@happyvertical/smrt-messages 0.60.8 → 0.60.10

package/dist/index.js

@@ -1,16 +1,16 @@
 import { t as __exportAll } from "./chunks/rolldown-runtime-D7D4PA-g.js";
-import "./chunks/__smrt-register__-DwNoP4GB.js";
+import "./chunks/__smrt-register__-CaGLtiEU.js";
 import { a as registerMessagingProvider, n as getMessagingProvider, o as ZulipSender, r as listMessagingProviders, s as TelegramSender, t as ensureBuiltinMessagingProvidersRegistered } from "./chunks/providers-4iLula-V.js";
-import { r as Account, t as AccountCollection } from "./chunks/AccountCollection-O-zbituV.js";
-import { t as Message } from "./chunks/Message-5Xz9tauF.js";
-import { t as MessageCollection } from "./chunks/MessageCollection-m1C6fDwS.js";
-import { t as Email } from "./chunks/Email-MRtj6D2s.js";
-import { t as EmailFolder } from "./chunks/EmailFolder-qpOwfo_O.js";
+import { r as Account, t as AccountCollection } from "./chunks/AccountCollection-By48bdwt.js";
+import { t as Message } from "./chunks/Message-DXpqot5f.js";
+import { t as MessageCollection } from "./chunks/MessageCollection-CMGaSGBc.js";
+import { t as Email } from "./chunks/Email-CMUK3aWU.js";
+import { t as EmailFolder } from "./chunks/EmailFolder-DLJvqNqI.js";
 import { t as SlackSender } from "./chunks/SlackSender-CjSvwY1K.js";
 import { t as TweetSender } from "./chunks/TweetSender-CcLPNNi1.js";
-import { SmrtCollection, SmrtObject, SmrtRecipe, crossPackageRef, field, foreignKey, importOptionalDependency, isUniqueViolationError, smrt } from "@happyvertical/smrt-core";
+import { SmrtCollection, SmrtObject, SmrtRecipe, crossPackageRef, field, foreignKey, importOptionalDependency, isUniqueViolationError, smrt, usesEmbeddedRevisionFallback, withEmbeddedWriteQueue } from "@happyvertical/smrt-core";
 import { registerPermissionDefinitions } from "@happyvertical/smrt-users";
-import { TenantScoped, queryGlobal, queryWithGlobals, tenantId, withTenant } from "@happyvertical/smrt-tenancy";
+import { TenantScoped, queryGlobal, queryWithGlobals, tenantId, withSystemContext, withTenant } from "@happyvertical/smrt-tenancy";
 //#region src/permissions.ts
 var SEND_MESSAGES_PERMISSION = "messages.send";
 var MANAGE_MESSAGE_ROUTES_PERMISSION = "messages.manage-routes";
@@ -54,21 +54,21 @@ function ensureMessagingPermissionsRegistered() {
 }
 //#endregion
 //#region src/models/Attachment.ts
-var __defProp$12 = Object.defineProperty;
-var __getOwnPropDesc$12 = Object.getOwnPropertyDescriptor;
-var __defNormalProp$12 = (obj, key, value) => key in obj ? __defProp$12(obj, key, {
+var __defProp$13 = Object.defineProperty;
+var __getOwnPropDesc$13 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$13 = (obj, key, value) => key in obj ? __defProp$13(obj, key, {
 	enumerable: true,
 	configurable: true,
 	writable: true,
 	value
 }) : obj[key] = value;
-var __decorateClass$12 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$12(target, key) : target;
+var __decorateClass$13 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$13(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$12(target, key, result);
+	if (kind && result) __defProp$13(target, key, result);
 	return result;
 };
-var __publicField$12 = (obj, key, value) => __defNormalProp$12(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __publicField$13 = (obj, key, value) => __defNormalProp$13(obj, typeof key !== "symbol" ? key + "" : key, value);
 function splitAbsolutePath(filePath) {
 	const windows = /^[A-Za-z]:[\\/]/.test(filePath);
 	if (!windows && !filePath.startsWith("/")) return null;
@@ -107,7 +107,7 @@ var Attachment = class extends SmrtObject {
 	*/
 	async getMessage() {
 		if (!this.messageId) return null;
-		const { MessageCollection } = await import("./chunks/MessageCollection-m1C6fDwS.js").then((n) => n.n);
+		const { MessageCollection } = await import("./chunks/MessageCollection-CMGaSGBc.js").then((n) => n.n);
 		return await (await MessageCollection.create(this.options)).get({ id: this.messageId });
 	}
 	/**
@@ -187,10 +187,10 @@ var Attachment = class extends SmrtObject {
 		}
 	}
 };
-__publicField$12(Attachment, "__smrtPackage__", "@happyvertical/smrt-messages");
-__decorateClass$12([tenantId({ nullable: true })], Attachment.prototype, "tenantId", 2);
-__decorateClass$12([foreignKey("Message")], Attachment.prototype, "messageId", 2);
-Attachment = __decorateClass$12([TenantScoped({ mode: "optional" }), smrt({
+__publicField$13(Attachment, "__smrtPackage__", "@happyvertical/smrt-messages");
+__decorateClass$13([tenantId({ nullable: true })], Attachment.prototype, "tenantId", 2);
+__decorateClass$13([foreignKey("Message")], Attachment.prototype, "messageId", 2);
+Attachment = __decorateClass$13([TenantScoped({ mode: "optional" }), smrt({
 	api: { include: [
 		"list",
 		"get",
@@ -317,21 +317,21 @@ var AttachmentCollection = class extends SmrtCollection {
 };
 //#endregion
 //#region src/models/MessagingEndpoint.ts
-var __defProp$11 = Object.defineProperty;
-var __getOwnPropDesc$11 = Object.getOwnPropertyDescriptor;
-var __defNormalProp$11 = (obj, key, value) => key in obj ? __defProp$11(obj, key, {
+var __defProp$12 = Object.defineProperty;
+var __getOwnPropDesc$12 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$12 = (obj, key, value) => key in obj ? __defProp$12(obj, key, {
 	enumerable: true,
 	configurable: true,
 	writable: true,
 	value
 }) : obj[key] = value;
-var __decorateClass$11 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$11(target, key) : target;
+var __decorateClass$12 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$12(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$11(target, key, result);
+	if (kind && result) __defProp$12(target, key, result);
 	return result;
 };
-var __publicField$11 = (obj, key, value) => __defNormalProp$11(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __publicField$12 = (obj, key, value) => __defNormalProp$12(obj, typeof key !== "symbol" ? key + "" : key, value);
 var MessagingEndpoint = class extends SmrtObject {
 	tenantId = "";
 	profileId = null;
@@ -376,16 +376,16 @@ var MessagingEndpoint = class extends SmrtObject {
 		return value.length <= 4 ? "••••" : `\u2022\u2022\u2022\u2022${value.slice(-4)}`;
 	}
 };
-__publicField$11(MessagingEndpoint, "__smrtPackage__", "@happyvertical/smrt-messages");
-__decorateClass$11([tenantId()], MessagingEndpoint.prototype, "tenantId", 2);
-__decorateClass$11([crossPackageRef("@happyvertical/smrt-profiles:Profile", { nullable: true })], MessagingEndpoint.prototype, "profileId", 2);
-__decorateClass$11([field({ required: true })], MessagingEndpoint.prototype, "label", 2);
-__decorateClass$11([field({ required: true })], MessagingEndpoint.prototype, "channel", 2);
-__decorateClass$11([field({
+__publicField$12(MessagingEndpoint, "__smrtPackage__", "@happyvertical/smrt-messages");
+__decorateClass$12([tenantId()], MessagingEndpoint.prototype, "tenantId", 2);
+__decorateClass$12([crossPackageRef("@happyvertical/smrt-profiles:Profile", { nullable: true })], MessagingEndpoint.prototype, "profileId", 2);
+__decorateClass$12([field({ required: true })], MessagingEndpoint.prototype, "label", 2);
+__decorateClass$12([field({ required: true })], MessagingEndpoint.prototype, "channel", 2);
+__decorateClass$12([field({
 	required: true,
 	sensitive: true
 })], MessagingEndpoint.prototype, "address", 2);
-MessagingEndpoint = __decorateClass$11([TenantScoped({ mode: "required" }), smrt({
+MessagingEndpoint = __decorateClass$12([TenantScoped({ mode: "required" }), smrt({
 	tableName: "messaging_endpoints",
 	api: { include: ["list", "get"] },
 	mcp: { include: ["list", "get"] },
@@ -403,6 +403,196 @@ var MessagingEndpointCollection = class extends SmrtCollection {
 	static _itemClass = MessagingEndpoint;
 };
 //#endregion
+//#region src/models/NotificationDelivery.ts
+var __defProp$11 = Object.defineProperty;
+var __getOwnPropDesc$11 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$11 = (obj, key, value) => key in obj ? __defProp$11(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$11 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$11(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$11(target, key, result);
+	return result;
+};
+var __publicField$11 = (obj, key, value) => __defNormalProp$11(obj, typeof key !== "symbol" ? key + "" : key, value);
+var NOTIFICATION_DELIVERY_CHANNELS = ["email"];
+var TRANSITION_COLUMNS = {
+	messageId: "message_id",
+	status: "status",
+	attempts: "attempts",
+	nextAttemptAt: "next_attempt_at",
+	leaseToken: "lease_token",
+	leaseExpiresAt: "lease_expires_at",
+	handedOffAt: "handed_off_at",
+	deliveredAt: "delivered_at",
+	providerMessageId: "provider_message_id",
+	lastError: "last_error"
+};
+var NotificationDelivery = class extends SmrtObject {
+	tenantId = "";
+	recipientUserId = "";
+	channel = "email";
+	sourceRef = "";
+	kind = "";
+	subject = "";
+	textBody = "";
+	href = "";
+	recipientAddress = "";
+	/** Display name snapshot from the host recipient resolver. */
+	recipientName = "";
+	accountId = "";
+	messageId = null;
+	status = "pending";
+	/** Compare-and-set counter; bumped by every transition. */
+	stateVersion = 0;
+	/** Unique id of the transition that wrote the current state. */
+	transitionId = "";
+	/** Leases acquired so far (provider handoffs are a subset). */
+	attempts = 0;
+	/** Lease budget before the delivery fails for good. */
+	maxAttempts = 5;
+	/** Earliest time a dispatcher may lease a `pending` row. */
+	nextAttemptAt = /* @__PURE__ */ new Date();
+	/** Proof of the current lease holder; cleared when the lease ends. */
+	leaseToken = null;
+	/** When the current lease lapses and the row becomes recoverable. */
+	leaseExpiresAt = null;
+	/** Set just before the current attempt reaches the provider. */
+	handedOffAt = null;
+	/** When the provider accepted the message. */
+	deliveredAt = null;
+	/** Provider message id, when the provider returns one. */
+	providerMessageId = "";
+	/** The latest failure or uncertainty reason. */
+	lastError = "";
+	constructor(options = {}) {
+		super(options);
+		const assign = (key) => {
+			if (options[key] !== void 0) this[key] = options[key];
+		};
+		for (const key of [
+			"tenantId",
+			"recipientUserId",
+			"channel",
+			"sourceRef",
+			"kind",
+			"subject",
+			"textBody",
+			"href",
+			"recipientAddress",
+			"recipientName",
+			"accountId",
+			"messageId",
+			"status",
+			"stateVersion",
+			"transitionId",
+			"attempts",
+			"maxAttempts",
+			"nextAttemptAt",
+			"leaseToken",
+			"leaseExpiresAt",
+			"handedOffAt",
+			"deliveredAt",
+			"providerMessageId",
+			"lastError"
+		]) assign(key);
+	}
+	/** Whether no further automatic work will happen on this row. */
+	get isSettled() {
+		return this.status === "sent" || this.status === "failed" || this.status === "cancelled" || this.status === "uncertain";
+	}
+	/**
+	* Apply `changes` only if the stored row is still at `stateVersion` (and,
+	* when `leaseToken` is given, still held by that lease). Returns whether
+	* this caller won; on success the instance reflects the stored row.
+	*
+	* PostgreSQL and remote LibSQL evaluate the guard in one conditional
+	* UPDATE; local embedded engines use the process write queue, matching
+	* `Message.send()`'s claim. The durable row is re-read either way, and the
+	* write is recognised by its unique `transitionId`, because DuckDB's update
+	* result over-reports affected rows.
+	*/
+	async transition(changes, expected = {}) {
+		if (!this.id) throw new Error("Cannot transition an unsaved delivery.");
+		const fromVersion = this.stateVersion;
+		const nextVersion = fromVersion + 1;
+		const transitionId = crypto.randomUUID();
+		const values = {
+			state_version: nextVersion,
+			transition_id: transitionId,
+			updated_at: /* @__PURE__ */ new Date()
+		};
+		for (const [key, value] of Object.entries(changes)) {
+			const column = TRANSITION_COLUMNS[key];
+			if (!column) throw new Error(`'${key}' is not a transition field.`);
+			values[column] = value;
+		}
+		const matches = (row) => row !== null && Number(row.state_version) === fromVersion && (expected.leaseToken === void 0 || row.lease_token === expected.leaseToken);
+		const useEmbeddedFallback = usesEmbeddedRevisionFallback(this.db);
+		await withEmbeddedWriteQueue(this.db, useEmbeddedFallback, async () => {
+			if (useEmbeddedFallback) {
+				const current = await this.getCanonicalPersistedRow({ id: this.id });
+				if (!matches(current)) return;
+				await this.db.upsert(this.tableName, ["id"], {
+					...current,
+					...values
+				});
+				return;
+			}
+			await this.db.update(this.tableName, {
+				id: this.id,
+				tenant_id: this.tenantId,
+				state_version: fromVersion,
+				...expected.leaseToken === void 0 ? {} : { lease_token: expected.leaseToken }
+			}, values);
+		});
+		const verified = await this.getCanonicalPersistedRow({ id: this.id });
+		if (!verified || verified.transition_id !== transitionId) return false;
+		await this.completePersistedUpdate(verified);
+		return true;
+	}
+};
+__publicField$11(NotificationDelivery, "__smrtPackage__", "@happyvertical/smrt-messages");
+__decorateClass$11([tenantId()], NotificationDelivery.prototype, "tenantId", 2);
+__decorateClass$11([crossPackageRef("@happyvertical/smrt-users:User", { required: true })], NotificationDelivery.prototype, "recipientUserId", 2);
+__decorateClass$11([field({ required: true })], NotificationDelivery.prototype, "channel", 2);
+__decorateClass$11([field({ required: true })], NotificationDelivery.prototype, "sourceRef", 2);
+__decorateClass$11([field({ required: true })], NotificationDelivery.prototype, "kind", 2);
+__decorateClass$11([field({ required: true })], NotificationDelivery.prototype, "subject", 2);
+__decorateClass$11([field({ required: true })], NotificationDelivery.prototype, "textBody", 2);
+__decorateClass$11([field({ required: true })], NotificationDelivery.prototype, "href", 2);
+__decorateClass$11([field({ required: true })], NotificationDelivery.prototype, "recipientAddress", 2);
+__decorateClass$11([foreignKey("Account")], NotificationDelivery.prototype, "accountId", 2);
+__decorateClass$11([foreignKey("Message")], NotificationDelivery.prototype, "messageId", 2);
+NotificationDelivery = __decorateClass$11([TenantScoped({ mode: "required" }), smrt({
+	tableName: "notification_deliveries",
+	api: false,
+	mcp: false,
+	cli: false,
+	conflictColumns: [
+		"tenant_id",
+		"recipient_user_id",
+		"channel",
+		"source_ref"
+	],
+	indexes: [{
+		name: "notification_deliveries_due_idx",
+		columns: ["status", "nextAttemptAt"]
+	}, {
+		name: "notification_deliveries_lease_idx",
+		columns: ["status", "leaseExpiresAt"]
+	}]
+})], NotificationDelivery);
+//#endregion
+//#region src/collections/NotificationDeliveryCollection.ts
+var NotificationDeliveryCollection = class extends SmrtCollection {
+	static _itemClass = NotificationDelivery;
+};
+//#endregion
 //#region src/models/PersonaMessageRoute.ts
 var __defProp$10 = Object.defineProperty;
 var __getOwnPropDesc$10 = Object.getOwnPropertyDescriptor;
@@ -688,7 +878,7 @@ var EmailAccount = class extends Account {
 			for (const folderName of foldersToSync) try {
 				let folder = await folderCollection.getByPath(accountId, folderName);
 				if (!folder) {
-					const { EmailFolder } = await import("./chunks/EmailFolder-qpOwfo_O.js").then((n) => n.n);
+					const { EmailFolder } = await import("./chunks/EmailFolder-DLJvqNqI.js").then((n) => n.n);
 					folder = new EmailFolder({
 						...this.childOptions(),
 						accountId,
@@ -713,7 +903,7 @@ var EmailAccount = class extends Account {
 							result.messagesSkipped++;
 							continue;
 						}
-						const { Email } = await import("./chunks/Email-MRtj6D2s.js").then((n) => n.n);
+						const { Email } = await import("./chunks/Email-CMUK3aWU.js").then((n) => n.n);
 						let email = existingEmail;
 						if (!email) {
 							email = new Email({
@@ -1924,7 +2114,10 @@ ZulipAccount = __decorateClass([smrt({
 })], ZulipAccount);
 //#endregion
 //#region src/senders/EmailSender.ts
-var EmailSender_exports = /* @__PURE__ */ __exportAll({ EmailSender: () => EmailSender });
+var EmailSender_exports = /* @__PURE__ */ __exportAll({
+	EmailSender: () => EmailSender,
+	isDefiniteSendRejection: () => isDefiniteSendRejection
+});
 var EmailSender = class {
 	providerType = "email";
 	client;
@@ -1987,6 +2180,7 @@ var EmailSender = class {
 			return {
 				success: false,
 				error: error instanceof Error ? error.message : String(error),
+				...isDefiniteSendRejection(error) ? {} : { outcomeUnknown: true },
 				sentAt: /* @__PURE__ */ new Date()
 			};
 		}
@@ -2033,6 +2227,31 @@ var EmailSender = class {
 		return resolved;
 	}
 };
+var DEFINITE_EMAIL_ERROR_CODES = /* @__PURE__ */ new Set([
+	"AUTHENTICATION_ERROR",
+	"AUTHORIZATION_ERROR",
+	"INVALID_MESSAGE",
+	"ATTACHMENT_ERROR"
+]);
+var NEVER_CONNECTED_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ENOTFOUND",
+	"EHOSTUNREACH",
+	"EAI_AGAIN"
+]);
+function isDefiniteSendRejection(error) {
+	if (!error || typeof error !== "object") return false;
+	const candidates = [error, error.cause].filter((value) => !!value && typeof value === "object");
+	for (const candidate of candidates) {
+		if (typeof candidate.responseCode === "number") return true;
+		if (typeof candidate.code === "string") {
+			if (DEFINITE_EMAIL_ERROR_CODES.has(candidate.code)) return true;
+			if (NEVER_CONNECTED_CODES.has(candidate.code)) return true;
+		}
+	}
+	const sendError = error;
+	return sendError.code === "SEND_ERROR" && Array.isArray(sendError.accepted) && sendError.accepted.length === 0;
+}
 //#endregion
 //#region src/services/MessagingSettingsService.ts
 var MessagingSettingsService = class {
@@ -2231,6 +2450,529 @@ var MessagingSettingsService = class {
 	}
 };
 //#endregion
+//#region src/services/NotificationOutboxService.ts
+var messageSendTransport = {
+	name: "message-send",
+	idempotent: false,
+	async send({ message }) {
+		const result = await message.send();
+		if (result.success) return {
+			status: "accepted",
+			...result.providerMessageId ? { providerMessageId: result.providerMessageId } : {}
+		};
+		if (result.outcomeUnknown || message.sendStatus === "sending" || message.sendStatus === "sent") return {
+			status: "unknown",
+			error: result.error ?? "The provider did not confirm the outcome."
+		};
+		return {
+			status: "rejected",
+			error: result.error ?? "Send failed",
+			retryable: true
+		};
+	},
+	async reconcile({ message }) {
+		const messages = await MessageCollection.create({ db: message.db });
+		const stored = message.id ? await messages.get({ id: message.id }) : null;
+		switch (stored?.sendStatus) {
+			case "sent": return { status: "accepted" };
+			case "failed":
+				if (stored.isSendOutcomeUnknown()) return {
+					status: "unknown",
+					error: stored.sendError || "The provider did not confirm the outcome."
+				};
+				return {
+					status: "rejected",
+					error: stored.sendError || "Send failed",
+					retryable: true
+				};
+			case "draft":
+			case "pending":
+			case "scheduled": return { status: "not-sent" };
+			default: return {
+				status: "unknown",
+				error: "The provider handoff did not record an outcome."
+			};
+		}
+	}
+};
+var NotificationOutboxDeniedError = class extends Error {
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+		this.name = "NotificationOutboxDeniedError";
+	}
+	reason;
+};
+var UUID_PATTERN$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var DEFAULT_LEASE_MS = 5 * 6e4;
+var DEFAULT_MAX_ATTEMPTS = 5;
+var DEFAULT_LIMIT$1 = 25;
+var MAX_LIMIT$1 = 200;
+function defaultRetryDelayMs(attempts) {
+	return Math.min(6e4 * 2 ** Math.max(0, attempts - 1), 60 * 6e4);
+}
+function requireText$1(value, name) {
+	const text = value?.trim();
+	if (!text) throw new Error(`A notification ${name} is required.`);
+	return text;
+}
+function errorText(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function notificationDeliveryMessageId(deliveryId) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`smrt-messages:notification-delivery:${deliveryId}`));
+	const bytes = new Uint8Array(digest).slice(0, 16);
+	bytes[6] = (bytes[6] ?? 0) & 15 | 80;
+	bytes[8] = (bytes[8] ?? 0) & 63 | 128;
+	const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+	return [
+		hex.slice(0, 4),
+		hex.slice(4, 6),
+		hex.slice(6, 8),
+		hex.slice(8, 10),
+		hex.slice(10, 16)
+	].map((group) => group.join("")).join("-");
+}
+function notificationDeliveryCorrelationId(deliveryId) {
+	return `notification-delivery:${deliveryId}`;
+}
+function buildNotificationLink(baseUrl, path) {
+	let base;
+	try {
+		base = new URL(baseUrl);
+	} catch {
+		throw new Error("Notification link base URL must be an absolute URL.");
+	}
+	if (base.protocol !== "https:" && base.protocol !== "http:") throw new Error("Notification link base URL must use http or https.");
+	if (base.username || base.password || base.search || base.hash) throw new Error("Notification link base URL must not carry credentials, a query, or a fragment.");
+	if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//") || /[\\\s]/u.test(path) || /[\u0000-\u001f\u007f]/u.test(path)) throw new NotificationOutboxDeniedError("link", "Notification links must be a host-relative path such as /inbox/123.");
+	const prefix = base.pathname.replace(/\/+$/u, "");
+	const link = new URL(`${prefix}${path}`, base.origin);
+	if (link.origin !== base.origin) throw new NotificationOutboxDeniedError("link", "Notification links must stay on the configured origin.");
+	return link.toString();
+}
+var NotificationOutboxService = class {
+	constructor(options) {
+		this.options = options;
+		buildNotificationLink(options.linkBaseUrl, "/");
+		this.transport = options.transport ?? messageSendTransport;
+		this.leaseMs = options.leaseMs ?? DEFAULT_LEASE_MS;
+		this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+		this.retryDelayMs = options.retryDelayMs ?? defaultRetryDelayMs;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		if (!Number.isInteger(this.leaseMs) || this.leaseMs < 1e3) throw new Error("Notification lease must be at least 1000 ms.");
+		if (!Number.isInteger(this.maxAttempts) || this.maxAttempts < 1) throw new Error("Notification maxAttempts must be a positive integer.");
+	}
+	options;
+	transport;
+	leaseMs;
+	maxAttempts;
+	retryDelayMs;
+	now;
+	collection() {
+		return NotificationDeliveryCollection.create({ db: this.options.db });
+	}
+	authorize(tenantId) {
+		if (!this.options.principal) return;
+		try {
+			assertMessagingPermission(this.options.principal, tenantId, SEND_MESSAGES_PERMISSION);
+		} catch (error) {
+			throw new NotificationOutboxDeniedError("permission", errorText(error));
+		}
+	}
+	/** Store one email delivery for the event unless `sourceRef` already has one. */
+	async enqueueEmail(input) {
+		const tenantId = requireText$1(input.tenantId, "tenant");
+		const recipientUserId = requireText$1(input.recipientUserId, "recipient");
+		const sourceRef = requireText$1(input.sourceRef, "sourceRef");
+		const kind = requireText$1(input.kind, "kind");
+		const subject = requireText$1(input.subject, "subject");
+		const text = requireText$1(input.text, "text");
+		if (/[\r\n]/u.test(subject)) throw new Error("A notification subject must be a single line.");
+		const channel = "email";
+		this.authorize(tenantId);
+		const href = buildNotificationLink(this.options.linkBaseUrl, input.path);
+		return withTenant({ tenantId }, async () => {
+			const deliveries = await this.collection();
+			const findExisting = async () => (await deliveries.list({
+				where: {
+					tenantId,
+					recipientUserId,
+					channel,
+					sourceRef
+				},
+				limit: 1
+			}))[0];
+			const existing = await findExisting();
+			if (existing) return {
+				delivery: existing,
+				created: false
+			};
+			const recipient = await this.options.resolveRecipient({
+				tenantId,
+				recipientUserId,
+				channel
+			});
+			const address = recipient?.address?.trim();
+			if (!address || /[\s,;<>]/u.test(address) || !address.includes("@")) throw new NotificationOutboxDeniedError("recipient", "The host did not authorize an email recipient for this user.");
+			const accountId = await this.requireSenderAccount(tenantId);
+			const suppressed = await this.isSuppressed({
+				tenantId,
+				recipientUserId,
+				channel,
+				kind,
+				sourceRef
+			});
+			try {
+				return {
+					delivery: await deliveries.create({
+						_insertOnly: true,
+						tenantId,
+						recipientUserId,
+						channel,
+						sourceRef,
+						kind,
+						subject,
+						textBody: text,
+						href,
+						recipientAddress: address,
+						recipientName: recipient?.name?.trim() ?? "",
+						accountId,
+						messageId: null,
+						status: suppressed ? "cancelled" : "pending",
+						stateVersion: 0,
+						transitionId: "",
+						attempts: 0,
+						maxAttempts: this.maxAttempts,
+						nextAttemptAt: input.notBefore ?? this.now(),
+						leaseToken: null,
+						leaseExpiresAt: null,
+						handedOffAt: null,
+						deliveredAt: null,
+						providerMessageId: "",
+						lastError: suppressed ? "Suppressed by recipient preference." : ""
+					}),
+					created: true
+				};
+			} catch (error) {
+				if (!isUniqueViolationError(error)) throw error;
+				const winner = await findExisting();
+				if (!winner) throw error;
+				return {
+					delivery: winner,
+					created: false
+				};
+			}
+		});
+	}
+	/** Lease and deliver due rows; returns what happened to each leased row. */
+	async dispatchDue(options = {}) {
+		const limit = Math.min(options.limit ?? DEFAULT_LIMIT$1, MAX_LIMIT$1);
+		if (!Number.isInteger(limit) || limit < 1) throw new Error("Notification dispatch limit must be a positive integer.");
+		const candidates = await this.findDue(options.tenantIds, limit);
+		const report = {
+			leased: 0,
+			outcomes: []
+		};
+		for (const candidate of candidates) {
+			if (report.leased >= limit) break;
+			const outcome = await withTenant({ tenantId: candidate.tenantId }, () => this.dispatchOne(candidate));
+			if (!outcome) continue;
+			report.leased += 1;
+			report.outcomes.push({
+				deliveryId: candidate.id,
+				tenantId: candidate.tenantId,
+				outcome
+			});
+		}
+		return report;
+	}
+	/** Deliveries waiting for a reconciliation decision, oldest first. */
+	async listUncertain(options) {
+		const tenantId = requireText$1(options.tenantId, "tenant");
+		this.authorize(tenantId);
+		return withTenant({ tenantId }, async () => (await this.collection()).list({
+			where: {
+				tenantId,
+				status: "uncertain"
+			},
+			orderBy: "handedOffAt ASC",
+			limit: Math.min(options.limit ?? DEFAULT_LIMIT$1, MAX_LIMIT$1)
+		}));
+	}
+	/**
+	* Settle an `uncertain` delivery after checking the provider out of band:
+	* `sent` (it arrived), `failed` (give up), or `retry` (send again,
+	* accepting the risk of a duplicate; a message left claimed by a dead
+	* sender is released first). Returns false when the row is not uncertain
+	* any more, or for `retry` when the message is recorded as sent.
+	*/
+	async reconcile(input) {
+		const tenantId = requireText$1(input.tenantId, "tenant");
+		this.authorize(tenantId);
+		if (!UUID_PATTERN$1.test(input.deliveryId ?? "")) return false;
+		return withTenant({ tenantId }, async () => {
+			const delivery = (await (await this.collection()).list({
+				where: {
+					tenantId,
+					id: input.deliveryId
+				},
+				limit: 1
+			}))[0];
+			if (delivery?.status !== "uncertain") return false;
+			const note = input.note?.trim();
+			const now = this.now();
+			switch (input.outcome) {
+				case "sent": return delivery.transition({
+					status: "sent",
+					deliveredAt: now,
+					...note ? { lastError: note } : {}
+				});
+				case "failed": return delivery.transition({
+					status: "failed",
+					lastError: note || delivery.lastError
+				});
+				case "retry": {
+					const message = delivery.messageId ? await this.loadMessage(delivery.messageId) : null;
+					if (message?.sendStatus === "sent") return false;
+					if (message?.sendStatus === "sending" && !await message.abandonSendAttempt(note || "Released for an operator-approved retry.")) return false;
+					return delivery.transition({
+						status: "pending",
+						nextAttemptAt: now,
+						handedOffAt: null,
+						attempts: Math.min(delivery.attempts, delivery.maxAttempts - 1),
+						...note ? { lastError: note } : {}
+					});
+				}
+				default: throw new Error(`Unknown reconcile outcome '${input.outcome}'.`);
+			}
+		});
+	}
+	async requireSenderAccount(tenantId) {
+		const accountId = (await this.options.resolveSenderAccountId({ tenantId }))?.trim();
+		const account = accountId ? await (await AccountCollection.create({ db: this.options.db })).get({ id: accountId }) : null;
+		if (!account || !(account instanceof EmailAccount) || account.tenantId !== tenantId || !account.isActive) throw new NotificationOutboxDeniedError("sender", "No active email sender account is configured for this tenant.");
+		return account.id;
+	}
+	async isSuppressed(request) {
+		return Boolean(await this.options.isSuppressed?.(request));
+	}
+	async findDue(tenantIds, limit) {
+		const now = this.now();
+		const read = async (tenantFilter) => {
+			const deliveries = await this.collection();
+			const [due, expired] = await Promise.all([deliveries.list({
+				where: {
+					...tenantFilter,
+					status: "pending",
+					"nextAttemptAt <=": now
+				},
+				orderBy: "nextAttemptAt ASC",
+				limit
+			}), deliveries.list({
+				where: {
+					...tenantFilter,
+					status: "sending",
+					"leaseExpiresAt <=": now
+				},
+				orderBy: "leaseExpiresAt ASC",
+				limit
+			})]);
+			return [...expired, ...due];
+		};
+		return (tenantIds === void 0 ? await withSystemContext(() => read({})) : (await Promise.all([...new Set(tenantIds.filter(Boolean))].map((tenantId) => withTenant({ tenantId }, () => read({ tenantId }))))).flat()).slice(0, limit * 2);
+	}
+	/** Lease one candidate and carry it to an outcome; null when not leased. */
+	async dispatchOne(candidate) {
+		const delivery = (await (await this.collection()).list({
+			where: {
+				tenantId: candidate.tenantId,
+				id: candidate.id
+			},
+			limit: 1
+		}))[0];
+		if (!delivery) return null;
+		const now = this.now();
+		const recovering = delivery.status === "sending" && delivery.leaseExpiresAt !== null && delivery.leaseExpiresAt.getTime() <= now.getTime();
+		const due = delivery.status === "pending" && delivery.nextAttemptAt.getTime() <= now.getTime();
+		if (!recovering && !due) return null;
+		const leaseToken = crypto.randomUUID();
+		const leaseExpiresAt = new Date(now.getTime() + this.leaseMs);
+		const priorHandoff = recovering && delivery.handedOffAt !== null;
+		if (!await delivery.transition({
+			status: "sending",
+			leaseToken,
+			leaseExpiresAt,
+			attempts: priorHandoff ? delivery.attempts : delivery.attempts + 1,
+			...priorHandoff ? {} : { handedOffAt: null }
+		})) return null;
+		try {
+			if (priorHandoff) {
+				const resolved = await this.recoverHandoff(delivery, leaseToken);
+				if (resolved) return resolved;
+			}
+			if (await this.isSuppressed({
+				tenantId: delivery.tenantId,
+				recipientUserId: delivery.recipientUserId,
+				channel: delivery.channel,
+				kind: delivery.kind,
+				sourceRef: delivery.sourceRef
+			})) return this.settle(delivery, leaseToken, {
+				status: "cancelled",
+				lastError: "Suppressed by recipient preference."
+			});
+			const message = await this.ensureMessage(delivery, leaseToken);
+			if (!message) return "lease-lost";
+			if (!await delivery.transition({ handedOffAt: this.now() }, { leaseToken })) return "lease-lost";
+			let outcome;
+			try {
+				outcome = await this.transport.send({
+					delivery,
+					message,
+					idempotencyKey: notificationDeliveryCorrelationId(delivery.id)
+				});
+			} catch (error) {
+				outcome = {
+					status: "unknown",
+					error: errorText(error)
+				};
+			}
+			return this.applyOutcome(delivery, leaseToken, outcome);
+		} catch (error) {
+			if (delivery.handedOffAt !== null) throw error;
+			return this.applyOutcome(delivery, leaseToken, {
+				status: "rejected",
+				error: errorText(error),
+				retryable: true
+			});
+		}
+	}
+	async recoverHandoff(delivery, leaseToken) {
+		const message = delivery.messageId ? await this.loadMessage(delivery.messageId) : null;
+		let known = {
+			status: "unknown",
+			error: "Lease lapsed after the provider handoff; outcome unknown."
+		};
+		if (message && this.transport.reconcile) try {
+			known = await this.transport.reconcile({
+				delivery,
+				message,
+				idempotencyKey: notificationDeliveryCorrelationId(delivery.id)
+			});
+		} catch (error) {
+			known = {
+				status: "unknown",
+				error: errorText(error)
+			};
+		}
+		if (known.status === "not-sent") {
+			if (!await delivery.transition({
+				handedOffAt: null,
+				attempts: delivery.attempts + 1
+			}, { leaseToken })) return "lease-lost";
+			return null;
+		}
+		if (known.status === "unknown" && this.transport.idempotent) {
+			if (!await delivery.transition({
+				handedOffAt: null,
+				attempts: delivery.attempts + 1
+			}, { leaseToken })) return "lease-lost";
+			return null;
+		}
+		return this.applyOutcome(delivery, leaseToken, known);
+	}
+	async applyOutcome(delivery, leaseToken, outcome) {
+		if (outcome.status === "accepted") return this.settle(delivery, leaseToken, {
+			status: "sent",
+			deliveredAt: this.now(),
+			providerMessageId: outcome.providerMessageId ?? "",
+			lastError: ""
+		});
+		if (outcome.status === "unknown") {
+			if (this.transport.idempotent && delivery.attempts < delivery.maxAttempts) return this.scheduleRetry(delivery, leaseToken, outcome.error);
+			return this.settle(delivery, leaseToken, {
+				status: "uncertain",
+				lastError: outcome.error
+			});
+		}
+		if (outcome.retryable && delivery.attempts < delivery.maxAttempts) return this.scheduleRetry(delivery, leaseToken, outcome.error);
+		return this.settle(delivery, leaseToken, {
+			status: "failed",
+			lastError: outcome.error
+		});
+	}
+	async scheduleRetry(delivery, leaseToken, error) {
+		const delay = this.retryDelayMs(delivery.attempts);
+		return await this.endLease(delivery, leaseToken, {
+			status: "pending",
+			nextAttemptAt: new Date(this.now().getTime() + Math.max(0, delay)),
+			handedOffAt: null,
+			lastError: error
+		}) ? "retry-scheduled" : "lease-lost";
+	}
+	/** End the lease in a terminal status; reports lease loss instead of overwriting. */
+	async settle(delivery, leaseToken, changes) {
+		return await this.endLease(delivery, leaseToken, changes) ? changes.status : "lease-lost";
+	}
+	endLease(delivery, leaseToken, changes) {
+		return delivery.transition({
+			...changes,
+			leaseToken: null,
+			leaseExpiresAt: null
+		}, { leaseToken });
+	}
+	async loadMessage(messageId) {
+		return await (await MessageCollection.create({ db: this.options.db })).get({ id: messageId }) ?? null;
+	}
+	/**
+	* The delivery's single outbound `Email`, created under the lease. Its id
+	* is derived from the delivery id and inserted insert-only, so a stale
+	* dispatcher that resumes after its lease was taken over hits the stored
+	* row (a unique violation) instead of creating a second email.
+	*/
+	async ensureMessage(delivery, leaseToken) {
+		if (delivery.messageId) {
+			const message2 = await this.loadMessage(delivery.messageId);
+			if (message2) return message2;
+		}
+		const messageId = await notificationDeliveryMessageId(delivery.id);
+		let message = await this.loadMessage(messageId);
+		if (!message) {
+			const body = `${delivery.textBody}
+
+${delivery.href}
+`;
+			const emails = await EmailCollection.create({ db: this.options.db });
+			try {
+				await emails.create({
+					_insertOnly: true,
+					id: messageId,
+					tenantId: delivery.tenantId,
+					accountId: delivery.accountId,
+					correlationId: notificationDeliveryCorrelationId(delivery.id),
+					subject: delivery.subject,
+					body,
+					textBody: body,
+					toAddresses: JSON.stringify([{
+						address: delivery.recipientAddress,
+						...delivery.recipientName ? { name: delivery.recipientName } : {}
+					}]),
+					sendStatus: "pending",
+					maxRetries: 0
+				});
+			} catch (error) {
+				if (!isUniqueViolationError(error)) throw error;
+			}
+			message = await this.loadMessage(messageId);
+			if (!message) throw new Error("The outbound email could not be stored.");
+		}
+		if (delivery.messageId !== message.id) {
+			if (!await delivery.transition({ messageId: message.id }, { leaseToken })) return null;
+		}
+		return message;
+	}
+};
+//#endregion
 //#region src/services/PersonaMessagingService.ts
 var PersonaMessagingService = class {
 	constructor(options) {
@@ -2759,6 +3501,6 @@ var SlackRecipe = class extends SmrtRecipe {
 ensureBuiltinMessagingProvidersRegistered();
 ensureMessagingPermissionsRegistered();
 //#endregion
-export { Account, AccountCollection, Attachment, AttachmentCollection, Blacklist, BlacklistCollection, Email, EmailAccount, EmailAccountCollection, EmailAttachment, EmailAttachmentCollection, EmailCollection, EmailFolder, EmailFolderCollection, EmailSender, MANAGE_MESSAGE_CREDENTIALS_PERMISSION, MANAGE_MESSAGE_ROUTES_PERMISSION, MESSAGING_PERMISSION_DEFINITIONS, MailboxRecipe, Message, MessageCollection, MessagingEndpoint, MessagingEndpointCollection, MessagingSettingsService, NotificationsRecipe, PersonaMessageRoute, PersonaMessageRouteCollection, PersonaMessagingService, SEND_MESSAGES_PERMISSION, SlackAccount, SlackMessage, SlackRecipe, SlackSender, TelegramAccount, TelegramSender, Tweet, TweetSender, TwitterAccount, USER_NOTIFICATION_SEVERITIES, UserNotification, UserNotificationCollection, UserNotificationService, Whitelist, WhitelistCollection, ZulipAccount, ZulipSender, AttachmentCollection_exports as a, assertMessagingPermission, ensureBuiltinMessagingProvidersRegistered, ensureMessagingPermissionsRegistered, getMessagingProvider, MessagingEndpointCollection_exports as i, listMessagingProviders, messagingPrincipalFromPermissions, EmailCollection_exports as n, EmailAccountCollection_exports as r, registerMessagingProvider, EmailFolderCollection_exports as t };
+export { Account, AccountCollection, Attachment, AttachmentCollection, Blacklist, BlacklistCollection, Email, EmailAccount, EmailAccountCollection, EmailAttachment, EmailAttachmentCollection, EmailCollection, EmailFolder, EmailFolderCollection, EmailSender, MANAGE_MESSAGE_CREDENTIALS_PERMISSION, MANAGE_MESSAGE_ROUTES_PERMISSION, MESSAGING_PERMISSION_DEFINITIONS, MailboxRecipe, Message, MessageCollection, MessagingEndpoint, MessagingEndpointCollection, MessagingSettingsService, NOTIFICATION_DELIVERY_CHANNELS, NotificationDelivery, NotificationDeliveryCollection, NotificationOutboxDeniedError, NotificationOutboxService, NotificationsRecipe, PersonaMessageRoute, PersonaMessageRouteCollection, PersonaMessagingService, SEND_MESSAGES_PERMISSION, SlackAccount, SlackMessage, SlackRecipe, SlackSender, TelegramAccount, TelegramSender, Tweet, TweetSender, TwitterAccount, USER_NOTIFICATION_SEVERITIES, UserNotification, UserNotificationCollection, UserNotificationService, Whitelist, WhitelistCollection, ZulipAccount, ZulipSender, AttachmentCollection_exports as a, assertMessagingPermission, buildNotificationLink, ensureBuiltinMessagingProvidersRegistered, ensureMessagingPermissionsRegistered, getMessagingProvider, MessagingEndpointCollection_exports as i, listMessagingProviders, messageSendTransport, messagingPrincipalFromPermissions, EmailCollection_exports as n, notificationDeliveryCorrelationId, notificationDeliveryMessageId, EmailAccountCollection_exports as r, registerMessagingProvider, EmailFolderCollection_exports as t };
 
 //# sourceMappingURL=index.js.map