@cronwatch/sdk 0.3.1 → 0.5.0

package/dist/twilio.d.ts

@@ -0,0 +1,52 @@
+import { A as Alert, a as AlertChannel } from './types-Ddq1MUPL.js';
+
+/**
+ * Twilio SMS. API reference: https://www.twilio.com/docs/messaging/api/message-resource
+ * POST https://api.twilio.com/2010-04-01/Accounts/<AccountSid>/Messages.json,
+ * form encoded, with basic auth. One recipient per request.
+ */
+
+interface TwilioOptions {
+    /** The account SID, "AC...". It is in the URL whichever credentials sign the request. */
+    accountSid: string;
+    /** The account's auth token. Or pass apiKeySid and apiKeySecret instead. */
+    authToken?: string;
+    /** An API key SID, "SK...", with apiKeySecret, in place of the auth token. */
+    apiKeySid?: string;
+    apiKeySecret?: string;
+    /** A Twilio number in E.164 form, "+15005550006". Or pass messagingServiceSid. */
+    from?: string;
+    /** A messaging service SID, "MG...", in place of from. */
+    messagingServiceSid?: string;
+    /** One number in E.164 form, or several; each gets its own message. */
+    to: string | string[];
+    /** Also text when a job recovers. Defaults to false: a text is for what needs a person. */
+    recovered?: boolean;
+    /** How many SMS segments a message may use, 1 to 10. Defaults to 3. */
+    segments?: number;
+    link?: (alert: Alert) => string;
+}
+/** The most segments a message may use, which keeps it inside Twilio's 1600 character Body limit. */
+declare const MAX_SEGMENTS = 10;
+/** Twilio refuses a Body longer than this. */
+declare const MAX_BODY = 1600;
+/**
+ * Texts alerts through Twilio, to every number at once. The alert counts as
+ * delivered when any number took it; each number that refused it is
+ * reported to the client's onError. It fails only when every number did.
+ */
+declare function twilio(options: TwilioOptions): AlertChannel;
+/**
+ * The segments `text` takes. A character is never split across two: an
+ * extension character (two septets) or a surrogate pair (two UCS-2 units)
+ * that would straddle a boundary starts the next segment, as phones pack them.
+ */
+declare function smsSegments(text: string): number;
+/**
+ * The title, then as many lines of the message (and the triage) as fit, then
+ * the link. The link is kept whole; the text before it is cut to make room.
+ * `segments` is clamped to 1 to 10.
+ */
+declare function smsBody(alert: Alert, link: string | undefined, segments?: number): string;
+
+export { MAX_BODY, MAX_SEGMENTS, type TwilioOptions, smsBody, smsSegments, twilio };

package/dist/twilio.js

@@ -0,0 +1,162 @@
+// src/alerts/shared.ts
+var TIMEOUT_MS = 1e4;
+function origin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return "(invalid URL)";
+  }
+}
+var ERROR_BODY_MAX = 200;
+async function post(provider, url, init, secrets = []) {
+  const response = await fetch(url, { method: "POST", headers: init.headers, body: init.body, redirect: "error", signal: AbortSignal.timeout(TIMEOUT_MS) });
+  if (!response.ok) {
+    let text = "";
+    try {
+      text = await response.text();
+    } catch {
+    }
+    throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : ""}`);
+  }
+  return response;
+}
+function errorBody(text, secrets = []) {
+  const kept = secrets.filter((s) => typeof s === "string" && s.length >= 4);
+  const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);
+  let head = cut(text, ERROR_BODY_MAX + longest);
+  for (const secret of kept) head = head.split(secret).join("[redacted]");
+  return cut(head, ERROR_BODY_MAX);
+}
+function trimmed(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function base64(text) {
+  let binary = "";
+  for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function basicAuth(user, password) {
+  return `Basic ${base64(`${user}:${password}`)}`;
+}
+function cut(text, max) {
+  if (text.length <= max) return text;
+  let end = max;
+  const code = text.charCodeAt(end - 1);
+  if (code >= 55296 && code <= 56319) end -= 1;
+  return text.slice(0, end);
+}
+
+// src/alerts/twilio.ts
+var MAX_SEGMENTS = 10;
+var MAX_BODY = 1600;
+function twilio(options) {
+  const accountSid = trimmed(options.accountSid);
+  if (!accountSid) throw new Error("twilio() needs an accountSid");
+  const apiKeySid = trimmed(options.apiKeySid);
+  const user = apiKeySid || accountSid;
+  const password = apiKeySid ? trimmed(options.apiKeySecret) : trimmed(options.authToken);
+  if (!password) throw new Error("twilio() needs an authToken, or an apiKeySid and apiKeySecret");
+  if (!options.from && !options.messagingServiceSid) throw new Error("twilio() needs a from number or a messagingServiceSid");
+  const to = (Array.isArray(options.to) ? options.to : [options.to]).filter((n) => typeof n === "string" && n.trim() !== "").map((n) => n.trim());
+  if (to.length === 0) throw new Error("twilio() needs at least one to number");
+  const url = `https://api.twilio.com/2010-04-01/Accounts/${encodeURIComponent(accountSid)}/Messages.json`;
+  const authorization = basicAuth(user, password);
+  const segments = segmentBudget(options.segments);
+  return {
+    name: "twilio",
+    async send(alert, context) {
+      if (alert.type === "recovered" && !options.recovered) return;
+      const body = smsBody(alert, options.link?.(alert), segments);
+      const results = await Promise.allSettled(to.map((number) => {
+        const form = new URLSearchParams();
+        form.append("To", number);
+        if (options.messagingServiceSid) form.append("MessagingServiceSid", options.messagingServiceSid);
+        else form.append("From", options.from);
+        form.append("Body", body);
+        return post("Twilio", url, { headers: { "content-type": "application/x-www-form-urlencoded", authorization }, body: form.toString() }, [password]);
+      }));
+      const failed = results.flatMap((r, i) => r.status === "rejected" ? [{ number: to[i], error: r.reason }] : []);
+      if (failed.length === 0) return;
+      if (failed.length === to.length) {
+        const message = failed[0].error.message;
+        throw new Error(to.length > 1 ? `${message} (${failed.length} of ${to.length} numbers failed)` : message);
+      }
+      for (const { number, error } of failed) {
+        const report = new Error(`${error.message} (to ${maskNumber(number)}; ${to.length - failed.length} of ${to.length} numbers took the alert)`);
+        if (context) context.onError(report);
+        else console.error("[cronwatch] alert channel twilio:", report);
+      }
+    }
+  };
+}
+function maskNumber(number) {
+  return number.length <= 4 ? number : `${"*".repeat(Math.min(number.length - 4, 8))}${number.slice(-4)}`;
+}
+var GSM = `@\xA3$\xA5\xE8\xE9\xF9\xEC\xF2\xC7
+\xD8\xF8\r\xC5\xE5\u0394_\u03A6\u0393\u039B\u03A9\u03A0\u03A8\u03A3\u0398\u039E\xC6\xE6\xDF\xC9 !"#\xA4%&'()*+,-./0123456789:;<=>?\xA1ABCDEFGHIJKLMNOPQRSTUVWXYZ\xC4\xD6\xD1\xDC\xA7\xBFabcdefghijklmnopqrstuvwxyz\xE4\xF6\xF1\xFC\xE0`;
+var GSM_EXTENDED = "^{}\\[~]|\u20AC\f";
+function smsSegments(text) {
+  const units = [];
+  let gsm = true;
+  for (const ch of text) {
+    if (GSM.includes(ch)) units.push(1);
+    else if (GSM_EXTENDED.includes(ch)) units.push(2);
+    else {
+      gsm = false;
+      break;
+    }
+  }
+  const [single, per, sizes] = gsm ? [160, 153, units] : [70, 67, Array.from(text, (ch) => ch.length)];
+  const total = sizes.reduce((n, u) => n + u, 0);
+  if (total <= single) return 1;
+  let count = 1;
+  let used = 0;
+  for (const u of sizes) {
+    if (used + u > per) {
+      count += 1;
+      used = 0;
+    }
+    used += u;
+  }
+  return count;
+}
+function fits(text, segments) {
+  return text.length <= MAX_BODY && smsSegments(text) <= segments;
+}
+function smsBody(alert, link, segments = 3) {
+  const budget = segmentBudget(segments);
+  const tail = link ? `
+${link}` : "";
+  const lines = [alert.title, ...alert.message.split("\n").filter((l) => l.trim() !== ""), ...alert.triage ? [`Triage: ${alert.triage}`] : []];
+  let text = "";
+  for (const line of lines) {
+    const next = text ? `${text}
+${line}` : line;
+    if (fits(next + tail, budget)) {
+      text = next;
+      continue;
+    }
+    const chars = Array.from(line);
+    let lo = 0;
+    let hi = chars.length;
+    while (lo < hi) {
+      const mid = Math.ceil((lo + hi) / 2);
+      const candidate = (text ? `${text}
+` : "") + chars.slice(0, mid).join("") + "...";
+      if (fits(candidate + tail, budget)) lo = mid;
+      else hi = mid - 1;
+    }
+    if (lo > 0) text = (text ? `${text}
+` : "") + chars.slice(0, lo).join("") + "...";
+    break;
+  }
+  return cut(text + tail, MAX_BODY);
+}
+function segmentBudget(segments) {
+  const n = typeof segments === "number" && Number.isFinite(segments) ? Math.floor(segments) : 3;
+  return Math.min(MAX_SEGMENTS, Math.max(1, n));
+}
+
+export { MAX_BODY, MAX_SEGMENTS, smsBody, smsSegments, twilio };
+//# sourceMappingURL=twilio.js.map
+//# sourceMappingURL=twilio.js.map

package/dist/twilio.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerts/shared.ts","../src/alerts/twilio.ts"],"names":[],"mappings":";AAOO,IAAM,UAAA,GAAa,GAAA;AAYnB,SAAS,OAAO,GAAA,EAAqB;AAC1C,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAGO,IAAM,cAAA,GAAiB,GAAA;AAW9B,eAAsB,KAAK,QAAA,EAAkB,GAAA,EAAa,IAAA,EAAyD,OAAA,GAAkC,EAAC,EAAsB;AAC1K,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAS,IAAA,CAAK,OAAA,EAAS,MAAM,IAAA,CAAK,IAAA,EAAM,UAAU,OAAA,EAAS,MAAA,EAAQ,YAAY,OAAA,CAAQ,UAAU,GAAG,CAAA;AACxJ,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,MAAM,CAAA,EAAG,QAAQ,IAAI,MAAA,CAAO,GAAG,CAAC,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,EAAG,IAAA,GAAO,KAAK,SAAA,CAAU,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACxH;AACA,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,SAAA,CAAU,IAAA,EAAc,OAAA,GAAkC,EAAC,EAAW;AACpF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,IAAU,CAAC,CAAA;AACtF,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,EAAG,CAAA,KAAM,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,CAAA,CAAE,MAAM,CAAA,EAAG,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,GAAO,GAAA,CAAI,IAAA,EAAM,cAAA,GAAiB,OAAO,CAAA;AAC7C,EAAA,KAAA,MAAW,MAAA,IAAU,MAAM,IAAA,GAAO,IAAA,CAAK,MAAM,MAAM,CAAA,CAAE,KAAK,YAAY,CAAA;AACtE,EAAA,OAAO,GAAA,CAAI,MAAM,cAAc,CAAA;AACjC;AAGO,SAAS,QAAQ,KAAA,EAAwB;AAC9C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,CAAM,MAAK,GAAI,EAAA;AACpD;AAGO,SAAS,OAAO,IAAA,EAAsB;AAC3C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,IAAU,MAAA,CAAO,YAAA,CAAa,IAAI,CAAA;AACrF,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB;AAEO,SAAS,SAAA,CAAU,MAAc,QAAA,EAA0B;AAChE,EAAA,OAAO,SAAS,MAAA,CAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,QAAQ,EAAE,CAAC,CAAA,CAAA;AAC/C;AAyBO,SAAS,GAAA,CAAI,MAAc,GAAA,EAAqB;AACrD,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,GAAA,EAAK,OAAO,IAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,GAAA,GAAM,CAAC,CAAA;AACpC,EAAA,IAAI,IAAA,IAAQ,KAAA,IAAU,IAAA,IAAQ,KAAA,EAAQ,GAAA,IAAO,CAAA;AAC7C,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B;;;AC7EO,IAAM,YAAA,GAAe;AAErB,IAAM,QAAA,GAAW;AAOjB,SAAS,OAAO,OAAA,EAAsC;AAE3D,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,UAAU,CAAA;AAC7C,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAC/D,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,SAAS,CAAA;AAC3C,EAAA,MAAM,OAAO,SAAA,IAAa,UAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,YAAY,OAAA,CAAQ,OAAA,CAAQ,YAAY,CAAA,GAAI,OAAA,CAAQ,QAAQ,SAAS,CAAA;AACtF,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAC9F,EAAA,IAAI,CAAC,QAAQ,IAAA,IAAQ,CAAC,QAAQ,mBAAA,EAAqB,MAAM,IAAI,KAAA,CAAM,uDAAuD,CAAA;AAC1H,EAAA,MAAM,EAAA,GAAA,CAAM,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,EAAE,CAAA,GAAI,OAAA,CAAQ,EAAA,GAAK,CAAC,OAAA,CAAQ,EAAE,CAAA,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,IAAA,EAAK,KAAM,EAAE,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAC9I,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAC5E,EAAA,MAAM,GAAA,GAAM,CAAA,2CAAA,EAA8C,kBAAA,CAAmB,UAAU,CAAC,CAAA,cAAA,CAAA;AACxF,EAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,IAAA,EAAM,QAAQ,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA;AAC/C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,MAAM,IAAA,CAAK,KAAA,EAAO,OAAA,EAAS;AACzB,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,WAAA,IAAe,CAAC,QAAQ,SAAA,EAAW;AACtD,MAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,EAAO,QAAQ,IAAA,GAAO,KAAK,GAAG,QAAQ,CAAA;AAC3D,MAAA,MAAM,UAAU,MAAM,OAAA,CAAQ,WAAW,EAAA,CAAG,GAAA,CAAI,CAAC,MAAA,KAAW;AAC1D,QAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,MAAM,CAAA;AACxB,QAAA,IAAI,QAAQ,mBAAA,EAAqB,IAAA,CAAK,MAAA,CAAO,qBAAA,EAAuB,QAAQ,mBAAmB,CAAA;AAAA,aAC1F,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,OAAA,CAAQ,IAAK,CAAA;AACtC,QAAA,IAAA,CAAK,MAAA,CAAO,QAAQ,IAAI,CAAA;AACxB,QAAA,OAAO,KAAK,QAAA,EAAU,GAAA,EAAK,EAAE,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,aAAA,EAAc,EAAG,MAAM,IAAA,CAAK,QAAA,IAAW,EAAG,CAAC,QAAQ,CAAC,CAAA;AAAA,MACnJ,CAAC,CAAC,CAAA;AACF,MAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,CAAC,GAAG,CAAA,KAAO,CAAA,CAAE,WAAW,UAAA,GAAa,CAAC,EAAE,MAAA,EAAQ,EAAA,CAAG,CAAC,CAAA,EAAI,KAAA,EAAO,EAAE,MAAA,EAAiB,CAAA,GAAI,EAAG,CAAA;AACxH,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACzB,MAAA,IAAI,MAAA,CAAO,MAAA,KAAW,EAAA,CAAG,MAAA,EAAQ;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAC,CAAA,CAAG,KAAA,CAAM,OAAA;AACjC,QAAA,MAAM,IAAI,KAAA,CAAM,EAAA,CAAG,MAAA,GAAS,IAAI,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,MAAA,CAAO,MAAM,CAAA,IAAA,EAAO,EAAA,CAAG,MAAM,qBAAqB,OAAO,CAAA;AAAA,MAC1G;AAEA,MAAA,KAAA,MAAW,EAAE,MAAA,EAAQ,KAAA,EAAM,IAAK,MAAA,EAAQ;AACtC,QAAA,MAAM,SAAS,IAAI,KAAA,CAAM,GAAG,KAAA,CAAM,OAAO,QAAQ,UAAA,CAAW,MAAM,CAAC,CAAA,EAAA,EAAK,GAAG,MAAA,GAAS,MAAA,CAAO,MAAM,CAAA,IAAA,EAAO,EAAA,CAAG,MAAM,CAAA,wBAAA,CAA0B,CAAA;AAC3I,QAAA,IAAI,OAAA,EAAS,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAAA,aAC9B,OAAA,CAAQ,KAAA,CAAM,mCAAA,EAAqC,MAAM,CAAA;AAAA,MAChE;AAAA,IACF;AAAA,GACF;AACF;AAGA,SAAS,WAAW,MAAA,EAAwB;AAC1C,EAAA,OAAO,OAAO,MAAA,IAAU,CAAA,GAAI,SAAS,CAAA,EAAG,GAAA,CAAI,OAAO,IAAA,CAAK,GAAA,CAAI,OAAO,MAAA,GAAS,CAAA,EAAG,CAAC,CAAC,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AACvG;AAIA,IAAM,GAAA,GAAM,CAAA;AAAA,sOAAA,CAAA;AACZ,IAAM,YAAA,GAAe,mBAAA;AAOd,SAAS,YAAY,IAAA,EAAsB;AAChD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACrB,IAAA,IAAI,IAAI,QAAA,CAAS,EAAE,CAAA,EAAG,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,SAAA,IACzB,aAAa,QAAA,CAAS,EAAE,CAAA,EAAG,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,SAC3C;AACH,MAAA,GAAA,GAAM,KAAA;AACN,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,CAAC,QAAQ,GAAA,EAAK,KAAK,IAAI,GAAA,GAAM,CAAC,KAAK,GAAA,EAAK,KAAK,IAAI,CAAC,EAAA,EAAI,IAAI,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,EAAA,KAAO,EAAA,CAAG,MAAM,CAAC,CAAA;AACnG,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,CAAC,GAAG,CAAA,KAAM,CAAA,GAAI,GAAG,CAAC,CAAA;AAC7C,EAAA,IAAI,KAAA,IAAS,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,IAAA,GAAO,IAAI,GAAA,EAAK;AAClB,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,IAAA,GAAO,CAAA;AAAA,IACT;AACA,IAAA,IAAA,IAAQ,CAAA;AAAA,EACV;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,IAAA,CAAK,MAAc,QAAA,EAA2B;AACrD,EAAA,OAAO,IAAA,CAAK,MAAA,IAAU,QAAA,IAAY,WAAA,CAAY,IAAI,CAAA,IAAK,QAAA;AACzD;AAOO,SAAS,OAAA,CAAQ,KAAA,EAAc,IAAA,EAA0B,QAAA,GAAW,CAAA,EAAW;AACpF,EAAA,MAAM,MAAA,GAAS,cAAc,QAAQ,CAAA;AACrC,EAAA,MAAM,OAAO,IAAA,GAAO;AAAA,EAAK,IAAI,CAAA,CAAA,GAAK,EAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,CAAM,KAAA,EAAO,GAAG,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAK,KAAM,EAAE,CAAA,EAAG,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,QAAA,EAAW,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,GAAI,EAAG,CAAA;AAC7I,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,IAAI;AAAA,EAAK,IAAI,CAAA,CAAA,GAAK,IAAA;AACzC,IAAA,IAAI,IAAA,CAAK,IAAA,GAAO,IAAA,EAAM,MAAM,CAAA,EAAG;AAC7B,MAAA,IAAA,GAAO,IAAA;AACP,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAC7B,IAAA,IAAI,EAAA,GAAK,CAAA;AACT,IAAA,IAAI,KAAK,KAAA,CAAM,MAAA;AACf,IAAA,OAAO,KAAK,EAAA,EAAI;AACd,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAA,CAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AACnC,MAAA,MAAM,SAAA,GAAA,CAAa,IAAA,GAAO,CAAA,EAAG,IAAI;AAAA,CAAA,GAAO,EAAA,IAAM,MAAM,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,GAAI,KAAA;AAC7E,MAAA,IAAI,IAAA,CAAK,SAAA,GAAY,IAAA,EAAM,MAAM,GAAG,EAAA,GAAK,GAAA;AAAA,gBAC/B,GAAA,GAAM,CAAA;AAAA,IAClB;AACA,IAAA,IAAI,EAAA,GAAK,CAAA,EAAG,IAAA,GAAA,CAAQ,IAAA,GAAO,GAAG,IAAI;AAAA,CAAA,GAAO,EAAA,IAAM,MAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,GAAI,KAAA;AAC7E,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,GAAA,CAAI,IAAA,GAAO,IAAA,EAAM,QAAQ,CAAA;AAClC;AAGA,SAAS,cAAc,QAAA,EAAsC;AAC3D,EAAA,MAAM,CAAA,GAAI,OAAO,QAAA,KAAa,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,CAAA;AAC7F,EAAA,OAAO,KAAK,GAAA,CAAI,YAAA,EAAc,KAAK,GAAA,CAAI,CAAA,EAAG,CAAC,CAAC,CAAA;AAC9C","file":"twilio.js","sourcesContent":["/**\n * Helpers shared by the provider channels. Only fetch and Web Crypto, so the\n * channels run on Node, Cloudflare Workers, Deno and Bun alike. Not an entry\n * point: each channel bundles its own copy.\n */\nimport type { Alert } from \"../types.js\";\n\nexport const TIMEOUT_MS = 10_000;\n\n/** Severity for trackers that have levels. Recovered is informational. */\nexport type Severity = \"error\" | \"warning\" | \"info\";\n\nexport function severity(type: Alert[\"type\"]): Severity {\n  if (type === \"recovered\") return \"info\";\n  if (type === \"slow\" || type === \"over_budget\") return \"warning\";\n  return \"error\";\n}\n\n/** The scheme, host and port only. A URL's path or query can hold a credential. */\nexport function origin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return \"(invalid URL)\";\n  }\n}\n\n/** How much of a provider's error body goes into the error message. */\nexport const ERROR_BODY_MAX = 200;\n\n/**\n * POSTs and throws on a non-2xx answer. The error names the provider and the\n * URL's origin, plus the start of the response body with every secret the\n * channel holds cut out, in case a provider echoes one back. Secrets are cut\n * from a prefix long enough to hold one that starts inside the first\n * ERROR_BODY_MAX characters, and only then is it cut to that length, so no\n * part of a secret survives at the edge. A redirect is refused rather than\n * followed: the credential headers would go with it to wherever it points.\n */\nexport async function post(provider: string, url: string, init: { headers: Record<string, string>; body: string }, secrets: (string | undefined)[] = []): Promise<Response> {\n  const response = await fetch(url, { method: \"POST\", headers: init.headers, body: init.body, redirect: \"error\", signal: AbortSignal.timeout(TIMEOUT_MS) });\n  if (!response.ok) {\n    let text = \"\";\n    try {\n      text = await response.text();\n    } catch {\n      // The status is enough.\n    }\n    throw new Error(`${provider} ${origin(url)} answered ${response.status}${text ? `: ${errorBody(text, secrets)}` : \"\"}`);\n  }\n  return response;\n}\n\n/** The start of an error body, secrets cut out first, then cut to ERROR_BODY_MAX on a code point. */\nexport function errorBody(text: string, secrets: (string | undefined)[] = []): string {\n  const kept = secrets.filter((s): s is string => typeof s === \"string\" && s.length >= 4);\n  const longest = kept.reduce((n, s) => Math.max(n, s.length), 0);\n  let head = cut(text, ERROR_BODY_MAX + longest);\n  for (const secret of kept) head = head.split(secret).join(\"[redacted]\");\n  return cut(head, ERROR_BODY_MAX);\n}\n\n/** A credential with the spaces and newlines a paste leaves around it taken off. Anything not a string is empty. */\nexport function trimmed(value: unknown): string {\n  return typeof value === \"string\" ? value.trim() : \"\";\n}\n\n/** Base64 of UTF-8, without Buffer. */\nexport function base64(text: string): string {\n  let binary = \"\";\n  for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nexport function basicAuth(user: string, password: string): string {\n  return `Basic ${base64(`${user}:${password}`)}`;\n}\n\nexport function hex(bytes: ArrayBuffer | Uint8Array): string {\n  return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport async function sha256Hex(text: string): Promise<string> {\n  return hex(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text)));\n}\n\n/**\n * A stable 32 hex character id for one alert: the same job, type and time\n * always give the same id, so a provider that deduplicates on it drops a\n * resend of an alert it already took.\n */\nexport async function alertId(alert: Alert): Promise<string> {\n  return (await sha256Hex(`${alert.job}\\n${alert.type}\\n${alert.at}`)).slice(0, 32);\n}\n\n/** The same id laid out as a UUID, for APIs that ask for one. */\nexport function asUuid(id: string): string {\n  return `${id.slice(0, 8)}-${id.slice(8, 12)}-${id.slice(12, 16)}-${id.slice(16, 20)}-${id.slice(20, 32)}`;\n}\n\n/** Cuts to at most `max` UTF-16 units without splitting a surrogate pair. */\nexport function cut(text: string, max: number): string {\n  if (text.length <= max) return text;\n  let end = max;\n  const code = text.charCodeAt(end - 1);\n  if (code >= 0xd800 && code <= 0xdbff) end -= 1;\n  return text.slice(0, end);\n}\n\n/** The run fields worth attaching to a tracker event. */\nexport function runSummary(alert: Alert): Record<string, unknown> | null {\n  const run = alert.run;\n  if (!run) return null;\n  return { id: run.id, status: run.status, startedAt: new Date(run.startedAt).toISOString(), durationMs: run.durationMs, trigger: run.trigger };\n}\n\n/** Title, message, triage and link as one plain text block, the way every channel reads. */\nexport function plainText(alert: Alert, link: string | undefined): string {\n  return [alert.title, \"\", alert.message, ...(alert.triage ? [\"\", `Triage: ${alert.triage}`] : []), ...(link ? [\"\", `Open: ${link}`] : [])].join(\"\\n\");\n}\n","/**\n * Twilio SMS. API reference: https://www.twilio.com/docs/messaging/api/message-resource\n * POST https://api.twilio.com/2010-04-01/Accounts/<AccountSid>/Messages.json,\n * form encoded, with basic auth. One recipient per request.\n */\nimport type { Alert, AlertChannel } from \"../types.js\";\nimport { basicAuth, cut, post, trimmed } from \"./shared.js\";\n\nexport interface TwilioOptions {\n  /** The account SID, \"AC...\". It is in the URL whichever credentials sign the request. */\n  accountSid: string;\n  /** The account's auth token. Or pass apiKeySid and apiKeySecret instead. */\n  authToken?: string;\n  /** An API key SID, \"SK...\", with apiKeySecret, in place of the auth token. */\n  apiKeySid?: string;\n  apiKeySecret?: string;\n  /** A Twilio number in E.164 form, \"+15005550006\". Or pass messagingServiceSid. */\n  from?: string;\n  /** A messaging service SID, \"MG...\", in place of from. */\n  messagingServiceSid?: string;\n  /** One number in E.164 form, or several; each gets its own message. */\n  to: string | string[];\n  /** Also text when a job recovers. Defaults to false: a text is for what needs a person. */\n  recovered?: boolean;\n  /** How many SMS segments a message may use, 1 to 10. Defaults to 3. */\n  segments?: number;\n  link?: (alert: Alert) => string;\n}\n\n/** The most segments a message may use, which keeps it inside Twilio's 1600 character Body limit. */\nexport const MAX_SEGMENTS = 10;\n/** Twilio refuses a Body longer than this. */\nexport const MAX_BODY = 1600;\n\n/**\n * Texts alerts through Twilio, to every number at once. The alert counts as\n * delivered when any number took it; each number that refused it is\n * reported to the client's onError. It fails only when every number did.\n */\nexport function twilio(options: TwilioOptions): AlertChannel {\n  // A pasted credential often carries a stray space or newline, which the Authorization header would refuse or send.\n  const accountSid = trimmed(options.accountSid);\n  if (!accountSid) throw new Error(\"twilio() needs an accountSid\");\n  const apiKeySid = trimmed(options.apiKeySid);\n  const user = apiKeySid || accountSid;\n  const password = apiKeySid ? trimmed(options.apiKeySecret) : trimmed(options.authToken);\n  if (!password) throw new Error(\"twilio() needs an authToken, or an apiKeySid and apiKeySecret\");\n  if (!options.from && !options.messagingServiceSid) throw new Error(\"twilio() needs a from number or a messagingServiceSid\");\n  const to = (Array.isArray(options.to) ? options.to : [options.to]).filter((n) => typeof n === \"string\" && n.trim() !== \"\").map((n) => n.trim());\n  if (to.length === 0) throw new Error(\"twilio() needs at least one to number\");\n  const url = `https://api.twilio.com/2010-04-01/Accounts/${encodeURIComponent(accountSid)}/Messages.json`;\n  const authorization = basicAuth(user, password);\n  const segments = segmentBudget(options.segments);\n  return {\n    name: \"twilio\",\n    async send(alert, context) {\n      if (alert.type === \"recovered\" && !options.recovered) return;\n      const body = smsBody(alert, options.link?.(alert), segments);\n      const results = await Promise.allSettled(to.map((number) => {\n        const form = new URLSearchParams();\n        form.append(\"To\", number);\n        if (options.messagingServiceSid) form.append(\"MessagingServiceSid\", options.messagingServiceSid);\n        else form.append(\"From\", options.from!);\n        form.append(\"Body\", body);\n        return post(\"Twilio\", url, { headers: { \"content-type\": \"application/x-www-form-urlencoded\", authorization }, body: form.toString() }, [password]);\n      }));\n      const failed = results.flatMap((r, i) => (r.status === \"rejected\" ? [{ number: to[i]!, error: r.reason as Error }] : []));\n      if (failed.length === 0) return;\n      if (failed.length === to.length) {\n        const message = failed[0]!.error.message;\n        throw new Error(to.length > 1 ? `${message} (${failed.length} of ${to.length} numbers failed)` : message);\n      }\n      // Delivered to someone: counted as sent, so a retry never texts the numbers that took it again.\n      for (const { number, error } of failed) {\n        const report = new Error(`${error.message} (to ${maskNumber(number)}; ${to.length - failed.length} of ${to.length} numbers took the alert)`);\n        if (context) context.onError(report);\n        else console.error(\"[cronwatch] alert channel twilio:\", report);\n      }\n    },\n  };\n}\n\n/** A number with all but its last four digits hidden, for an error message. */\nfunction maskNumber(number: string): string {\n  return number.length <= 4 ? number : `${\"*\".repeat(Math.min(number.length - 4, 8))}${number.slice(-4)}`;\n}\n\n// The GSM 03.38 alphabet: a message in it takes 153 characters a segment\n// (when split), anything else is UCS-2 at 67. The extension table costs two.\nconst GSM = \"@£$¥èéùìòÇ\\nØø\\rÅåΔ_ΦΓΛΩΠΨΣΘΞÆæßÉ !\\\"#¤%&'()*+,-./0123456789:;<=>?¡ABCDEFGHIJKLMNOPQRSTUVWXYZÄÖÑܧ¿abcdefghijklmnopqrstuvwxyzäöñüà\";\nconst GSM_EXTENDED = \"^{}\\\\[~]|€\\f\";\n\n/**\n * The segments `text` takes. A character is never split across two: an\n * extension character (two septets) or a surrogate pair (two UCS-2 units)\n * that would straddle a boundary starts the next segment, as phones pack them.\n */\nexport function smsSegments(text: string): number {\n  const units: number[] = [];\n  let gsm = true;\n  for (const ch of text) {\n    if (GSM.includes(ch)) units.push(1);\n    else if (GSM_EXTENDED.includes(ch)) units.push(2);\n    else {\n      gsm = false;\n      break;\n    }\n  }\n  const [single, per, sizes] = gsm ? [160, 153, units] : [70, 67, Array.from(text, (ch) => ch.length)];\n  const total = sizes.reduce((n, u) => n + u, 0);\n  if (total <= single) return 1;\n  let count = 1;\n  let used = 0;\n  for (const u of sizes) {\n    if (used + u > per) {\n      count += 1;\n      used = 0;\n    }\n    used += u;\n  }\n  return count;\n}\n\n/** Fits `text` within `segments` SMS segments and Twilio's Body limit. */\nfunction fits(text: string, segments: number): boolean {\n  return text.length <= MAX_BODY && smsSegments(text) <= segments;\n}\n\n/**\n * The title, then as many lines of the message (and the triage) as fit, then\n * the link. The link is kept whole; the text before it is cut to make room.\n * `segments` is clamped to 1 to 10.\n */\nexport function smsBody(alert: Alert, link: string | undefined, segments = 3): string {\n  const budget = segmentBudget(segments);\n  const tail = link ? `\\n${link}` : \"\";\n  const lines = [alert.title, ...alert.message.split(\"\\n\").filter((l) => l.trim() !== \"\"), ...(alert.triage ? [`Triage: ${alert.triage}`] : [])];\n  let text = \"\";\n  for (const line of lines) {\n    const next = text ? `${text}\\n${line}` : line;\n    if (fits(next + tail, budget)) {\n      text = next;\n      continue;\n    }\n    // Part of this line, cut on a code point and marked.\n    const chars = Array.from(line);\n    let lo = 0;\n    let hi = chars.length;\n    while (lo < hi) {\n      const mid = Math.ceil((lo + hi) / 2);\n      const candidate = (text ? `${text}\\n` : \"\") + chars.slice(0, mid).join(\"\") + \"...\";\n      if (fits(candidate + tail, budget)) lo = mid;\n      else hi = mid - 1;\n    }\n    if (lo > 0) text = (text ? `${text}\\n` : \"\") + chars.slice(0, lo).join(\"\") + \"...\";\n    break;\n  }\n  // Only a link too long for any budget gets here too long; Twilio would refuse it whole.\n  return cut(text + tail, MAX_BODY);\n}\n\n/** A segment count clamped to 1 to MAX_SEGMENTS; 3 for anything not a number. */\nfunction segmentBudget(segments: number | undefined): number {\n  const n = typeof segments === \"number\" && Number.isFinite(segments) ? Math.floor(segments) : 3;\n  return Math.min(MAX_SEGMENTS, Math.max(1, n));\n}\n"]}

package/dist/{types-DUt2apl0.d.cts → types-Ddq1MUPL.d.cts}

@@ -131,8 +131,16 @@ interface AlertDetails {
     over_budget: {
         breaches: BudgetBreach[];
     };
+    /**
+     * `after` names the conditions that closed. A recovery with `reason`
+     * "unscheduled" closes missed alone because the job no longer has a
+     * schedule; `since` is when missed opened. Without `reason`, a successful
+     * run closed everything that was open.
+     */
     recovered: {
         after: Condition[];
+        reason?: "unscheduled";
+        since?: number;
     };
 }
 /** An alert before it has a title and message. See composeAlert(). */
@@ -166,9 +174,18 @@ type Alert = {
         details: AlertDetails[K];
     };
 }[AlertType];
+/** What the client hands a channel with each alert. */
+interface ChannelContext {
+    /**
+     * Report a problem that did not stop the alert going out, such as one of
+     * several recipients refusing it. Goes to the client's onError.
+     */
+    onError(error: unknown): void;
+}
 interface AlertChannel {
     name: string;
-    send(alert: Alert): Promise<void>;
+    /** Resolves once the alert went out (to at least one recipient); throws when it went nowhere. */
+    send(alert: Alert, context?: ChannelContext): Promise<void>;
 }
 interface Store {
     /** Called once before first use. Create tables here. */
@@ -179,6 +196,16 @@ interface Store {
     deleteJob(name: string): Promise<void>;
     insertRun(run: Run): Promise<void>;
     updateRun(run: Run): Promise<void>;
+    /**
+     * Write a run's status, finishedAt, durationMs, error, output and metrics
+     * only when its stored status is one of `fromStatuses`, in one step (SQL:
+     * `UPDATE ... WHERE id = ? AND status IN (...)`). Returns whether it wrote.
+     * This is what lets exactly one of several processes finishing the same run
+     * evaluate it; the others see false and report the run as already finished.
+     * A store without it falls back to getRun then updateRun, which is safe only
+     * when one process at a time finishes a given run.
+     */
+    updateRunIf?(run: Run, fromStatuses: Run["status"][]): Promise<boolean>;
     getRun(id: string): Promise<Run | null>;
     /** Newest first. */
     listRuns(job: string, limit: number): Promise<Run[]>;
@@ -233,4 +260,4 @@ interface TriageContext {
 }
 type TriageFn = (context: TriageContext) => Promise<string | null>;
 
-export type { Alert as A, BudgetBreach as B, CheckResult as C, Duration as D, ExpectRule as E, JobOptions as J, Run as R, Store as S, TriageFn as T, AlertChannel as a, JobDefinition as b, JobSummary as c, JobState as d, AlertDraft as e, StoredJobDefinition as f, AlertDetails as g, AlertType as h, Condition as i, JobHealth as j, RunStatus as k, StoredJob as l, TriageContext as m };
+export type { Alert as A, BudgetBreach as B, ChannelContext as C, Duration as D, ExpectRule as E, JobDefinition as J, Run as R, Store as S, TriageContext as T, AlertChannel as a, AlertDraft as b, StoredJobDefinition as c, AlertDetails as d, AlertType as e, CheckResult as f, Condition as g, JobHealth as h, JobOptions as i, JobState as j, JobSummary as k, RunStatus as l, StoredJob as m, TriageFn as n };

package/dist/{types-DUt2apl0.d.ts → types-Ddq1MUPL.d.ts}

@@ -131,8 +131,16 @@ interface AlertDetails {
     over_budget: {
         breaches: BudgetBreach[];
     };
+    /**
+     * `after` names the conditions that closed. A recovery with `reason`
+     * "unscheduled" closes missed alone because the job no longer has a
+     * schedule; `since` is when missed opened. Without `reason`, a successful
+     * run closed everything that was open.
+     */
     recovered: {
         after: Condition[];
+        reason?: "unscheduled";
+        since?: number;
     };
 }
 /** An alert before it has a title and message. See composeAlert(). */
@@ -166,9 +174,18 @@ type Alert = {
         details: AlertDetails[K];
     };
 }[AlertType];
+/** What the client hands a channel with each alert. */
+interface ChannelContext {
+    /**
+     * Report a problem that did not stop the alert going out, such as one of
+     * several recipients refusing it. Goes to the client's onError.
+     */
+    onError(error: unknown): void;
+}
 interface AlertChannel {
     name: string;
-    send(alert: Alert): Promise<void>;
+    /** Resolves once the alert went out (to at least one recipient); throws when it went nowhere. */
+    send(alert: Alert, context?: ChannelContext): Promise<void>;
 }
 interface Store {
     /** Called once before first use. Create tables here. */
@@ -179,6 +196,16 @@ interface Store {
     deleteJob(name: string): Promise<void>;
     insertRun(run: Run): Promise<void>;
     updateRun(run: Run): Promise<void>;
+    /**
+     * Write a run's status, finishedAt, durationMs, error, output and metrics
+     * only when its stored status is one of `fromStatuses`, in one step (SQL:
+     * `UPDATE ... WHERE id = ? AND status IN (...)`). Returns whether it wrote.
+     * This is what lets exactly one of several processes finishing the same run
+     * evaluate it; the others see false and report the run as already finished.
+     * A store without it falls back to getRun then updateRun, which is safe only
+     * when one process at a time finishes a given run.
+     */
+    updateRunIf?(run: Run, fromStatuses: Run["status"][]): Promise<boolean>;
     getRun(id: string): Promise<Run | null>;
     /** Newest first. */
     listRuns(job: string, limit: number): Promise<Run[]>;
@@ -233,4 +260,4 @@ interface TriageContext {
 }
 type TriageFn = (context: TriageContext) => Promise<string | null>;
 
-export type { Alert as A, BudgetBreach as B, CheckResult as C, Duration as D, ExpectRule as E, JobOptions as J, Run as R, Store as S, TriageFn as T, AlertChannel as a, JobDefinition as b, JobSummary as c, JobState as d, AlertDraft as e, StoredJobDefinition as f, AlertDetails as g, AlertType as h, Condition as i, JobHealth as j, RunStatus as k, StoredJob as l, TriageContext as m };
+export type { Alert as A, BudgetBreach as B, ChannelContext as C, Duration as D, ExpectRule as E, JobDefinition as J, Run as R, Store as S, TriageContext as T, AlertChannel as a, AlertDraft as b, StoredJobDefinition as c, AlertDetails as d, AlertType as e, CheckResult as f, Condition as g, JobHealth as h, JobOptions as i, JobState as j, JobSummary as k, RunStatus as l, StoredJob as m, TriageFn as n };

package/dist/webhook.cjs

@@ -1,7 +1,5 @@
 'use strict';
 
-var crypto = require('crypto');
-
 // src/alerts/webhook.ts
 var TIMEOUT_MS = 1e4;
 function origin(url) {
@@ -17,16 +15,24 @@ function webhook(options) {
     name: "webhook",
     async send(alert) {
       const body = JSON.stringify(alert);
-      const headers = { "content-type": "application/json", "user-agent": "cronwatch", ...options.headers };
+      const headers = { "content-type": "application/json", "user-agent": "cronwatch" };
+      for (const [name, value] of Object.entries(options.headers ?? {})) headers[name] = typeof value === "string" ? value.trim() : value;
       if (options.secret) {
-        headers["x-cronwatch-signature"] = `sha256=${crypto.createHmac("sha256", options.secret).update(body).digest("hex")}`;
+        headers["x-cronwatch-signature"] = `sha256=${await hmacSha256Hex(options.secret, body)}`;
       }
-      const response = await fetch(options.url, { method: "POST", headers, body, signal: AbortSignal.timeout(TIMEOUT_MS) });
+      const response = await fetch(options.url, { method: "POST", headers, body, redirect: "error", signal: AbortSignal.timeout(TIMEOUT_MS) });
       if (!response.ok) throw new Error(`Webhook ${origin(options.url)} answered ${response.status}`);
     }
   };
 }
+async function hmacSha256Hex(secret, body) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(body)));
+  return Array.from(signature, (b) => b.toString(16).padStart(2, "0")).join("");
+}
 
+exports.hmacSha256Hex = hmacSha256Hex;
 exports.webhook = webhook;
 //# sourceMappingURL=webhook.cjs.map
 //# sourceMappingURL=webhook.cjs.map

package/dist/webhook.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/alerts/webhook.ts"],"names":["createHmac"],"mappings":";;;;;AAeA,IAAM,UAAA,GAAa,GAAA;AAEnB,SAAS,OAAO,GAAA,EAAqB;AACnC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAMO,SAAS,QAAQ,OAAA,EAAuC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACzD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACjC,MAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAoB,cAAc,WAAA,EAAa,GAAG,QAAQ,OAAA,EAAQ;AAC5H,MAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,QAAA,OAAA,CAAQ,uBAAuB,CAAA,GAAI,CAAA,OAAA,EAAUA,iBAAA,CAAW,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA,CAAA;AAAA,MAC9G;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,MAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,GAAG,CAAA;AAEpH,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IAChG;AAAA,GACF;AACF","file":"webhook.cjs","sourcesContent":["import { createHmac } from \"node:crypto\";\nimport type { AlertChannel } from \"../types.js\";\n\nexport interface WebhookOptions {\n  url: string;\n  /** Extra request headers, for an Authorization header say. */\n  headers?: Record<string, string>;\n  /**\n   * When set, each request carries `X-CronWatch-Signature: sha256=<hex>`,\n   * the HMAC-SHA256 of the raw body with this secret, so the receiver can\n   * verify it.\n   */\n  secret?: string;\n}\n\nconst TIMEOUT_MS = 10_000;\n\nfunction origin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return \"(invalid URL)\";\n  }\n}\n\n/**\n * POSTs the alert as JSON to any URL. The body is the Alert object:\n * { type, job, title, message, run, details, triage, at, definition }.\n */\nexport function webhook(options: WebhookOptions): AlertChannel {\n  if (!options.url) throw new Error(\"webhook() needs a url\");\n  return {\n    name: \"webhook\",\n    async send(alert) {\n      const body = JSON.stringify(alert);\n      const headers: Record<string, string> = { \"content-type\": \"application/json\", \"user-agent\": \"cronwatch\", ...options.headers };\n      if (options.secret) {\n        headers[\"x-cronwatch-signature\"] = `sha256=${createHmac(\"sha256\", options.secret).update(body).digest(\"hex\")}`;\n      }\n      const response = await fetch(options.url, { method: \"POST\", headers, body, signal: AbortSignal.timeout(TIMEOUT_MS) });\n      // Only the origin: a webhook URL's path or query often is the credential.\n      if (!response.ok) throw new Error(`Webhook ${origin(options.url)} answered ${response.status}`);\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/alerts/webhook.ts"],"names":[],"mappings":";;;AAcA,IAAM,UAAA,GAAa,GAAA;AAEnB,SAAS,OAAO,GAAA,EAAqB;AACnC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAOO,SAAS,QAAQ,OAAA,EAAuC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACzD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACjC,MAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAoB,cAAc,WAAA,EAAY;AAExG,MAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,OAAA,IAAW,EAAE,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAO,UAAU,QAAA,GAAW,KAAA,CAAM,MAAK,GAAI,KAAA;AAC9H,MAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,QAAA,OAAA,CAAQ,uBAAuB,IAAI,CAAA,OAAA,EAAU,MAAM,cAAc,OAAA,CAAQ,MAAA,EAAQ,IAAI,CAAC,CAAA,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,WAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,UAAU,OAAA,EAAS,MAAA,EAAQ,YAAY,OAAA,CAAQ,UAAU,GAAG,CAAA;AAEvI,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IAChG;AAAA,GACF;AACF;AAGA,eAAsB,aAAA,CAAc,QAAgB,IAAA,EAA+B;AACjF,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,QAAQ,MAAA,CAAO,MAAM,GAAG,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AAC3H,EAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AAC5F,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,SAAA,EAAW,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC9E","file":"webhook.cjs","sourcesContent":["import type { AlertChannel } from \"../types.js\";\n\nexport interface WebhookOptions {\n  url: string;\n  /** Extra request headers, for an Authorization header say. Values are trimmed. */\n  headers?: Record<string, string>;\n  /**\n   * When set, each request carries `X-CronWatch-Signature: sha256=<hex>`,\n   * the HMAC-SHA256 of the raw body with this secret, so the receiver can\n   * verify it.\n   */\n  secret?: string;\n}\n\nconst TIMEOUT_MS = 10_000;\n\nfunction origin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return \"(invalid URL)\";\n  }\n}\n\n/**\n * POSTs the alert as JSON to any URL. The body is the Alert object:\n * { type, job, title, message, run, details, triage, at, definition }.\n * A redirect is an error: point the url at where the receiver really is.\n */\nexport function webhook(options: WebhookOptions): AlertChannel {\n  if (!options.url) throw new Error(\"webhook() needs a url\");\n  return {\n    name: \"webhook\",\n    async send(alert) {\n      const body = JSON.stringify(alert);\n      const headers: Record<string, string> = { \"content-type\": \"application/json\", \"user-agent\": \"cronwatch\" };\n      // A pasted Authorization value often carries a stray space or newline, which fetch would refuse.\n      for (const [name, value] of Object.entries(options.headers ?? {})) headers[name] = typeof value === \"string\" ? value.trim() : value;\n      if (options.secret) {\n        headers[\"x-cronwatch-signature\"] = `sha256=${await hmacSha256Hex(options.secret, body)}`;\n      }\n      // A redirect is refused, not followed: the headers (and the signature) would go with it.\n      const response = await fetch(options.url, { method: \"POST\", headers, body, redirect: \"error\", signal: AbortSignal.timeout(TIMEOUT_MS) });\n      // Only the origin: a webhook URL's path or query often is the credential.\n      if (!response.ok) throw new Error(`Webhook ${origin(options.url)} answered ${response.status}`);\n    },\n  };\n}\n\n/** HMAC-SHA256 as lowercase hex, with Web Crypto so it runs on Workers and Deno too. */\nexport async function hmacSha256Hex(secret: string, body: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(body)));\n  return Array.from(signature, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n"]}

package/dist/webhook.d.cts

@@ -1,8 +1,8 @@
-import { a as AlertChannel } from './types-DUt2apl0.cjs';
+import { a as AlertChannel } from './types-Ddq1MUPL.cjs';
 
 interface WebhookOptions {
     url: string;
-    /** Extra request headers, for an Authorization header say. */
+    /** Extra request headers, for an Authorization header say. Values are trimmed. */
     headers?: Record<string, string>;
     /**
      * When set, each request carries `X-CronWatch-Signature: sha256=<hex>`,
@@ -14,7 +14,10 @@ interface WebhookOptions {
 /**
  * POSTs the alert as JSON to any URL. The body is the Alert object:
  * { type, job, title, message, run, details, triage, at, definition }.
+ * A redirect is an error: point the url at where the receiver really is.
  */
 declare function webhook(options: WebhookOptions): AlertChannel;
+/** HMAC-SHA256 as lowercase hex, with Web Crypto so it runs on Workers and Deno too. */
+declare function hmacSha256Hex(secret: string, body: string): Promise<string>;
 
-export { type WebhookOptions, webhook };
+export { type WebhookOptions, hmacSha256Hex, webhook };

package/dist/webhook.d.ts

@@ -1,8 +1,8 @@
-import { a as AlertChannel } from './types-DUt2apl0.js';
+import { a as AlertChannel } from './types-Ddq1MUPL.js';
 
 interface WebhookOptions {
     url: string;
-    /** Extra request headers, for an Authorization header say. */
+    /** Extra request headers, for an Authorization header say. Values are trimmed. */
     headers?: Record<string, string>;
     /**
      * When set, each request carries `X-CronWatch-Signature: sha256=<hex>`,
@@ -14,7 +14,10 @@ interface WebhookOptions {
 /**
  * POSTs the alert as JSON to any URL. The body is the Alert object:
  * { type, job, title, message, run, details, triage, at, definition }.
+ * A redirect is an error: point the url at where the receiver really is.
  */
 declare function webhook(options: WebhookOptions): AlertChannel;
+/** HMAC-SHA256 as lowercase hex, with Web Crypto so it runs on Workers and Deno too. */
+declare function hmacSha256Hex(secret: string, body: string): Promise<string>;
 
-export { type WebhookOptions, webhook };
+export { type WebhookOptions, hmacSha256Hex, webhook };

package/dist/webhook.js

@@ -1,5 +1,3 @@
-import { createHmac } from 'crypto';
-
 // src/alerts/webhook.ts
 var TIMEOUT_MS = 1e4;
 function origin(url) {
@@ -15,16 +13,23 @@ function webhook(options) {
     name: "webhook",
     async send(alert) {
       const body = JSON.stringify(alert);
-      const headers = { "content-type": "application/json", "user-agent": "cronwatch", ...options.headers };
+      const headers = { "content-type": "application/json", "user-agent": "cronwatch" };
+      for (const [name, value] of Object.entries(options.headers ?? {})) headers[name] = typeof value === "string" ? value.trim() : value;
       if (options.secret) {
-        headers["x-cronwatch-signature"] = `sha256=${createHmac("sha256", options.secret).update(body).digest("hex")}`;
+        headers["x-cronwatch-signature"] = `sha256=${await hmacSha256Hex(options.secret, body)}`;
       }
-      const response = await fetch(options.url, { method: "POST", headers, body, signal: AbortSignal.timeout(TIMEOUT_MS) });
+      const response = await fetch(options.url, { method: "POST", headers, body, redirect: "error", signal: AbortSignal.timeout(TIMEOUT_MS) });
       if (!response.ok) throw new Error(`Webhook ${origin(options.url)} answered ${response.status}`);
     }
   };
 }
+async function hmacSha256Hex(secret, body) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(body)));
+  return Array.from(signature, (b) => b.toString(16).padStart(2, "0")).join("");
+}
 
-export { webhook };
+export { hmacSha256Hex, webhook };
 //# sourceMappingURL=webhook.js.map
 //# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/alerts/webhook.ts"],"names":[],"mappings":";;;AAeA,IAAM,UAAA,GAAa,GAAA;AAEnB,SAAS,OAAO,GAAA,EAAqB;AACnC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAMO,SAAS,QAAQ,OAAA,EAAuC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACzD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACjC,MAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAoB,cAAc,WAAA,EAAa,GAAG,QAAQ,OAAA,EAAQ;AAC5H,MAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,QAAA,OAAA,CAAQ,uBAAuB,CAAA,GAAI,CAAA,OAAA,EAAU,UAAA,CAAW,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA,CAAA;AAAA,MAC9G;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,MAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,UAAU,GAAG,CAAA;AAEpH,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IAChG;AAAA,GACF;AACF","file":"webhook.js","sourcesContent":["import { createHmac } from \"node:crypto\";\nimport type { AlertChannel } from \"../types.js\";\n\nexport interface WebhookOptions {\n  url: string;\n  /** Extra request headers, for an Authorization header say. */\n  headers?: Record<string, string>;\n  /**\n   * When set, each request carries `X-CronWatch-Signature: sha256=<hex>`,\n   * the HMAC-SHA256 of the raw body with this secret, so the receiver can\n   * verify it.\n   */\n  secret?: string;\n}\n\nconst TIMEOUT_MS = 10_000;\n\nfunction origin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return \"(invalid URL)\";\n  }\n}\n\n/**\n * POSTs the alert as JSON to any URL. The body is the Alert object:\n * { type, job, title, message, run, details, triage, at, definition }.\n */\nexport function webhook(options: WebhookOptions): AlertChannel {\n  if (!options.url) throw new Error(\"webhook() needs a url\");\n  return {\n    name: \"webhook\",\n    async send(alert) {\n      const body = JSON.stringify(alert);\n      const headers: Record<string, string> = { \"content-type\": \"application/json\", \"user-agent\": \"cronwatch\", ...options.headers };\n      if (options.secret) {\n        headers[\"x-cronwatch-signature\"] = `sha256=${createHmac(\"sha256\", options.secret).update(body).digest(\"hex\")}`;\n      }\n      const response = await fetch(options.url, { method: \"POST\", headers, body, signal: AbortSignal.timeout(TIMEOUT_MS) });\n      // Only the origin: a webhook URL's path or query often is the credential.\n      if (!response.ok) throw new Error(`Webhook ${origin(options.url)} answered ${response.status}`);\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/alerts/webhook.ts"],"names":[],"mappings":";AAcA,IAAM,UAAA,GAAa,GAAA;AAEnB,SAAS,OAAO,GAAA,EAAqB;AACnC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,eAAA;AAAA,EACT;AACF;AAOO,SAAS,QAAQ,OAAA,EAAuC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACzD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACjC,MAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAoB,cAAc,WAAA,EAAY;AAExG,MAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,OAAA,IAAW,EAAE,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAO,UAAU,QAAA,GAAW,KAAA,CAAM,MAAK,GAAI,KAAA;AAC9H,MAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,QAAA,OAAA,CAAQ,uBAAuB,IAAI,CAAA,OAAA,EAAU,MAAM,cAAc,OAAA,CAAQ,MAAA,EAAQ,IAAI,CAAC,CAAA,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,WAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,UAAU,OAAA,EAAS,MAAA,EAAQ,YAAY,OAAA,CAAQ,UAAU,GAAG,CAAA;AAEvI,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IAChG;AAAA,GACF;AACF;AAGA,eAAsB,aAAA,CAAc,QAAgB,IAAA,EAA+B;AACjF,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,QAAQ,MAAA,CAAO,MAAM,GAAG,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AAC3H,EAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AAC5F,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,SAAA,EAAW,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC9E","file":"webhook.js","sourcesContent":["import type { AlertChannel } from \"../types.js\";\n\nexport interface WebhookOptions {\n  url: string;\n  /** Extra request headers, for an Authorization header say. Values are trimmed. */\n  headers?: Record<string, string>;\n  /**\n   * When set, each request carries `X-CronWatch-Signature: sha256=<hex>`,\n   * the HMAC-SHA256 of the raw body with this secret, so the receiver can\n   * verify it.\n   */\n  secret?: string;\n}\n\nconst TIMEOUT_MS = 10_000;\n\nfunction origin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return \"(invalid URL)\";\n  }\n}\n\n/**\n * POSTs the alert as JSON to any URL. The body is the Alert object:\n * { type, job, title, message, run, details, triage, at, definition }.\n * A redirect is an error: point the url at where the receiver really is.\n */\nexport function webhook(options: WebhookOptions): AlertChannel {\n  if (!options.url) throw new Error(\"webhook() needs a url\");\n  return {\n    name: \"webhook\",\n    async send(alert) {\n      const body = JSON.stringify(alert);\n      const headers: Record<string, string> = { \"content-type\": \"application/json\", \"user-agent\": \"cronwatch\" };\n      // A pasted Authorization value often carries a stray space or newline, which fetch would refuse.\n      for (const [name, value] of Object.entries(options.headers ?? {})) headers[name] = typeof value === \"string\" ? value.trim() : value;\n      if (options.secret) {\n        headers[\"x-cronwatch-signature\"] = `sha256=${await hmacSha256Hex(options.secret, body)}`;\n      }\n      // A redirect is refused, not followed: the headers (and the signature) would go with it.\n      const response = await fetch(options.url, { method: \"POST\", headers, body, redirect: \"error\", signal: AbortSignal.timeout(TIMEOUT_MS) });\n      // Only the origin: a webhook URL's path or query often is the credential.\n      if (!response.ok) throw new Error(`Webhook ${origin(options.url)} answered ${response.status}`);\n    },\n  };\n}\n\n/** HMAC-SHA256 as lowercase hex, with Web Crypto so it runs on Workers and Deno too. */\nexport async function hmacSha256Hex(secret: string, body: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(body)));\n  return Array.from(signature, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n"]}