = credentials.sessionToken;\n\n const signed: Record<string, string> = { ...headers, host: url.host };\n const names = Object.keys(signed).sort();\n const canonicalHeaders = names.map((n) => `${n}:${signed[n]!.trim().replace(/\\s+/g, \" \")}\\n`).join(\"\");\n const signedHeaders = names.join(\";\");\n const canonicalRequest = [\n request.method.toUpperCase(),\n canonicalUri(url.pathname),\n canonicalQuery(url.searchParams),\n canonicalHeaders,\n signedHeaders,\n await sha256Hex(request.body),\n ].join(\"\\n\");\n const scope = `${day}/${request.region}/${request.service}/aws4_request`;\n const stringToSign = [\"AWS4-HMAC-SHA256\", amzDate, scope, await sha256Hex(canonicalRequest)].join(\"\\n\");\n\n let key = await hmac(new TextEncoder().encode(`AWS4${credentials.secretAccessKey}`), day);\n key = await hmac(key, request.region);\n key = await hmac(key, request.service);\n key = await hmac(key, \"aws4_request\");\n const signature = hex(await hmac(key, stringToSign));\n\n headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;\n return headers;\n}\n\nasync function hmac(key: Uint8Array, data: string): Promise<Uint8Array> {\n const cryptoKey = await crypto.subtle.importKey(\"raw\", key as Uint8Array<ArrayBuffer>, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n return new Uint8Array(await crypto.subtle.sign(\"HMAC\", cryptoKey, new TextEncoder().encode(data)));\n}\n\n/** RFC 3986 encoding of every byte but the unreserved characters. */\nfunction uriEncode(text: string): string {\n return encodeURIComponent(text).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);\n}\n\nfunction canonicalUri(path: string): string {\n if (!path) return \"/\";\n // URL.pathname is already encoded once; every AWS service but S3 expects each segment encoded again.\n return path.split(\"/\").map(uriEncode).join(\"/\");\n}\n\nfunction canonicalQuery(params: URLSearchParams): string {\n const pairs: [string, string][] = [];\n params.forEach((value, name) => pairs.push([uriEncode(name), uriEncode(value)]));\n pairs.sort(([a, av], [b, bv]) => (a b ? 1 : av < bv ? -1 : av > bv ? 1 : 0));\n return pairs.map(([n, v]) => `${n}=${v}`).join(\"&\");\n}\n","/**\n * Amazon SES, API v2 SendEmail. API reference: https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.html\n * POST https://email.<region>.amazonaws.com/v2/email/outbound-emails, signed\n * with AWS Signature Version 4 (see sigv4.ts), so no AWS SDK is needed.\n */\nimport type { AlertChannel } from \"../types.js\";\nimport { composeEmail, recipients, type EmailOptions } from \"./email.js\";\nimport { post, trimmed } from \"./shared.js\";\nimport { signV4 } from \"./sigv4.js\";\n\nexport interface SesOptions extends EmailOptions {\n /** The SES region, \"us-east-1\" say. The from identity must be verified there. */\n region: string;\n accessKeyId: string;\n secretAccessKey: string;\n /** For temporary credentials, an assumed role say. */\n sessionToken?: string;\n /** A configuration set for event publishing, if you use one. */\n configurationSetName?: string;\n /** The clock used to sign requests, in epoch milliseconds. For tests. */\n now?: () => number;\n}\n\n/** Sends alerts as email through Amazon SES. */\nexport function ses(options: SesOptions): AlertChannel {\n if (!options.region) throw new Error(\"ses() needs a region\");\n if (!/^[a-z0-9-]+$/.test(options.region)) throw new Error(\"ses() needs a region like us-east-1\");\n // A pasted credential often carries a stray space or newline, which would spoil the signature.\n const credentials = { accessKeyId: trimmed(options.accessKeyId), secretAccessKey: trimmed(options.secretAccessKey), sessionToken: trimmed(options.sessionToken) || undefined };\n if (!credentials.accessKeyId || !credentials.secretAccessKey) throw new Error(\"ses() needs an accessKeyId and secretAccessKey\");\n const to = recipients(\"ses\", options);\n const url = `https://email.${options.region}.amazonaws.com/v2/email/outbound-emails`;\n const now = options.now ?? Date.now;\n return {\n name: \"ses\",\n async send(alert) {\n const email = composeEmail(alert, options, to);\n const body = JSON.stringify({\n FromEmailAddress: email.from,\n Destination: { ToAddresses: email.to },\n Content: {\n Simple: {\n Subject: { Data: email.subject, Charset: \"UTF-8\" },\n Body: { Text: { Data: email.text, Charset: \"UTF-8\" }, Html: { Data: email.html, Charset: \"UTF-8\" } },\n },\n },\n ...(options.configurationSetName ? { ConfigurationSetName: options.configurationSetName } : {}),\n EmailTags: [{ Name: \"source\", Value: \"cronwatch\" }],\n });\n const headers = await signV4(\n { method: \"POST\", url, headers: { \"content-type\": \"application/json\" }, body, region: options.region, service: \"ses\", now: now() },\n credentials,\n );\n await post(\"SES\", url, { headers, body }, [credentials.secretAccessKey, credentials.sessionToken]);\n },\n };\n}\n"]}

package/dist/slack.cjs CHANGED Viewed

@@ -21,6 +21,8 @@ function slack(options) {
       const response = await fetch(options.webhookUrl, {
         method: "POST",
         headers: { "content-type": "application/json" },
+        // Refused, not followed: a webhook URL is its own credential.
+        redirect: "error",
         signal: AbortSignal.timeout(TIMEOUT_MS),
         body: JSON.stringify({
           // The notification fallback is parsed as mrkdwn too, so it is escaped like the blocks.

package/dist/slack.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/alerts/slack.ts"],"names":[],"mappings":";;;AASA,IAAM,KAAA,GAAuC;AAAA,EAC3C,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,KAAA;AAAA,EACR,KAAA,EAAO,YAAA;AAAA,EACP,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,YAAA;AAAA,EACb,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,UAAA,GAAa,GAAA;AAGZ,SAAS,MAAM,OAAA,EAAqC;AACzD,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,MAAM,4BAA4B,CAAA;AACrE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAA;AAChC,MAAA,MAAM,QAAQ,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,CAAA,EAAI,GAAA,GAAM,CAAA,GAAA,EAAM,GAAG,YAAY,EAAE,CAAA,CAAA;AAC3F,MAAA,MAAM,IAAA,GAAO,cAAc,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,UAAA,EAAY;AAAA,QAC/C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,~~QAC9C~~,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,CAAA;AAAA,QACtC,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA;AAAA,UAEnB,IAAA,EAAM,MAAA,CAAO,CAAA,EAAG,KAAA,CAAM,KAAK;AAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,UAC/C,MAAA,EAAQ;AAAA,YACN,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,EAAM,EAAE;AAAA,YACzD,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,GAAQ,IAAA,GAAO,KAAA,EAAM,EAAE;AAAA;AAAA,YAExE,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,aAAa,MAAA,CAAO,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,CAAG,KAAA,CAAM,CAAA,EAAG,GAAI,CAAA,EAAE,EAAG,CAAA,GAAI;AAAC;AAClI,SACD;AAAA,OACF,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,IAAI,KAAA,CAAM,0BAA0B,QAAA,CAAS,MAAM,CAAA,EAAA,EAAA,CAAM,MAAM,SAAS,IAAA,EAAK,EAAG,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACzH;AAAA,GACF;AACF;AAGA,SAAS,OAAO,IAAA,EAAsB;AACpC,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAC/E;AAGA,SAAS,cAAc,IAAA,EAAsB;AAC3C,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,iBAAO,CAAA;AACrC","file":"slack.cjs","sourcesContent":["import type { Alert, AlertChannel } from \"../types.js\";\n\nexport interface SlackOptions {\n /** An incoming webhook URL from api.slack.com/messaging/webhooks. /\n webhookUrl: string;\n /* Link back to the job in your dashboard: (alert) => `https://app.example.com/cronwatch/jobs/${alert.job}`. /\n link?: (alert: Alert) => string;\n}\n\nconst EMOJI: Record<Alert[\"type\"], string> = {\n missed: \":hourglass_flowing_sand:\",\n failed: \":x:\",\n stuck: \":no_entry:\",\n slow: \":turtle:\",\n over_budget: \":moneybag:\",\n recovered: \":white_check_mark:\",\n};\n\nconst TIMEOUT_MS = 10_000;\n\n/* Sends alerts to a Slack channel through an incoming webhook. /\nexport function slack(options: SlackOptions): AlertChannel {\n if (!options.webhookUrl) throw new Error(\"slack() needs a webhookUrl\");\n return {\n name: \"slack\",\n async send(alert) {\n const url = options.link?.(alert);\n const title = `${EMOJI[alert.type]} ${escape(alert.title)}${url ? ` (<${url}\|open>)` : \"\"}`;\n const body = codeBlockSafe(escape(alert.message)).slice(0, 2900);\n const response = await fetch(options.webhookUrl, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n signal: AbortSignal.timeout(TIMEOUT_MS),\n body: JSON.stringify({\n // The notification fallback is parsed as mrkdwn too, so it is escaped like the blocks.\n text: escape(`${alert.title}\\n${alert.message}`),\n blocks: [\n { type: \"section\", text: { type: \"mrkdwn\", text: title } },\n { type: \"section\", text: { type: \"mrkdwn\", text: \"```\" + body + \"```\" } },\n // Its own block, so a long diagnosis cannot push a block past Slack's 3000 character limit.\n ...(alert.triage ? [{ type: \"section\", text: { type: \"mrkdwn\", text: `_Triage:_ ${escape(alert.triage)}`.slice(0, 3000) } }] : []),\n ],\n }),\n });\n if (!response.ok) throw new Error(`Slack webhook answered ${response.status}: ${(await response.text()).slice(0, 200)}`);\n },\n };\n}\n\n/* Slack's three control characters. Escaping < and > also stops <!channel> and <url\|links>. /\nfunction escape(text: string): string {\n return text.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\");\n}\n\n/* Breaks up ``` so text inside a code block cannot close it. */\nfunction codeBlockSafe(text: string): string {\n return text.replace(/```/g, \"```\");\n}\n"]}
1	+ {"version":3,"sources":["../src/alerts/slack.ts"],"names":[],"mappings":";;;AASA,IAAM,KAAA,GAAuC;AAAA,EAC3C,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,KAAA;AAAA,EACR,KAAA,EAAO,YAAA;AAAA,EACP,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,YAAA;AAAA,EACb,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,UAAA,GAAa,GAAA;AAGZ,SAAS,MAAM,OAAA,EAAqC;AACzD,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,MAAM,4BAA4B,CAAA;AACrE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAA;AAChC,MAAA,MAAM,QAAQ,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,CAAA,EAAI,GAAA,GAAM,CAAA,GAAA,EAAM,GAAG,YAAY,EAAE,CAAA,CAAA;AAC3F,MAAA,MAAM,IAAA,GAAO,cAAc,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,UAAA,EAAY;AAAA,QAC/C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA;AAAA,QAE9C,QAAA,EAAU,OAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,CAAA;AAAA,QACtC,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA;AAAA,UAEnB,IAAA,EAAM,MAAA,CAAO,CAAA,EAAG,KAAA,CAAM,KAAK;AAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,UAC/C,MAAA,EAAQ;AAAA,YACN,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,EAAM,EAAE;AAAA,YACzD,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,GAAQ,IAAA,GAAO,KAAA,EAAM,EAAE;AAAA;AAAA,YAExE,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,aAAa,MAAA,CAAO,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,CAAG,KAAA,CAAM,CAAA,EAAG,GAAI,CAAA,EAAE,EAAG,CAAA,GAAI;AAAC;AAClI,SACD;AAAA,OACF,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,IAAI,KAAA,CAAM,0BAA0B,QAAA,CAAS,MAAM,CAAA,EAAA,EAAA,CAAM,MAAM,SAAS,IAAA,EAAK,EAAG,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACzH;AAAA,GACF;AACF;AAGA,SAAS,OAAO,IAAA,EAAsB;AACpC,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAC/E;AAGA,SAAS,cAAc,IAAA,EAAsB;AAC3C,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,iBAAO,CAAA;AACrC","file":"slack.cjs","sourcesContent":["import type { Alert, AlertChannel } from \"../types.js\";\n\nexport interface SlackOptions {\n /** An incoming webhook URL from api.slack.com/messaging/webhooks. /\n webhookUrl: string;\n /* Link back to the job in your dashboard: (alert) => `https://app.example.com/cronwatch/jobs/${alert.job}`. /\n link?: (alert: Alert) => string;\n}\n\nconst EMOJI: Record<Alert[\"type\"], string> = {\n missed: \":hourglass_flowing_sand:\",\n failed: \":x:\",\n stuck: \":no_entry:\",\n slow: \":turtle:\",\n over_budget: \":moneybag:\",\n recovered: \":white_check_mark:\",\n};\n\nconst TIMEOUT_MS = 10_000;\n\n/* Sends alerts to a Slack channel through an incoming webhook. /\nexport function slack(options: SlackOptions): AlertChannel {\n if (!options.webhookUrl) throw new Error(\"slack() needs a webhookUrl\");\n return {\n name: \"slack\",\n async send(alert) {\n const url = options.link?.(alert);\n const title = `${EMOJI[alert.type]} ${escape(alert.title)}${url ? ` (<${url}\|open>)` : \"\"}`;\n const body = codeBlockSafe(escape(alert.message)).slice(0, 2900);\n const response = await fetch(options.webhookUrl, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n // Refused, not followed: a webhook URL is its own credential.\n redirect: \"error\",\n signal: AbortSignal.timeout(TIMEOUT_MS),\n body: JSON.stringify({\n // The notification fallback is parsed as mrkdwn too, so it is escaped like the blocks.\n text: escape(`${alert.title}\\n${alert.message}`),\n blocks: [\n { type: \"section\", text: { type: \"mrkdwn\", text: title } },\n { type: \"section\", text: { type: \"mrkdwn\", text: \"```\" + body + \"```\" } },\n // Its own block, so a long diagnosis cannot push a block past Slack's 3000 character limit.\n ...(alert.triage ? [{ type: \"section\", text: { type: \"mrkdwn\", text: `_Triage:_ ${escape(alert.triage)}`.slice(0, 3000) } }] : []),\n ],\n }),\n });\n if (!response.ok) throw new Error(`Slack webhook answered ${response.status}: ${(await response.text()).slice(0, 200)}`);\n },\n };\n}\n\n/* Slack's three control characters. Escaping < and > also stops <!channel> and <url\|links>. /\nfunction escape(text: string): string {\n return text.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\");\n}\n\n/* Breaks up ``` so text inside a code block cannot close it. */\nfunction codeBlockSafe(text: string): string {\n return text.replace(/```/g, \"```\");\n}\n"]}

package/dist/slack.d.cts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { A as Alert, a as AlertChannel } from './types-C1PyRjI5.cjs';
+import { A as Alert, a as AlertChannel } from './types-Ddq1MUPL.cjs';
 interface SlackOptions {
     /** An incoming webhook URL from api.slack.com/messaging/webhooks. */

package/dist/slack.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { A as Alert, a as AlertChannel } from './types-C1PyRjI5.js';
+import { A as Alert, a as AlertChannel } from './types-Ddq1MUPL.js';
 interface SlackOptions {
     /** An incoming webhook URL from api.slack.com/messaging/webhooks. */

package/dist/slack.js CHANGED Viewed

@@ -19,6 +19,8 @@ function slack(options) {
       const response = await fetch(options.webhookUrl, {
         method: "POST",
         headers: { "content-type": "application/json" },
+        // Refused, not followed: a webhook URL is its own credential.
+        redirect: "error",
         signal: AbortSignal.timeout(TIMEOUT_MS),
         body: JSON.stringify({
           // The notification fallback is parsed as mrkdwn too, so it is escaped like the blocks.

package/dist/slack.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/alerts/slack.ts"],"names":[],"mappings":";AASA,IAAM,KAAA,GAAuC;AAAA,EAC3C,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,KAAA;AAAA,EACR,KAAA,EAAO,YAAA;AAAA,EACP,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,YAAA;AAAA,EACb,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,UAAA,GAAa,GAAA;AAGZ,SAAS,MAAM,OAAA,EAAqC;AACzD,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,MAAM,4BAA4B,CAAA;AACrE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAA;AAChC,MAAA,MAAM,QAAQ,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,CAAA,EAAI,GAAA,GAAM,CAAA,GAAA,EAAM,GAAG,YAAY,EAAE,CAAA,CAAA;AAC3F,MAAA,MAAM,IAAA,GAAO,cAAc,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,UAAA,EAAY;AAAA,QAC/C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,~~QAC9C~~,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,CAAA;AAAA,QACtC,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA;AAAA,UAEnB,IAAA,EAAM,MAAA,CAAO,CAAA,EAAG,KAAA,CAAM,KAAK;AAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,UAC/C,MAAA,EAAQ;AAAA,YACN,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,EAAM,EAAE;AAAA,YACzD,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,GAAQ,IAAA,GAAO,KAAA,EAAM,EAAE;AAAA;AAAA,YAExE,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,aAAa,MAAA,CAAO,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,CAAG,KAAA,CAAM,CAAA,EAAG,GAAI,CAAA,EAAE,EAAG,CAAA,GAAI;AAAC;AAClI,SACD;AAAA,OACF,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,IAAI,KAAA,CAAM,0BAA0B,QAAA,CAAS,MAAM,CAAA,EAAA,EAAA,CAAM,MAAM,SAAS,IAAA,EAAK,EAAG,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACzH;AAAA,GACF;AACF;AAGA,SAAS,OAAO,IAAA,EAAsB;AACpC,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAC/E;AAGA,SAAS,cAAc,IAAA,EAAsB;AAC3C,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,iBAAO,CAAA;AACrC","file":"slack.js","sourcesContent":["import type { Alert, AlertChannel } from \"../types.js\";\n\nexport interface SlackOptions {\n /** An incoming webhook URL from api.slack.com/messaging/webhooks. /\n webhookUrl: string;\n /* Link back to the job in your dashboard: (alert) => `https://app.example.com/cronwatch/jobs/${alert.job}`. /\n link?: (alert: Alert) => string;\n}\n\nconst EMOJI: Record<Alert[\"type\"], string> = {\n missed: \":hourglass_flowing_sand:\",\n failed: \":x:\",\n stuck: \":no_entry:\",\n slow: \":turtle:\",\n over_budget: \":moneybag:\",\n recovered: \":white_check_mark:\",\n};\n\nconst TIMEOUT_MS = 10_000;\n\n/* Sends alerts to a Slack channel through an incoming webhook. /\nexport function slack(options: SlackOptions): AlertChannel {\n if (!options.webhookUrl) throw new Error(\"slack() needs a webhookUrl\");\n return {\n name: \"slack\",\n async send(alert) {\n const url = options.link?.(alert);\n const title = `${EMOJI[alert.type]} ${escape(alert.title)}${url ? ` (<${url}\|open>)` : \"\"}`;\n const body = codeBlockSafe(escape(alert.message)).slice(0, 2900);\n const response = await fetch(options.webhookUrl, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n signal: AbortSignal.timeout(TIMEOUT_MS),\n body: JSON.stringify({\n // The notification fallback is parsed as mrkdwn too, so it is escaped like the blocks.\n text: escape(`${alert.title}\\n${alert.message}`),\n blocks: [\n { type: \"section\", text: { type: \"mrkdwn\", text: title } },\n { type: \"section\", text: { type: \"mrkdwn\", text: \"```\" + body + \"```\" } },\n // Its own block, so a long diagnosis cannot push a block past Slack's 3000 character limit.\n ...(alert.triage ? [{ type: \"section\", text: { type: \"mrkdwn\", text: `_Triage:_ ${escape(alert.triage)}`.slice(0, 3000) } }] : []),\n ],\n }),\n });\n if (!response.ok) throw new Error(`Slack webhook answered ${response.status}: ${(await response.text()).slice(0, 200)}`);\n },\n };\n}\n\n/* Slack's three control characters. Escaping < and > also stops <!channel> and <url\|links>. /\nfunction escape(text: string): string {\n return text.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\");\n}\n\n/* Breaks up ``` so text inside a code block cannot close it. */\nfunction codeBlockSafe(text: string): string {\n return text.replace(/```/g, \"```\");\n}\n"]}
1	+ {"version":3,"sources":["../src/alerts/slack.ts"],"names":[],"mappings":";AASA,IAAM,KAAA,GAAuC;AAAA,EAC3C,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,KAAA;AAAA,EACR,KAAA,EAAO,YAAA;AAAA,EACP,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,YAAA;AAAA,EACb,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,UAAA,GAAa,GAAA;AAGZ,SAAS,MAAM,OAAA,EAAqC;AACzD,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,MAAM,4BAA4B,CAAA;AACrE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,GAAO,KAAK,CAAA;AAChC,MAAA,MAAM,QAAQ,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,CAAA,EAAI,GAAA,GAAM,CAAA,GAAA,EAAM,GAAG,YAAY,EAAE,CAAA,CAAA;AAC3F,MAAA,MAAM,IAAA,GAAO,cAAc,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA;AAC/D,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,UAAA,EAAY;AAAA,QAC/C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA;AAAA,QAE9C,QAAA,EAAU,OAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,CAAA;AAAA,QACtC,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA;AAAA,UAEnB,IAAA,EAAM,MAAA,CAAO,CAAA,EAAG,KAAA,CAAM,KAAK;AAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,UAC/C,MAAA,EAAQ;AAAA,YACN,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,EAAM,EAAE;AAAA,YACzD,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,GAAQ,IAAA,GAAO,KAAA,EAAM,EAAE;AAAA;AAAA,YAExE,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,EAAE,MAAM,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,aAAa,MAAA,CAAO,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,CAAG,KAAA,CAAM,CAAA,EAAG,GAAI,CAAA,EAAE,EAAG,CAAA,GAAI;AAAC;AAClI,SACD;AAAA,OACF,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,IAAI,KAAA,CAAM,0BAA0B,QAAA,CAAS,MAAM,CAAA,EAAA,EAAA,CAAM,MAAM,SAAS,IAAA,EAAK,EAAG,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACzH;AAAA,GACF;AACF;AAGA,SAAS,OAAO,IAAA,EAAsB;AACpC,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AAC/E;AAGA,SAAS,cAAc,IAAA,EAAsB;AAC3C,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,iBAAO,CAAA;AACrC","file":"slack.js","sourcesContent":["import type { Alert, AlertChannel } from \"../types.js\";\n\nexport interface SlackOptions {\n /** An incoming webhook URL from api.slack.com/messaging/webhooks. /\n webhookUrl: string;\n /* Link back to the job in your dashboard: (alert) => `https://app.example.com/cronwatch/jobs/${alert.job}`. /\n link?: (alert: Alert) => string;\n}\n\nconst EMOJI: Record<Alert[\"type\"], string> = {\n missed: \":hourglass_flowing_sand:\",\n failed: \":x:\",\n stuck: \":no_entry:\",\n slow: \":turtle:\",\n over_budget: \":moneybag:\",\n recovered: \":white_check_mark:\",\n};\n\nconst TIMEOUT_MS = 10_000;\n\n/* Sends alerts to a Slack channel through an incoming webhook. /\nexport function slack(options: SlackOptions): AlertChannel {\n if (!options.webhookUrl) throw new Error(\"slack() needs a webhookUrl\");\n return {\n name: \"slack\",\n async send(alert) {\n const url = options.link?.(alert);\n const title = `${EMOJI[alert.type]} ${escape(alert.title)}${url ? ` (<${url}\|open>)` : \"\"}`;\n const body = codeBlockSafe(escape(alert.message)).slice(0, 2900);\n const response = await fetch(options.webhookUrl, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n // Refused, not followed: a webhook URL is its own credential.\n redirect: \"error\",\n signal: AbortSignal.timeout(TIMEOUT_MS),\n body: JSON.stringify({\n // The notification fallback is parsed as mrkdwn too, so it is escaped like the blocks.\n text: escape(`${alert.title}\\n${alert.message}`),\n blocks: [\n { type: \"section\", text: { type: \"mrkdwn\", text: title } },\n { type: \"section\", text: { type: \"mrkdwn\", text: \"```\" + body + \"```\" } },\n // Its own block, so a long diagnosis cannot push a block past Slack's 3000 character limit.\n ...(alert.triage ? [{ type: \"section\", text: { type: \"mrkdwn\", text: `_Triage:_ ${escape(alert.triage)}`.slice(0, 3000) } }] : []),\n ],\n }),\n });\n if (!response.ok) throw new Error(`Slack webhook answered ${response.status}: ${(await response.text()).slice(0, 200)}`);\n },\n };\n}\n\n/* Slack's three control characters. Escaping < and > also stops <!channel> and <url\|links>. /\nfunction escape(text: string): string {\n return text.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\");\n}\n\n/* Breaks up ``` so text inside a code block cannot close it. */\nfunction codeBlockSafe(text: string): string {\n return text.replace(/```/g, \"```\");\n}\n"]}