@lunora/notify 1.0.0-alpha.30 → 1.0.0-alpha.32

package/README.md

@@ -45,11 +45,8 @@ await client.mutation("registerDevice", { subscription });
 
 ```ts
 // lunora/registerDevice.ts (a mutation — storage write is fine here)
-export const registerDevice = mutation({
-    args: { subscription: v.any() },
-    handler: async (ctx, { subscription }) => {
-        await ctx.push.register({ subscription, userId: ctx.auth?.userId });
-    },
+export const registerDevice = mutation.input({ subscription: v.any() }).mutation(async ({ ctx, args: { subscription } }) => {
+    await ctx.push.register({ subscription, userId: ctx.auth?.userId });
 });
 ```
 
@@ -58,12 +55,9 @@ export const registerDevice = mutation({
 Notification sends are external I/O, so they belong in **actions** (the `notify_send_outside_action` advisor lint enforces this):
 
 ```ts
-export const announce = action({
-    args: { title: v.string(), body: v.string() },
-    handler: async (ctx, { title, body }) => {
-        const result = await ctx.push.broadcast({ title, body });
-        // result: { total, sent, pruned, failed, outcomes }
-    },
+export const announce = action.input({ title: v.string(), body: v.string() }).action(async ({ ctx, args: { title, body } }) => {
+    const result = await ctx.push.broadcast({ title, body });
+    // result: { total, sent, pruned, failed, outcomes }
 });
 ```
 
@@ -90,27 +84,35 @@ Move a large broadcast off the request path with `@lunora/queue`:
 // producer (mutation/action)
 await enqueuePushBroadcast(ctx.queues.push, { payload: { title: "New drop", body: "…" } });
 
-// consumer (lunora/queues.ts)
-for (const message of batch.messages) {
-    const { failedIds, nextCursor } = await runPushBroadcastPage(ctx.push, message.body);
+// lunora/notify-fanout.ts — an INTERNAL ACTION, because that is where
+// `ctx.push` and `ctx.queues` exist.
+export const deliverPage = internalAction.input({ job: v.any() }).action(async ({ args: { job }, ctx }) => {
+    const { failedIds, nextCursor } = await runPushBroadcastPage(ctx.push, job);
 
     // One message = ONE bounded page. Discarding `nextCursor` delivers only the
     // first page (default 250 devices) and reports success for the whole audience.
     if (nextCursor !== undefined) {
-        await enqueuePushBroadcast(ctx.queues.push, {
-            payload: message.body.payload,
-            filter: { ...message.body.filter, after: nextCursor },
-        });
+        await enqueuePushBroadcast(ctx.queues.push, { payload: job.payload, filter: { ...job.filter, after: nextCursor } });
     }
 
     // Redeliver ONLY the recipients that failed — a retry of the whole page would
     // re-POST everyone it already reached.
     if (failedIds.length > 0) {
-        await enqueuePushBroadcast(ctx.queues.push, { payload: message.body.payload, retryIds: failedIds });
+        await enqueuePushBroadcast(ctx.queues.push, { payload: job.payload, retryIds: failedIds });
     }
+});
 
-    message.ack();
-}
+// lunora/queues.ts — a `QueueRunContext` is exactly `{ env, log, run }`: no
+// `ctx.push`, no `ctx.queues`. The consumer hands each message to the action above.
+// (Note the handler signature: `(context, batch)`, in that order.)
+export const push = defineQueue<PushBroadcastJob>({
+    handler: async (context, batch) => {
+        for (const message of batch.messages) {
+            await message.run(internal.notifyFanout.deliverPage, { job: message.body });
+            message.ack();
+        }
+    },
+});
 ```
 
 ## Subscription storage

package/dist/index.d.mts

@@ -111,7 +111,7 @@ interface SubscriptionFilter {
    * subscriptions reached across every internally-walked page (still
    * deliberately left unset by default — it must reach every matched
    * device); the PER-PAGE batch size is a separate, independent knob (see
-   * `CreateNotifyOptions`'s `broadcastPageSize`, default 250) so a caller
+   * `defineNotify`'s `broadcastPageSize`, default 250) so a caller
    * that sets `limit` to bound the audience doesn't also have to reason
    * about page sizing.
    *
@@ -244,7 +244,7 @@ interface LunoraPush {
    *
    * Internally walks the audience in bounded pages (via {@link LunoraPush.broadcastPage},
    * keyset-paginated on the subscription `id`) so a huge audience is never
-   * materialized wholesale in the isolate — see `CreateNotifyOptions`'s
+   * materialized wholesale in the isolate — see `defineNotify`'s
    * `broadcastPageSize`. This call still processes the WHOLE matched
    * audience in one request/queue message; use {@link LunoraPush.broadcastPage}
    * directly (as `runPushBroadcastPage` does) to bound a single queue message
@@ -253,7 +253,7 @@ interface LunoraPush {
   broadcast: (payload: PushContent, filter?: SubscriptionFilter) => Promise<BroadcastResult>;
   /**
    * Fan-out a push to ONE bounded page of stored subscriptions matching
-   * `filter` (page size: `CreateNotifyOptions`'s `broadcastPageSize`, default
+   * `filter` (page size: `defineNotify`'s `broadcastPageSize`, default
    * 250, capped by `filter.limit` when set). Same delivery semantics as
    * {@link LunoraPush.broadcast} (retry/circuit-breaker, gone-pruning) but
    * scoped to a single page; returns the page's own {@link BroadcastResult}
@@ -323,11 +323,32 @@ interface NotifyConfig {
    * wildcards) to hard-pin the boundary and close DNS rebinding.
    */
   allowedPushOrigins?: string[];
+  /**
+   * Page size for `push.broadcast`'s internal keyset pagination over the
+   * subscription store (default 250, minimum 1). Each page is fetched,
+   * delivered, and counted before the next page's store round trip, so a huge
+   * audience is never materialized wholesale in the isolate. Also the
+   * per-message bound `push.broadcastPage` (and `runPushBroadcastPage`) uses.
+   *
+   * Declared here, and not only on `createNotify`'s third argument, because
+   * this file is the only handle an app has: the sole production constructor is
+   * codegen's fixed `createNotify(definition, env, { log, metrics })`, so a knob
+   * that lives only on those options is unsettable by every Lunora app —
+   * while {@link SubscriptionFilter.limit}'s own docs point at it as the way to
+   * size pages.
+   */
+  broadcastPageSize?: number;
   /**
    * Optional chat provider factory (Slack/Discord/Teams/Telegram). Wire with a
    * provider from `@visulima/notification/providers/*`. Edge-safe (fetch-based).
    */
   chat?: (env: NotifyEnv) => unknown;
+  /**
+   * Max concurrent sends during a `push.broadcast` (default 10, minimum 1).
+   * Same reasoning as {@link NotifyConfig.broadcastPageSize}: this is where an
+   * app can reach it.
+   */
+  concurrency?: number;
   /** FCM (Firebase Cloud Messaging HTTP v1) config. Edge-safe — supply an OAuth2 token. */
   fcm?: FcmConfig | FcmConfigFactory;
   /** Optional in-app inbox provider factory. Edge-safe. */
@@ -416,14 +437,18 @@ interface CreateNotifyOptions {
   /**
    * Page size for `push.broadcast`'s internal keyset pagination over the
    * subscription store (default {@link DEFAULT_BROADCAST_PAGE_SIZE}, 250).
-   * Each page is fetched, delivered, and counted independently before the
-   * next page's store round trip, so a huge audience is never materialized
-   * wholesale in the isolate. Also the per-message bound `push.broadcastPage`
-   * (and so `runPushBroadcastPage`) uses. A test/tuning seam — most apps never
-   * need to set this.
+   *
+   * A test/tuning seam only. **Apps set `broadcastPageSize` on `defineNotify`
+   * instead** — the sole production call is codegen's fixed
+   * `createNotify(definition, env, { log, metrics })`, so nothing an app writes
+   * reaches this object. Set here it wins over the definition's value.
    */
   broadcastPageSize?: number;
-  /** Max concurrent sends during a `broadcast` (default 10). */
+  /**
+   * Max concurrent sends during a `broadcast` (default 10). Test/tuning seam;
+   * apps set `concurrency` on `defineNotify` — see
+   * {@link CreateNotifyOptions.broadcastPageSize}.
+   */
   concurrency?: number;
   /**
    * Override the assembled `@visulima/notification` engine. Advanced/testing
@@ -548,31 +573,45 @@ interface QueueProducerLike {
  * across MULTIPLE messages (one bounded page per message), not one.
  *
  * ```ts
- * // in a mutation/action:
- * await enqueuePushBroadcast(ctx.queues.push, { payload: { title: "New drop", body: "…" } });
+ * // lunora/notify-fanout.ts — an INTERNAL ACTION, because that is where
+ * // `ctx.push` and `ctx.queues` exist.
+ * import { internalAction, v } from "./_generated/server";
+ * import { enqueuePushBroadcast, runPushBroadcastPage } from "@lunora/notify";
  *
- * // in lunora/queues.ts consumer:
- * export const push = defineQueue({ async handler(batch, ctx) {
- *     for (const message of batch.messages) {
- *         const { failedIds, nextCursor } = await runPushBroadcastPage(ctx.push, message.body);
+ * export const deliverPage = internalAction
+ *     .input({ job: v.any() })
+ *     .action(async ({ args: { job }, ctx }) => {
+ *         const { failedIds, nextCursor } = await runPushBroadcastPage(ctx.push, job);
  *
  *         if (nextCursor !== undefined) {
  *             // More pages remain — enqueue the continuation. Each message still
  *             // does only ONE bounded page of work.
  *             await enqueuePushBroadcast(ctx.queues.push, {
- *                 payload: message.body.payload,
- *                 filter: { ...message.body.filter, after: nextCursor },
+ *                 filter: { ...job.filter, after: nextCursor },
+ *                 payload: job.payload,
  *             });
  *         }
  *
  *         if (failedIds.length > 0) {
  *             // Redeliver ONLY the recipients that failed — never the whole page.
- *             await enqueuePushBroadcast(ctx.queues.push, { payload: message.body.payload, retryIds: failedIds });
+ *             await enqueuePushBroadcast(ctx.queues.push, { payload: job.payload, retryIds: failedIds });
+ *         }
+ *     });
+ *
+ * // lunora/queues.ts — the consumer itself has NO ctx.push / ctx.queues: a
+ * // `QueueRunContext` is exactly `{ env, log, run }` (handler signature
+ * // `(context, batch)`, in that order). It hands each message to the action above.
+ * export const push = defineQueue<PushBroadcastJob>({
+ *     handler: async (context, batch) => {
+ *         for (const message of batch.messages) {
+ *             await message.run(internal.notifyFanout.deliverPage, { job: message.body });
+ *             message.ack();
  *         }
+ *     },
+ * });
  *
- *         message.ack();
- *     }
- * }});
+ * // in a mutation/action, to start it:
+ * await enqueuePushBroadcast(ctx.queues.push, { payload: { body: "…", title: "New drop" } });
  * ```
  */
 declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBroadcastJob, "type">) => Promise<void>;
@@ -584,8 +623,8 @@ declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBro
  *
  * RETRY / CONTINUATION SEMANTICS:
  *
- * - A job processes exactly ONE bounded page (see `CreateNotifyOptions`'s
- * page-size option, default 250, or `job.filter.limit` when smaller),
+ * - A job processes exactly ONE bounded page (see `defineNotify`'s
+ * `broadcastPageSize`, default 250, or `job.filter.limit` when smaller),
  * keyset-paginated on the subscription `id` (see `SubscriptionFilter.after`)
  * — so per-message work is bounded regardless of total audience size.
  * - A page NEVER throws for a partial failure. Throwing discarded the page's
@@ -595,7 +634,7 @@ declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBro
  * every already-delivered recipient on each retry, dead-letter, and leave
  * every LATER page unreached. The page's `nextCursor` and its `failedIds`
  * both come back instead.
- * - The CALLER (the `lunora/queues.ts` consumer) re-enqueues: `filter.after:
+ * - The CALLER re-enqueues: `filter.after:
  * nextCursor` while more pages remain, and a `retryIds: failedIds` job when
  * any recipient failed. `@lunora/notify` cannot do it itself — it has no
  * `@lunora/queue` dependency (the seam stays structural) and no reference to
@@ -660,7 +699,21 @@ declare const d1SubscriptionStore: (database: D1Like, options?: D1StoreOptions)
  */
 declare const memorySubscriptionStore: () => SubscriptionStore;
 /**
- * Stable store id for a web-push endpoint.
+ * Stable store id for a web-push endpoint — `fnv1a64Hex` of the (long) endpoint,
+ * so re-registering the same device upserts rather than duplicates.
+ *
+ * The digest comes from the canonical `shared/fnv1a`, not a local copy. This id
+ * is a PERSISTED primary key: a digest that drifts in one copy silently re-keys
+ * every existing subscription — the old row goes dark and the device
+ * re-registers as a duplicate — so the implementation must have exactly one
+ * home. `shared/fnv1a`'s is bit-verified against a BigInt reference in
+ * `packages/replica/__tests__/apply-diff.test.ts`.
+ *
+ * Widened from the previous 32-bit FNV-1a (8 hex): at 100K devices a 32-bit key
+ * collides with ~68% probability (birthday bound), and a collision silently
+ * overwrites another device's row under the store's `ON CONFLICT(id) DO UPDATE` —
+ * so the wrong user gets the push and the victim goes dark. 64 bits drops that to
+ * negligible at any realistic device count.
  *
  * The `wp2_` prefix is a version tag (see also {@link fcmId}'s `fcm2_`): it marks
  * the 64-bit-id revision so the pre-existing 32-bit `wp_` rows stay readable and a

package/dist/index.d.ts

@@ -111,7 +111,7 @@ interface SubscriptionFilter {
    * subscriptions reached across every internally-walked page (still
    * deliberately left unset by default — it must reach every matched
    * device); the PER-PAGE batch size is a separate, independent knob (see
-   * `CreateNotifyOptions`'s `broadcastPageSize`, default 250) so a caller
+   * `defineNotify`'s `broadcastPageSize`, default 250) so a caller
    * that sets `limit` to bound the audience doesn't also have to reason
    * about page sizing.
    *
@@ -244,7 +244,7 @@ interface LunoraPush {
    *
    * Internally walks the audience in bounded pages (via {@link LunoraPush.broadcastPage},
    * keyset-paginated on the subscription `id`) so a huge audience is never
-   * materialized wholesale in the isolate — see `CreateNotifyOptions`'s
+   * materialized wholesale in the isolate — see `defineNotify`'s
    * `broadcastPageSize`. This call still processes the WHOLE matched
    * audience in one request/queue message; use {@link LunoraPush.broadcastPage}
    * directly (as `runPushBroadcastPage` does) to bound a single queue message
@@ -253,7 +253,7 @@ interface LunoraPush {
   broadcast: (payload: PushContent, filter?: SubscriptionFilter) => Promise<BroadcastResult>;
   /**
    * Fan-out a push to ONE bounded page of stored subscriptions matching
-   * `filter` (page size: `CreateNotifyOptions`'s `broadcastPageSize`, default
+   * `filter` (page size: `defineNotify`'s `broadcastPageSize`, default
    * 250, capped by `filter.limit` when set). Same delivery semantics as
    * {@link LunoraPush.broadcast} (retry/circuit-breaker, gone-pruning) but
    * scoped to a single page; returns the page's own {@link BroadcastResult}
@@ -323,11 +323,32 @@ interface NotifyConfig {
    * wildcards) to hard-pin the boundary and close DNS rebinding.
    */
   allowedPushOrigins?: string[];
+  /**
+   * Page size for `push.broadcast`'s internal keyset pagination over the
+   * subscription store (default 250, minimum 1). Each page is fetched,
+   * delivered, and counted before the next page's store round trip, so a huge
+   * audience is never materialized wholesale in the isolate. Also the
+   * per-message bound `push.broadcastPage` (and `runPushBroadcastPage`) uses.
+   *
+   * Declared here, and not only on `createNotify`'s third argument, because
+   * this file is the only handle an app has: the sole production constructor is
+   * codegen's fixed `createNotify(definition, env, { log, metrics })`, so a knob
+   * that lives only on those options is unsettable by every Lunora app —
+   * while {@link SubscriptionFilter.limit}'s own docs point at it as the way to
+   * size pages.
+   */
+  broadcastPageSize?: number;
   /**
    * Optional chat provider factory (Slack/Discord/Teams/Telegram). Wire with a
    * provider from `@visulima/notification/providers/*`. Edge-safe (fetch-based).
    */
   chat?: (env: NotifyEnv) => unknown;
+  /**
+   * Max concurrent sends during a `push.broadcast` (default 10, minimum 1).
+   * Same reasoning as {@link NotifyConfig.broadcastPageSize}: this is where an
+   * app can reach it.
+   */
+  concurrency?: number;
   /** FCM (Firebase Cloud Messaging HTTP v1) config. Edge-safe — supply an OAuth2 token. */
   fcm?: FcmConfig | FcmConfigFactory;
   /** Optional in-app inbox provider factory. Edge-safe. */
@@ -416,14 +437,18 @@ interface CreateNotifyOptions {
   /**
    * Page size for `push.broadcast`'s internal keyset pagination over the
    * subscription store (default {@link DEFAULT_BROADCAST_PAGE_SIZE}, 250).
-   * Each page is fetched, delivered, and counted independently before the
-   * next page's store round trip, so a huge audience is never materialized
-   * wholesale in the isolate. Also the per-message bound `push.broadcastPage`
-   * (and so `runPushBroadcastPage`) uses. A test/tuning seam — most apps never
-   * need to set this.
+   *
+   * A test/tuning seam only. **Apps set `broadcastPageSize` on `defineNotify`
+   * instead** — the sole production call is codegen's fixed
+   * `createNotify(definition, env, { log, metrics })`, so nothing an app writes
+   * reaches this object. Set here it wins over the definition's value.
    */
   broadcastPageSize?: number;
-  /** Max concurrent sends during a `broadcast` (default 10). */
+  /**
+   * Max concurrent sends during a `broadcast` (default 10). Test/tuning seam;
+   * apps set `concurrency` on `defineNotify` — see
+   * {@link CreateNotifyOptions.broadcastPageSize}.
+   */
   concurrency?: number;
   /**
    * Override the assembled `@visulima/notification` engine. Advanced/testing
@@ -548,31 +573,45 @@ interface QueueProducerLike {
  * across MULTIPLE messages (one bounded page per message), not one.
  *
  * ```ts
- * // in a mutation/action:
- * await enqueuePushBroadcast(ctx.queues.push, { payload: { title: "New drop", body: "…" } });
+ * // lunora/notify-fanout.ts — an INTERNAL ACTION, because that is where
+ * // `ctx.push` and `ctx.queues` exist.
+ * import { internalAction, v } from "./_generated/server";
+ * import { enqueuePushBroadcast, runPushBroadcastPage } from "@lunora/notify";
  *
- * // in lunora/queues.ts consumer:
- * export const push = defineQueue({ async handler(batch, ctx) {
- *     for (const message of batch.messages) {
- *         const { failedIds, nextCursor } = await runPushBroadcastPage(ctx.push, message.body);
+ * export const deliverPage = internalAction
+ *     .input({ job: v.any() })
+ *     .action(async ({ args: { job }, ctx }) => {
+ *         const { failedIds, nextCursor } = await runPushBroadcastPage(ctx.push, job);
  *
  *         if (nextCursor !== undefined) {
  *             // More pages remain — enqueue the continuation. Each message still
  *             // does only ONE bounded page of work.
  *             await enqueuePushBroadcast(ctx.queues.push, {
- *                 payload: message.body.payload,
- *                 filter: { ...message.body.filter, after: nextCursor },
+ *                 filter: { ...job.filter, after: nextCursor },
+ *                 payload: job.payload,
  *             });
  *         }
  *
  *         if (failedIds.length > 0) {
  *             // Redeliver ONLY the recipients that failed — never the whole page.
- *             await enqueuePushBroadcast(ctx.queues.push, { payload: message.body.payload, retryIds: failedIds });
+ *             await enqueuePushBroadcast(ctx.queues.push, { payload: job.payload, retryIds: failedIds });
+ *         }
+ *     });
+ *
+ * // lunora/queues.ts — the consumer itself has NO ctx.push / ctx.queues: a
+ * // `QueueRunContext` is exactly `{ env, log, run }` (handler signature
+ * // `(context, batch)`, in that order). It hands each message to the action above.
+ * export const push = defineQueue<PushBroadcastJob>({
+ *     handler: async (context, batch) => {
+ *         for (const message of batch.messages) {
+ *             await message.run(internal.notifyFanout.deliverPage, { job: message.body });
+ *             message.ack();
  *         }
+ *     },
+ * });
  *
- *         message.ack();
- *     }
- * }});
+ * // in a mutation/action, to start it:
+ * await enqueuePushBroadcast(ctx.queues.push, { payload: { body: "…", title: "New drop" } });
  * ```
  */
 declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBroadcastJob, "type">) => Promise<void>;
@@ -584,8 +623,8 @@ declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBro
  *
  * RETRY / CONTINUATION SEMANTICS:
  *
- * - A job processes exactly ONE bounded page (see `CreateNotifyOptions`'s
- * page-size option, default 250, or `job.filter.limit` when smaller),
+ * - A job processes exactly ONE bounded page (see `defineNotify`'s
+ * `broadcastPageSize`, default 250, or `job.filter.limit` when smaller),
  * keyset-paginated on the subscription `id` (see `SubscriptionFilter.after`)
  * — so per-message work is bounded regardless of total audience size.
  * - A page NEVER throws for a partial failure. Throwing discarded the page's
@@ -595,7 +634,7 @@ declare const enqueuePushBroadcast: (queue: QueueProducerLike, job: Omit<PushBro
  * every already-delivered recipient on each retry, dead-letter, and leave
  * every LATER page unreached. The page's `nextCursor` and its `failedIds`
  * both come back instead.
- * - The CALLER (the `lunora/queues.ts` consumer) re-enqueues: `filter.after:
+ * - The CALLER re-enqueues: `filter.after:
  * nextCursor` while more pages remain, and a `retryIds: failedIds` job when
  * any recipient failed. `@lunora/notify` cannot do it itself — it has no
  * `@lunora/queue` dependency (the seam stays structural) and no reference to
@@ -660,7 +699,21 @@ declare const d1SubscriptionStore: (database: D1Like, options?: D1StoreOptions)
  */
 declare const memorySubscriptionStore: () => SubscriptionStore;
 /**
- * Stable store id for a web-push endpoint.
+ * Stable store id for a web-push endpoint — `fnv1a64Hex` of the (long) endpoint,
+ * so re-registering the same device upserts rather than duplicates.
+ *
+ * The digest comes from the canonical `shared/fnv1a`, not a local copy. This id
+ * is a PERSISTED primary key: a digest that drifts in one copy silently re-keys
+ * every existing subscription — the old row goes dark and the device
+ * re-registers as a duplicate — so the implementation must have exactly one
+ * home. `shared/fnv1a`'s is bit-verified against a BigInt reference in
+ * `packages/replica/__tests__/apply-diff.test.ts`.
+ *
+ * Widened from the previous 32-bit FNV-1a (8 hex): at 100K devices a 32-bit key
+ * collides with ~68% probability (birthday bound), and a collision silently
+ * overwrites another device's row under the store's `ON CONFLICT(id) DO UPDATE` —
+ * so the wrong user gets the push and the victim goes dark. 64 bits drops that to
+ * negligible at any realistic device count.
  *
  * The `wp2_` prefix is a version tag (see also {@link fcmId}'s `fcm2_`): it marks
  * the 64-bit-id revision so the pre-existing 32-bit `wp_` rows stay readable and a

package/dist/index.mjs

@@ -1 +1 @@
-import{FCM_ENV_KEYS as e,WEB_PUSH_ENV_KEYS as t,fcmFromEnv as i,webPushFromEnv as f}from"./packem_shared/FCM_ENV_KEYS-BbhPScGH.mjs";import{defineNotify as n,isNotifyDefinition as u}from"./packem_shared/defineNotify-CUi2k7pP.mjs";import{createNotify as p}from"./packem_shared/createNotify-BDE42tvH.mjs";import{buildEngine as a,routingPushProvider as d}from"./packem_shared/buildEngine-oDWs9Pom.mjs";import{enqueuePushBroadcast as P,runPushBroadcastPage as c}from"./packem_shared/enqueuePushBroadcast-B6v3DLLp.mjs";import{d1SubscriptionStore as b}from"./packem_shared/d1SubscriptionStore-s-AJH4hS.mjs";import{memorySubscriptionStore as h}from"./packem_shared/memorySubscriptionStore-FY8yANEM.mjs";import{fcmId as _,isGoneError as y,normalizeRegisterInput as v,targetOf as B,webPushId as F}from"./packem_shared/fcmId-Dwh_R5xe.mjs";export{e as FCM_ENV_KEYS,t as WEB_PUSH_ENV_KEYS,a as buildEngine,p as createNotify,b as d1SubscriptionStore,n as defineNotify,P as enqueuePushBroadcast,i as fcmFromEnv,_ as fcmId,y as isGoneError,u as isNotifyDefinition,h as memorySubscriptionStore,v as normalizeRegisterInput,d as routingPushProvider,c as runPushBroadcastPage,B as targetOf,f as webPushFromEnv,F as webPushId};
+import{FCM_ENV_KEYS as e,WEB_PUSH_ENV_KEYS as t,fcmFromEnv as i,webPushFromEnv as f}from"./packem_shared/FCM_ENV_KEYS-BbhPScGH.mjs";import{defineNotify as n,isNotifyDefinition as u}from"./packem_shared/defineNotify-DVPpVkU0.mjs";import{createNotify as p}from"./packem_shared/createNotify-B27o09vm.mjs";import{buildEngine as a,routingPushProvider as d}from"./packem_shared/buildEngine-oDWs9Pom.mjs";import{enqueuePushBroadcast as P,runPushBroadcastPage as c}from"./packem_shared/enqueuePushBroadcast-B6v3DLLp.mjs";import{d1SubscriptionStore as b}from"./packem_shared/d1SubscriptionStore-B7f20Nqr.mjs";import{memorySubscriptionStore as h}from"./packem_shared/memorySubscriptionStore-DdVxq2zI.mjs";import{fcmId as _,isGoneError as y,normalizeRegisterInput as v,targetOf as B,webPushId as F}from"./packem_shared/fcmId-DNM-rzkd.mjs";export{e as FCM_ENV_KEYS,t as WEB_PUSH_ENV_KEYS,a as buildEngine,p as createNotify,b as d1SubscriptionStore,n as defineNotify,P as enqueuePushBroadcast,i as fcmFromEnv,_ as fcmId,y as isGoneError,u as isNotifyDefinition,h as memorySubscriptionStore,v as normalizeRegisterInput,d as routingPushProvider,c as runPushBroadcastPage,B as targetOf,f as webPushFromEnv,F as webPushId};

package/dist/packem_shared/createNotify-B27o09vm.mjs

@@ -0,0 +1 @@
+import{LunoraError as v}from"@lunora/errors";import{buildEngine as z}from"./buildEngine-oDWs9Pom.mjs";import{memorySubscriptionStore as F}from"./memorySubscriptionStore-DdVxq2zI.mjs";import{normalizeRegisterInput as R,targetOf as B,isGoneError as L}from"./fcmId-DNM-rzkd.mjs";const W=250,w=(o,u)=>typeof o=="function"?o(u):o,S=o=>o.successful?void 0:o.errorMessages.join("; "),U=(o,u)=>o.successful?"accepted":L(u)?"gone":"failed",j=async(o,u,d)=>{const l=Array.from({length:o.length});let h=0;const g=async()=>{for(;h<o.length;){const f=h;h+=1,l[f]=await d(o[f])}};return await Promise.all(Array.from({length:Math.min(u,o.length)},()=>g())),l},G=(o,u)=>({allowedPushOrigins:o.allowedPushOrigins,chat:w(o.chat,u),fcm:w(o.fcm,u),inApp:w(o.inApp,u),webhook:w(o.webhook,u),webPush:w(o.webPush,u)}),x=new WeakMap,Q=(o,u)=>{let d=x.get(o);d===void 0&&(d=new WeakMap,x.set(o,d));let l=d.get(u);return l===void 0&&(l={warnedNoPushOriginAllowlist:!1,warnedNoStore:!1},d.set(u,l)),l},Y=(o,u,d={})=>{const l=Q(o,u);let h;d.engine===void 0?(l.engine??=z(G(o,u)),h=l.engine):h=d.engine,l.store??=o.store?.(u);let{store:g}=l;g===void 0&&(l.fallbackStore??=F(),!d.silent&&!l.warnedNoStore&&(l.warnedNoStore=!0,console.warn("@lunora/notify: no `store` configured — using a non-durable in-memory subscription store. Configure `store: (env) => d1SubscriptionStore(env.DB)` for production.")),g=l.fallbackStore);const f=g,C=Math.max(1,d.concurrency??o.concurrency??10),b=Math.max(1,d.broadcastPageSize??o.broadcastPageSize??W),{log:M,metrics:P}=d,p=(e,t,r,n=1)=>{P?.count("notify.send",n,{channel:e,provider:t??e,status:r})},y=(e,t,r)=>{M?.warn(`notify ${e} delivery failed`,{channel:e,provider:t??e,status:"failed",...r})},A=(e,t)=>{P?.count("notify.skipped",1,{channel:e,reason:t})},I=()=>{const e=o.allowedPushOrigins!==void 0&&o.allowedPushOrigins.length>0;d.silent||e||l.warnedNoPushOriginAllowlist||(l.warnedNoPushOriginAllowlist=!0,console.warn("@lunora/notify: Web Push registered without `allowedPushOrigins` — endpoints are guarded by a string classifier at register time and a best-effort DNS re-check at send time, both of which are defeatable. Set `allowedPushOrigins` to the exact push-service origins for a hard guarantee."))},T=async e=>(await f.list(e)).map(({keys:r,token:n,...a})=>a),_=async e=>{if(typeof e!="string")return e;const t=await f.get(e);if(t===void 0)throw new v("BAD_REQUEST",`@lunora/notify: no registered subscription with id "${e}"`);return t},E=async(e,t,r)=>{let n,a,s;try{n=await h.sendToChannel("push",{...t,to:B(e)}),a=S(n),s=U(n,a)}catch(c){s="failed",a=c instanceof Error?c.message:String(c)}try{s==="accepted"?await f.markStatus(e.id,"ok"):s==="gone"?await f.delete(e.id):await f.markStatus(e.id,"failed",a)}catch{}return s==="failed"&&y("push",e.kind,{error:a,subscriptionId:e.id,userId:e.userId??null}),r&&p("push",e.kind,s),{error:a,receipt:n,status:s}},D=async(e,t)=>{const r=await j(t,C,async s=>{const{error:c,status:i}=await E(s,e,!1);return{error:c,kind:s.kind,status:i,subscription:s}}),n=new Map;for(const{kind:s,status:c}of r){const i=`${s} ${c}`,m=n.get(i);m===void 0?n.set(i,{count:1,kind:s,status:c}):m.count+=1}for(const{count:s,kind:c,status:i}of n.values())p("push",c,i,s);const a=r.map(({error:s,status:c,subscription:i})=>c==="accepted"?{id:i.id,status:"ok"}:c==="gone"?{error:s,id:i.id,status:"expired"}:{error:s,id:i.id,status:"failed"});return{failed:a.filter(s=>s.status==="failed").length,outcomes:a,pruned:a.filter(s=>s.status==="expired").length,sent:a.filter(s=>s.status==="ok").length,total:a.length}},O=async(e,t)=>{if(t?.limit!==void 0&&t.limit<=0)return{nextCursor:void 0,result:{failed:0,outcomes:[],pruned:0,sent:0,total:0}};const r=t?.limit!==void 0&&t.limit>0?Math.trunc(t.limit):void 0,n=r===void 0?b:Math.min(r,b),a=await f.list({after:t?.after,kind:t?.kind,limit:n+1,userId:t?.userId}),s=t?.after===void 0?a:a.filter($=>$.id>t.after),c=s.length>n,i=c?s.slice(0,n):s;i.length===0&&t?.after===void 0&&A("push","no-subscriptions-matched");const m=await D(e,i);return{nextCursor:c?i[i.length-1]?.id:void 0,result:m}},N={broadcast:async(e,t)=>{const r={failed:0,outcomes:[],pruned:0,sent:0,total:0};let n=t?.after;const a=t?.limit;if(a!==void 0&&a<=0)return r;for(;;){const s=a===void 0?{...t,after:n}:{...t,after:n,limit:a-r.total},{nextCursor:c,result:i}=await O(e,s);if(r.failed+=i.failed,r.pruned+=i.pruned,r.sent+=i.sent,r.total+=i.total,r.outcomes.push(...i.outcomes),a!==void 0&&r.total>=a||c===void 0||c===n)break;n=c}return r},broadcastPage:O,list:e=>T(e),register:e=>("token"in e||I(),f.put(R(e,void 0,{allowedPushOrigins:o.allowedPushOrigins}))),send:async(e,t)=>{const{error:r,receipt:n}=await E(await _(e),t,!0);if(n===void 0)throw new v("INTERNAL",`@lunora/notify: push send failed: ${r??"unknown error"}`);return n},unregister:e=>f.delete(e)},k=async(e,t)=>{if(h.getProvider(e)===void 0)throw A(e,"channel-not-configured"),new v("BAD_REQUEST",`@lunora/notify: the "${e}" channel is not configured in defineNotify(...)`);const r=await h.sendToChannel(e,t),n=r.successful?"accepted":"failed";return p(e,r.provider,n),n==="failed"&&y(e,r.provider,{error:S(r)}),r};return{notify:{chat:e=>k("chat",e),inApp:e=>k("inapp",e),push:N,send:async e=>{const t=await h.send(e);for(const r of t){const n=r.channel??"unknown",a=r.successful?"accepted":"failed";p(n,r.provider,a),a==="failed"&&y(n,r.provider,{error:S(r)})}return t},webhook:e=>k("webhook",e)},push:N}};export{Y as createNotify};

package/dist/packem_shared/{d1SubscriptionStore-s-AJH4hS.mjs → d1SubscriptionStore-B7f20Nqr.mjs}

@@ -1 +1 @@
-import{LunoraError as p}from"@lunora/errors";import{legacyIdFor as S}from"./fcmId-Dwh_R5xe.mjs";const c=e=>/^[A-Z_]\w*$/i.test(e),E=e=>{const i={createdAt:e.created_at,id:e.id,kind:e.kind,lastSeenAt:e.last_seen_at,userId:e.user_id};if(e.endpoint!==null&&(i.endpoint=e.endpoint),e.p256dh!==null&&e.auth!==null&&(i.keys={auth:e.auth,p256dh:e.p256dh}),e.token!==null&&(i.token=e.token),e.last_status!==null&&(i.lastStatus=e.last_status),e.last_error!==null&&(i.lastError=e.last_error),e.metadata!==null)try{i.metadata=JSON.parse(e.metadata)}catch{}return i},O=(e,i={})=>{const n=i.tableName??"lunora_push_subscriptions";if(!c(n))throw new p("BAD_REQUEST",`@lunora/notify: d1SubscriptionStore tableName "${n}" is not a bare SQL identifier`);let r;const s=()=>(r===void 0&&(r=e.prepare(`CREATE TABLE IF NOT EXISTS ${n} (id TEXT PRIMARY KEY, kind TEXT NOT NULL, endpoint TEXT, p256dh TEXT, auth TEXT, token TEXT, user_id TEXT, metadata TEXT, created_at INTEGER NOT NULL, last_seen_at INTEGER NOT NULL, last_status TEXT, last_error TEXT)`).run().then(()=>e.prepare(`CREATE INDEX IF NOT EXISTS ${n}_user_id_idx ON ${n} (user_id)`).run()).then(()=>e.prepare(`CREATE INDEX IF NOT EXISTS ${n}_kind_idx ON ${n} (kind)`).run()).then(()=>{}),r.catch(()=>{r=void 0})),r),l=async t=>{await s();const a=await e.prepare(`SELECT * FROM ${n} WHERE id = ?1`).bind(t).first();return a===null?void 0:E(a)};return{delete:async t=>{await s(),await e.prepare(`DELETE FROM ${n} WHERE id = ?1`).bind(t).run()},get:l,list:async t=>{await s();const a=[],d=[];t?.kind!==void 0&&(d.push(t.kind),a.push(`kind = ?${d.length.toString()}`)),t?.userId!==void 0&&(t.userId===null?a.push("user_id IS NULL"):(d.push(t.userId),a.push(`user_id = ?${d.length.toString()}`))),t?.after!==void 0&&(d.push(t.after),a.push(`id > ?${d.length.toString()}`));const o=a.length===0?"":` WHERE ${a.join(" AND ")}`,T=" ORDER BY id ASC";let u="";t?.limit!==void 0&&t.limit>0&&(d.push(Math.trunc(t.limit)),u=` LIMIT ?${d.length.toString()}`);const{results:_}=await e.prepare(`SELECT * FROM ${n}${o}${T}${u}`).bind(...d).all();return _.map(h=>E(h))},markStatus:async(t,a,d)=>{await s(),await e.prepare(`UPDATE ${n} SET last_status = ?2, last_error = ?3, last_seen_at = ?4 WHERE id = ?1`).bind(t,a,d??null,Date.now()).run()},put:async t=>{await s(),await e.prepare(`INSERT INTO ${n} (id, kind, endpoint, p256dh, auth, token, user_id, metadata, created_at, last_seen_at, last_status, last_error) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12) ON CONFLICT(id) DO UPDATE SET kind = ?2, endpoint = ?3, p256dh = ?4, auth = ?5, token = ?6, user_id = ?7, metadata = ?8, last_seen_at = ?10`).bind(t.id,t.kind,t.endpoint??null,t.keys?.p256dh??null,t.keys?.auth??null,t.token??null,t.userId??null,t.metadata===void 0?null:JSON.stringify(t.metadata),t.createdAt,t.lastSeenAt,t.lastStatus??null,t.lastError??null).run();const a=S(t);return a!==void 0&&a!==t.id&&await e.prepare(`DELETE FROM ${n} WHERE id = ?1`).bind(a).run(),await l(t.id)??t}}};export{O as d1SubscriptionStore};
+import{LunoraError as p}from"@lunora/errors";import{legacyIdFor as S}from"./fcmId-DNM-rzkd.mjs";const c=e=>/^[A-Z_]\w*$/i.test(e),E=e=>{const i={createdAt:e.created_at,id:e.id,kind:e.kind,lastSeenAt:e.last_seen_at,userId:e.user_id};if(e.endpoint!==null&&(i.endpoint=e.endpoint),e.p256dh!==null&&e.auth!==null&&(i.keys={auth:e.auth,p256dh:e.p256dh}),e.token!==null&&(i.token=e.token),e.last_status!==null&&(i.lastStatus=e.last_status),e.last_error!==null&&(i.lastError=e.last_error),e.metadata!==null)try{i.metadata=JSON.parse(e.metadata)}catch{}return i},O=(e,i={})=>{const n=i.tableName??"lunora_push_subscriptions";if(!c(n))throw new p("BAD_REQUEST",`@lunora/notify: d1SubscriptionStore tableName "${n}" is not a bare SQL identifier`);let r;const s=()=>(r===void 0&&(r=e.prepare(`CREATE TABLE IF NOT EXISTS ${n} (id TEXT PRIMARY KEY, kind TEXT NOT NULL, endpoint TEXT, p256dh TEXT, auth TEXT, token TEXT, user_id TEXT, metadata TEXT, created_at INTEGER NOT NULL, last_seen_at INTEGER NOT NULL, last_status TEXT, last_error TEXT)`).run().then(()=>e.prepare(`CREATE INDEX IF NOT EXISTS ${n}_user_id_idx ON ${n} (user_id)`).run()).then(()=>e.prepare(`CREATE INDEX IF NOT EXISTS ${n}_kind_idx ON ${n} (kind)`).run()).then(()=>{}),r.catch(()=>{r=void 0})),r),l=async t=>{await s();const a=await e.prepare(`SELECT * FROM ${n} WHERE id = ?1`).bind(t).first();return a===null?void 0:E(a)};return{delete:async t=>{await s(),await e.prepare(`DELETE FROM ${n} WHERE id = ?1`).bind(t).run()},get:l,list:async t=>{await s();const a=[],d=[];t?.kind!==void 0&&(d.push(t.kind),a.push(`kind = ?${d.length.toString()}`)),t?.userId!==void 0&&(t.userId===null?a.push("user_id IS NULL"):(d.push(t.userId),a.push(`user_id = ?${d.length.toString()}`))),t?.after!==void 0&&(d.push(t.after),a.push(`id > ?${d.length.toString()}`));const o=a.length===0?"":` WHERE ${a.join(" AND ")}`,T=" ORDER BY id ASC";let u="";t?.limit!==void 0&&t.limit>0&&(d.push(Math.trunc(t.limit)),u=` LIMIT ?${d.length.toString()}`);const{results:_}=await e.prepare(`SELECT * FROM ${n}${o}${T}${u}`).bind(...d).all();return _.map(h=>E(h))},markStatus:async(t,a,d)=>{await s(),await e.prepare(`UPDATE ${n} SET last_status = ?2, last_error = ?3, last_seen_at = ?4 WHERE id = ?1`).bind(t,a,d??null,Date.now()).run()},put:async t=>{await s(),await e.prepare(`INSERT INTO ${n} (id, kind, endpoint, p256dh, auth, token, user_id, metadata, created_at, last_seen_at, last_status, last_error) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12) ON CONFLICT(id) DO UPDATE SET kind = ?2, endpoint = ?3, p256dh = ?4, auth = ?5, token = ?6, user_id = ?7, metadata = ?8, last_seen_at = ?10`).bind(t.id,t.kind,t.endpoint??null,t.keys?.p256dh??null,t.keys?.auth??null,t.token??null,t.userId??null,t.metadata===void 0?null:JSON.stringify(t.metadata),t.createdAt,t.lastSeenAt,t.lastStatus??null,t.lastError??null).run();const a=S(t);return a!==void 0&&a!==t.id&&await e.prepare(`DELETE FROM ${n} WHERE id = ?1`).bind(a).run(),await l(t.id)??t}}};export{O as d1SubscriptionStore};

package/dist/packem_shared/{defineNotify-CUi2k7pP.mjs → defineNotify-DVPpVkU0.mjs}

@@ -1 +1 @@
-const t=e=>{if(e.webPush!==void 0&&typeof e.webPush!="function"&&typeof e.webPush!="object")throw new TypeError("defineNotify: `webPush` must be a WebPushConfig object or an `(env) => WebPushConfig` function");if(e.fcm!==void 0&&typeof e.fcm!="function"&&typeof e.fcm!="object")throw new TypeError("defineNotify: `fcm` must be an FcmConfig object or an `(env) => FcmConfig` function");if(e.store!==void 0&&typeof e.store!="function")throw new TypeError("defineNotify: `store` must be a function `(env) => SubscriptionStore` when provided");if(e.allowedPushOrigins!==void 0&&(!Array.isArray(e.allowedPushOrigins)||e.allowedPushOrigins.some(o=>typeof o!="string")))throw new TypeError('defineNotify: `allowedPushOrigins` must be an array of origin strings (e.g. ["https://fcm.googleapis.com"]) when provided');if(e.webPush===void 0&&e.fcm===void 0)throw new TypeError("defineNotify: configure at least one push channel — `webPush` and/or `fcm`");return{...e,isLunoraNotify:!0}},r=e=>typeof e=="object"&&e!==null&&e.isLunoraNotify===!0;export{t as defineNotify,r as isNotifyDefinition};
+const t=e=>{if(e.webPush!==void 0&&typeof e.webPush!="function"&&typeof e.webPush!="object")throw new TypeError("defineNotify: `webPush` must be a WebPushConfig object or an `(env) => WebPushConfig` function");if(e.fcm!==void 0&&typeof e.fcm!="function"&&typeof e.fcm!="object")throw new TypeError("defineNotify: `fcm` must be an FcmConfig object or an `(env) => FcmConfig` function");if(e.store!==void 0&&typeof e.store!="function")throw new TypeError("defineNotify: `store` must be a function `(env) => SubscriptionStore` when provided");if(e.allowedPushOrigins!==void 0&&(!Array.isArray(e.allowedPushOrigins)||e.allowedPushOrigins.some(o=>typeof o!="string")))throw new TypeError('defineNotify: `allowedPushOrigins` must be an array of origin strings (e.g. ["https://fcm.googleapis.com"]) when provided');for(const o of["broadcastPageSize","concurrency"]){const r=e[o];if(r!==void 0&&(!Number.isInteger(r)||r<1))throw new TypeError(`defineNotify: \`${o}\` must be a positive integer when provided`)}if(e.webPush===void 0&&e.fcm===void 0)throw new TypeError("defineNotify: configure at least one push channel — `webPush` and/or `fcm`");return{...e,isLunoraNotify:!0}},i=e=>typeof e=="object"&&e!==null&&e.isLunoraNotify===!0;export{t as defineNotify,i as isNotifyDefinition};

package/dist/packem_shared/{fcmId-Dwh_R5xe.mjs → fcmId-DNM-rzkd.mjs}

@@ -1 +1 @@
-import{LunoraError as s}from"@lunora/errors";import{i as A}from"./ssrf-host-BCpHorGa.mjs";const b=2166136261,_=16777619,m=(t,e=b)=>{let n=e;for(let o=0;o<t.length;o+=1)n^=t.codePointAt(o)??0,n=Math.imul(n,_);return(n>>>0).toString(16).padStart(8,"0")},f=4096,h=t=>{if(t===void 0)return;const e=typeof t=="object"&&t!==null?Object.getPrototypeOf(t):void 0;if(!(typeof t=="object"&&t!==null&&!Array.isArray(t)&&(e===Object.prototype||e===null)))throw new s("BAD_REQUEST","@lunora/notify: register() `metadata` must be a plain object");let o;try{o=JSON.stringify(t)}catch(i){throw new s("BAD_REQUEST",`@lunora/notify: register() \`metadata\` is not JSON-serialisable: ${i instanceof Error?i.message:String(i)}`)}const r=new TextEncoder().encode(o).length;if(r>f)throw new s("BAD_REQUEST",`@lunora/notify: register() \`metadata\` is ${r.toString()} bytes, exceeding the ${f.toString()}-byte cap`);return t},d=t=>t.toString(16).padStart(4,"0"),p=t=>{let e=8997,n=33826,o=40164,r=52210;for(let i=0;i<t.length;i+=1){const a=t.codePointAt(i)??0;e^=a&65535,n^=a>>>16&65535;const c=e*435,y=n*435,E=o*435+e*256,w=r*435+n*256,l=y+(c>>>16),u=E+(l>>>16),S=w+(u>>>16);e=c&65535,n=l&65535,o=u&65535,r=S&65535}return d(r)+d(o)+d(n)+d(e)},T=t=>`wp2_${p(t)}`,O=t=>`fcm2_${p(t)}`,g=t=>m(t),k=t=>`wp_${g(t)}`,v=t=>`fcm_${g(t)}`,U=t=>t.kind==="fcm"?t.token===void 0?void 0:v(t.token):t.endpoint===void 0?void 0:k(t.endpoint),R=t=>{if(typeof t!="string")return t??{};try{return JSON.parse(t)}catch(e){throw new s("BAD_REQUEST",`@lunora/notify: register() web-push subscription is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}},B=(t,e)=>{let n;try{n=new URL(t)}catch{throw new s("BAD_REQUEST",`@lunora/notify: register() web-push \`endpoint\` must be an absolute https URL (got "${t}")`)}if(n.protocol!=="https:")throw new s("BAD_REQUEST",`@lunora/notify: register() web-push \`endpoint\` must use https (got "${n.protocol}")`);if(e!==void 0&&e.length>0){if(!e.includes(n.origin))throw new s("FORBIDDEN",`@lunora/notify: register() web-push endpoint origin "${n.origin}" is not in the configured allowedPushOrigins allowlist`);return}if(A(n.hostname))throw new s("FORBIDDEN",`@lunora/notify: register() web-push endpoint host "${n.hostname}" is a private/internal address; configure allowedPushOrigins to permit a specific origin`)},x=(t,e=Date.now(),n={})=>{if("token"in t){const{token:c}=t;if(typeof c!="string"||c==="")throw new s("BAD_REQUEST","@lunora/notify: register() fcm input requires a non-empty `token`");return{createdAt:e,id:O(c),kind:"fcm",lastSeenAt:e,metadata:h(t.metadata),token:c,userId:t.userId??null}}const o=R(t.subscription),{endpoint:r}=o,i=o.keys?.p256dh,a=o.keys?.auth;if(typeof r!="string"||r===""||typeof i!="string"||typeof a!="string")throw new s("BAD_REQUEST","@lunora/notify: register() web-push subscription requires `endpoint` and `keys.{p256dh, auth}`");return B(r,n.allowedPushOrigins),{createdAt:e,endpoint:r,id:T(r),keys:{auth:a,p256dh:i},kind:"web-push",lastSeenAt:e,metadata:h(t.metadata),userId:t.userId??null}},F=t=>t.kind==="fcm"?t.token??"":JSON.stringify({endpoint:t.endpoint,keys:t.keys}),D=/\bhttp\s*4(?:04|10)\b/iu,I=/\b(?:unregistered|not[\s-]?registered|registration-token-not-registered)\b/iu,N=/\bsubscription (?:is )?(?:gone|expired|no longer valid)\b/iu,Q=t=>t===void 0?!1:D.test(t)||I.test(t)||N.test(t);export{O as fcmId,Q as isGoneError,v as legacyFcmId,U as legacyIdFor,k as legacyWebPushId,x as normalizeRegisterInput,F as targetOf,T as webPushId};
+import{LunoraError as s}from"@lunora/errors";import{i as A}from"./ssrf-host-BCpHorGa.mjs";const b=2166136261,_=16777619,m=(t,e=b)=>{let n=e;for(let o=0;o<t.length;o+=1)n^=t.codePointAt(o)??0,n=Math.imul(n,_);return(n>>>0).toString(16).padStart(8,"0")},d=t=>t.toString(16).padStart(4,"0"),p=t=>{let e=8997,n=33826,o=40164,r=52210;for(let i=0;i<t.length;i+=1){const a=t.codePointAt(i)??0;e^=a&65535,n^=a>>>16&65535;const c=e*435,y=n*435,E=o*435+e*256,w=r*435+n*256,l=y+(c>>>16),u=E+(l>>>16),S=w+(u>>>16);e=c&65535,n=l&65535,o=u&65535,r=S&65535}return d(r)+d(o)+d(n)+d(e)},f=4096,h=t=>{if(t===void 0)return;const e=typeof t=="object"&&t!==null?Object.getPrototypeOf(t):void 0;if(!(typeof t=="object"&&t!==null&&!Array.isArray(t)&&(e===Object.prototype||e===null)))throw new s("BAD_REQUEST","@lunora/notify: register() `metadata` must be a plain object");let o;try{o=JSON.stringify(t)}catch(i){throw new s("BAD_REQUEST",`@lunora/notify: register() \`metadata\` is not JSON-serialisable: ${i instanceof Error?i.message:String(i)}`)}const r=new TextEncoder().encode(o).length;if(r>f)throw new s("BAD_REQUEST",`@lunora/notify: register() \`metadata\` is ${r.toString()} bytes, exceeding the ${f.toString()}-byte cap`);return t},T=t=>`wp2_${p(t)}`,O=t=>`fcm2_${p(t)}`,g=t=>m(t),k=t=>`wp_${g(t)}`,v=t=>`fcm_${g(t)}`,U=t=>t.kind==="fcm"?t.token===void 0?void 0:v(t.token):t.endpoint===void 0?void 0:k(t.endpoint),R=t=>{if(typeof t!="string")return t??{};try{return JSON.parse(t)}catch(e){throw new s("BAD_REQUEST",`@lunora/notify: register() web-push subscription is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}},B=(t,e)=>{let n;try{n=new URL(t)}catch{throw new s("BAD_REQUEST",`@lunora/notify: register() web-push \`endpoint\` must be an absolute https URL (got "${t}")`)}if(n.protocol!=="https:")throw new s("BAD_REQUEST",`@lunora/notify: register() web-push \`endpoint\` must use https (got "${n.protocol}")`);if(e!==void 0&&e.length>0){if(!e.includes(n.origin))throw new s("FORBIDDEN",`@lunora/notify: register() web-push endpoint origin "${n.origin}" is not in the configured allowedPushOrigins allowlist`);return}if(A(n.hostname))throw new s("FORBIDDEN",`@lunora/notify: register() web-push endpoint host "${n.hostname}" is a private/internal address; configure allowedPushOrigins to permit a specific origin`)},x=(t,e=Date.now(),n={})=>{if("token"in t){const{token:c}=t;if(typeof c!="string"||c==="")throw new s("BAD_REQUEST","@lunora/notify: register() fcm input requires a non-empty `token`");return{createdAt:e,id:O(c),kind:"fcm",lastSeenAt:e,metadata:h(t.metadata),token:c,userId:t.userId??null}}const o=R(t.subscription),{endpoint:r}=o,i=o.keys?.p256dh,a=o.keys?.auth;if(typeof r!="string"||r===""||typeof i!="string"||typeof a!="string")throw new s("BAD_REQUEST","@lunora/notify: register() web-push subscription requires `endpoint` and `keys.{p256dh, auth}`");return B(r,n.allowedPushOrigins),{createdAt:e,endpoint:r,id:T(r),keys:{auth:a,p256dh:i},kind:"web-push",lastSeenAt:e,metadata:h(t.metadata),userId:t.userId??null}},F=t=>t.kind==="fcm"?t.token??"":JSON.stringify({endpoint:t.endpoint,keys:t.keys}),D=/\bhttp\s*4(?:04|10)\b/iu,I=/\b(?:unregistered|not[\s-]?registered|registration-token-not-registered)\b/iu,N=/\bsubscription (?:is )?(?:gone|expired|no longer valid)\b/iu,Q=t=>t===void 0?!1:D.test(t)||I.test(t)||N.test(t);export{O as fcmId,Q as isGoneError,v as legacyFcmId,U as legacyIdFor,k as legacyWebPushId,x as normalizeRegisterInput,F as targetOf,T as webPushId};

package/dist/packem_shared/{memorySubscriptionStore-FY8yANEM.mjs → memorySubscriptionStore-DdVxq2zI.mjs}

@@ -1 +1 @@
-import{legacyIdFor as n}from"./fcmId-Dwh_R5xe.mjs";const i=(t,e)=>t.id<e.id?-1:t.id>e.id?1:0,a=(t,e)=>e===void 0?!0:!(e.kind!==void 0&&t.kind!==e.kind||e.userId!==void 0&&(t.userId??null)!==e.userId),c=()=>{const t=new Map;return{delete:e=>(t.delete(e),Promise.resolve()),get:e=>Promise.resolve(t.get(e)),list:e=>{const r=[];for(const d of t.values())a(d,e)&&r.push(d);r.sort(i);const o=e?.after===void 0?r:r.filter(d=>d.id>e.after),s=e?.limit!==void 0&&e.limit>0?o.slice(0,Math.trunc(e.limit)):o;return Promise.resolve(s)},markStatus:(e,r,o)=>{const s=t.get(e);return s!==void 0&&t.set(e,{...s,lastError:o,lastSeenAt:Date.now(),lastStatus:r}),Promise.resolve()},put:e=>{const r=n(e);r!==void 0&&r!==e.id&&t.delete(r);const o=t.get(e.id),s=o===void 0?e:{...o,...e,createdAt:o.createdAt};return t.set(s.id,s),Promise.resolve(s)}}};export{c as memorySubscriptionStore};
+import{legacyIdFor as n}from"./fcmId-DNM-rzkd.mjs";const i=(t,e)=>t.id<e.id?-1:t.id>e.id?1:0,a=(t,e)=>e===void 0?!0:!(e.kind!==void 0&&t.kind!==e.kind||e.userId!==void 0&&(t.userId??null)!==e.userId),c=()=>{const t=new Map;return{delete:e=>(t.delete(e),Promise.resolve()),get:e=>Promise.resolve(t.get(e)),list:e=>{const r=[];for(const d of t.values())a(d,e)&&r.push(d);r.sort(i);const o=e?.after===void 0?r:r.filter(d=>d.id>e.after),s=e?.limit!==void 0&&e.limit>0?o.slice(0,Math.trunc(e.limit)):o;return Promise.resolve(s)},markStatus:(e,r,o)=>{const s=t.get(e);return s!==void 0&&t.set(e,{...s,lastError:o,lastSeenAt:Date.now(),lastStatus:r}),Promise.resolve()},put:e=>{const r=n(e);r!==void 0&&r!==e.id&&t.delete(r);const o=t.get(e.id),s=o===void 0?e:{...o,...e,createdAt:o.createdAt};return t.set(s.id,s),Promise.resolve(s)}}};export{c as memorySubscriptionStore};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/notify",
-  "version": "1.0.0-alpha.30",
+  "version": "1.0.0-alpha.32",
   "description": "Multi-channel notifications for Lunora — ctx.notify / ctx.push over @visulima/notification: edge-safe Web Push + FCM, plus chat, in-app inbox and webhook channels, with subscription storage and queue-backed fan-out",
   "keywords": [
     "cloudflare",
@@ -49,7 +49,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.26",
+    "@lunora/errors": "1.0.0-alpha.28",
     "@visulima/notification": "1.0.12"
   },
   "engines": {

package/dist/packem_shared/createNotify-BDE42tvH.mjs

@@ -1 +0,0 @@
-import{LunoraError as v}from"@lunora/errors";import{buildEngine as F}from"./buildEngine-oDWs9Pom.mjs";import{memorySubscriptionStore as R}from"./memorySubscriptionStore-FY8yANEM.mjs";import{normalizeRegisterInput as z,targetOf as B,isGoneError as L}from"./fcmId-Dwh_R5xe.mjs";const W=250,w=(s,l)=>typeof s=="function"?s(l):s,S=s=>s.successful?void 0:s.errorMessages.join("; "),U=(s,l)=>s.successful?"accepted":L(l)?"gone":"failed",j=async(s,l,d)=>{const u=Array.from({length:s.length});let h=0;const g=async()=>{for(;h<s.length;){const f=h;h+=1,u[f]=await d(s[f])}};return await Promise.all(Array.from({length:Math.min(l,s.length)},()=>g())),u},G=(s,l)=>({allowedPushOrigins:s.allowedPushOrigins,chat:w(s.chat,l),fcm:w(s.fcm,l),inApp:w(s.inApp,l),webhook:w(s.webhook,l),webPush:w(s.webPush,l)}),x=new WeakMap,Q=(s,l)=>{let d=x.get(s);d===void 0&&(d=new WeakMap,x.set(s,d));let u=d.get(l);return u===void 0&&(u={warnedNoPushOriginAllowlist:!1,warnedNoStore:!1},d.set(l,u)),u},Y=(s,l,d={})=>{const u=Q(s,l);let h;d.engine===void 0?(u.engine??=F(G(s,l)),h=u.engine):h=d.engine,u.store??=s.store?.(l);let{store:g}=u;g===void 0&&(u.fallbackStore??=R(),!d.silent&&!u.warnedNoStore&&(u.warnedNoStore=!0,console.warn("@lunora/notify: no `store` configured — using a non-durable in-memory subscription store. Configure `store: (env) => d1SubscriptionStore(env.DB)` for production.")),g=u.fallbackStore);const f=g,C=Math.max(1,d.concurrency??10),b=Math.max(1,d.broadcastPageSize??W),{log:M,metrics:P}=d,p=(e,t,r,n=1)=>{P?.count("notify.send",n,{channel:e,provider:t??e,status:r})},y=(e,t,r)=>{M?.warn(`notify ${e} delivery failed`,{channel:e,provider:t??e,status:"failed",...r})},A=(e,t)=>{P?.count("notify.skipped",1,{channel:e,reason:t})},I=()=>{const e=s.allowedPushOrigins!==void 0&&s.allowedPushOrigins.length>0;d.silent||e||u.warnedNoPushOriginAllowlist||(u.warnedNoPushOriginAllowlist=!0,console.warn("@lunora/notify: Web Push registered without `allowedPushOrigins` — endpoints are guarded by a string classifier at register time and a best-effort DNS re-check at send time, both of which are defeatable. Set `allowedPushOrigins` to the exact push-service origins for a hard guarantee."))},T=async e=>(await f.list(e)).map(({keys:r,token:n,...a})=>a),_=async e=>{if(typeof e!="string")return e;const t=await f.get(e);if(t===void 0)throw new v("BAD_REQUEST",`@lunora/notify: no registered subscription with id "${e}"`);return t},E=async(e,t,r)=>{let n,a,o;try{n=await h.sendToChannel("push",{...t,to:B(e)}),a=S(n),o=U(n,a)}catch(c){o="failed",a=c instanceof Error?c.message:String(c)}try{o==="accepted"?await f.markStatus(e.id,"ok"):o==="gone"?await f.delete(e.id):await f.markStatus(e.id,"failed",a)}catch{}return o==="failed"&&y("push",e.kind,{error:a,subscriptionId:e.id,userId:e.userId??null}),r&&p("push",e.kind,o),{error:a,receipt:n,status:o}},D=async(e,t)=>{const r=await j(t,C,async o=>{const{error:c,status:i}=await E(o,e,!1);return{error:c,kind:o.kind,status:i,subscription:o}}),n=new Map;for(const{kind:o,status:c}of r){const i=`${o} ${c}`,m=n.get(i);m===void 0?n.set(i,{count:1,kind:o,status:c}):m.count+=1}for(const{count:o,kind:c,status:i}of n.values())p("push",c,i,o);const a=r.map(({error:o,status:c,subscription:i})=>c==="accepted"?{id:i.id,status:"ok"}:c==="gone"?{error:o,id:i.id,status:"expired"}:{error:o,id:i.id,status:"failed"});return{failed:a.filter(o=>o.status==="failed").length,outcomes:a,pruned:a.filter(o=>o.status==="expired").length,sent:a.filter(o=>o.status==="ok").length,total:a.length}},O=async(e,t)=>{if(t?.limit!==void 0&&t.limit<=0)return{nextCursor:void 0,result:{failed:0,outcomes:[],pruned:0,sent:0,total:0}};const r=t?.limit!==void 0&&t.limit>0?Math.trunc(t.limit):void 0,n=r===void 0?b:Math.min(r,b),a=await f.list({after:t?.after,kind:t?.kind,limit:n+1,userId:t?.userId}),o=t?.after===void 0?a:a.filter($=>$.id>t.after),c=o.length>n,i=c?o.slice(0,n):o;i.length===0&&t?.after===void 0&&A("push","no-subscriptions-matched");const m=await D(e,i);return{nextCursor:c?i[i.length-1]?.id:void 0,result:m}},N={broadcast:async(e,t)=>{const r={failed:0,outcomes:[],pruned:0,sent:0,total:0};let n=t?.after;const a=t?.limit;if(a!==void 0&&a<=0)return r;for(;;){const o=a===void 0?{...t,after:n}:{...t,after:n,limit:a-r.total},{nextCursor:c,result:i}=await O(e,o);if(r.failed+=i.failed,r.pruned+=i.pruned,r.sent+=i.sent,r.total+=i.total,r.outcomes.push(...i.outcomes),a!==void 0&&r.total>=a||c===void 0||c===n)break;n=c}return r},broadcastPage:O,list:e=>T(e),register:e=>("token"in e||I(),f.put(z(e,void 0,{allowedPushOrigins:s.allowedPushOrigins}))),send:async(e,t)=>{const{error:r,receipt:n}=await E(await _(e),t,!0);if(n===void 0)throw new v("INTERNAL",`@lunora/notify: push send failed: ${r??"unknown error"}`);return n},unregister:e=>f.delete(e)},k=async(e,t)=>{if(h.getProvider(e)===void 0)throw A(e,"channel-not-configured"),new v("BAD_REQUEST",`@lunora/notify: the "${e}" channel is not configured in defineNotify(...)`);const r=await h.sendToChannel(e,t),n=r.successful?"accepted":"failed";return p(e,r.provider,n),n==="failed"&&y(e,r.provider,{error:S(r)}),r};return{notify:{chat:e=>k("chat",e),inApp:e=>k("inapp",e),push:N,send:async e=>{const t=await h.send(e);for(const r of t){const n=r.channel??"unknown",a=r.successful?"accepted":"failed";p(n,r.provider,a),a==="failed"&&y(n,r.provider,{error:S(r)})}return t},webhook:e=>k("webhook",e)},push:N}};export{Y as createNotify};