@marktiderman/genesis-chat 0.1.1 → 0.2.0

package/src/server/moderation.ts

@@ -0,0 +1,155 @@
+// @feat:chat
+/**
+ * OpenAI's moderation endpoint behind `Moderator`
+ * (https://developers.openai.com/api/docs/guides/moderation):
+ *
+ *   POST https://api.openai.com/v1/moderations
+ *   { model: "omni-moderation-latest", input: [{ type: "text", text }, { type: "image_url", image_url: { url } }] }
+ *
+ * Each result has `flagged`, `categories`, `category_scores` (0 to 1) and
+ * `category_applied_input_types`. A message's text goes with its first photo;
+ * further photos go one request each (the guide doesn't say how many images one
+ * request takes), and the highest score per category wins.
+ *
+ * Mapping: any category at or over its `hide` threshold → `hidden`; else any at
+ * or over `flag` (or OpenAI's own `flagged`, unless `trustFlagged: false`) →
+ * `flagged`; else `clean`. The reason names the categories and scores, never
+ * the text.
+ */
+import type { ModerateInput, ModerationVerdict, Moderator } from "./types";
+
+export const OPENAI_MODERATIONS_URL = "https://api.openai.com/v1/moderations";
+
+/** The categories omni-moderation scores (text and images, or text only where noted in OpenAI's guide). */
+export const OPENAI_MODERATION_CATEGORIES = [
+  "sexual",
+  "sexual/minors",
+  "harassment",
+  "harassment/threatening",
+  "hate",
+  "hate/threatening",
+  "illicit",
+  "illicit/violent",
+  "self-harm",
+  "self-harm/intent",
+  "self-harm/instructions",
+  "violence",
+  "violence/graphic",
+] as const;
+
+export interface ModerationThresholds {
+  /** At or over: a report for observers (default 0.5). */
+  flag?: number | undefined;
+  /** At or over: the message is hidden from members and reported (default 0.9). */
+  hide?: number | undefined;
+}
+
+export interface OpenAiModeratorOptions {
+  apiKey: string;
+  /** Default `omni-moderation-latest`. */
+  model?: string | undefined;
+  /** Defaults for every category. */
+  thresholds?: ModerationThresholds | undefined;
+  /**
+   * Per category, over the defaults. Default: `sexual/minors` hides at 0.5 and
+   * flags at 0.2; `self-harm/intent` and `self-harm/instructions` flag at 0.3
+   * (a coach should see them) and hide at 0.95.
+   */
+  categories?: Record<string, ModerationThresholds> | undefined;
+  /** Count OpenAI's own `flagged` as at least `flagged` (default true). */
+  trustFlagged?: boolean | undefined;
+  /** Text sent per request (default 10 000 characters, a message's maximum). */
+  maxTextChars?: number | undefined;
+  fetch?: typeof fetch | undefined;
+  timeoutMs?: number | undefined;
+}
+
+const DEFAULT_CATEGORIES: Record<string, ModerationThresholds> = {
+  "sexual/minors": { flag: 0.2, hide: 0.5 },
+  "self-harm/intent": { flag: 0.3, hide: 0.95 },
+  "self-harm/instructions": { flag: 0.3, hide: 0.95 },
+};
+
+interface OpenAiModerationResult {
+  flagged?: boolean;
+  category_scores?: Record<string, number>;
+}
+
+type Input = { type: "text"; text: string } | { type: "image_url"; image_url: { url: string } };
+
+/** Maps category scores to a verdict with the given thresholds (exported for tests and other providers). */
+export function moderationVerdict(
+  scores: Record<string, number>,
+  options: { thresholds?: ModerationThresholds | undefined; categories?: Record<string, ModerationThresholds> | undefined; flagged?: boolean } = {},
+): ModerationVerdict {
+  const flagAt = options.thresholds?.flag ?? 0.5;
+  const hideAt = options.thresholds?.hide ?? 0.9;
+  const per = { ...DEFAULT_CATEGORIES, ...(options.categories ?? {}) };
+  const hidden: string[] = [];
+  const flagged: string[] = [];
+  for (const [category, raw] of Object.entries(scores)) {
+    const score = Number(raw);
+    if (!Number.isFinite(score)) continue;
+    const t = per[category];
+    const label = `${category} ${score.toFixed(2)}`;
+    if (score >= (t?.hide ?? hideAt)) hidden.push(label);
+    else if (score >= (t?.flag ?? flagAt)) flagged.push(label);
+  }
+  if (hidden.length > 0) return { result: "hidden", reason: `Automatic moderation: ${[...hidden, ...flagged].join(", ")}` };
+  if (flagged.length > 0) return { result: "flagged", reason: `Automatic moderation: ${flagged.join(", ")}` };
+  if (options.flagged) return { result: "flagged", reason: "Automatic moderation: flagged by the provider" };
+  return { result: "clean" };
+}
+
+export function openAiModerator(options: OpenAiModeratorOptions): Moderator {
+  const fetchFn = options.fetch ?? fetch;
+  const model = options.model ?? "omni-moderation-latest";
+  const maxText = options.maxTextChars ?? 10_000;
+
+  async function call(input: Input[]): Promise<OpenAiModerationResult[]> {
+    const response = await fetchFn(OPENAI_MODERATIONS_URL, {
+      method: "POST",
+      headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
+      body: JSON.stringify({ model, input }),
+      signal: AbortSignal.timeout(options.timeoutMs ?? 15_000),
+    });
+    if (!response.ok) {
+      await response.body?.cancel().catch(() => {});
+      throw new Error(`OpenAI moderation answered HTTP ${response.status}`);
+    }
+    const body = (await response.json()) as { results?: OpenAiModerationResult[] };
+    if (!Array.isArray(body.results)) throw new Error("OpenAI moderation answered without results");
+    return body.results;
+  }
+
+  return {
+    name: "openai",
+    async moderate({ text, imageUrls }: ModerateInput): Promise<ModerationVerdict> {
+      const requests: Input[][] = [];
+      const first: Input[] = [];
+      const trimmed = text.trim().slice(0, maxText);
+      if (trimmed) first.push({ type: "text", text: trimmed });
+      const [firstImage, ...rest] = imageUrls;
+      if (firstImage) first.push({ type: "image_url", image_url: { url: firstImage } });
+      if (first.length > 0) requests.push(first);
+      for (const url of rest) requests.push([{ type: "image_url", image_url: { url } }]);
+      if (requests.length === 0) return { result: "clean" };
+
+      const scores: Record<string, number> = {};
+      let flagged = false;
+      for (const results of await Promise.all(requests.map(call))) {
+        for (const result of results) {
+          if (result.flagged) flagged = true;
+          for (const [category, score] of Object.entries(result.category_scores ?? {})) {
+            if (typeof score === "number") scores[category] = Math.max(scores[category] ?? 0, score);
+          }
+        }
+      }
+      return moderationVerdict(scores, {
+        thresholds: options.thresholds,
+        categories: options.categories,
+        flagged: flagged && options.trustFlagged !== false,
+      });
+    },
+  };
+}

package/src/server/mux.ts

@@ -0,0 +1,290 @@
+// @feat:chat
+/**
+ * Mux Video behind `VideoProvider` (https://www.mux.com/docs):
+ *
+ *   createUpload   POST /video/v1/uploads: a direct upload, its asset with English
+ *                  auto-generated captions and the passthrough the upload handler
+ *                  sets (the conversation and uploader, never the client's choice)
+ *   remove         DELETE /video/v1/assets/{id}; 404 counts as removed
+ *   handleWebhook  verifies `mux-signature` (HMAC-SHA256 of `t.body`, 5 minutes'
+ *                  tolerance) and applies:
+ *                    video.asset.ready         status ready, provider_id = asset id,
+ *                                              playback_id, duration_ms
+ *                    video.asset.errored       status failed
+ *                    video.asset.track.ready   a generated text track: its plain
+ *                                              text becomes the transcript
+ *                    video.asset.track.errored a generated text track: transcript failed
+ *
+ * The attachment is found only by provider_id: the upload id the client sent
+ * with its message (unique per attachment), or the asset id once ready. An
+ * asset event is applied only when its passthrough names that attachment's
+ * conversation, and its sender when it names one; otherwise it answers 409 and
+ * changes nothing. An event for an attachment not there yet answers 404, so Mux
+ * retries it.
+ */
+import { CHAT_SCHEMA, type ChatSupabase } from "../core/client";
+import { hmacSha256Hex, importRsaPrivateKey, safeEqual, signJwtRs256 } from "./crypto";
+import type { VideoProvider } from "./types";
+import { parseChatUploadPassthrough } from "./upload";
+
+const API = "https://api.mux.com/video/v1";
+const TOLERANCE_SECONDS = 300;
+
+export interface MuxSigningKey {
+  /** The signing key's id (`kid`). */
+  signingKeyId: string;
+  /** The private key as Mux gives it: base64 of a PEM. A PEM works too. */
+  privateKey: string;
+}
+
+export interface MuxVideoOptions {
+  tokenId: string;
+  tokenSecret: string;
+  /** The webhook endpoint's signing secret (Settings → Webhooks). */
+  webhookSecret: string;
+  /** `public` (default) or `signed`; signed playback needs `signing` to build URLs. */
+  playbackPolicy?: "public" | "signed" | undefined;
+  /** Mux's auto-generated captions, kept as the transcript (default English; false turns them off). */
+  captions?: { languageCode?: string; name?: string } | false | undefined;
+  /** For signed playback: fetching generated captions as the transcript. */
+  signing?: MuxSigningKey | undefined;
+  /** Mux `video_quality` (default `basic`). */
+  videoQuality?: "basic" | "plus" | "premium" | undefined;
+  fetch?: typeof fetch | undefined;
+  now?: (() => number) | undefined;
+}
+
+/** Verifies a `mux-signature` header (`t=<unix>,v1=<hex>`) over the raw body. */
+export async function verifyMuxSignature(
+  header: string | null,
+  body: string,
+  secret: string,
+  options: { now?: number; toleranceSeconds?: number } = {},
+): Promise<boolean> {
+  if (!header || !secret) return false;
+  let timestamp: string | null = null;
+  const signatures: string[] = [];
+  for (const part of header.split(",")) {
+    const [k, v] = part.split("=", 2).map((s) => s.trim());
+    if (k === "t" && v) timestamp = v;
+    else if (k === "v1" && v) signatures.push(v.toLowerCase());
+  }
+  if (!timestamp || !/^\d{1,12}$/.test(timestamp) || signatures.length === 0) return false;
+  const now = Math.floor((options.now ?? Date.now()) / 1000);
+  if (Math.abs(now - Number(timestamp)) > (options.toleranceSeconds ?? TOLERANCE_SECONDS)) return false;
+  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
+  let ok = false;
+  for (const signature of signatures) if (await safeEqual(signature, expected)) ok = true;
+  return ok;
+}
+
+/**
+ * A signed playback URL (RS256 JWT with `sub` = playback id, `aud` = v, `kid`
+ * in the header), valid for `expiresInSeconds` (default 6 hours).
+ */
+export async function muxPlaybackUrl(
+  playbackId: string,
+  key: MuxSigningKey,
+  options: { expiresInSeconds?: number; now?: number; path?: string } = {},
+): Promise<string> {
+  const token = await muxPlaybackToken(playbackId, key, options);
+  return `https://stream.mux.com/${playbackId}${options.path ?? ".m3u8"}?token=${token}`;
+}
+
+export async function muxPlaybackToken(
+  playbackId: string,
+  key: MuxSigningKey,
+  options: { expiresInSeconds?: number; now?: number; audience?: "v" | "t" | "g" | "s" } = {},
+): Promise<string> {
+  const now = Math.floor((options.now ?? Date.now()) / 1000);
+  const privateKey = await importRsaPrivateKey(key.privateKey);
+  return signJwtRs256(
+    { kid: key.signingKeyId },
+    { sub: playbackId, aud: options.audience ?? "v", exp: now + (options.expiresInSeconds ?? 6 * 3600) },
+    privateKey,
+  );
+}
+
+interface MuxEvent {
+  type?: string;
+  data?: {
+    id?: string;
+    asset_id?: string;
+    upload_id?: string;
+    passthrough?: string;
+    duration?: number;
+    playback_ids?: { id?: string; policy?: string }[];
+    type?: string;
+    text_source?: string;
+  };
+}
+
+const json = (status: number, body: unknown) =>
+  new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+
+export function muxVideo(options: MuxVideoOptions): VideoProvider & {
+  playbackUrl(playbackId: string, opts?: { expiresInSeconds?: number }): Promise<string>;
+} {
+  const fetchFn = options.fetch ?? fetch;
+  const policy = options.playbackPolicy ?? "public";
+  const captions = options.captions === false ? null : { languageCode: options.captions?.languageCode ?? "en", name: options.captions?.name ?? "English (auto)" };
+  const auth = `Basic ${btoa(`${options.tokenId}:${options.tokenSecret}`)}`;
+
+  async function api(method: string, path: string, body?: unknown): Promise<Response> {
+    return fetchFn(`${API}${path}`, {
+      method,
+      headers: { authorization: auth, accept: "application/json", ...(body ? { "content-type": "application/json" } : {}) },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+      signal: AbortSignal.timeout(15_000),
+    });
+  }
+
+  async function update(supabase: ChatSupabase, id: string, patch: Record<string, unknown>): Promise<void> {
+    const { error } = await supabase.schema(CHAT_SCHEMA).rpc("update_attachment", { p_attachment_id: id, p_patch: patch });
+    if (error) throw new Error(`update_attachment: ${error.code ?? "error"}`);
+  }
+
+  interface FoundAttachment {
+    id: string;
+    conversation_id: string;
+    message_id: string;
+    playback_id: string | null;
+    transcript_status: string | null;
+  }
+
+  /** The attachment an event is about, by provider_id only (the upload id, or the asset id once ready). */
+  async function find(supabase: ChatSupabase, providerIds: (string | undefined)[]): Promise<FoundAttachment | null> {
+    for (const providerId of providerIds) {
+      if (!providerId) continue;
+      const { data, error } = await supabase
+        .schema(CHAT_SCHEMA)
+        .from("attachments")
+        .select("id, conversation_id, message_id, playback_id, transcript_status")
+        .eq("provider", "mux")
+        .eq("provider_id", providerId)
+        .limit(1)
+        .maybeSingle();
+      if (error) throw new Error(`attachments: ${error.code ?? "error"}`);
+      if (data) return data as FoundAttachment;
+    }
+    return null;
+  }
+
+  /** Does the upload's passthrough (set by the upload handler) name this attachment's conversation and sender? */
+  async function boundTo(supabase: ChatSupabase, attachment: FoundAttachment, passthrough: string | undefined): Promise<boolean> {
+    const binding = parseChatUploadPassthrough(passthrough);
+    if (!binding || binding.conversationId !== String(attachment.conversation_id).toLowerCase()) return false;
+    if (!binding.userId) return true;
+    const { data, error } = await supabase.schema(CHAT_SCHEMA).from("messages").select("sender_id").eq("id", attachment.message_id).maybeSingle();
+    if (error) throw new Error(`messages: ${error.code ?? "error"}`);
+    const sender = (data as { sender_id: string | null } | null)?.sender_id;
+    return typeof sender === "string" && sender.toLowerCase() === binding.userId;
+  }
+
+  async function transcriptOf(playbackId: string, trackId: string): Promise<string | null> {
+    let url = `https://stream.mux.com/${playbackId}/text/${trackId}.txt`;
+    if (policy === "signed") {
+      if (!options.signing) return null;
+      url += `?token=${await muxPlaybackToken(playbackId, options.signing, { expiresInSeconds: 600 })}`;
+    }
+    const response = await fetchFn(url, { signal: AbortSignal.timeout(15_000) });
+    if (!response.ok) {
+      await response.body?.cancel().catch(() => {});
+      throw new Error(`Mux text track answered HTTP ${response.status}`);
+    }
+    return (await response.text()).trim();
+  }
+
+  return {
+    name: "mux",
+
+    async createUpload({ corsOrigin, passthrough }) {
+      const response = await api("POST", "/uploads", {
+        cors_origin: corsOrigin,
+        new_asset_settings: {
+          playback_policies: [policy],
+          video_quality: options.videoQuality ?? "basic",
+          ...(passthrough ? { passthrough: passthrough.slice(0, 255) } : {}),
+          ...(captions ? { inputs: [{ generated_subtitles: [{ language_code: captions.languageCode, name: captions.name }] }] } : {}),
+        },
+      });
+      if (!response.ok) {
+        await response.body?.cancel().catch(() => {});
+        throw new Error(`Mux uploads answered HTTP ${response.status}`);
+      }
+      const body = (await response.json()) as { data?: { id?: string; url?: string } };
+      if (!body.data?.id || !body.data.url) throw new Error("Mux uploads answered without an upload");
+      return { uploadId: body.data.id, url: body.data.url };
+    },
+
+    async remove(assetId) {
+      const response = await api("DELETE", `/assets/${encodeURIComponent(assetId)}`);
+      await response.body?.cancel().catch(() => {});
+      if (response.ok || response.status === 404) return;
+      throw new Error(`Mux delete asset answered HTTP ${response.status}`);
+    },
+
+    playbackUrl(playbackId, opts) {
+      if (policy !== "signed") return Promise.resolve(`https://stream.mux.com/${playbackId}.m3u8`);
+      if (!options.signing) return Promise.reject(new Error("muxVideo: signed playback needs `signing`"));
+      return muxPlaybackUrl(playbackId, options.signing, opts);
+    },
+
+    async handleWebhook(request, { supabase }) {
+      if (request.method !== "POST") return json(405, { error: "method not allowed" });
+      const body = await request.text();
+      const ok = await verifyMuxSignature(request.headers.get("mux-signature"), body, options.webhookSecret, {
+        ...(options.now ? { now: options.now() } : {}),
+      });
+      if (!ok) return json(401, { error: "bad signature" });
+      let event: MuxEvent;
+      try {
+        event = JSON.parse(body) as MuxEvent;
+      } catch {
+        return json(400, { error: "bad json" });
+      }
+      const data = event.data ?? {};
+      switch (event.type) {
+        case "video.asset.ready":
+        case "video.asset.errored": {
+          const attachment = await find(supabase, [data.upload_id, data.id]);
+          if (!attachment) return json(404, { error: "attachment not found" });
+          // Someone else's upload id on this attachment, or an upload not made for this conversation.
+          if (!(await boundTo(supabase, attachment, data.passthrough))) return json(409, { error: "upload not made for this attachment" });
+          if (event.type === "video.asset.errored") {
+            await update(supabase, attachment.id, { status: "failed", ...(data.id ? { provider_id: data.id } : {}) });
+          } else {
+            const playback = data.playback_ids?.find((p) => p.policy === policy) ?? data.playback_ids?.[0];
+            await update(supabase, attachment.id, {
+              status: "ready",
+              ...(data.id ? { provider_id: data.id } : {}),
+              ...(playback?.id ? { playback_id: playback.id } : {}),
+              ...(typeof data.duration === "number" ? { duration_ms: Math.round(data.duration * 1000) } : {}),
+              // No captions asked for: nothing will fill the transcript.
+              ...(!captions ? { transcript_status: "off" } : {}),
+            });
+          }
+          return json(200, { ok: true });
+        }
+        case "video.asset.track.ready":
+        case "video.asset.track.errored": {
+          if (data.type !== "text" || data.text_source !== "generated_vod") return json(200, { ignored: true });
+          const attachment = await find(supabase, [data.asset_id]);
+          if (!attachment) return json(404, { error: "attachment not found" });
+          if (event.type === "video.asset.track.errored") {
+            await update(supabase, attachment.id, { transcript_status: "failed" });
+            return json(200, { ok: true });
+          }
+          // The asset's ready event comes first; until it has, Mux retries this one.
+          if (!attachment.playback_id || !data.id) return json(404, { error: "no playback id yet" });
+          const text = await transcriptOf(attachment.playback_id, data.id);
+          if (text === null) return json(200, { ignored: "signed playback without a signing key" });
+          await update(supabase, attachment.id, { transcript: text.slice(0, 100_000), transcript_status: "ready" });
+          return json(200, { ok: true });
+        }
+        default:
+          return json(200, { ignored: true });
+      }
+    },
+  };
+}

package/src/server/notifications.ts

@@ -0,0 +1,130 @@
+// @feat:chat
+/**
+ * Chat pushes through genesis-notifications: `notificationsDeliver` hands a
+ * message's `ChatNotification` to `notify()` (one call, every recipient with
+ * their own badge), and `CHAT_NOTIFICATION_TYPES` / `CHAT_NOTIFICATION_CATEGORIES`
+ * go into the app's `defineNotifications` registry. Typed structurally, so
+ * genesis-chat doesn't depend on genesis-notifications; its tests check the
+ * shapes against the real package.
+ *
+ * ```ts
+ * import { notify } from "@marktiderman/genesis-notifications/server";
+ * const deliver = notificationsDeliver({ notify, client: supabase, registry: notifications });
+ * ```
+ *
+ * The preferences, quiet hours, channels and devices are genesis-notifications'.
+ */
+import type { ChatDeliver, ChatNotification } from "./types";
+
+/** The notification type id chat pushes go out as. */
+export const CHAT_NOTIFICATION_TYPE_ID = "chat.message";
+
+/** What `notify()` receives for a chat message (a `NotifyInput<"chat.message">`). */
+export interface ChatNotifyInput {
+  type: string;
+  recipients: { userId: string; badge?: number }[];
+  data: {
+    url: string;
+    conversationId: string;
+    messageId: string;
+    seq: number | null;
+    title: string;
+    body: string;
+    senderId: string | null;
+    senderName?: string;
+    senderAvatar?: string;
+    groupName?: string;
+  };
+
+  idempotencyKey: string;
+  threadKey: string;
+  collapseKey?: string;
+  tenantId?: string;
+}
+
+export interface NotificationsDeliverOptions<Client, Registry> {
+  /** genesis-notifications' `notify` from `@marktiderman/genesis-notifications/server`. */
+  notify: (client: Client, input: ChatNotifyInput, options?: { registry?: Registry }) => Promise<unknown>;
+  /** The service-role client `notify` calls `genesis_notify` through. */
+  client: Client;
+  /** Passed to `notify` as `{ registry }`, so an unknown type fails before the database. */
+  registry?: Registry | undefined;
+  /** Default `chat.message`. `collapseKey` is passed on only when the runner set it (its `collapse` option). */
+  type?: string | undefined;
+  /** The practice or workspace the conversation belongs to, when the app has one. */
+  tenantFor?: ((notification: ChatNotification) => string | null | undefined | Promise<string | null | undefined>) | undefined;
+}
+
+/** Maps a chat push onto genesis-notifications' `notify()` (exported for tests and apps that call notify themselves). */
+export function chatNotifyInput(notification: ChatNotification, options: { type?: string | undefined } = {}): ChatNotifyInput {
+  return {
+    type: options.type ?? CHAT_NOTIFICATION_TYPE_ID,
+    recipients: notification.recipients.map((r) => ({ userId: r.userId, badge: Math.max(0, Math.floor(r.badge)) })),
+    data: {
+      url: notification.data.url,
+      conversationId: notification.conversationId,
+      messageId: notification.messageId,
+      seq: notification.data.seq,
+      title: notification.title,
+      body: notification.body,
+      senderId: notification.senderId,
+      ...(notification.data.senderName ? { senderName: notification.data.senderName } : {}),
+      ...(notification.data.senderAvatar ? { senderAvatar: notification.data.senderAvatar } : {}),
+      ...(notification.data.groupName ? { groupName: notification.data.groupName } : {}),
+    },
+
+    idempotencyKey: notification.idempotencyKey,
+    threadKey: notification.threadKey,
+    ...(notification.collapseKey ? { collapseKey: notification.collapseKey } : {}),
+  };
+}
+
+export function notificationsDeliver<Client, Registry>(options: NotificationsDeliverOptions<Client, Registry>): ChatDeliver {
+  return async (notification) => {
+    const input = chatNotifyInput(notification, options);
+    const tenant = options.tenantFor ? await options.tenantFor(notification) : null;
+    if (tenant) input.tenantId = tenant;
+    return options.registry === undefined
+      ? options.notify(options.client, input)
+      : options.notify(options.client, input, { registry: options.registry });
+  };
+}
+
+/** The `messages` category, for `defineNotifications({ categories })`. */
+export const CHAT_NOTIFICATION_CATEGORIES = {
+  messages: { label: "Messages", description: "New messages in your conversations.", android: { importance: "high" } },
+} as const;
+
+/**
+ * The `chat.message` type, for `defineNotifications({ types })`: in the feed and
+ * pushed, no email unless the app adds it. Spread it and override what you need
+ * (`actions: "message"` with genesis-notifications' `MESSAGE_ACTIONS` for reply
+ * and mark-as-read buttons).
+ */
+export const CHAT_NOTIFICATION_TYPES = {
+  [CHAT_NOTIFICATION_TYPE_ID]: {
+    category: "messages",
+    channels: { in_app: true, push: true },
+    render: (data: Record<string, unknown>) => ({
+      title: typeof data.title === "string" && data.title ? data.title : "New message",
+      ...(typeof data.body === "string" && data.body ? { body: data.body } : {}),
+      ...(typeof data.url === "string" ? { url: data.url } : {}),
+      // iOS rich push (genesis-chat/push's chatPushPayload fields): ids always travel (reply,
+      // mark read); the sender's name and photo and the group only when previews are shown.
+      push: {
+        ids: pick(data, ["conversationId", "messageId", "seq", "senderId"]),
+        display: pick(data, ["senderName", "senderAvatar", "groupName"]),
+        mutableContent: typeof data.senderName === "string" && data.senderName !== "",
+      },
+    }),
+  },
+} as const;
+
+function pick(data: Record<string, unknown>, keys: readonly string[]): Record<string, string | number> {
+  const out: Record<string, string | number> = {};
+  for (const k of keys) {
+    const v = data[k];
+    if (typeof v === "string" ? v !== "" : typeof v === "number" && Number.isFinite(v)) out[k] = v as string | number;
+  }
+  return out;
+}