@marktiderman/genesis-notifications 0.0.0-stage → 0.1.0

package/dist/server.js

@@ -0,0 +1,995 @@
+import { assertNoSecrets, recipientsToJson } from './chunk-7PHA3WVG.js';
+import { createRunner, failureOf } from './chunk-UXNWI7OS.js';
+
+// src/server/store.ts
+var NotificationStoreError = class extends Error {
+  constructor(operation, code) {
+    super(`${operation} failed${code ? ` (${code})` : ""}`);
+    this.operation = operation;
+    this.code = code;
+    this.name = "NotificationStoreError";
+  }
+  operation;
+  code;
+};
+function supabaseNotificationStore(client) {
+  const call = async (fn, args) => {
+    const { data, error } = await client.rpc(fn, args);
+    if (error) throw new NotificationStoreError(fn, error.code ?? null);
+    return data;
+  };
+  return {
+    claim: (channel, limit, leaseSeconds, maxAttempts = 8) => call("genesis_notifications_claim", { p_channel: channel, p_limit: limit, p_lease_seconds: leaseSeconds, p_max_attempts: maxAttempts }).then((rows) => rows ?? []),
+    async storeRendered(id, claimId, rendered, hash) {
+      const rows = await call("genesis_notifications_store_rendered", { p_id: id, p_claim: claimId, p_rendered: rendered, p_hash: hash });
+      const row = rows?.[0];
+      return row?.rendered && row.rendered_hash ? { rendered: row.rendered, hash: row.rendered_hash } : null;
+    },
+    settle: (id, claimId, outcome) => call("genesis_notifications_settle", { p_id: id, p_claim: claimId, p_outcome: outcome }).then(Boolean),
+    recordProviderId: (id, claimId, providerId) => call("genesis_notifications_record_provider_id", { p_id: id, p_claim: claimId, p_provider_id: providerId }).then(Boolean),
+    async pushTickets(deliveryId, tickets) {
+      await call("genesis_notifications_push_tickets", { p_delivery: deliveryId, p_tickets: tickets });
+    },
+    receiptsClaim: (limit) => call("genesis_notifications_receipts_claim", { p_limit: limit }).then((r) => r ?? []),
+    async receiptsSettle(results) {
+      await call("genesis_notifications_receipts_settle", { p_results: results });
+    },
+    emailEvent: (providerId, event, permanent) => call("genesis_notifications_email_event", { p_provider_id: providerId, p_event: event, p_permanent: permanent }).then(Boolean),
+    unsubscribe: (userId, emailHash2, category, tenantId) => call("genesis_notifications_unsubscribe", { p_user_id: userId, p_email_hash: emailHash2, p_category: category, p_tenant_id: tenantId }).then(Boolean),
+    syncTypes: (rows) => call("genesis_notifications_sync_types", { p_rows: rows })
+  };
+}
+
+// src/server/notify.ts
+async function notify(client, input, options = {}) {
+  const t = options.registry?.type(input.type);
+  if (input.secret !== void 0 && t && !t.secretLink) throw new Error(`notify: type ${input.type} carries no secret link`);
+  if (input.secret !== void 0 && input.recipients.length !== 1) throw new Error("notify: a secret goes to exactly one recipient");
+  if (!input.idempotencyKey || input.idempotencyKey.length > 200) throw new Error("notify: an idempotency key of 1 to 200 characters is required");
+  assertNoSecrets(input.data);
+  if (input.badge !== void 0 && (!Number.isInteger(input.badge) || input.badge < 0)) throw new Error("notify: badge is a whole number, 0 or more");
+  const { data, error } = await client.rpc("genesis_notify", {
+    p_type: input.type,
+    p_recipients: recipientsToJson(input.recipients),
+    p_data: input.data ?? {},
+    p_idempotency_key: input.idempotencyKey,
+    p_thread_key: input.threadKey ?? null,
+    p_collapse_key: input.collapseKey ?? null,
+    p_badge: input.badge ?? null,
+    p_tenant_id: input.tenantId ?? null,
+    p_brand: input.brand ?? null,
+    p_secret: input.secret ?? null
+  });
+  if (error) throw new NotificationStoreError("genesis_notify", error.code ?? null);
+  return (data ?? []).map((r) => ({
+    notificationId: r.notification_id,
+    recipientKey: r.recipient_key,
+    created: r.created
+  }));
+}
+async function cancelNotification(client, input) {
+  if (!input.type) throw new Error("cancelNotification: a type is required");
+  if (!input.idempotencyKey || input.idempotencyKey.length > 200) throw new Error("cancelNotification: an idempotency key of 1 to 200 characters is required");
+  const { data, error } = await client.rpc("genesis_notifications_cancel", {
+    p_type: input.type,
+    p_idempotency_key: input.idempotencyKey,
+    p_tenant_id: input.tenantId ?? null,
+    p_recipients: input.recipients ? recipientsToJson(input.recipients) : null,
+    p_archive: input.archive ?? false
+  });
+  if (error) throw new NotificationStoreError("genesis_notifications_cancel", error.code ?? null);
+  const row = Array.isArray(data) ? data[0] : data;
+  return { cancelled: Number(row?.cancelled ?? 0), archived: Number(row?.archived ?? 0) };
+}
+async function syncNotificationTypes(client, registry) {
+  const { data, error } = await client.rpc("genesis_notifications_sync_types", { p_rows: registry.toTypeRows() });
+  if (error) throw new NotificationStoreError("genesis_notifications_sync_types", error.code ?? null);
+  return Number(data ?? 0);
+}
+
+// src/server/email-render.ts
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function headerSafe(text, max = 200) {
+  const flat = text.replace(/[\u0000-\u001f\u007f\u2028\u2029]+/g, " ").replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+}
+function isSafeAddress(value) {
+  return typeof value === "string" && value.length <= 254 && /^[^\s@<>,;:"()[\]\\]+@[^\s@<>,;:"()[\]\\]+\.[^\s@<>,;:"()[\]\\]+$/.test(value) && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function displayName(name) {
+  return headerSafe(name.replace(/["<>()[\]:;@,\\]/g, ""), 100);
+}
+var defaultEmailTemplate = (ctx) => {
+  const title = ctx.text.title;
+  const body = ctx.text.body ?? "";
+  const link = ctx.secretLink ?? ctx.url;
+  const accent = typeof ctx.brand.color === "string" && /^#[0-9a-fA-F]{3,8}$/.test(ctx.brand.color) ? ctx.brand.color : "#111827";
+  const from = ctx.brand.name ? escapeHtml(ctx.brand.name) : "";
+  const p = "font-family:sans-serif;font-size:15px;line-height:1.5;margin:0 0 16px;color:#111827";
+  const html = `<!doctype html><html><body style="margin:0;padding:24px;background:#f9fafb"><div style="max-width:560px;margin:0 auto;background:#ffffff;border-radius:8px;padding:24px">` + (from ? `<p style="${p};font-weight:600;color:${accent}">${from}</p>` : "") + `<p style="${p};font-size:18px;font-weight:600">${escapeHtml(title)}</p>` + (body ? `<p style="${p};white-space:pre-wrap">${escapeHtml(body)}</p>` : "") + (link ? `<p style="${p}"><a href="${escapeHtml(link)}" style="display:inline-block;background:${accent};color:#ffffff;padding:10px 16px;border-radius:6px;text-decoration:none">Open</a></p>` : "") + (ctx.unsubscribeUrl ? `<p style="${p};font-size:12px;color:#6b7280"><a href="${escapeHtml(ctx.unsubscribeUrl)}" style="color:#6b7280">Unsubscribe</a> from these emails.</p>` : "") + `</div></body></html>`;
+  const text = [from, title, body, link ?? "", ctx.unsubscribeUrl ? `Unsubscribe: ${ctx.unsubscribeUrl}` : ""].filter(Boolean).join("\n\n");
+  return { subject: title, html, text };
+};
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+
+// src/server/errors.ts
+var SendError = class extends Error {
+  name = "SendError";
+  retryable;
+  retryAfterSeconds;
+  status;
+  constructor(message, options = {}) {
+    super(message.slice(0, 500));
+    this.retryable = options.retryable ?? false;
+    this.retryAfterSeconds = options.retryAfterSeconds;
+    this.status = options.status;
+  }
+};
+function isRetryableStatus(status) {
+  return status === 408 || status === 425 || status === 429 || status >= 500;
+}
+function retryAfterSeconds(header, fallback = 60, now = Date.now()) {
+  const clamp = (s) => Math.min(86400, Math.max(1, s));
+  const value = header?.trim();
+  if (value && /^\d+$/.test(value)) return clamp(Number(value));
+  if (value && /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(value)) {
+    const at = Date.parse(value);
+    if (Number.isFinite(at)) return clamp(Math.ceil((at - now) / 1e3));
+  }
+  return fallback;
+}
+var REQUEST_TIMEOUT_MS = 1e4;
+async function timedFetch(deps, url, init, signal) {
+  const f = deps.fetch ?? fetch;
+  const timeout = AbortSignal.timeout(deps.timeoutMs ?? REQUEST_TIMEOUT_MS);
+  const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+  try {
+    return await f(url, { ...init, signal: combined });
+  } catch (error) {
+    const name = error?.name;
+    throw new SendError(name === "TimeoutError" || name === "AbortError" ? "Timed out" : "Network error", { retryable: true });
+  }
+}
+function discard(response) {
+  response.body?.cancel().catch(() => {
+  });
+}
+
+// src/server/dns.ts
+var DOMAIN = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+var SENDER_OWNERSHIP_HOST = "_genesis-notifications";
+function senderOwnershipRecord(domain, token) {
+  return { type: "TXT", name: `${SENDER_OWNERSHIP_HOST}.${domain}`, value: `genesis-notifications-verify=${token}` };
+}
+function isReservedDomain(domain, reserved) {
+  const d = domain.toLowerCase().replace(/\.$/, "");
+  return reserved.some((r) => {
+    const x = r?.toLowerCase().replace(/\.$/, "");
+    return !!x && (d === x || d.endsWith(`.${x}`));
+  });
+}
+async function txt(options, name) {
+  const url = new URL(options.resolver ?? "https://cloudflare-dns.com/dns-query");
+  url.searchParams.set("name", name);
+  url.searchParams.set("type", "TXT");
+  const response = await timedFetch(options, url.toString(), { headers: { accept: "application/dns-json" } });
+  if (!response.ok) return [];
+  const json2 = await response.json();
+  return (json2.Answer ?? []).filter((a) => a.type === 16 && typeof a.data === "string").map((a) => a.data.replace(/"\s*"/g, "").replace(/^"|"$/g, ""));
+}
+async function checkSenderDomain(domain, options) {
+  if (!DOMAIN.test(domain)) throw new Error("checkSenderDomain: not a domain name");
+  if (typeof options?.token !== "string" || !/^[0-9a-f]{32}$/.test(options.token)) throw new Error("checkSenderDomain: token is the sender's domain_token");
+  if (!Array.isArray(options.reservedDomains) || options.reservedDomains.length === 0) {
+    throw new Error("checkSenderDomain: reservedDomains (the app's shared sending domains) is required");
+  }
+  const reserved = isReservedDomain(domain, options.reservedDomains);
+  if (reserved) return { ownership: false, spf: false, dkim: false, dmarc: false, reserved: true, ok: false };
+  const include = options.spfInclude ?? "amazonses.com";
+  const proof = senderOwnershipRecord(domain, options.token);
+  const [owner, spf, dkim, dmarc] = await Promise.all([
+    txt(options, proof.name),
+    txt(options, options.spfHost ?? `send.${domain}`),
+    txt(options, `${options.dkimSelector ?? "resend"}._domainkey.${domain}`),
+    txt(options, `_dmarc.${domain}`)
+  ]);
+  const result = {
+    ownership: owner.some((r) => r.trim() === proof.value),
+    spf: spf.some((r) => /^v=spf1\b/i.test(r) && r.toLowerCase().includes(`include:${include}`)),
+    dkim: dkim.some((r) => /(^|;)\s*p=[A-Za-z0-9+/=]{20,}/.test(r)),
+    dmarc: dmarc.some((r) => /^v=DMARC1\b/i.test(r)),
+    reserved: false
+  };
+  return { ...result, ok: result.ownership && result.spf && result.dkim && result.dmarc };
+}
+
+// src/server/expo.ts
+var EXPO_SEND_URL = "https://exp.host/--/api/v2/push/send";
+var EXPO_RECEIPTS_URL = "https://exp.host/--/api/v2/push/getReceipts";
+var EXPO_SEND_BATCH = 100;
+var EXPO_RECEIPTS_BATCH = 1e3;
+function expoErrorCode(value) {
+  const code = value?.details?.error;
+  return typeof code === "string" && /^[A-Za-z_]{1,64}$/.test(code) ? code : "Unknown";
+}
+function refusedOutright(error) {
+  return error instanceof SendError && error.status !== void 0 && error.status >= 400 && error.status < 500 && error.status !== 429;
+}
+function expoPushProvider(options = {}) {
+  const headers = {
+    accept: "application/json",
+    "content-type": "application/json",
+    ...options.accessToken ? { authorization: `Bearer ${options.accessToken}` } : {}
+  };
+  async function post(url, body, signal) {
+    const response = await timedFetch(options, url, { method: "POST", headers, body: JSON.stringify(body) }, signal);
+    if (!response.ok) {
+      const retryAfter = response.status === 429 ? retryAfterSeconds(response.headers.get("retry-after"), 30) : void 0;
+      discard(response);
+      throw new SendError(`Expo push answered HTTP ${response.status}`, {
+        retryable: isRetryableStatus(response.status),
+        status: response.status,
+        ...retryAfter !== void 0 ? { retryAfterSeconds: retryAfter } : {}
+      });
+    }
+    try {
+      return await response.json();
+    } catch {
+      throw new SendError("Expo push answered with something that isn't JSON", { retryable: true });
+    }
+  }
+  return {
+    name: "expo",
+    async send(messages, { signal } = {}) {
+      if (messages.length > EXPO_SEND_BATCH) throw new Error(`expoPushProvider: at most ${EXPO_SEND_BATCH} messages`);
+      if (messages.length === 0) return [];
+      const json2 = await post(options.sendUrl ?? EXPO_SEND_URL, messages, signal);
+      const tickets = Array.isArray(json2?.data) ? json2.data : [];
+      return messages.map((_, i) => {
+        const t = tickets[i];
+        if (t?.status === "ok" && typeof t.id === "string" && t.id.length > 0 && t.id.length <= 128) return { status: "ok", id: t.id };
+        if (t?.status === "error") return { status: "error", code: expoErrorCode(t) };
+        return { status: "error", code: "NoTicket" };
+      });
+    },
+    async receipts(ids, { signal } = {}) {
+      if (ids.length > EXPO_RECEIPTS_BATCH) throw new Error(`expoPushProvider: at most ${EXPO_RECEIPTS_BATCH} ids`);
+      if (ids.length === 0) return {};
+      const json2 = await post(options.receiptsUrl ?? EXPO_RECEIPTS_URL, { ids }, signal);
+      const data = json2?.data && typeof json2.data === "object" && !Array.isArray(json2.data) ? json2.data : {};
+      const out = {};
+      for (const id of ids) {
+        const r = data[id];
+        if (r?.status === "ok") out[id] = { status: "ok" };
+        else if (r?.status === "error") out[id] = { status: "error", code: expoErrorCode(r) };
+      }
+      return out;
+    }
+  };
+}
+
+// src/server/secret-links.ts
+var SecretLinkError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecretLinkError";
+  }
+};
+async function resolveSecretLink(links, type, ref) {
+  const build = Object.prototype.hasOwnProperty.call(links, type) ? links[type] : void 0;
+  if (!build) throw new SecretLinkError(`No secret link builder for type ${type}`);
+  const link = await build(ref);
+  let url;
+  try {
+    url = new URL(link);
+  } catch {
+    throw new SecretLinkError(`The secret link for type ${type} is not a URL`);
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:")) throw new SecretLinkError(`The secret link for type ${type} is not https`);
+  return url.toString();
+}
+var SECRET_LINK_PLACEHOLDER = "https://genesis-secret-link.invalid/";
+
+// src/server/crypto.ts
+var encoder = new TextEncoder();
+function base64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64url(text) {
+  const s = text.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(s + "=".repeat((4 - s.length % 4) % 4));
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+function fromBase64(text) {
+  const bin = atob(text);
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+async function hmacSha256(key, message) {
+  const raw = typeof key === "string" ? encoder.encode(key) : key;
+  const k = await crypto.subtle.importKey("raw", raw, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", k, encoder.encode(message)));
+}
+async function sha256Hex(text) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(text)));
+  return [...digest].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+
+// src/server/unsubscribe.ts
+function emailHash(email) {
+  return sha256Hex(email.trim().toLowerCase());
+}
+function checkSecret(secret) {
+  if (typeof secret !== "string" || secret.length < 32) throw new Error("The unsubscribe secret must be at least 32 characters");
+}
+async function createUnsubscribeToken(secret, claims) {
+  checkSecret(secret);
+  if (claims.emailHash !== void 0 && !/^[0-9a-f]{64}$/.test(claims.emailHash)) throw new Error("createUnsubscribeToken: emailHash is a SHA-256 hex digest (emailHash(address))");
+  const payload = base64url(new TextEncoder().encode(JSON.stringify({ u: claims.userId, h: claims.emailHash, c: claims.category, t: claims.tenantId, v: 2 })));
+  const sig = base64url(await hmacSha256(secret, `unsubscribe.${payload}`));
+  return `${payload}.${sig}`;
+}
+async function verifyUnsubscribeToken(secret, token) {
+  checkSecret(secret);
+  if (typeof token !== "string" || token.length > 2e3) return null;
+  const [payload, sig, extra] = token.split(".");
+  if (!payload || !sig || extra !== void 0) return null;
+  let given;
+  try {
+    given = fromBase64url(sig);
+  } catch {
+    return null;
+  }
+  const expected = await hmacSha256(secret, `unsubscribe.${payload}`);
+  if (!timingSafeEqual(given, expected)) return null;
+  try {
+    const raw = JSON.parse(new TextDecoder().decode(fromBase64url(payload)));
+    if (raw.v !== 2 || typeof raw.c !== "string") return null;
+    const hash = typeof raw.h === "string" && /^[0-9a-f]{64}$/.test(raw.h) ? raw.h : void 0;
+    if (typeof raw.u !== "string" && !hash) return null;
+    return {
+      category: raw.c,
+      ...typeof raw.u === "string" ? { userId: raw.u } : {},
+      ...hash ? { emailHash: hash } : {},
+      ...typeof raw.t === "string" ? { tenantId: raw.t } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function unsubscribeHeaders(url, token) {
+  const link = new URL(url);
+  link.searchParams.set("t", token);
+  return {
+    "List-Unsubscribe": `<${link.toString()}>`,
+    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
+  };
+}
+
+// src/server/runner.ts
+function settleOf(outcome, providerId) {
+  const id = providerId ? { provider_id: providerId } : {};
+  switch (outcome.status) {
+    case "sent":
+      return { status: "sent", provider_id: providerId ?? null };
+    case "filtered":
+      return { status: "filtered" };
+    case "skipped":
+      return { status: "skipped", reason: /^[a-z_]{1,64}$/.test(outcome.reason) ? outcome.reason : "not_sent" };
+    case "failed":
+      return { status: "failed", error: outcome.error, ...id };
+    case "retry":
+      return { status: "retry", error: outcome.error, retry_at: outcome.retryAt.toISOString(), counted: outcome.counted, ...id };
+  }
+}
+function appPath(url) {
+  if (typeof url !== "string" || url.length > 2e3) return null;
+  if (!/^\/(?![/\\])/.test(url) || /[\u0000-\u001f\u007f\s\\]/.test(url)) return null;
+  return url;
+}
+function emptyReport() {
+  return { claimed: 0, sent: 0, filtered: 0, skipped: 0, retrying: 0, deferred: 0, failed: 0, stale: 0, unrecorded: 0 };
+}
+function addReport(a, b) {
+  const out = { ...a };
+  for (const k of Object.keys(out)) out[k] += b[k];
+  return out;
+}
+function createNotificationRunner(options) {
+  const { store, registry } = options;
+  const log = (m) => {
+    try {
+      options.log?.(m);
+    } catch {
+    }
+  };
+  const batch = options.batchSize ?? 100;
+  const lease = options.leaseSeconds ?? 300;
+  const now = () => options.now?.() ?? Date.now();
+  if (options.runBudgetMs !== void 0 && !(options.runBudgetMs >= lease * 1e3)) {
+    throw new Error("createNotificationRunner: runBudgetMs must be at least leaseSeconds (a run would claim jobs it can't finish)");
+  }
+  const email = options.email;
+  if (email) {
+    const needsUnsubscribe = Object.keys(registry.types).some((key) => registry.type(key).channels.email !== void 0 && !registry.type(key).transactional && !registry.isCritical(key));
+    if (needsUnsubscribe && !email.unsubscribe) {
+      throw new Error("createNotificationRunner: a type sends email that isn't transactional, so email.unsubscribe ({ url, secret }) is required");
+    }
+    for (const [key, t] of Object.entries(registry.types)) {
+      if (t.secretLink && !email.secretLinks?.[key]) throw new Error(`createNotificationRunner: type ${key} needs a secret link builder in email.secretLinks`);
+    }
+  }
+  const providerIds = /* @__PURE__ */ new Map();
+  const record = async (job, outcome) => {
+    const providerId = providerIds.get(job.id);
+    providerIds.delete(job.id);
+    return store.settle(job.id, job.claim_id, settleOf(outcome, providerId));
+  };
+  const common = {
+    record,
+    now: options.now,
+    log: options.log,
+    maxAttempts: options.maxAttempts,
+    maxDeferrals: options.maxDeferrals,
+    recordLabel: (job) => `${job.channel} job ${job.id}`
+  };
+  const pushChunk = /* @__PURE__ */ new Map();
+  const leaseEnds = /* @__PURE__ */ new Map();
+  let pushTurn = Promise.resolve();
+  const pushRunner = options.push ? createRunner({
+    ...common,
+    label: (job) => `Push ${job.id}`,
+    claim: async ({ limit }) => {
+      const claimedAt = now();
+      const jobs = await store.claim("push", limit, lease, options.maxAttempts ?? 8);
+      let chunk = 0;
+      let filled = 0;
+      for (const job of jobs) {
+        const n = Math.min(job.devices?.length ?? 0, EXPO_SEND_BATCH);
+        if (filled > 0 && filled + n > EXPO_SEND_BATCH) {
+          chunk++;
+          filled = 0;
+        }
+        filled += n;
+        pushChunk.set(job.id, chunk);
+        leaseEnds.set(job.id, claimedAt + lease * 1e3);
+      }
+      return jobs;
+    },
+    // One group per Expo batch: each is sent, recorded and settled on its own.
+    group: (job) => `push:${pushChunk.get(job.id) ?? 0}`,
+    send: (jobs, { signal }) => {
+      const deadline = Math.min(...jobs.map((j) => leaseEnds.get(j.id) ?? Infinity));
+      for (const j of jobs) {
+        pushChunk.delete(j.id);
+        leaseEnds.delete(j.id);
+      }
+      const mine = pushTurn.then(() => sendPush(jobs, options.push.provider, deadline, signal));
+      pushTurn = mine.catch(() => void 0);
+      return mine;
+    },
+    batchSize: batch
+  }) : null;
+  function flatValues(values) {
+    const out = {};
+    for (const [key, value] of Object.entries(values ?? {})) {
+      if (typeof value === "string" || typeof value === "number" && Number.isFinite(value)) out[key] = value;
+    }
+    return out;
+  }
+  function pushMessage(job, token) {
+    const hidden = job.hide_previews || job.push_privacy === "generic";
+    const rendered = registry.render(job.type, job.data);
+    const text = hidden ? { title: registry.hiddenPreview.title, body: registry.hiddenPreview.body } : rendered;
+    const url = appPath(rendered.url);
+    const extras = { ...flatValues(rendered.push?.ids), ...hidden ? {} : flatValues(rendered.push?.display) };
+    return {
+      to: token,
+      title: text.title,
+      ...text.body ? { body: text.body } : {},
+      data: { ...extras, notification_id: job.notification_id, type: job.type, ...url ? { url } : {}, ...job.thread_key ? { thread_key: job.thread_key } : {} },
+      ...!hidden && rendered.push?.mutableContent ? { mutableContent: true } : {},
+      sound: "default",
+      ...job.badge !== null && job.badge !== void 0 ? { badge: job.badge } : {},
+      channelId: job.category,
+      ...job.ios_category ? { categoryId: job.ios_category } : {},
+      ...job.thread_key ? { threadId: job.thread_key } : {},
+      collapseId: (job.collapse_key ?? job.notification_id).slice(0, 64),
+      tag: (job.collapse_key ?? job.notification_id).slice(0, 64),
+      priority: "high"
+    };
+  }
+  async function sendPush(jobs, provider, deadline, signal) {
+    const lastStart = deadline - REQUEST_TIMEOUT_MS - 5e3;
+    const leaseRunningOut = () => new SendError("lease_running_out", { retryable: true, retryAfterSeconds: 1 });
+    const slots = [];
+    const results = jobs.map((job) => registry.has(job.type) ? null : { ok: false, retryable: false, error: "unknown_type" });
+    jobs.forEach((job, j) => {
+      if (results[j]) return;
+      for (const d of job.devices ?? []) slots.push({ job: j, device: d.id, message: pushMessage(job, d.token) });
+    });
+    const tickets = new Array(slots.length);
+    for (let start = 0; start < slots.length; start += EXPO_SEND_BATCH) {
+      const chunk = slots.slice(start, start + EXPO_SEND_BATCH);
+      if (now() > lastStart) {
+        for (let i = 0; i < chunk.length; i++) tickets[start + i] = leaseRunningOut();
+        continue;
+      }
+      try {
+        const got = await provider.send(chunk.map((s) => s.message), { signal });
+        got.forEach((t, i) => tickets[start + i] = t);
+      } catch (error) {
+        if (refusedOutright(error) && chunk.length > 1) {
+          for (let i = 0; i < chunk.length; i++) {
+            if (now() > lastStart) {
+              tickets[start + i] = leaseRunningOut();
+              continue;
+            }
+            try {
+              tickets[start + i] = (await provider.send([chunk[i].message], { signal }))[0] ?? { status: "error", code: "NoTicket" };
+            } catch (one) {
+              tickets[start + i] = one instanceof SendError ? one : new SendError("Push failed", { retryable: true });
+            }
+          }
+        } else {
+          const e = error instanceof SendError ? error : new SendError("Push failed", { retryable: true });
+          for (let i = 0; i < chunk.length; i++) tickets[start + i] = e;
+        }
+      }
+    }
+    await Promise.all(
+      jobs.map(async (job, j) => {
+        if (results[j]) return;
+        const mine = slots.map((s, i) => ({ s, t: tickets[i] })).filter((x) => x.s.job === j);
+        const rows = mine.filter((x) => !(x.t instanceof SendError)).map(({ s, t }) => {
+          const ticket = t;
+          return ticket.status === "ok" ? { device_id: s.device, ticket_id: ticket.id, status: "sent", error: null } : { device_id: s.device, ticket_id: null, status: "failed", error: ticket.code };
+        });
+        if (rows.length) {
+          try {
+            await store.pushTickets(job.id, rows);
+          } catch {
+            log(`Recording push ${job.id}'s tickets failed`);
+          }
+        }
+        if (rows.some((r) => r.status === "sent")) {
+          results[j] = { ok: true };
+          return;
+        }
+        const httpError = mine.find((x) => x.t instanceof SendError)?.t;
+        if (httpError) {
+          results[j] = failureOf(httpError);
+          return;
+        }
+        const codes = rows.map((r) => r.error);
+        if (codes.length && codes.every((c) => c === "DeviceNotRegistered")) results[j] = { ok: true, notSent: "device_not_registered" };
+        else if (codes.includes("MessageRateExceeded")) results[j] = { ok: false, retryable: true, retryAfterSeconds: 60, error: "Expo: MessageRateExceeded" };
+        else if (!codes.length) results[j] = { ok: true, notSent: "no_devices" };
+        else results[j] = { ok: false, retryable: false, error: `Expo: ${codes.find((c) => c !== "DeviceNotRegistered") ?? "Unknown"}` };
+      })
+    );
+    return results;
+  }
+  const emailRunner = email ? createRunner({
+    ...common,
+    label: (job) => `Email ${job.id}`,
+    claim: ({ limit }) => store.claim("email", limit, lease, options.maxAttempts ?? 8),
+    send: async ([job], { signal }) => [await sendEmail(job, email, signal)],
+    batchSize: batch
+  }) : null;
+  function fromAddress(job, e) {
+    const local = e.localPart ?? "notifications";
+    const shared = job.transactional ? e.domains.transactional : e.domains.other ?? e.domains.transactional;
+    const own = job.sender?.domain_verified && job.sender.domain && !isReservedDomain(job.sender.domain, [e.domains.transactional, e.domains.other]) ? job.sender.domain : null;
+    const domain = own ?? shared;
+    const brandName = typeof job.brand?.["name"] === "string" ? job.brand["name"] : null;
+    const name = displayName(job.sender?.from_name ?? brandName ?? e.appName) || displayName(e.appName);
+    return `${name} <${local}@${domain}>`;
+  }
+  async function render(job, e) {
+    const to = job.email;
+    if (!isSafeAddress(to)) throw new SendError("no_valid_address");
+    const t = registry.type(job.type);
+    let unsubscribeUrl = null;
+    let headers;
+    if (!job.transactional && !job.critical && e.unsubscribe) {
+      const token = await createUnsubscribeToken(e.unsubscribe.secret, {
+        ...job.user_id ? { userId: job.user_id } : { emailHash: await emailHash(to) },
+        category: job.category,
+        ...job.tenant_id ? { tenantId: job.tenant_id } : {}
+      });
+      headers = unsubscribeHeaders(e.unsubscribe.url, token);
+      unsubscribeUrl = headers["List-Unsubscribe"].slice(1, -1);
+    }
+    const text = registry.render(job.type, job.data);
+    const path = appPath(text.url);
+    const url = path && options.appUrl ? new URL(path, new URL(options.appUrl).origin).toString() : null;
+    const template = e.templates?.[job.type] ?? e.defaultTemplate ?? defaultEmailTemplate;
+    const content = await template({
+      type: job.type,
+      category: job.category,
+      data: job.data,
+      text,
+      recipient: { email: to, name: job.recipient_name },
+      brand: job.brand ?? {},
+      tenantId: job.tenant_id,
+      transactional: job.transactional,
+      secretLink: t.secretLink ? SECRET_LINK_PLACEHOLDER : null,
+      unsubscribeUrl,
+      url
+    });
+    const replyTo = job.sender?.reply_to;
+    return {
+      from: fromAddress(job, e),
+      to: [to],
+      ...isSafeAddress(replyTo) ? { reply_to: replyTo } : {},
+      subject: headerSafe(content.subject) || headerSafe(text.title) || "Notification",
+      html: content.html,
+      text: content.text,
+      ...headers ? { headers } : {},
+      tags: [
+        { name: "category", value: job.category.replace(/[^A-Za-z0-9_-]/g, "_") },
+        { name: "stream", value: job.transactional ? "transactional" : "other" }
+      ]
+    };
+  }
+  async function sendEmail(job, e, signal) {
+    try {
+      if (!registry.has(job.type)) return { ok: false, retryable: false, error: "unknown_type" };
+      let rendered = job.rendered;
+      if (rendered) {
+        if (!job.rendered_hash || await sha256Hex(canonicalJson(rendered)) !== job.rendered_hash) {
+          return { ok: false, retryable: false, error: "rendered_email_changed" };
+        }
+      } else {
+        const fresh = await render(job, e);
+        const hash = await sha256Hex(canonicalJson(fresh));
+        const kept = await store.storeRendered(job.id, job.claim_id, fresh, hash);
+        if (!kept) return { ok: false, retryable: true, error: "claim_lost" };
+        rendered = kept.rendered;
+      }
+      let html = rendered.html;
+      let text = rendered.text;
+      if (registry.type(job.type).secretLink) {
+        const link = await resolveSecretLink(e.secretLinks ?? {}, job.type, {
+          data: job.data,
+          secret: job.secret,
+          notificationId: job.notification_id,
+          tenantId: job.tenant_id
+        });
+        html = html.split(SECRET_LINK_PLACEHOLDER).join(escapeHtml(link));
+        text = text.split(SECRET_LINK_PLACEHOLDER).join(link);
+      }
+      const provider = e.providerFor?.(job) ?? e.provider;
+      const result = await provider.send(
+        {
+          from: rendered.from,
+          to: rendered.to,
+          ...rendered.reply_to ? { replyTo: rendered.reply_to } : {},
+          subject: rendered.subject,
+          html,
+          text,
+          ...rendered.headers ? { headers: rendered.headers } : {},
+          ...rendered.tags ? { tags: rendered.tags } : {},
+          idempotencyKey: `genesis-notification-${job.id}`
+        },
+        { signal }
+      );
+      if (result.id) {
+        providerIds.set(job.id, result.id);
+        try {
+          await store.recordProviderId(job.id, job.claim_id, result.id);
+        } catch {
+          log(`Keeping email ${job.id}'s provider id failed; it is kept when it settles`);
+        }
+      }
+      return result.alreadySent ? { ok: true, alreadyThere: true } : { ok: true };
+    } catch (error) {
+      if (error instanceof SendError && error.message === "no_valid_address") return { ok: true, notSent: "no_address" };
+      if (error instanceof Error && error.name === "SecretLinkError") return { ok: false, retryable: false, error: "secret_link_unavailable" };
+      return failureOf(error);
+    }
+  }
+  const none = async () => {
+    throw new Error("This channel isn't configured");
+  };
+  async function drain(r, signal) {
+    const budget = options.runBudgetMs;
+    if (budget === void 0) return r.run({ signal });
+    const started = now();
+    let total = emptyReport();
+    while (budget - (now() - started) >= lease * 1e3 && !signal?.aborted) {
+      const report = await r.run({ signal });
+      total = addReport(total, report);
+      if (report.claimed < batch) break;
+    }
+    return total;
+  }
+  return {
+    async run({ signal } = {}) {
+      const [push, mail] = await Promise.all([pushRunner ? drain(pushRunner, signal) : null, emailRunner ? drain(emailRunner, signal) : null]);
+      return { push, email: mail };
+    },
+    runPush: ({ signal } = {}) => pushRunner ? drain(pushRunner, signal) : none(),
+    runEmail: ({ signal } = {}) => emailRunner ? drain(emailRunner, signal) : none(),
+    async checkReceipts({ signal, budgetMs = 6e4 } = {}) {
+      const provider = options.push?.provider;
+      if (!provider) return { checked: 0, settled: 0 };
+      const started = Date.now();
+      let checked = 0;
+      let settled = 0;
+      for (; ; ) {
+        const due = await store.receiptsClaim(EXPO_RECEIPTS_BATCH);
+        if (!due.length) break;
+        checked += due.length;
+        let receipts;
+        try {
+          receipts = await provider.receipts(due.map((d) => d.ticket_id), { signal });
+        } catch (error) {
+          log(`Push receipts failed: ${error instanceof Error ? error.message : "unknown"}`);
+          break;
+        }
+        const results = due.flatMap((d) => {
+          const r = receipts[d.ticket_id];
+          if (!r) return [];
+          return [{ id: d.id, status: r.status === "ok" ? "delivered" : "failed", error: r.status === "error" ? r.code : null }];
+        });
+        if (results.some((r) => r.error === "InvalidCredentials")) log("Push receipts: InvalidCredentials (the APNs or FCM credentials in EAS are wrong)");
+        if (results.length) await store.receiptsSettle(results);
+        settled += results.length;
+        if (due.length < EXPO_RECEIPTS_BATCH || Date.now() - started > budgetMs) break;
+      }
+      return { checked, settled };
+    }
+  };
+}
+
+// src/server/webhook.ts
+var WEBHOOK_TOLERANCE_SECONDS = 300;
+async function verifyResendWebhook(secret, headers, body, now = Date.now()) {
+  const id = headers.get("svix-id") ?? headers.get("webhook-id");
+  const timestamp = headers.get("svix-timestamp") ?? headers.get("webhook-timestamp");
+  const signatures = headers.get("svix-signature") ?? headers.get("webhook-signature");
+  if (!secret || !id || !timestamp || !signatures || !/^\d{1,12}$/.test(timestamp)) return false;
+  if (Math.abs(now / 1e3 - Number(timestamp)) > WEBHOOK_TOLERANCE_SECONDS) return false;
+  let key;
+  try {
+    key = fromBase64(secret.startsWith("whsec_") ? secret.slice(6) : secret);
+  } catch {
+    return false;
+  }
+  const expected = await hmacSha256(key, `${id}.${timestamp}.${body}`);
+  for (const part of signatures.split(" ")) {
+    const [version, sig] = part.split(",");
+    if (version !== "v1" || !sig) continue;
+    let given;
+    try {
+      given = fromBase64(sig);
+    } catch {
+      continue;
+    }
+    if (timingSafeEqual(given, expected)) return true;
+  }
+  return false;
+}
+function emailEventOf(payload) {
+  const p = payload;
+  const id = p?.data?.email_id;
+  if (typeof id !== "string" || !id || id.length > 200) return null;
+  switch (p?.type) {
+    case "email.delivered":
+      return { providerId: id, event: "delivered", permanent: false };
+    case "email.bounced":
+      return { providerId: id, event: "bounced", permanent: p.data?.bounce?.type === "Permanent" };
+    case "email.complained":
+      return { providerId: id, event: "complained", permanent: true };
+    default:
+      return null;
+  }
+}
+
+// src/server/handler.ts
+var COPY = {
+  title: "Unsubscribe",
+  confirm: "Stop getting these emails?",
+  button: "Unsubscribe",
+  done: "You're unsubscribed. You won't get these emails any more.",
+  invalid: "This link isn't valid any more."
+};
+function page(title, body, status = 200) {
+  const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><title>${escapeHtml(title)}</title></head><body style="font-family:sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5">${body}</body></html>`;
+  return new Response(html, { status, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" } });
+}
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json", "cache-control": "no-store" } });
+}
+function createNotificationsHandler(options) {
+  if (!options.cronSecret || options.cronSecret.length < 32) throw new Error("createNotificationsHandler: cronSecret must be at least 32 characters");
+  const copy = { ...COPY, ...options.copy };
+  const enc = new TextEncoder();
+  const authorized = (request) => {
+    const header = request.headers.get("authorization") ?? "";
+    const given = header.startsWith("Bearer ") ? header.slice(7) : "";
+    return timingSafeEqual(enc.encode(given), enc.encode(options.cronSecret));
+  };
+  const log = (m) => {
+    try {
+      options.log?.(m);
+    } catch {
+    }
+  };
+  return async (request) => {
+    const url = new URL(request.url);
+    const path = url.pathname.replace(/\/+$/, "");
+    try {
+      if (path.endsWith("/run") || path.endsWith("/receipts")) {
+        if (request.method !== "POST") return json({ error: "method_not_allowed" }, 405);
+        if (!authorized(request)) return json({ error: "unauthorized" }, 401);
+        if (path.endsWith("/run")) return json({ ok: true, ...await options.runner.run({ signal: request.signal }) });
+        return json({ ok: true, ...await options.runner.checkReceipts({ signal: request.signal }) });
+      }
+      if (path.endsWith("/webhooks/resend")) {
+        if (request.method !== "POST") return json({ error: "method_not_allowed" }, 405);
+        if (!options.resendWebhookSecret) return json({ error: "not_configured" }, 404);
+        const body = await request.text();
+        if (body.length > 256e3 || !await verifyResendWebhook(options.resendWebhookSecret, request.headers, body)) return json({ error: "bad_signature" }, 401);
+        let payload;
+        try {
+          payload = JSON.parse(body);
+        } catch {
+          return json({ error: "bad_json" }, 400);
+        }
+        const event = emailEventOf(payload);
+        if (!event) return json({ ok: true, ignored: true });
+        const ours = await options.store.emailEvent(event.providerId, event.event, event.permanent);
+        return json({ ok: true, ours });
+      }
+      if (path.endsWith("/unsubscribe")) {
+        if (!options.unsubscribeSecret) return page(copy.title, `<p>${escapeHtml(copy.invalid)}</p>`, 404);
+        const token = url.searchParams.get("t") ?? "";
+        const claims = await verifyUnsubscribeToken(options.unsubscribeSecret, token);
+        if (!claims) return page(copy.title, `<p>${escapeHtml(copy.invalid)}</p>`, 400);
+        if (request.method === "GET") {
+          const action = `?t=${encodeURIComponent(token)}`;
+          return page(
+            copy.title,
+            `<h1 style="font-size:1.25rem">${escapeHtml(copy.confirm)}</h1><form method="post" action="${escapeHtml(action)}"><input type="hidden" name="List-Unsubscribe" value="One-Click"><button type="submit" style="font-size:1rem;padding:.5rem 1rem">${escapeHtml(copy.button)}</button></form>`
+          );
+        }
+        if (request.method !== "POST") return json({ error: "method_not_allowed" }, 405);
+        await options.store.unsubscribe(claims.userId ?? null, claims.userId ? null : claims.emailHash ?? null, claims.category, claims.tenantId ?? null);
+        return page(copy.title, `<p>${escapeHtml(copy.done)}</p>`);
+      }
+      return json({ error: "not_found" }, 404);
+    } catch (error) {
+      log(`notifications handler: ${error instanceof Error ? error.name : "error"} on ${path.split("/").slice(-1)[0]}`);
+      return json({ error: "server_error" }, 500);
+    }
+  };
+}
+
+// src/server/rate.ts
+function defaultSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(signal.reason ?? new Error("Aborted"));
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason ?? new Error("Aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function createRateLimiter(options) {
+  if (!(options.perSecond > 0) || !Number.isFinite(options.perSecond)) throw new Error("createRateLimiter: perSecond must be a positive number");
+  const gap = 1e3 / options.perSecond;
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? defaultSleep;
+  let next = 0;
+  return {
+    async acquire(signal) {
+      const at = Math.max(now(), next);
+      next = at + gap;
+      const wait = at - now();
+      if (wait > 0) await sleep(wait, signal);
+    }
+  };
+}
+
+// src/server/resend.ts
+var RESEND_API = "https://api.resend.com/emails";
+var RESEND_DEFAULT_PER_SECOND = 5;
+function resendProvider(options) {
+  const pace = createRateLimiter({
+    perSecond: options.perSecond ?? RESEND_DEFAULT_PER_SECOND,
+    ...options.now ? { now: options.now } : {},
+    ...options.sleep ? { sleep: options.sleep } : {}
+  });
+  return {
+    name: "resend",
+    async send(message, { signal } = {}) {
+      if (!options.apiKey) throw new SendError("The Resend API key is not set");
+      try {
+        await pace.acquire(signal);
+      } catch {
+        throw new SendError("Timed out", { retryable: true });
+      }
+      const response = await timedFetch(
+        options,
+        options.endpoint ?? RESEND_API,
+        {
+          method: "POST",
+          headers: {
+            authorization: `Bearer ${options.apiKey}`,
+            "content-type": "application/json",
+            "idempotency-key": message.idempotencyKey
+          },
+          body: JSON.stringify({
+            from: message.from,
+            to: message.to,
+            subject: message.subject,
+            html: message.html,
+            text: message.text,
+            ...message.replyTo ? { reply_to: message.replyTo } : {},
+            ...message.headers && Object.keys(message.headers).length ? { headers: message.headers } : {},
+            ...message.tags?.length ? { tags: message.tags } : {}
+          })
+        },
+        signal
+      );
+      if (response.ok) {
+        let id = null;
+        try {
+          const body = await response.json();
+          if (typeof body.id === "string" && body.id.length <= 200) id = body.id;
+        } catch {
+        }
+        return { id };
+      }
+      let name;
+      try {
+        const body = await response.json();
+        if (typeof body.name === "string" && /^[a-z_]{1,64}$/.test(body.name)) name = body.name;
+      } catch {
+        discard(response);
+      }
+      if (response.status === 409 && name === "invalid_idempotent_request") {
+        throw new SendError("idempotency_body_changed: Resend answered 409 (invalid_idempotent_request); a secret link builder must give the same link every time", {
+          retryable: false,
+          status: 409
+        });
+      }
+      if (response.status === 409 && name === "concurrent_idempotent_requests") {
+        throw new SendError("Resend answered 409 (concurrent_idempotent_requests)", { retryable: true, retryAfterSeconds: 5, status: 409 });
+      }
+      const retryable = isRetryableStatus(response.status);
+      throw new SendError(`Resend answered HTTP ${response.status}${name ? ` (${name})` : ""}`, {
+        retryable,
+        status: response.status,
+        ...response.status === 429 || response.status === 503 ? { retryAfterSeconds: retryAfterSeconds(response.headers.get("retry-after"), 30) } : {}
+      });
+    }
+  };
+}
+
+export { EXPO_RECEIPTS_BATCH, EXPO_RECEIPTS_URL, EXPO_SEND_BATCH, EXPO_SEND_URL, NotificationStoreError, REQUEST_TIMEOUT_MS, RESEND_API, RESEND_DEFAULT_PER_SECOND, SECRET_LINK_PLACEHOLDER, SENDER_OWNERSHIP_HOST, SecretLinkError, SendError, WEBHOOK_TOLERANCE_SECONDS, cancelNotification, canonicalJson, checkSenderDomain, createNotificationRunner, createNotificationsHandler, createRateLimiter, createUnsubscribeToken, defaultEmailTemplate, displayName, emailEventOf, emailHash, escapeHtml, expoErrorCode, expoPushProvider, headerSafe, isReservedDomain, isRetryableStatus, isSafeAddress, notify, refusedOutright, resendProvider, resolveSecretLink, retryAfterSeconds, senderOwnershipRecord, supabaseNotificationStore, syncNotificationTypes, unsubscribeHeaders, verifyResendWebhook, verifyUnsubscribeToken };
+//# sourceMappingURL=server.js.map
+//# sourceMappingURL=server.js.map