@lunora/notify 1.0.0-alpha.3 → 1.0.0-alpha.5

package/README.md

@@ -98,6 +98,35 @@ for (const message of batch.messages) await runPushBroadcastJob(ctx.push, messag
 
 `SubscriptionStore` implementations: `memorySubscriptionStore()` (non-durable default, tests/dev) and `d1SubscriptionStore(db)` (durable, edge-safe, lazy table creation). Lifecycle: register (upsert), list/filter (by kind or user), status marking, and automatic prune of gone subscriptions on send/broadcast.
 
+## Security
+
+`ctx.push.register(...)` and the browser `subscribeToPush` helper both accept
+client-supplied data, so the facade enforces two boundaries:
+
+- **Endpoint validation (anti-SSRF).** Every later `send`/`broadcast` POSTs to a
+  subscription's stored Web Push `endpoint`, so a hostile `endpoint` would turn the
+  worker into an SSRF / amplification primitive. `register()` validates the endpoint
+  **at storage time** (the durable boundary): it must be an absolute `https:` URL
+  with a non-private / non-loopback / non-link-local / non-CGNAT host. To hard-pin
+  the boundary to the push services you actually use, set `allowedPushOrigins` on
+  `defineNotify` — when present, an endpoint's origin must match one of the listed
+  origins **exactly** (no wildcards), which also closes DNS rebinding:
+
+    ```ts
+    export default defineNotify({
+        webPush: (env) => webPushFromEnv(env),
+        allowedPushOrigins: ["https://fcm.googleapis.com", "https://updates.push.services.mozilla.com"],
+        store: (env) => d1SubscriptionStore(env.DB),
+    });
+    ```
+
+- **No secrets on the app facade.** `ctx.push.list()`
+  returns the registered devices with the delivery **secrets stripped** — the Web
+  Push `keys` (`auth`/`p256dh`) and the FCM `token`, which together with the
+  endpoint are enough to deliver arbitrary push to a device. The raw rows are
+  reachable only through the internal `SubscriptionStore` (which handlers never
+  hold); the broadcast path uses the store directly.
+
 ## Delivery observability
 
 Every send is counted onto `ctx.metrics` and failures onto `ctx.log` for you — codegen threads the request's logger/metrics into `ctx.notify` (`createNotify(notifyConfig, env, { log, metrics })`), so there is nothing to wire. Two low-cardinality metric series feed the durable metric history + trend charts:

package/dist/index.d.mts

@@ -77,6 +77,14 @@ type RegisterInput = {
 interface SubscriptionFilter {
   /** Restrict to a delivery kind. */
   kind?: SubscriptionKind;
+  /**
+   * Cap the number of rows returned (a `LIMIT`). Applied server-side by the
+   * store, so a large audience never materializes wholesale in the isolate.
+   * A non-positive/absent value means "no cap"; a fractional value is truncated.
+   * `broadcast` deliberately leaves this unset (it must reach every matched
+   * device); admin/list reads set it to bound the page.
+   */
+  limit?: number;
   /** Restrict to a single owning user. */
   userId?: string | null;
 }
@@ -175,8 +183,14 @@ interface LunoraPush {
    * target is derived from each subscription, so it is omitted from the payload.
    */
   broadcast: (payload: PushContent, filter?: SubscriptionFilter) => Promise<BroadcastResult>;
-  /** List stored subscriptions (optionally filtered). */
-  list: (filter?: SubscriptionFilter) => Promise<StoredSubscription[]>;
+  /**
+   * List stored subscriptions (optionally filtered), with the delivery
+   * **secrets** stripped — the Web Push `keys` (RFC 8291 `auth`/`p256dh`) and the
+   * FCM `token`. Those, plus the endpoint, are enough to deliver arbitrary push to
+   * a device, so they never cross the app-facing facade; the raw rows are
+   * reachable only through the internal `SubscriptionStore`.
+   */
+  list: (filter?: SubscriptionFilter) => Promise<PushSubscriptionDevice[]>;
   /** Register (upsert) a device subscription and return the stored record. */
   register: (input: RegisterInput) => Promise<StoredSubscription>;
   /** Send a push to a single stored subscription (by id or record); `to` is derived from it. */
@@ -213,6 +227,22 @@ type WebPushConfigFactory = (env: NotifyEnv) => WebPushConfig | undefined;
 type FcmConfigFactory = (env: NotifyEnv) => FcmConfig | undefined;
 /** Options accepted by `defineNotify`. */
 interface NotifyConfig {
+  /**
+   * Exact origins (`https://host[:port]`) a client-supplied Web Push `endpoint`
+   * may register from. When set (non-empty), `register()` requires the endpoint's
+   * origin to be one of these — the strongest anti-SSRF posture, and the way to
+   * close DNS rebinding for a facade that accepts client-controlled endpoints.
+   *
+   * When unset, the default posture applies: an endpoint must be `https:` with a
+   * host a STRING classifier does not flag as private / loopback / link-local.
+   * That classifier does NOT resolve DNS, so a public hostname resolving to a
+   * private/internal IP (e.g. `https://127.0.0.1.nip.io/…`) is NOT blocked by it
+   * — `register()` also emits a one-shot dev warning in this case. Set this to the
+   * push services your app actually uses (e.g. `["https://fcm.googleapis.com",
+   * "https://updates.push.services.mozilla.com"]` — exact origins only, no
+   * wildcards) to hard-pin the boundary and close DNS rebinding.
+   */
+  allowedPushOrigins?: string[];
   /**
    * Optional chat provider factory (Slack/Discord/Teams/Telegram). Wire with a
    * provider from `@visulima/notification/providers/*`. Edge-safe (fetch-based).
@@ -410,8 +440,20 @@ declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBro
  * Run an enqueued broadcast job on the consumer side, delivering through the push
  * facade (which reuses the engine's retry + circuit-breaker middleware and prunes
  * gone subscriptions).
+ *
+ * RETRY SEMANTICS: retry is gated on `failed` — the count of TRANSIENT delivery
+ * errors (a provider 5xx / network fault worth another attempt). When at least one
+ * recipient `failed`, the job is RE-THROWN so the queue does NOT ack it and its
+ * normal retry/backoff (and, on exhaustion, dead-letter) applies. A broadcast with
+ * zero `failed` resolves and is acked — this includes the all-`pruned` case (every
+ * device had unsubscribed: `sent:0`, `failed:0`, `pruned:N`), which is a SUCCESSFUL
+ * prune, not a failure, so throwing on it would spuriously retry and pressure the
+ * DLQ; and the empty audience (zero `total`), which has nothing to retry. Note a
+ * retry re-runs the WHOLE broadcast, re-sending to the already-delivered recipients
+ * (broadcast is not idempotent) — the accepted cost of getting the transiently
+ * failed ones redelivered.
  */
-declare const runPushBroadcastJob: (push: LunoraPush, job: PushBroadcastJob) => Promise<unknown>;
+declare const runPushBroadcastJob: (push: LunoraPush, job: PushBroadcastJob) => Promise<BroadcastResult>;
 /**
  * The minimal structural slice of Cloudflare's `D1Database` this store uses. A
  * structural type (rather than importing `@cloudflare/workers-types`) keeps the
@@ -438,6 +480,15 @@ interface D1StoreOptions {
  * backing table is created lazily on first use (`CREATE TABLE IF NOT EXISTS`), so
  * no migration step is required for the subscription table itself.
  *
+ * ID SCHEME / LAZY MIGRATION: `id` (the `PRIMARY KEY`, upserted via `ON
+ * CONFLICT(id) DO UPDATE`) is a version-prefixed digest of the endpoint/token —
+ * currently `wp2_`/`fcm2_` (64-bit FNV-1a; see `normalize.ts`). No table migration
+ * runs when the id scheme is revised: a returning device re-registers under its new
+ * id and upserts a fresh row, while its old-prefix row (`wp_`/`fcm_`) ages out via
+ * the normal gone-pruning on the next failed send. So a table can transiently hold
+ * both an old- and new-prefix row for one device — expected, self-healing, and the
+ * reason a prefix must NEVER be reused for a different scheme.
+ *
  * ```ts
  * export default defineNotify({
  *     webPush: (env) => webPushFromEnv(env),
@@ -453,16 +504,41 @@ declare const d1SubscriptionStore: (database: D1Like, options?: D1StoreOptions)
  * (or another backing store) for production so subscriptions survive restarts.
  */
 declare const memorySubscriptionStore: () => SubscriptionStore;
-/** Stable store id for a web-push endpoint. */
+/**
+ * Stable store id for a web-push endpoint.
+ *
+ * The `wp2_` prefix is a version tag (see also {@link fcmId}'s `fcm2_`): it marks
+ * the 64-bit-id revision so the pre-existing 32-bit `wp_` rows stay readable and a
+ * returning device simply re-registers under the new id, its stale `wp_` row aging
+ * out via normal gone-pruning. A future third revision must mint `wp3_` and repeat
+ * the lazy migration — NEVER reuse a prefix.
+ */
 declare const webPushId: (endpoint: string) => string;
-/** Stable store id for an FCM device token. */
+/** Stable store id for an FCM device token. See {@link webPushId} for the `_2` version-prefix contract. */
 declare const fcmId: (token: string) => string;
+/** Options threaded into {@link normalizeRegisterInput} from the notify definition. */
+interface NormalizeOptions {
+  /**
+   * Exact origins (`https://host[:port]`) a web-push endpoint may register from.
+   * When set (non-empty), the endpoint's origin must be one of these — the
+   * strongest anti-SSRF posture, and the ONLY way to close DNS rebinding for a
+   * facade that accepts client-controlled endpoints.
+   *
+   * When unset, the default posture applies: `https:` scheme + a host the
+   * {@link assertPushEndpoint} STRING classifier does not flag as
+   * private/loopback. That classifier does NOT resolve DNS, so a public hostname
+   * resolving to a private/internal IP (e.g. `https://127.0.0.1.nip.io/…`) is NOT
+   * blocked by it — set this allowlist to close that gap.
+   */
+  allowedPushOrigins?: string[];
+}
 /**
  * Normalise a `register(...)` input into a {@link StoredSubscription}. Validates
  * the shape (a web-push subscription needs `endpoint` + `keys.{p256dh,auth}`; an
- * FCM entry needs a non-empty `token`) and stamps `createdAt`/`lastSeenAt`.
+ * FCM entry needs a non-empty `token`), enforces the anti-SSRF endpoint boundary
+ * (see {@link assertPushEndpoint}), and stamps `createdAt`/`lastSeenAt`.
  */
-declare const normalizeRegisterInput: (input: RegisterInput, now?: number) => StoredSubscription;
+declare const normalizeRegisterInput: (input: RegisterInput, now?: number, options?: NormalizeOptions) => StoredSubscription;
 /**
  * The provider `to` target for a stored subscription: the W3C Push subscription
  * (JSON-stringified) for web-push, or the raw device token for FCM. Matches the

package/dist/index.d.ts

@@ -77,6 +77,14 @@ type RegisterInput = {
 interface SubscriptionFilter {
   /** Restrict to a delivery kind. */
   kind?: SubscriptionKind;
+  /**
+   * Cap the number of rows returned (a `LIMIT`). Applied server-side by the
+   * store, so a large audience never materializes wholesale in the isolate.
+   * A non-positive/absent value means "no cap"; a fractional value is truncated.
+   * `broadcast` deliberately leaves this unset (it must reach every matched
+   * device); admin/list reads set it to bound the page.
+   */
+  limit?: number;
   /** Restrict to a single owning user. */
   userId?: string | null;
 }
@@ -175,8 +183,14 @@ interface LunoraPush {
    * target is derived from each subscription, so it is omitted from the payload.
    */
   broadcast: (payload: PushContent, filter?: SubscriptionFilter) => Promise<BroadcastResult>;
-  /** List stored subscriptions (optionally filtered). */
-  list: (filter?: SubscriptionFilter) => Promise<StoredSubscription[]>;
+  /**
+   * List stored subscriptions (optionally filtered), with the delivery
+   * **secrets** stripped — the Web Push `keys` (RFC 8291 `auth`/`p256dh`) and the
+   * FCM `token`. Those, plus the endpoint, are enough to deliver arbitrary push to
+   * a device, so they never cross the app-facing facade; the raw rows are
+   * reachable only through the internal `SubscriptionStore`.
+   */
+  list: (filter?: SubscriptionFilter) => Promise<PushSubscriptionDevice[]>;
   /** Register (upsert) a device subscription and return the stored record. */
   register: (input: RegisterInput) => Promise<StoredSubscription>;
   /** Send a push to a single stored subscription (by id or record); `to` is derived from it. */
@@ -213,6 +227,22 @@ type WebPushConfigFactory = (env: NotifyEnv) => WebPushConfig | undefined;
 type FcmConfigFactory = (env: NotifyEnv) => FcmConfig | undefined;
 /** Options accepted by `defineNotify`. */
 interface NotifyConfig {
+  /**
+   * Exact origins (`https://host[:port]`) a client-supplied Web Push `endpoint`
+   * may register from. When set (non-empty), `register()` requires the endpoint's
+   * origin to be one of these — the strongest anti-SSRF posture, and the way to
+   * close DNS rebinding for a facade that accepts client-controlled endpoints.
+   *
+   * When unset, the default posture applies: an endpoint must be `https:` with a
+   * host a STRING classifier does not flag as private / loopback / link-local.
+   * That classifier does NOT resolve DNS, so a public hostname resolving to a
+   * private/internal IP (e.g. `https://127.0.0.1.nip.io/…`) is NOT blocked by it
+   * — `register()` also emits a one-shot dev warning in this case. Set this to the
+   * push services your app actually uses (e.g. `["https://fcm.googleapis.com",
+   * "https://updates.push.services.mozilla.com"]` — exact origins only, no
+   * wildcards) to hard-pin the boundary and close DNS rebinding.
+   */
+  allowedPushOrigins?: string[];
   /**
    * Optional chat provider factory (Slack/Discord/Teams/Telegram). Wire with a
    * provider from `@visulima/notification/providers/*`. Edge-safe (fetch-based).
@@ -410,8 +440,20 @@ declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBro
  * Run an enqueued broadcast job on the consumer side, delivering through the push
  * facade (which reuses the engine's retry + circuit-breaker middleware and prunes
  * gone subscriptions).
+ *
+ * RETRY SEMANTICS: retry is gated on `failed` — the count of TRANSIENT delivery
+ * errors (a provider 5xx / network fault worth another attempt). When at least one
+ * recipient `failed`, the job is RE-THROWN so the queue does NOT ack it and its
+ * normal retry/backoff (and, on exhaustion, dead-letter) applies. A broadcast with
+ * zero `failed` resolves and is acked — this includes the all-`pruned` case (every
+ * device had unsubscribed: `sent:0`, `failed:0`, `pruned:N`), which is a SUCCESSFUL
+ * prune, not a failure, so throwing on it would spuriously retry and pressure the
+ * DLQ; and the empty audience (zero `total`), which has nothing to retry. Note a
+ * retry re-runs the WHOLE broadcast, re-sending to the already-delivered recipients
+ * (broadcast is not idempotent) — the accepted cost of getting the transiently
+ * failed ones redelivered.
  */
-declare const runPushBroadcastJob: (push: LunoraPush, job: PushBroadcastJob) => Promise<unknown>;
+declare const runPushBroadcastJob: (push: LunoraPush, job: PushBroadcastJob) => Promise<BroadcastResult>;
 /**
  * The minimal structural slice of Cloudflare's `D1Database` this store uses. A
  * structural type (rather than importing `@cloudflare/workers-types`) keeps the
@@ -438,6 +480,15 @@ interface D1StoreOptions {
  * backing table is created lazily on first use (`CREATE TABLE IF NOT EXISTS`), so
  * no migration step is required for the subscription table itself.
  *
+ * ID SCHEME / LAZY MIGRATION: `id` (the `PRIMARY KEY`, upserted via `ON
+ * CONFLICT(id) DO UPDATE`) is a version-prefixed digest of the endpoint/token —
+ * currently `wp2_`/`fcm2_` (64-bit FNV-1a; see `normalize.ts`). No table migration
+ * runs when the id scheme is revised: a returning device re-registers under its new
+ * id and upserts a fresh row, while its old-prefix row (`wp_`/`fcm_`) ages out via
+ * the normal gone-pruning on the next failed send. So a table can transiently hold
+ * both an old- and new-prefix row for one device — expected, self-healing, and the
+ * reason a prefix must NEVER be reused for a different scheme.
+ *
  * ```ts
  * export default defineNotify({
  *     webPush: (env) => webPushFromEnv(env),
@@ -453,16 +504,41 @@ declare const d1SubscriptionStore: (database: D1Like, options?: D1StoreOptions)
  * (or another backing store) for production so subscriptions survive restarts.
  */
 declare const memorySubscriptionStore: () => SubscriptionStore;
-/** Stable store id for a web-push endpoint. */
+/**
+ * Stable store id for a web-push endpoint.
+ *
+ * The `wp2_` prefix is a version tag (see also {@link fcmId}'s `fcm2_`): it marks
+ * the 64-bit-id revision so the pre-existing 32-bit `wp_` rows stay readable and a
+ * returning device simply re-registers under the new id, its stale `wp_` row aging
+ * out via normal gone-pruning. A future third revision must mint `wp3_` and repeat
+ * the lazy migration — NEVER reuse a prefix.
+ */
 declare const webPushId: (endpoint: string) => string;
-/** Stable store id for an FCM device token. */
+/** Stable store id for an FCM device token. See {@link webPushId} for the `_2` version-prefix contract. */
 declare const fcmId: (token: string) => string;
+/** Options threaded into {@link normalizeRegisterInput} from the notify definition. */
+interface NormalizeOptions {
+  /**
+   * Exact origins (`https://host[:port]`) a web-push endpoint may register from.
+   * When set (non-empty), the endpoint's origin must be one of these — the
+   * strongest anti-SSRF posture, and the ONLY way to close DNS rebinding for a
+   * facade that accepts client-controlled endpoints.
+   *
+   * When unset, the default posture applies: `https:` scheme + a host the
+   * {@link assertPushEndpoint} STRING classifier does not flag as
+   * private/loopback. That classifier does NOT resolve DNS, so a public hostname
+   * resolving to a private/internal IP (e.g. `https://127.0.0.1.nip.io/…`) is NOT
+   * blocked by it — set this allowlist to close that gap.
+   */
+  allowedPushOrigins?: string[];
+}
 /**
  * Normalise a `register(...)` input into a {@link StoredSubscription}. Validates
  * the shape (a web-push subscription needs `endpoint` + `keys.{p256dh,auth}`; an
- * FCM entry needs a non-empty `token`) and stamps `createdAt`/`lastSeenAt`.
+ * FCM entry needs a non-empty `token`), enforces the anti-SSRF endpoint boundary
+ * (see {@link assertPushEndpoint}), and stamps `createdAt`/`lastSeenAt`.
  */
-declare const normalizeRegisterInput: (input: RegisterInput, now?: number) => StoredSubscription;
+declare const normalizeRegisterInput: (input: RegisterInput, now?: number, options?: NormalizeOptions) => StoredSubscription;
 /**
  * The provider `to` target for a stored subscription: the W3C Push subscription
  * (JSON-stringified) for web-push, or the raw device token for FCM. Matches the

package/dist/index.mjs

@@ -1,8 +1 @@
-export { FCM_ENV_KEYS, WEB_PUSH_ENV_KEYS, fcmFromEnv, webPushFromEnv } from './packem_shared/FCM_ENV_KEYS-DY4-A717.mjs';
-export { defineNotify, isNotifyDefinition } from './packem_shared/defineNotify-B6S_47C2.mjs';
-export { createNotify } from './packem_shared/createNotify-bDWs4qBm.mjs';
-export { buildEngine, routingPushProvider } from './packem_shared/buildEngine-DlmjvnNk.mjs';
-export { enqueuePushBroadcast, runPushBroadcastJob } from './packem_shared/enqueuePushBroadcast-DiK7Hyja.mjs';
-export { d1SubscriptionStore } from './packem_shared/d1SubscriptionStore-Dv3VPMI_.mjs';
-export { memorySubscriptionStore } from './packem_shared/memorySubscriptionStore-DhS-YnLe.mjs';
-export { fcmId, isGoneError, normalizeRegisterInput, targetOf, webPushId } from './packem_shared/fcmId-B-YPgHi7.mjs';
+import{FCM_ENV_KEYS as e,WEB_PUSH_ENV_KEYS as t,fcmFromEnv as i,webPushFromEnv as f}from"./packem_shared/FCM_ENV_KEYS-D0tvRTLQ.mjs";import{defineNotify as n,isNotifyDefinition as u}from"./packem_shared/defineNotify-DLEy53HJ.mjs";import{createNotify as p}from"./packem_shared/createNotify-iBbs9Bew.mjs";import{buildEngine as d,routingPushProvider as x}from"./packem_shared/buildEngine-Jlzf2Jzn.mjs";import{enqueuePushBroadcast as c,runPushBroadcastJob as P}from"./packem_shared/enqueuePushBroadcast-DMwYIM0o.mjs";import{d1SubscriptionStore as b}from"./packem_shared/d1SubscriptionStore-BwssRgeI.mjs";import{memorySubscriptionStore as N}from"./packem_shared/memorySubscriptionStore-BxKdyxjC.mjs";import{fcmId as g,isGoneError as y,normalizeRegisterInput as v,targetOf as B,webPushId as F}from"./packem_shared/fcmId-CLRyQJVw.mjs";export{e as FCM_ENV_KEYS,t as WEB_PUSH_ENV_KEYS,d as buildEngine,p as createNotify,b as d1SubscriptionStore,n as defineNotify,c as enqueuePushBroadcast,i as fcmFromEnv,g as fcmId,y as isGoneError,u as isNotifyDefinition,N as memorySubscriptionStore,v as normalizeRegisterInput,x as routingPushProvider,P as runPushBroadcastJob,B as targetOf,f as webPushFromEnv,F as webPushId};

package/dist/packem_shared/FCM_ENV_KEYS-D0tvRTLQ.mjs

@@ -0,0 +1 @@
+const s={privateKey:"VAPID_PRIVATE_KEY",publicKey:"VAPID_PUBLIC_KEY",subject:"VAPID_SUBJECT"},v={accessToken:"FCM_ACCESS_TOKEN",projectId:"FCM_PROJECT_ID"},t=(c,o)=>{const e=c[o];return typeof e=="string"&&e!==""?e:void 0},E=(c,o)=>{const e=t(c,s.publicKey),i=t(c,s.privateKey),r=t(c,s.subject);if(!(e===void 0||i===void 0||r===void 0))return{vapidPrivateKey:i,vapidPublicKey:e,vapidSubject:r,...o}},_=(c,o)=>{const e=t(c,v.projectId);return e===void 0?void 0:{accessToken:t(c,v.accessToken),projectId:e,...o}};export{v as FCM_ENV_KEYS,s as WEB_PUSH_ENV_KEYS,_ as fcmFromEnv,E as webPushFromEnv};

package/dist/packem_shared/buildEngine-Jlzf2Jzn.mjs

@@ -0,0 +1 @@
+import{createNotification as s}from"@visulima/notification";import{retryMiddleware as a,circuitBreakerMiddleware as c}from"@visulima/notification/middleware";import{fcmProvider as u}from"@visulima/notification/providers/fcm";import{webPushProvider as d}from"@visulima/notification/providers/web-push";const i=e=>{if(typeof e!="string")return typeof e=="object"&&e!==null&&"endpoint"in e;if(!e.startsWith("{"))return!1;try{const t=JSON.parse(e);return typeof t.endpoint=="string"&&typeof t.keys=="object"}catch{return!1}},f=e=>{const t=o=>{const r=i(o)?e.webPush:e.fcm;if(r===void 0)throw new Error(i(o)?"@lunora/notify: received a web-push target but no `webPush` channel is configured":"@lunora/notify: received an FCM token target but no `fcm` channel is configured");return r};return{channel:"push",id:"lunora-push-router",initialize:async()=>{await e.webPush?.initialize(),await e.fcm?.initialize()},isAvailable:()=>(e.webPush??e.fcm)!==void 0,send:o=>{const r=Array.isArray(o.to)?o.to[0]:o.to;return t(r).send(o)}}},w=e=>{const t=e.webPush===void 0?void 0:d(e.webPush),o=e.fcm===void 0?void 0:u(e.fcm),r={};(t!==void 0||o!==void 0)&&(r.push=f({fcm:o,webPush:t})),e.chat!==void 0&&(r.chat=e.chat),e.inApp!==void 0&&(r.inapp=e.inApp),e.webhook!==void 0&&(r.webhook=e.webhook);const n=s(r);return n.use(a()).use(c()),n};export{w as buildEngine,f as routingPushProvider};

package/dist/packem_shared/createNotify-iBbs9Bew.mjs

@@ -0,0 +1 @@
+import{LunoraError as v}from"@lunora/errors";import{buildEngine as R}from"./buildEngine-Jlzf2Jzn.mjs";import{memorySubscriptionStore as x}from"./memorySubscriptionStore-BxKdyxjC.mjs";import{normalizeRegisterInput as C,targetOf as W,isGoneError as B}from"./fcmId-CLRyQJVw.mjs";const w=(t,s)=>typeof t=="function"?t(s):t,b=t=>t.successful?void 0:t.errorMessages.join("; "),L=(t,s)=>t.successful?"accepted":B(s)?"gone":"failed",_=async(t,s,l)=>{const a=Array.from({length:t.length});let f=0;const g=async()=>{for(;f<t.length;){const c=f;f+=1,a[c]=await l(t[c])}};return await Promise.all(Array.from({length:Math.min(s,t.length)},()=>g())),a},j=(t,s)=>({chat:w(t.chat,s),fcm:w(t.fcm,s),inApp:w(t.inApp,s),webhook:w(t.webhook,s),webPush:w(t.webPush,s)}),E=new WeakMap,Q=(t,s)=>{let l=E.get(t);l===void 0&&(l=new WeakMap,E.set(t,l));let a=l.get(s);return a===void 0&&(a={warnedNoPushOriginAllowlist:!1,warnedNoStore:!1},l.set(s,a)),a},F=(t,s,l={})=>{const a=Q(t,s);let f;l.engine===void 0?(a.engine??=R(j(t,s)),f=a.engine):f=l.engine,a.store??=t.store?.(s);let{store:g}=a;g===void 0&&(a.fallbackStore??=x(),!l.silent&&!a.warnedNoStore&&(a.warnedNoStore=!0,console.warn("@lunora/notify: no `store` configured — using a non-durable in-memory subscription store. Configure `store: (env) => d1SubscriptionStore(env.DB)` for production.")),g=a.fallbackStore);const c=g,T=Math.max(1,l.concurrency??10),{log:$,metrics:S}=l,y=(e,o,n,i=1)=>{S?.count("notify.send",i,{channel:e,provider:o??e,status:n})},m=(e,o,n)=>{$?.warn(`notify ${e} delivery failed`,{channel:e,provider:o??e,status:"failed",...n})},P=(e,o)=>{S?.count("notify.skipped",1,{channel:e,reason:o})},I=()=>{const e=t.allowedPushOrigins!==void 0&&t.allowedPushOrigins.length>0;l.silent||e||a.warnedNoPushOriginAllowlist||(a.warnedNoPushOriginAllowlist=!0,console.warn("@lunora/notify: Web Push registered without `allowedPushOrigins` — the endpoint host is validated by a string classifier that does NOT resolve DNS, so a public hostname resolving to a private/internal IP (e.g. `https://127.0.0.1.nip.io/…`) is NOT blocked. Set `allowedPushOrigins` to the exact push-service origins to close DNS rebinding."))},D=async e=>(await c.list(e)).map(({keys:o,token:n,...i})=>i),M=async e=>{if(typeof e!="string")return e;const o=await c.get(e);if(o===void 0)throw new v("BAD_REQUEST",`@lunora/notify: no registered subscription with id "${e}"`);return o},N=async(e,o,n)=>{let i,u,d;try{i=await f.sendToChannel("push",{...o,to:W(e)}),u=b(i),d=L(i,u)}catch(r){d="failed",u=r instanceof Error?r.message:String(r)}try{d==="accepted"?await c.markStatus(e.id,"ok"):d==="gone"?await c.delete(e.id):await c.markStatus(e.id,"failed",u)}catch{}return d==="failed"&&m("push",e.kind,{error:u,subscriptionId:e.id,userId:e.userId??null}),n&&y("push",e.kind,d),{error:u,receipt:i,status:d}},O={broadcast:async(e,o)=>{const n=await c.list(o);n.length===0&&P("push","no-subscriptions-matched");const i=await _(n,T,async r=>{const{error:p,status:h}=await N(r,e,!1);return{error:p,kind:r.kind,status:h,subscription:r}}),u=new Map;for(const{kind:r,status:p}of i){const h=`${r}\0${p}`,A=u.get(h);A===void 0?u.set(h,{count:1,kind:r,status:p}):A.count+=1}for(const{count:r,kind:p,status:h}of u.values())y("push",p,h,r);const d=i.map(({error:r,status:p,subscription:h})=>p==="accepted"?{id:h.id,status:"ok"}:p==="gone"?{error:r,id:h.id,status:"expired"}:{error:r,id:h.id,status:"failed"});return{failed:d.filter(r=>r.status==="failed").length,outcomes:d,pruned:d.filter(r=>r.status==="expired").length,sent:d.filter(r=>r.status==="ok").length,total:d.length}},list:e=>D(e),register:e=>("token"in e||I(),c.put(C(e,void 0,{allowedPushOrigins:t.allowedPushOrigins}))),send:async(e,o)=>{const{error:n,receipt:i}=await N(await M(e),o,!0);if(i===void 0)throw new v("INTERNAL",`@lunora/notify: push send failed: ${n??"unknown error"}`);return i},unregister:e=>c.delete(e)},k=async(e,o)=>{if(f.getProvider(e)===void 0)throw P(e,"channel-not-configured"),new v("BAD_REQUEST",`@lunora/notify: the "${e}" channel is not configured in defineNotify(...)`);const n=await f.sendToChannel(e,o),i=n.successful?"accepted":"failed";return y(e,n.provider,i),i==="failed"&&m(e,n.provider,{error:b(n)}),n};return{notify:{chat:e=>k("chat",e),inApp:e=>k("inapp",e),push:O,send:async e=>{const o=await f.send(e);for(const n of o){const i=n.channel??"unknown",u=n.successful?"accepted":"failed";y(i,n.provider,u),u==="failed"&&m(i,n.provider,{error:b(n)})}return o},webhook:e=>k("webhook",e)},push:O}};export{F as createNotify};

package/dist/packem_shared/d1SubscriptionStore-BwssRgeI.mjs

@@ -0,0 +1 @@
+import{LunoraError as _}from"@lunora/errors";import{legacyIdFor as h}from"./fcmId-CLRyQJVw.mjs";const o=a=>{const i={createdAt:a.created_at,id:a.id,kind:a.kind,lastSeenAt:a.last_seen_at,userId:a.user_id};if(a.endpoint!==null&&(i.endpoint=a.endpoint),a.p256dh!==null&&a.auth!==null&&(i.keys={auth:a.auth,p256dh:a.p256dh}),a.token!==null&&(i.token=a.token),a.last_status!==null&&(i.lastStatus=a.last_status),a.last_error!==null&&(i.lastError=a.last_error),a.metadata!==null)try{i.metadata=JSON.parse(a.metadata)}catch{}return i},S=/^[A-Za-z_]\w*$/u,I=(a,i={})=>{const r=i.tableName??"lunora_push_subscriptions";if(!S.test(r))throw new _("BAD_REQUEST",`@lunora/notify: d1SubscriptionStore tableName "${r}" is not a bare SQL identifier`);let s;const d=()=>(s===void 0&&(s=a.prepare(`CREATE TABLE IF NOT EXISTS ${r} (id TEXT PRIMARY KEY, kind TEXT NOT NULL, endpoint TEXT, p256dh TEXT, auth TEXT, token TEXT, user_id TEXT, metadata TEXT, created_at INTEGER NOT NULL, last_seen_at INTEGER NOT NULL, last_status TEXT, last_error TEXT)`).run().then(()=>a.prepare(`CREATE INDEX IF NOT EXISTS ${r}_user_id_idx ON ${r} (user_id)`).run()).then(()=>a.prepare(`CREATE INDEX IF NOT EXISTS ${r}_kind_idx ON ${r} (kind)`).run()).then(()=>{}),s.catch(()=>{s=void 0})),s),l=async t=>{await d();const n=await a.prepare(`SELECT * FROM ${r} WHERE id = ?1`).bind(t).first();return n===null?void 0:o(n)};return{delete:async t=>{await d(),await a.prepare(`DELETE FROM ${r} WHERE id = ?1`).bind(t).run()},get:l,list:async t=>{await d();const n=[],e=[];t?.kind!==void 0&&(e.push(t.kind),n.push(`kind = ?${e.length.toString()}`)),t?.userId!==void 0&&(t.userId===null?n.push("user_id IS NULL"):(e.push(t.userId),n.push(`user_id = ?${e.length.toString()}`)));const E=n.length===0?"":` WHERE ${n.join(" AND ")}`;let u="";t?.limit!==void 0&&t.limit>0&&(e.push(Math.trunc(t.limit)),u=` LIMIT ?${e.length.toString()}`);const{results:p}=await a.prepare(`SELECT * FROM ${r}${E}${u}`).bind(...e).all();return p.map(T=>o(T))},markStatus:async(t,n,e)=>{await d(),await a.prepare(`UPDATE ${r} SET last_status = ?2, last_error = ?3, last_seen_at = ?4 WHERE id = ?1`).bind(t,n,e??null,Date.now()).run()},put:async t=>{await d(),await a.prepare(`INSERT INTO ${r} (id, kind, endpoint, p256dh, auth, token, user_id, metadata, created_at, last_seen_at, last_status, last_error) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12) ON CONFLICT(id) DO UPDATE SET kind = ?2, endpoint = ?3, p256dh = ?4, auth = ?5, token = ?6, user_id = ?7, metadata = ?8, last_seen_at = ?10`).bind(t.id,t.kind,t.endpoint??null,t.keys?.p256dh??null,t.keys?.auth??null,t.token??null,t.userId??null,t.metadata===void 0?null:JSON.stringify(t.metadata),t.createdAt,t.lastSeenAt,t.lastStatus??null,t.lastError??null).run();const n=h(t);return n!==void 0&&n!==t.id&&await a.prepare(`DELETE FROM ${r} WHERE id = ?1`).bind(n).run(),await l(t.id)??t}}};export{I as d1SubscriptionStore};

package/dist/packem_shared/defineNotify-DLEy53HJ.mjs

@@ -0,0 +1 @@
+const e=o=>{if(o.webPush!==void 0&&typeof o.webPush!="function"&&typeof o.webPush!="object")throw new TypeError("defineNotify: `webPush` must be a WebPushConfig object or an `(env) => WebPushConfig` function");if(o.fcm!==void 0&&typeof o.fcm!="function"&&typeof o.fcm!="object")throw new TypeError("defineNotify: `fcm` must be an FcmConfig object or an `(env) => FcmConfig` function");if(o.store!==void 0&&typeof o.store!="function")throw new TypeError("defineNotify: `store` must be a function `(env) => SubscriptionStore` when provided");if(o.allowedPushOrigins!==void 0&&(!Array.isArray(o.allowedPushOrigins)||o.allowedPushOrigins.some(i=>typeof i!="string")))throw new TypeError('defineNotify: `allowedPushOrigins` must be an array of origin strings (e.g. ["https://fcm.googleapis.com"]) when provided');if(o.webPush===void 0&&o.fcm===void 0)throw new TypeError("defineNotify: configure at least one push channel — `webPush` and/or `fcm`");return{...o,isLunoraNotify:!0}},n=o=>typeof o=="object"&&o!==null&&o.isLunoraNotify===!0;export{e as defineNotify,n as isNotifyDefinition};

package/dist/packem_shared/enqueuePushBroadcast-DMwYIM0o.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";const e=(o,r)=>o.send({...r,type:"lunora.push.broadcast"}),s=async(o,r)=>{const t=await o.broadcast(r.payload,r.filter);if(t.failed>0)throw new a("INTERNAL",`@lunora/notify: push broadcast had ${t.failed.toString()} transient failure(s) of ${t.total.toString()} subscription(s) (${t.sent.toString()} sent, ${t.pruned.toString()} pruned) — throwing so the queue retries`);return t};export{e as enqueuePushBroadcast,s as runPushBroadcastJob};

package/dist/packem_shared/fcmId-CLRyQJVw.mjs

@@ -0,0 +1 @@
+import{LunoraError as u}from"@lunora/errors";const k=/^\d{1,3}$/u,E=/^::ffff:([\da-f]{1,4}):([\da-f]{1,4})$/u,I=/^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/u,S=/^::(\d{1,3}(?:\.\d{1,3}){3})$/u,v=/^::([\da-f]{1,4}):([\da-f]{1,4})$/u,A=/^64:ff9b::[\da-f]{1,4}:[\da-f]{1,4}$/u,W=/^\[|\]$/gu,N=/\.$/u,l=t=>{const e=t.split(".");if(e.length!==4)return;const n=e.map(r=>k.test(r)?Number(r):-1);if(!n.some(r=>r<0||r>255))return[n[0],n[1],n[2],n[3]]},f=([t,e])=>t===0||t===10||t===127||t===100&&e>=64&&e<=127||t===169&&e===254||t===172&&e>=16&&e<=31||t===192&&e===168||t>=224,p=(t,e)=>{const n=Number.parseInt(t??"",16),r=Number.parseInt(e??"",16);return!Number.isFinite(n)||!Number.isFinite(r)?!0:f([Math.floor(n/256),n%256,Math.floor(r/256),r%256])},R=t=>{const e=t.toLowerCase(),n=E.exec(e);if(n)return p(n[1],n[2]);const r=I.exec(e);if(r){const o=l(r[1]??"");return o===void 0||f(o)}const i=S.exec(e);if(i){const o=l(i[1]??"");return o===void 0||f(o)}const s=v.exec(e);return s?p(s[1],s[2]):A.test(e)||e.startsWith("2002:")||e.startsWith("2001:0:")?!0:e==="::"||e==="::1"||e.startsWith("fc")||e.startsWith("fd")||e.startsWith("fe8")||e.startsWith("fe9")||e.startsWith("fea")||e.startsWith("feb")},_=t=>t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal")||t.endsWith(".home.arpa"),D=t=>t.replaceAll(W,"").replace(N,"").toLowerCase(),O=t=>{const e=D(t);if(e.includes(":"))return R(e);const n=l(e);return n===void 0?_(e):f(n)},d=t=>t.toString(16).padStart(4,"0"),g=t=>{let e=8997,n=33826,r=40164,i=52210;for(let s=0;s<t.length;s+=1){const o=t.codePointAt(s)??0;e^=o&65535,n^=o>>>16&65535;const a=e*435,w=n*435,b=r*435+e*256,y=i*435+n*256,c=w+(a>>>16),h=b+(c>>>16),$=y+(h>>>16);e=a&65535,n=c&65535,r=h&65535,i=$&65535}return d(i)+d(r)+d(n)+d(e)},P=t=>`wp2_${g(t)}`,B=t=>`fcm2_${g(t)}`,m=t=>{let e=2166136261;for(let n=0;n<t.length;n+=1)e^=t.codePointAt(n)??0,e=Math.imul(e,16777619);return(e>>>0).toString(16).padStart(8,"0")},U=t=>`wp_${m(t)}`,x=t=>`fcm_${m(t)}`,q=t=>t.kind==="fcm"?t.token===void 0?void 0:x(t.token):t.endpoint===void 0?void 0:U(t.endpoint),F=t=>{if(typeof t!="string")return t??{};try{return JSON.parse(t)}catch(e){throw new u("BAD_REQUEST",`@lunora/notify: register() web-push subscription is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}},T=(t,e)=>{let n;try{n=new URL(t)}catch{throw new u("BAD_REQUEST",`@lunora/notify: register() web-push \`endpoint\` must be an absolute https URL (got "${t}")`)}if(n.protocol!=="https:")throw new u("BAD_REQUEST",`@lunora/notify: register() web-push \`endpoint\` must use https (got "${n.protocol}")`);if(e!==void 0&&e.length>0){if(!e.includes(n.origin))throw new u("FORBIDDEN",`@lunora/notify: register() web-push endpoint origin "${n.origin}" is not in the configured allowedPushOrigins allowlist`);return}if(O(n.hostname))throw new u("FORBIDDEN",`@lunora/notify: register() web-push endpoint host "${n.hostname}" is a private/internal address; configure allowedPushOrigins to permit a specific origin`)},C=(t,e=Date.now(),n={})=>{if("token"in t){const{token:a}=t;if(typeof a!="string"||a==="")throw new u("BAD_REQUEST","@lunora/notify: register() fcm input requires a non-empty `token`");return{createdAt:e,id:B(a),kind:"fcm",lastSeenAt:e,metadata:t.metadata,token:a,userId:t.userId??null}}const r=F(t.subscription),{endpoint:i}=r,s=r.keys?.p256dh,o=r.keys?.auth;if(typeof i!="string"||i===""||typeof s!="string"||typeof o!="string")throw new u("BAD_REQUEST","@lunora/notify: register() web-push subscription requires `endpoint` and `keys.{p256dh, auth}`");return T(i,n.allowedPushOrigins),{createdAt:e,endpoint:i,id:P(i),keys:{auth:o,p256dh:s},kind:"web-push",lastSeenAt:e,metadata:t.metadata,userId:t.userId??null}},z=t=>t.kind==="fcm"?t.token??"":JSON.stringify({endpoint:t.endpoint,keys:t.keys}),L=/\bhttp\s*4(?:04|10)\b/iu,Q=/\b(?:unregistered|not[\s-]?registered|registration-token-not-registered)\b/iu,J=/\bsubscription (?:is )?(?:gone|expired|no longer valid)\b/iu,G=t=>t===void 0?!1:L.test(t)||Q.test(t)||J.test(t);export{B as fcmId,G as isGoneError,x as legacyFcmId,q as legacyIdFor,U as legacyWebPushId,C as normalizeRegisterInput,z as targetOf,P as webPushId};

package/dist/packem_shared/memorySubscriptionStore-BxKdyxjC.mjs

@@ -0,0 +1 @@
+import{legacyIdFor as i}from"./fcmId-CLRyQJVw.mjs";const d=(e,t)=>t===void 0?!0:!(t.kind!==void 0&&e.kind!==t.kind||t.userId!==void 0&&(e.userId??null)!==t.userId),l=()=>{const e=new Map;return{delete:t=>(e.delete(t),Promise.resolve()),get:t=>Promise.resolve(e.get(t)),list:t=>{const r=[];for(const o of e.values())d(o,t)&&r.push(o);const s=t?.limit!==void 0&&t.limit>0?r.slice(0,Math.trunc(t.limit)):r;return Promise.resolve(s)},markStatus:(t,r,s)=>{const o=e.get(t);return o!==void 0&&e.set(t,{...o,lastError:s,lastSeenAt:Date.now(),lastStatus:r}),Promise.resolve()},put:t=>{const r=i(t);r!==void 0&&r!==t.id&&e.delete(r);const s=e.get(t.id),o=s===void 0?t:{...s,...t,createdAt:s.createdAt};return e.set(o.id,o),Promise.resolve(o)}}};export{l as memorySubscriptionStore};

package/dist/web.mjs

@@ -1,44 +1 @@
-const urlBase64ToUint8Array = (base64) => {
-  const padding = "=".repeat((4 - base64.length % 4) % 4);
-  const normalized = (base64 + padding).replaceAll("-", "+").replaceAll("_", "/");
-  const raw = atob(normalized);
-  const output = new Uint8Array(raw.length);
-  for (let index = 0; index < raw.length; index += 1) {
-    output[index] = raw.codePointAt(index) ?? 0;
-  }
-  return output;
-};
-const browserGlobals = globalThis;
-const isPushSupported = () => browserGlobals.navigator?.serviceWorker !== void 0 && browserGlobals.PushManager !== void 0;
-const subscribeToPush = async (options) => {
-  if (!isPushSupported()) {
-    throw new Error("@lunora/notify: Web Push is not supported in this browser (needs service workers + PushManager)");
-  }
-  let registration;
-  if (options.serviceWorkerUrl === void 0) {
-    registration = await navigator.serviceWorker.ready;
-  } else {
-    const registerOptions = options.scope === void 0 ? void 0 : { scope: options.scope };
-    registration = await navigator.serviceWorker.register(options.serviceWorkerUrl, registerOptions);
-  }
-  const permission = await Notification.requestPermission();
-  if (permission !== "granted") {
-    throw new Error(`@lunora/notify: notification permission was not granted (got "${permission}")`);
-  }
-  const existing = await registration.pushManager.getSubscription();
-  const subscription = existing ?? await registration.pushManager.subscribe({
-    applicationServerKey: urlBase64ToUint8Array(options.vapidPublicKey),
-    userVisibleOnly: true
-  });
-  return subscription.toJSON();
-};
-const unsubscribeFromPush = async () => {
-  if (!isPushSupported()) {
-    return false;
-  }
-  const registration = await navigator.serviceWorker.ready;
-  const subscription = await registration.pushManager.getSubscription();
-  return subscription === null ? false : subscription.unsubscribe();
-};
-
-export { isPushSupported, subscribeToPush, unsubscribeFromPush };
+const l=r=>{const i="=".repeat((4-r.length%4)%4),n=(r+i).replaceAll("-","+").replaceAll("_","/"),e=atob(n),a=new Uint8Array(e.length);for(let s=0;s<e.length;s+=1)a[s]=e.codePointAt(s)??0;return a},c=(r,i)=>r.length===i.length&&r.every((n,e)=>n===i[e]),t=(r,i)=>{const n=r.options.applicationServerKey;return n===null?!1:c(new Uint8Array(n),l(i))},o=globalThis,u=()=>o.navigator?.serviceWorker!==void 0&&o.PushManager!==void 0,p=async r=>{if(!u())throw new Error("@lunora/notify: Web Push is not supported in this browser (needs service workers + PushManager)");let i;if(r.serviceWorkerUrl===void 0)i=await navigator.serviceWorker.ready;else{const a=r.scope===void 0?void 0:{scope:r.scope};i=await navigator.serviceWorker.register(r.serviceWorkerUrl,a)}const n=await Notification.requestPermission();if(n!=="granted")throw new Error(`@lunora/notify: notification permission was not granted (got "${n}")`);const e=await i.pushManager.getSubscription();return e!==null&&!t(e,r.vapidPublicKey)&&await e.unsubscribe(),((e!==null&&t(e,r.vapidPublicKey)?e:null)??await i.pushManager.subscribe({applicationServerKey:l(r.vapidPublicKey),userVisibleOnly:!0})).toJSON()},g=async()=>{if(!u())return!1;const r=await(await navigator.serviceWorker.ready).pushManager.getSubscription();return r===null?!1:r.unsubscribe()};export{u as isPushSupported,p as subscribeToPush,g as unsubscribeFromPush};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/notify",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0-alpha.5",
   "description": "Multi-channel notifications for Lunora — ctx.notify / ctx.push over @visulima/notification: edge-safe Web Push + FCM, plus chat, in-app inbox and webhook channels, with subscription storage and queue-backed fan-out",
   "keywords": [
     "cloudflare",
@@ -49,7 +49,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.8",
+    "@lunora/errors": "1.0.0-alpha.9",
     "@visulima/notification": "1.0.5"
   },
   "engines": {

package/dist/packem_shared/FCM_ENV_KEYS-DY4-A717.mjs

@@ -1,32 +0,0 @@
-const WEB_PUSH_ENV_KEYS = {
-  privateKey: "VAPID_PRIVATE_KEY",
-  publicKey: "VAPID_PUBLIC_KEY",
-  subject: "VAPID_SUBJECT"
-};
-const FCM_ENV_KEYS = {
-  accessToken: "FCM_ACCESS_TOKEN",
-  projectId: "FCM_PROJECT_ID"
-};
-const readString = (env, key) => {
-  const value = env[key];
-  return typeof value === "string" && value !== "" ? value : void 0;
-};
-const webPushFromEnv = (env, overrides) => {
-  const vapidPublicKey = readString(env, WEB_PUSH_ENV_KEYS.publicKey);
-  const vapidPrivateKey = readString(env, WEB_PUSH_ENV_KEYS.privateKey);
-  const vapidSubject = readString(env, WEB_PUSH_ENV_KEYS.subject);
-  if (vapidPublicKey === void 0 || vapidPrivateKey === void 0 || vapidSubject === void 0) {
-    return void 0;
-  }
-  return { vapidPrivateKey, vapidPublicKey, vapidSubject, ...overrides };
-};
-const fcmFromEnv = (env, overrides) => {
-  const projectId = readString(env, FCM_ENV_KEYS.projectId);
-  if (projectId === void 0) {
-    return void 0;
-  }
-  const accessToken = readString(env, FCM_ENV_KEYS.accessToken);
-  return { accessToken, projectId, ...overrides };
-};
-
-export { FCM_ENV_KEYS, WEB_PUSH_ENV_KEYS, fcmFromEnv, webPushFromEnv };

package/dist/packem_shared/buildEngine-DlmjvnNk.mjs

@@ -1,65 +0,0 @@
-import { createNotification } from '@visulima/notification';
-import { retryMiddleware, circuitBreakerMiddleware } from '@visulima/notification/middleware';
-import { fcmProvider } from '@visulima/notification/providers/fcm';
-import { webPushProvider } from '@visulima/notification/providers/web-push';
-
-const isWebPushTarget = (target) => {
-  if (typeof target !== "string") {
-    return typeof target === "object" && target !== null && "endpoint" in target;
-  }
-  if (!target.startsWith("{")) {
-    return false;
-  }
-  try {
-    const parsed = JSON.parse(target);
-    return typeof parsed.endpoint === "string" && typeof parsed.keys === "object";
-  } catch {
-    return false;
-  }
-};
-const routingPushProvider = (options) => {
-  const pick = (target) => {
-    const provider = isWebPushTarget(target) ? options.webPush : options.fcm;
-    if (provider === void 0) {
-      throw new Error(
-        isWebPushTarget(target) ? "@lunora/notify: received a web-push target but no `webPush` channel is configured" : "@lunora/notify: received an FCM token target but no `fcm` channel is configured"
-      );
-    }
-    return provider;
-  };
-  return {
-    channel: "push",
-    id: "lunora-push-router",
-    initialize: async () => {
-      await options.webPush?.initialize();
-      await options.fcm?.initialize();
-    },
-    isAvailable: () => (options.webPush ?? options.fcm) !== void 0,
-    send: (payload) => {
-      const target = Array.isArray(payload.to) ? payload.to[0] : payload.to;
-      return pick(target).send(payload);
-    }
-  };
-};
-const buildEngine = (resolved) => {
-  const webPush = resolved.webPush === void 0 ? void 0 : webPushProvider(resolved.webPush);
-  const fcm = resolved.fcm === void 0 ? void 0 : fcmProvider(resolved.fcm);
-  const providers = {};
-  if (webPush !== void 0 || fcm !== void 0) {
-    providers.push = routingPushProvider({ fcm, webPush });
-  }
-  if (resolved.chat !== void 0) {
-    providers.chat = resolved.chat;
-  }
-  if (resolved.inApp !== void 0) {
-    providers.inapp = resolved.inApp;
-  }
-  if (resolved.webhook !== void 0) {
-    providers.webhook = resolved.webhook;
-  }
-  const engine = createNotification(providers);
-  engine.use(retryMiddleware()).use(circuitBreakerMiddleware());
-  return engine;
-};
-
-export { buildEngine, routingPushProvider };

package/dist/packem_shared/createNotify-bDWs4qBm.mjs

@@ -1,191 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { buildEngine } from './buildEngine-DlmjvnNk.mjs';
-import { memorySubscriptionStore } from './memorySubscriptionStore-DhS-YnLe.mjs';
-import { normalizeRegisterInput, targetOf, isGoneError } from './fcmId-B-YPgHi7.mjs';
-
-const resolveMaybeFactory = (value, env) => typeof value === "function" ? value(env) : value;
-const receiptError = (receipt) => receipt.successful ? void 0 : receipt.errorMessages.join("; ");
-const pushDeliveryStatus = (receipt, error) => {
-  if (receipt.successful) {
-    return "accepted";
-  }
-  return isGoneError(error) ? "gone" : "failed";
-};
-const mapWithConcurrency = async (items, limit, task) => {
-  const results = Array.from({ length: items.length });
-  let cursor = 0;
-  const worker = async () => {
-    while (cursor < items.length) {
-      const index = cursor;
-      cursor += 1;
-      results[index] = await task(items[index]);
-    }
-  };
-  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker()));
-  return results;
-};
-const resolveProviders = (definition, env) => {
-  return {
-    chat: resolveMaybeFactory(definition.chat, env),
-    fcm: resolveMaybeFactory(definition.fcm, env),
-    inApp: resolveMaybeFactory(definition.inApp, env),
-    webhook: resolveMaybeFactory(definition.webhook, env),
-    webPush: resolveMaybeFactory(definition.webPush, env)
-  };
-};
-const runtimeCache = /* @__PURE__ */ new WeakMap();
-const runtimeFor = (definition, env) => {
-  let byEnv = runtimeCache.get(definition);
-  if (byEnv === void 0) {
-    byEnv = /* @__PURE__ */ new WeakMap();
-    runtimeCache.set(definition, byEnv);
-  }
-  let runtime = byEnv.get(env);
-  if (runtime === void 0) {
-    runtime = { warnedNoStore: false };
-    byEnv.set(env, runtime);
-  }
-  return runtime;
-};
-const createNotify = (definition, env, options = {}) => {
-  const runtime = runtimeFor(definition, env);
-  let engine;
-  if (options.engine === void 0) {
-    runtime.engine ??= buildEngine(resolveProviders(definition, env));
-    engine = runtime.engine;
-  } else {
-    engine = options.engine;
-  }
-  let store = definition.store?.(env);
-  if (store === void 0) {
-    runtime.fallbackStore ??= memorySubscriptionStore();
-    if (!options.silent && !runtime.warnedNoStore) {
-      runtime.warnedNoStore = true;
-      console.warn(
-        "@lunora/notify: no `store` configured — using a non-durable in-memory subscription store. Configure `store: (env) => d1SubscriptionStore(env.DB)` for production."
-      );
-    }
-    store = runtime.fallbackStore;
-  }
-  const subscriptionStore = store;
-  const concurrency = Math.max(1, options.concurrency ?? 10);
-  const { log, metrics } = options;
-  const countSend = (channel, provider, status, count = 1) => {
-    metrics?.count("notify.send", count, { channel, provider: provider ?? channel, status });
-  };
-  const warnFailedSend = (channel, provider, fields) => {
-    log?.warn(`notify ${channel} delivery failed`, { channel, provider: provider ?? channel, status: "failed", ...fields });
-  };
-  const observeSkip = (channel, reason) => {
-    metrics?.count("notify.skipped", 1, { channel, reason });
-  };
-  const resolveSubscription = async (target) => {
-    if (typeof target !== "string") {
-      return target;
-    }
-    const found = await subscriptionStore.get(target);
-    if (found === void 0) {
-      throw new LunoraError("BAD_REQUEST", `@lunora/notify: no registered subscription with id "${target}"`);
-    }
-    return found;
-  };
-  const deliver = async (subscription, payload, countInline) => {
-    const receipt = await engine.sendToChannel("push", { ...payload, to: targetOf(subscription) });
-    const error = receiptError(receipt);
-    const status = pushDeliveryStatus(receipt, error);
-    if (status === "accepted") {
-      await subscriptionStore.markStatus(subscription.id, "ok");
-    } else if (status === "gone") {
-      await subscriptionStore.delete(subscription.id);
-    } else {
-      await subscriptionStore.markStatus(subscription.id, "failed", error);
-    }
-    if (status === "failed") {
-      warnFailedSend("push", subscription.kind, { error, subscriptionId: subscription.id, userId: subscription.userId ?? null });
-    }
-    if (countInline) {
-      countSend("push", subscription.kind, status);
-    }
-    return { receipt, status };
-  };
-  const push = {
-    broadcast: async (payload, filter) => {
-      const subscriptions = await subscriptionStore.list(filter);
-      if (subscriptions.length === 0) {
-        observeSkip("push", "no-subscriptions-matched");
-      }
-      const rows = await mapWithConcurrency(subscriptions, concurrency, async (subscription) => {
-        const { receipt, status } = await deliver(subscription, payload, false);
-        return { kind: subscription.kind, receipt, status, subscription };
-      });
-      const buckets = /* @__PURE__ */ new Map();
-      for (const { kind, status } of rows) {
-        const key = `${kind}\0${status}`;
-        const bucket = buckets.get(key);
-        if (bucket === void 0) {
-          buckets.set(key, { count: 1, kind, status });
-        } else {
-          bucket.count += 1;
-        }
-      }
-      for (const { count, kind, status } of buckets.values()) {
-        countSend("push", kind, status, count);
-      }
-      const outcomes = rows.map(({ receipt, status, subscription }) => {
-        if (status === "accepted") {
-          return { id: subscription.id, status: "ok" };
-        }
-        const error = receiptError(receipt);
-        return status === "gone" ? { error, id: subscription.id, status: "expired" } : { error, id: subscription.id, status: "failed" };
-      });
-      return {
-        failed: outcomes.filter((outcome) => outcome.status === "failed").length,
-        outcomes,
-        pruned: outcomes.filter((outcome) => outcome.status === "expired").length,
-        sent: outcomes.filter((outcome) => outcome.status === "ok").length,
-        total: outcomes.length
-      };
-    },
-    list: (filter) => subscriptionStore.list(filter),
-    register: (input) => subscriptionStore.put(normalizeRegisterInput(input)),
-    send: async (target, payload) => {
-      const { receipt } = await deliver(await resolveSubscription(target), payload, true);
-      return receipt;
-    },
-    unregister: (id) => subscriptionStore.delete(id)
-  };
-  const sendToChannel = async (channel, payload) => {
-    if (engine.getProvider(channel) === void 0) {
-      observeSkip(channel, "channel-not-configured");
-      throw new LunoraError("BAD_REQUEST", `@lunora/notify: the "${channel}" channel is not configured in defineNotify(...)`);
-    }
-    const receipt = await engine.sendToChannel(channel, payload);
-    const status = receipt.successful ? "accepted" : "failed";
-    countSend(channel, receipt.provider, status);
-    if (status === "failed") {
-      warnFailedSend(channel, receipt.provider, { error: receiptError(receipt) });
-    }
-    return receipt;
-  };
-  const notify = {
-    chat: (payload) => sendToChannel("chat", payload),
-    inApp: (payload) => sendToChannel("inapp", payload),
-    push,
-    send: async (message) => {
-      const receipts = await engine.send(message);
-      for (const receipt of receipts) {
-        const channel = receipt.channel ?? "unknown";
-        const status = receipt.successful ? "accepted" : "failed";
-        countSend(channel, receipt.provider, status);
-        if (status === "failed") {
-          warnFailedSend(channel, receipt.provider, { error: receiptError(receipt) });
-        }
-      }
-      return receipts;
-    },
-    webhook: (payload) => sendToChannel("webhook", payload)
-  };
-  return { notify, push };
-};
-
-export { createNotify };

package/dist/packem_shared/d1SubscriptionStore-Dv3VPMI_.mjs

@@ -1,107 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-
-const rowToSubscription = (row) => {
-  const subscription = {
-    createdAt: row.created_at,
-    id: row.id,
-    kind: row.kind,
-    lastSeenAt: row.last_seen_at,
-    userId: row.user_id
-  };
-  if (row.endpoint !== null) {
-    subscription.endpoint = row.endpoint;
-  }
-  if (row.p256dh !== null && row.auth !== null) {
-    subscription.keys = { auth: row.auth, p256dh: row.p256dh };
-  }
-  if (row.token !== null) {
-    subscription.token = row.token;
-  }
-  if (row.last_status !== null) {
-    subscription.lastStatus = row.last_status;
-  }
-  if (row.last_error !== null) {
-    subscription.lastError = row.last_error;
-  }
-  if (row.metadata !== null) {
-    try {
-      subscription.metadata = JSON.parse(row.metadata);
-    } catch {
-    }
-  }
-  return subscription;
-};
-const IDENTIFIER_PATTERN = /^[A-Za-z_]\w*$/u;
-const d1SubscriptionStore = (database, options = {}) => {
-  const table = options.tableName ?? "lunora_push_subscriptions";
-  if (!IDENTIFIER_PATTERN.test(table)) {
-    throw new LunoraError("BAD_REQUEST", `@lunora/notify: d1SubscriptionStore tableName "${table}" is not a bare SQL identifier`);
-  }
-  let schemaReady;
-  const ensureSchema = () => {
-    if (schemaReady === void 0) {
-      schemaReady = database.prepare(
-        `CREATE TABLE IF NOT EXISTS ${table} (id TEXT PRIMARY KEY, kind TEXT NOT NULL, endpoint TEXT, p256dh TEXT, auth TEXT, token TEXT, user_id TEXT, metadata TEXT, created_at INTEGER NOT NULL, last_seen_at INTEGER NOT NULL, last_status TEXT, last_error TEXT)`
-      ).run().then(() => void 0);
-      schemaReady.catch(() => {
-        schemaReady = void 0;
-      });
-    }
-    return schemaReady;
-  };
-  const put = async (subscription) => {
-    await ensureSchema();
-    await database.prepare(
-      `INSERT INTO ${table} (id, kind, endpoint, p256dh, auth, token, user_id, metadata, created_at, last_seen_at, last_status, last_error) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12) ON CONFLICT(id) DO UPDATE SET kind = ?2, endpoint = ?3, p256dh = ?4, auth = ?5, token = ?6, user_id = ?7, metadata = ?8, last_seen_at = ?10, last_status = ?11, last_error = ?12`
-    ).bind(
-      subscription.id,
-      subscription.kind,
-      subscription.endpoint ?? null,
-      subscription.keys?.p256dh ?? null,
-      subscription.keys?.auth ?? null,
-      subscription.token ?? null,
-      subscription.userId ?? null,
-      subscription.metadata === void 0 ? null : JSON.stringify(subscription.metadata),
-      subscription.createdAt,
-      subscription.lastSeenAt,
-      subscription.lastStatus ?? null,
-      subscription.lastError ?? null
-    ).run();
-    return subscription;
-  };
-  const get = async (id) => {
-    await ensureSchema();
-    const row = await database.prepare(`SELECT * FROM ${table} WHERE id = ?1`).bind(id).first();
-    return row === null ? void 0 : rowToSubscription(row);
-  };
-  const remove = async (id) => {
-    await ensureSchema();
-    await database.prepare(`DELETE FROM ${table} WHERE id = ?1`).bind(id).run();
-  };
-  const list = async (filter) => {
-    await ensureSchema();
-    const clauses = [];
-    const bindings = [];
-    if (filter?.kind !== void 0) {
-      bindings.push(filter.kind);
-      clauses.push(`kind = ?${bindings.length.toString()}`);
-    }
-    if (filter?.userId !== void 0) {
-      bindings.push(filter.userId);
-      clauses.push(filter.userId === null ? "user_id IS NULL" : `user_id = ?${bindings.length.toString()}`);
-      if (filter.userId === null) {
-        bindings.pop();
-      }
-    }
-    const where = clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`;
-    const { results } = await database.prepare(`SELECT * FROM ${table}${where}`).bind(...bindings).all();
-    return results.map((row) => rowToSubscription(row));
-  };
-  const markStatus = async (id, status, error) => {
-    await ensureSchema();
-    await database.prepare(`UPDATE ${table} SET last_status = ?2, last_error = ?3, last_seen_at = ?4 WHERE id = ?1`).bind(id, status, error ?? null, Date.now()).run();
-  };
-  return { delete: remove, get, list, markStatus, put };
-};
-
-export { d1SubscriptionStore };

package/dist/packem_shared/defineNotify-B6S_47C2.mjs

@@ -1,18 +0,0 @@
-const defineNotify = (config) => {
-  if (config.webPush !== void 0 && typeof config.webPush !== "function" && typeof config.webPush !== "object") {
-    throw new TypeError("defineNotify: `webPush` must be a WebPushConfig object or an `(env) => WebPushConfig` function");
-  }
-  if (config.fcm !== void 0 && typeof config.fcm !== "function" && typeof config.fcm !== "object") {
-    throw new TypeError("defineNotify: `fcm` must be an FcmConfig object or an `(env) => FcmConfig` function");
-  }
-  if (config.store !== void 0 && typeof config.store !== "function") {
-    throw new TypeError("defineNotify: `store` must be a function `(env) => SubscriptionStore` when provided");
-  }
-  if (config.webPush === void 0 && config.fcm === void 0) {
-    throw new TypeError("defineNotify: configure at least one push channel — `webPush` and/or `fcm`");
-  }
-  return { ...config, isLunoraNotify: true };
-};
-const isNotifyDefinition = (value) => typeof value === "object" && value !== null && value.isLunoraNotify === true;
-
-export { defineNotify, isNotifyDefinition };

package/dist/packem_shared/enqueuePushBroadcast-DiK7Hyja.mjs

@@ -1,4 +0,0 @@
-const enqueuePushBroadcast = (queue, job) => queue.send({ ...job, type: "lunora.push.broadcast" });
-const runPushBroadcastJob = (push, job) => push.broadcast(job.payload, job.filter);
-
-export { enqueuePushBroadcast, runPushBroadcastJob };

package/dist/packem_shared/fcmId-B-YPgHi7.mjs

@@ -1,68 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-
-const fnv1a = (input) => {
-  let hash = 2166136261;
-  for (let index = 0; index < input.length; index += 1) {
-    hash ^= input.codePointAt(index) ?? 0;
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-};
-const webPushId = (endpoint) => `wp_${fnv1a(endpoint)}`;
-const fcmId = (token) => `fcm_${fnv1a(token)}`;
-const parseSubscription = (subscription) => {
-  if (typeof subscription !== "string") {
-    return subscription ?? {};
-  }
-  try {
-    return JSON.parse(subscription);
-  } catch (error) {
-    throw new LunoraError(
-      "BAD_REQUEST",
-      `@lunora/notify: register() web-push subscription is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-};
-const normalizeRegisterInput = (input, now = Date.now()) => {
-  if ("token" in input) {
-    const { token } = input;
-    if (typeof token !== "string" || token === "") {
-      throw new LunoraError("BAD_REQUEST", "@lunora/notify: register() fcm input requires a non-empty `token`");
-    }
-    return { createdAt: now, id: fcmId(token), kind: "fcm", lastSeenAt: now, metadata: input.metadata, token, userId: input.userId ?? null };
-  }
-  const subscription = parseSubscription(input.subscription);
-  const { endpoint } = subscription;
-  const p256dh = subscription.keys?.p256dh;
-  const auth = subscription.keys?.auth;
-  if (typeof endpoint !== "string" || endpoint === "" || typeof p256dh !== "string" || typeof auth !== "string") {
-    throw new LunoraError("BAD_REQUEST", "@lunora/notify: register() web-push subscription requires `endpoint` and `keys.{p256dh, auth}`");
-  }
-  return {
-    createdAt: now,
-    endpoint,
-    id: webPushId(endpoint),
-    keys: { auth, p256dh },
-    kind: "web-push",
-    lastSeenAt: now,
-    metadata: input.metadata,
-    userId: input.userId ?? null
-  };
-};
-const targetOf = (subscription) => {
-  if (subscription.kind === "fcm") {
-    return subscription.token ?? "";
-  }
-  return JSON.stringify({ endpoint: subscription.endpoint, keys: subscription.keys });
-};
-const WEB_PUSH_GONE_PATTERN = /\bhttp\s*4(?:04|10)\b/iu;
-const FCM_GONE_PATTERN = /\b(?:unregistered|not[\s-]?registered|registration-token-not-registered)\b/iu;
-const GONE_TEXT_FALLBACK = /\bsubscription (?:is )?(?:gone|expired|no longer valid)\b/iu;
-const isGoneError = (message) => {
-  if (message === void 0) {
-    return false;
-  }
-  return WEB_PUSH_GONE_PATTERN.test(message) || FCM_GONE_PATTERN.test(message) || GONE_TEXT_FALLBACK.test(message);
-};
-
-export { fcmId, isGoneError, normalizeRegisterInput, targetOf, webPushId };

package/dist/packem_shared/memorySubscriptionStore-DhS-YnLe.mjs

@@ -1,46 +0,0 @@
-const matches = (subscription, filter) => {
-  if (filter === void 0) {
-    return true;
-  }
-  if (filter.kind !== void 0 && subscription.kind !== filter.kind) {
-    return false;
-  }
-  if (filter.userId !== void 0 && (subscription.userId ?? null) !== filter.userId) {
-    return false;
-  }
-  return true;
-};
-const memorySubscriptionStore = () => {
-  const map = /* @__PURE__ */ new Map();
-  return {
-    delete: (id) => {
-      map.delete(id);
-      return Promise.resolve();
-    },
-    get: (id) => Promise.resolve(map.get(id)),
-    list: (filter) => {
-      const result = [];
-      for (const subscription of map.values()) {
-        if (matches(subscription, filter)) {
-          result.push(subscription);
-        }
-      }
-      return Promise.resolve(result);
-    },
-    markStatus: (id, status, error) => {
-      const existing = map.get(id);
-      if (existing !== void 0) {
-        map.set(id, { ...existing, lastError: error, lastSeenAt: Date.now(), lastStatus: status });
-      }
-      return Promise.resolve();
-    },
-    put: (subscription) => {
-      const existing = map.get(subscription.id);
-      const merged = existing === void 0 ? subscription : { ...existing, ...subscription, createdAt: existing.createdAt };
-      map.set(merged.id, merged);
-      return Promise.resolve(merged);
-    }
-  };
-};
-
-export { memorySubscriptionStore };