@mpgd/game-services 0.26.0 → 0.27.1

package/dist/notifications/fcm.js

@@ -16,7 +16,10 @@ import { fcmInstallationIdRefusal, } from './delivery-provider.js';
  * names the iOS category `mpgd-advertising`, whose opt-out action the app
  * registers; an Android FCM notification message cannot carry actions, and
  * the Capacitor shell does not render advertising natively yet. An expiry
- * becomes `android.ttl` and the `apns-expiration` header.
+ * becomes `android.ttl` and the `apns-expiration` header. A replay of the
+ * same send key sets `android.collapse_key` and `apns-collapse-id` so a
+ * crash after HTTP 200, before the ledger write, does not show a second
+ * notification.
  */
 export const fcmMessagingScope = 'https://www.googleapis.com/auth/firebase.messaging';
 export const fcmTokenEndpoint = 'https://oauth2.googleapis.com/token';
@@ -37,6 +40,11 @@ export const fcmAdvertisingCategory = 'mpgd-advertising';
  * not refused for its size.
  */
 const maxPayloadBytes = 3840;
+/**
+ * `android.collapse_key` and `apns-collapse-id` are at most 64 bytes. The
+ * id is the SHA-256 of the send key, which is 64 hex characters.
+ */
+export const fcmCollapseIdBytes = 64;
 /** The longest `Retry-After` this provider passes on; the service gives up after a day anyway. */
 const maxRetryAfterSeconds = 86_400;
 /** How long a refused grant or an unusable key answers without asking Google again. */
@@ -307,22 +315,28 @@ export function buildFcmMessage(request) {
             code: 'MESSAGE_EXPIRED',
         };
     }
+    // Same id on both transports: a replay of this send replaces the first
+    // instead of showing beside it. Collapse is per token, so two devices of
+    // one send do not hide each other.
+    const collapseId = fcmCollapseId(request.sendKey);
     const android = {
+        collapse_key: collapseId,
         ...(expiresAt === undefined ? {} : { ttl: `${Math.floor((expiresAt - at) / 1000)}s` }),
         notification: { channel_id: channelId },
     };
     const category = request.topic.purpose === 'advertising' ? fcmAdvertisingCategory : undefined;
     const apns = {
-        ...(expiresAt === undefined
-            ? {}
-            : { headers: { 'apns-expiration': String(Math.floor(expiresAt / 1000)) } }),
+        headers: {
+            'apns-collapse-id': collapseId,
+            ...(expiresAt === undefined ? {} : { 'apns-expiration': String(Math.floor(expiresAt / 1000)) }),
+        },
         ...(category === undefined ? {} : { payload: { aps: { category } } }),
     };
     const payload = {
         notification,
         data: { ...data },
         android,
-        ...(Object.keys(apns).length === 0 ? {} : { apns }),
+        apns,
     };
     // Everything but the token counts toward the size FCM and APNs carry.
     const payloadBytes = new TextEncoder().encode(JSON.stringify(payload)).length;
@@ -600,3 +614,91 @@ function retryAfterOf(response, now) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/**
+ * Collapse id for one send key: SHA-256 hex, exactly 64 bytes, so it fits
+ * `android.collapse_key` and `apns-collapse-id`. Sync because
+ * `buildFcmMessage` is sync; Workers have no sync WebCrypto digest.
+ */
+export function fcmCollapseId(sendKey) {
+    const hex = sha256Hex(new TextEncoder().encode(sendKey));
+    return hex.length === fcmCollapseIdBytes ? hex : hex.slice(0, fcmCollapseIdBytes);
+}
+const sha256K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+function rotr(value, bits) {
+    return (value >>> bits) | (value << (32 - bits));
+}
+function sha256Hex(data) {
+    const bitLength = data.length * 8;
+    const paddedLength = (Math.floor((data.length + 8) / 64) + 1) * 64;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(data);
+    padded[data.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x100000000));
+    view.setUint32(paddedLength - 4, bitLength >>> 0);
+    let h0 = 0x6a09e667;
+    let h1 = 0xbb67ae85;
+    let h2 = 0x3c6ef372;
+    let h3 = 0xa54ff53a;
+    let h4 = 0x510e527f;
+    let h5 = 0x9b05688c;
+    let h6 = 0x1f83d9ab;
+    let h7 = 0x5be0cd19;
+    const words = new Uint32Array(64);
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let index = 0; index < 16; index += 1) {
+            words[index] = view.getUint32(offset + index * 4);
+        }
+        for (let index = 16; index < 64; index += 1) {
+            const earlier = words[index - 15] ?? 0;
+            const recent = words[index - 2] ?? 0;
+            const s0 = rotr(earlier, 7) ^ rotr(earlier, 18) ^ (earlier >>> 3);
+            const s1 = rotr(recent, 17) ^ rotr(recent, 19) ^ (recent >>> 10);
+            words[index] = ((words[index - 16] ?? 0) + s0 + (words[index - 7] ?? 0) + s1) >>> 0;
+        }
+        let a = h0;
+        let b = h1;
+        let c = h2;
+        let d = h3;
+        let e = h4;
+        let f = h5;
+        let g = h6;
+        let h = h7;
+        for (let index = 0; index < 64; index += 1) {
+            const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const temp1 = (h + s1 + ch + (sha256K[index] ?? 0) + (words[index] ?? 0)) >>> 0;
+            const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (s0 + maj) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        h0 = (h0 + a) >>> 0;
+        h1 = (h1 + b) >>> 0;
+        h2 = (h2 + c) >>> 0;
+        h3 = (h3 + d) >>> 0;
+        h4 = (h4 + e) >>> 0;
+        h5 = (h5 + f) >>> 0;
+        h6 = (h6 + g) >>> 0;
+        h7 = (h7 + h) >>> 0;
+    }
+    return [h0, h1, h2, h3, h4, h5, h6, h7]
+        .map((word) => word.toString(16).padStart(8, '0'))
+        .join('');
+}

package/dist/notifications/service.d.ts

@@ -179,7 +179,10 @@ export interface NotificationService {
   * each endpoint reported, or the host read, for any provider the player
   * can be reached on; a refusal stores nothing. Otherwise the reminder with
   * this key is stored or replaced, and a send of the previous one that
-  * still waits (deferred or in flight) is stopped.
+  * still waits (deferred, or in flight with no live claim) is stopped. A
+  * row a holder has claimed is left so an acceptance the provider already
+  * took can be recorded; that holder does not call the provider if the
+  * reminder was cancelled or replaced before the call.
   */
   setReminder(session: NotificationSession, input: unknown): Promise<{
     readonly status: NotificationReminderSetStatus;

package/dist/notifications/service.js

@@ -1,4 +1,4 @@
-import { assertNotificationConsentRecord, assertNotificationDeployment, assertNotificationEndpointRegistration, assertRecordNotificationNoticeInput, createNotificationNoticeIdempotencyKey, createNotificationReminderIdempotencyKey, evaluateNotificationDelivery, evaluateNotificationReminderConsent, isNotificationTimestamp, isSameNotificationNotice, isValidNotificationTimeZone, latestNotificationConsent, listNotificationNotices, normalizeNotificationTimestamp, NotificationError, notificationKeyIssue, notificationNoticeCopyIssues, notificationNoticeSendFrom, notificationNoticeTopic, notificationProviderCarriesNotices, notificationReservedKeyPrefix, notificationSendFingerprint, notificationTemplateDataIssue, toSeoulCalendarDate, } from '@mpgd/platform/notifications';
+import { assertNotificationConsentRecord, assertNotificationDeployment, assertNotificationEndpointRegistration, assertRecordNotificationNoticeInput, createNotificationNoticeIdempotencyKey, createNotificationReminderIdempotencyKey, evaluateNotificationDelivery, evaluateNotificationReminderConsent, fillNotificationTemplate, isNotificationTimestamp, isSameNotificationNotice, isValidNotificationTimeZone, latestNotificationConsent, listNotificationNotices, normalizeNotificationTimestamp, NotificationError, notificationKeyIssue, notificationNoticeCopyIssues, notificationNoticeSendFrom, notificationNoticeTopic, notificationProviderCarriesNotices, notificationReservedKeyPrefix, notificationSendFingerprint, notificationTemplateDataIssue, toSeoulCalendarDate, } from '@mpgd/platform/notifications';
 import { fcmInstallationIdRefusal, notificationExpiredProviderCode, } from './delivery-provider.js';
 import { notificationHistoryRetentionDays, } from './registry.js';
 import { bestNotificationOutcome, formatNotificationInstant, isNotificationRowAbandoned, isNotificationRowDue, notificationAmbiguousReplayHours, notificationSendOutcome, } from './store.js';
@@ -525,6 +525,8 @@ export function createNotificationService(input) {
         const perProvider = new Map();
         const rows = [];
         const refusals = [];
+        let checked = 0;
+        let hostFailure;
         for (const recipient of recipients) {
             const id = recipient.provider.entry.provider;
             let inputs = perProvider.get(id);
@@ -535,8 +537,23 @@ export function createNotificationService(input) {
             const held = inputs;
             const evaluate = (permission) => decide(request, origin, recipient, consent, held.history, permission, at);
             // One read per provider and send, made only once a recipient needs it.
-            const { decision } = earlyRefusal(recipient.provider, evaluate)
-                ?? evaluate(await (held.permission ??= readServerPermission(recipient.provider, request)));
+            // A host that cannot answer is skipped; the send fails only when no
+            // provider could be checked and none passed.
+            let decision;
+            try {
+                const early = earlyRefusal(recipient.provider, evaluate);
+                decision = early === undefined
+                    ? evaluate(await (held.permission ??= readServerPermission(recipient.provider, request))).decision
+                    : early.decision;
+                checked += 1;
+            }
+            catch (error) {
+                if (error instanceof NotificationError && error.code === 'NOTIFICATIONS_TEMPORARILY_UNAVAILABLE') {
+                    hostFailure ??= error;
+                    continue;
+                }
+                throw error;
+            }
             const row = {
                 key: recipient.rowKey,
                 provider: id,
@@ -562,6 +579,9 @@ export function createNotificationService(input) {
                 refusals.push(decision);
             }
         }
+        if (checked === 0 && rows.length === 0 && hostFailure !== undefined) {
+            throw hostFailure;
+        }
         return { rows, refusals };
     };
     const eligible = (mode, row, at) => {
@@ -630,9 +650,19 @@ export function createNotificationService(input) {
         }
         throw busy(sendKey);
     };
+    /**
+     * True when a reminder send must not reach the provider: its schedule entry
+     * is gone, or names another time or content. Assigned once the reminder
+     * helpers below exist; `runRow` only calls it after this factory returns.
+     * A schedule read that fails counts as stopped, so a cancel is never
+     * outlived by a replay.
+     */
+    let sendWasStopped = async () => false;
     /**
      * Claims one row, runs the gate for it immediately before the provider
      * call, and stores the answer. Answers the row's refusal, if any.
+     * A notice the game recorded since the claim, or a reminder cancelled or
+     * replaced since the claim, is dropped instead of sent.
      */
     const runRow = async (sendKey, provider, rowKey, mode) => {
         let claimed;
@@ -646,15 +676,20 @@ export function createNotificationService(input) {
             if (held.send.origin.kind === 'notice'
                 && !await noticeListed(held.send.request.player, held.send.origin.notice, at)) {
                 // The game gave the notice while the push waited: it is not sent again.
+                // A lost compare-and-set is retried; a row another holder claimed is
+                // left for that holder, which checks again immediately before the call.
                 const rows = rowsWith(held.send, row, { kind: 'remove' });
-                await store.updateSend({
+                const dropped = await store.updateSend({
                     key: sendKey,
                     version: held.version,
                     send: rows.length === 0
                         ? undefined
                         : { ...held.send, rows, changedAt: formatNotificationInstant(at) },
                 });
-                return {};
+                if (dropped) {
+                    return {};
+                }
+                continue;
             }
             const token = newToken();
             // The replay window opens at the first claim that may reach the
@@ -746,6 +781,15 @@ export function createNotificationService(input) {
             await complete(sendKey, row, token, { kind: 'remove' }, at);
             return { refusal: decision.status === 'allowed' ? noEndpoint() : decision };
         }
+        if ((send.origin.kind === 'notice'
+            && !await noticeListed(send.request.player, send.origin.notice, nowMs()))
+            || (send.origin.kind === 'reminder' && await sendWasStopped(send))) {
+            // Recorded, cancelled, or replaced while this claim resolved the
+            // recipient. Drop while the claim still holds; a lost compare-and-set
+            // is retried until it wins or the claim is gone.
+            await complete(sendKey, row, token, { kind: 'remove' }, nowMs());
+            return {};
+        }
         const answer = await callProvider(recipient, send.request, topic, decision, at);
         const answeredAt = nowMs();
         switch (answer.status) {
@@ -774,7 +818,9 @@ export function createNotificationService(input) {
                 // The replay window started at the claim that reached the provider (or an earlier one).
                 const firstAttemptedAt = row.firstAttemptedAt ?? formatNotificationInstant(at);
                 if (isNotificationRowAbandoned({ ...row, firstAttemptedAt }, leaseUntil)) {
-                    report(new Error('Ambiguous answers for a day: the delivery stays in flight and is not replayed again.'), 'dispatch.abandoned', { sendKey, provider: row.provider, rowKey: row.key });
+                    report(new Error(answer.providerCode === undefined
+                        ? 'Ambiguous answers for a day: the delivery stays in flight and is not replayed again.'
+                        : `Ambiguous answers for a day (${answer.providerCode}): the delivery stays in flight and is not replayed again.`), 'dispatch.abandoned', { sendKey, provider: row.provider, rowKey: row.key });
                 }
                 await settleAfterCall(sendKey, row, token, {
                     kind: 'set',
@@ -1208,12 +1254,17 @@ export function createNotificationService(input) {
     });
     /**
      * Stops a reminder's send that still waits: the rows not delivered yet
-     * (deferred, queued, or in flight) are dropped, and a send the scheduler
-     * is still making loses its key, so no row of it is ever stored. Only a
-     * send of `fingerprint` (the reminder's own content) is stopped, since the
-     * send key names only the key and time: a send of other content at the key
-     * belongs to the reminder that replaced this one. A send the provider may
-     * already have accepted cannot be recalled. Answers whether anything waited.
+     * (deferred, queued, or in flight with no live claim) are dropped, and a
+     * send the scheduler is still making loses its key, so no row of it is
+     * ever stored. A row whose claim lease is still live is left: its holder
+     * may already have called the provider, and deleting the row makes
+     * `complete` a no-op, which drops the idempotency key and lets the same
+     * key and time send again. The holder drops the row itself if the reminder
+     * was cancelled or replaced before the call. Only a send of `fingerprint`
+     * (the reminder's own content) is stopped, since the send key names only
+     * the key and time: a send of other content at the key belongs to the
+     * reminder that replaced this one. A send the provider may already have
+     * accepted cannot be recalled. Answers whether anything waited.
      */
     const stopReminderSend = async (player, reminder, fingerprint) => {
         let key;
@@ -1224,24 +1275,50 @@ export function createNotificationService(input) {
             return false;
         }
         for (let attempt = 0; attempt < maxLedgerAttempts; attempt += 1) {
+            const at = nowMs();
             const held = await store.getSend(key);
             if (held === undefined || held.send.origin.kind !== 'reminder' || held.send.fingerprint !== fingerprint) {
                 return false;
             }
             const { send } = held;
-            const kept = send.rows.filter((row) => row.state.status === 'delivered');
+            const kept = send.rows.filter((row) => row.state.status === 'delivered' || liveClaim(row, at));
             if (send.rows.length > 0 && kept.length === send.rows.length) {
                 return false;
             }
             const next = kept.length === 0
                 ? undefined
-                : { ...send, rows: kept, changedAt: formatNotificationInstant(nowMs()) };
+                : { ...send, rows: kept, changedAt: formatNotificationInstant(at) };
             if (await store.updateSend({ key, version: held.version, send: next })) {
                 return true;
             }
         }
         throw busy(key);
     };
+    sendWasStopped = async (send) => {
+        if (send.origin.kind !== 'reminder') {
+            return false;
+        }
+        try {
+            const held = await store.getScheduleEntry({
+                player: send.request.player,
+                id: reminderEntryId(send.origin.key),
+            });
+            const item = held?.entry.item;
+            if (item?.kind !== 'reminder') {
+                return true;
+            }
+            const sameTime = createNotificationReminderIdempotencyKey({
+                player: send.request.player,
+                key: send.origin.key,
+                fireAt: item.fireAt,
+            }) === send.key;
+            return !sameTime || reminderFingerprint(send.request.player, item) !== send.fingerprint;
+        }
+        catch (error) {
+            report(error, 'scheduler.reread', send.key);
+            return true;
+        }
+    };
     /** Moves an entry's due time later after a failure, so a broken item does not fill every run. */
     const deferEntry = async (held, at) => {
         try {
@@ -1319,11 +1396,17 @@ export function createNotificationService(input) {
             await stopReminderSend(player, reminder, made.existing.fingerprint);
             made = await createItemSend(request, { kind: 'reminder', key: reminder.key }, at);
             if (made !== 'busy' && 'existing' in made && made.existing.fingerprint !== fingerprint) {
-                // A row of it was delivered, so the key keeps that send: this
-                // reminder cannot have its own under the same key and time.
-                report(new Error("A delivered send of another reminder holds this reminder's key and time; it is not sent."), 'scheduler.reminder', key);
-                await markFired();
-                return undefined;
+                // A delivered row keeps the key: this reminder cannot have its own
+                // under the same key and time. A merely live claim does not. The
+                // holder drops that row if the reminder was replaced before the
+                // provider call, and marking this one fired would spend it with no
+                // delivery. It stays pending until the claim settles or is dropped.
+                if (made.existing.rows.some((row) => row.state.status === 'delivered')) {
+                    report(new Error("A delivered send of another reminder holds this reminder's key and time; it is not sent."), 'scheduler.reminder', key);
+                    await markFired();
+                    return undefined;
+                }
+                return 'busy';
             }
         }
         if (made === 'busy') {
@@ -1729,8 +1812,9 @@ export function createNotificationService(input) {
                 else {
                     const result = await fireReminder(held, item);
                     if (result === 'busy') {
-                        // Another run holds its send: it waits a minute, so the next
-                        // round does not list it again, and it is not progress. The run
+                        // Another run holds its send, or a live claim of other content
+                        // still occupies the key: it waits a minute, so the next round
+                        // does not list it again, and it is not progress. The run
                         // holding the send then loses its mark to this version, re-reads
                         // the same reminder, and keeps its rows; the next run marks it.
                         await deferEntry(held, nowMs());
@@ -2081,12 +2165,26 @@ export function createNotificationService(input) {
             if (reminder.templateData !== undefined && hostTemplate) {
                 throw invalidInput('A host-template provider keeps template context on the server; a reminder takes no templateData.');
             }
+            // An uncompilable link rule is the deployment's. Every provider that
+            // would deliver the topic is checked, not only until the first
+            // candidate passes: registry order, or a player not reached on that
+            // provider yet, must not schedule a reminder the deployment cannot take.
+            if (reminder.link !== undefined) {
+                for (const provider of declaring) {
+                    const configuration = reminderLinkRuleConfigurationIssue(provider);
+                    if (configuration !== undefined) {
+                        throw invalidInput(`Invalid reminder: ${configuration}`);
+                    }
+                }
+            }
             // Gate steps 3 to 5 at set time: one candidate that passes is enough.
             const consent = await store.listConsent(player);
             const permissions = new Map();
             let refusal;
             let passed = false;
             let mapped = false;
+            let evaluated = false;
+            let hostFailure;
             let linkRefusal;
             for (const recipient of candidates) {
                 const topic = topicFor(recipient.provider, recipient.target, reminder.topic, origin);
@@ -2096,9 +2194,14 @@ export function createNotificationService(input) {
                 mapped = true;
                 // The gate's link step, at set time: a provider whose sends need a
                 // link takes the reminder's (by its mapping rule) or the mapping's.
+                // A link rule that does not compile is the deployment's, and fails
+                // the set even when another provider would pass.
                 const linkIssue = reminderLinkIssue(recipient.provider, topic, reminder.link);
                 if (linkIssue !== undefined) {
-                    linkRefusal ??= linkIssue;
+                    if (linkIssue.configuration) {
+                        throw invalidInput(`Invalid reminder: ${linkIssue.message}`);
+                    }
+                    linkRefusal ??= linkIssue.message;
                     continue;
                 }
                 const id = recipient.provider.entry.provider;
@@ -2107,7 +2210,18 @@ export function createNotificationService(input) {
                     permission = readServerPermission(recipient.provider, request);
                     permissions.set(id, permission);
                 }
-                const serverPermission = await permission;
+                let serverPermission;
+                try {
+                    serverPermission = await permission;
+                    evaluated = true;
+                }
+                catch (error) {
+                    if (error instanceof NotificationError && error.code === 'NOTIFICATIONS_TEMPORARILY_UNAVAILABLE') {
+                        hostFailure ??= error;
+                        continue;
+                    }
+                    throw error;
+                }
                 const refused = evaluateNotificationReminderConsent({
                     entry: recipient.provider.entry,
                     topic,
@@ -2131,9 +2245,15 @@ export function createNotificationService(input) {
                 if (linkRefusal !== undefined) {
                     throw invalidInput(`Invalid reminder: ${linkRefusal}`);
                 }
+                if (!evaluated && hostFailure !== undefined) {
+                    throw hostFailure;
+                }
                 // Mapped for none of the player's targets (or none reached): nothing could deliver it.
                 return { status: mapped ? 'permission-required' : 'unavailable' };
             }
+            // A placeholder the fire would throw on is refused now, before the
+            // previous reminder's send is stopped or this one is written.
+            assertReminderCopyFills(declaring, reminder.topic, reminder.templateData, catalog);
             // One reminder per key: setting it replaces the previous one and, before
             // the write, stops the previous one's send that waits; a scheduler run
             // that fires the previous one meanwhile then fails to mark it and stops
@@ -2268,36 +2388,98 @@ export function createNotificationService(input) {
         },
     };
 }
+/**
+ * Fills every locale copy a free-form provider would send, and a target
+ * mapping's own title and body, with the reminder's template data. A
+ * host-template provider skips catalog copy (the host renders that) but not
+ * a mapping that supplies its own title and body: that text is what the
+ * send renders, ahead of the host template. A placeholder without a value
+ * is `NOTIFICATIONS_INVALID_INPUT` now, not a reminder that is stored and
+ * then dropped when it fires.
+ */
+function assertReminderCopyFills(providers, topicId, templateData, catalog) {
+    const data = templateData ?? {};
+    for (const provider of providers) {
+        const hostTemplate = provider.entry.content === 'host-template';
+        for (const target of provider.targets) {
+            const topic = catalog.topicsFor(target).find((declared) => declared.id === topicId && declared.channels.includes('remote'));
+            if (topic === undefined) {
+                continue;
+            }
+            const mappedTitle = topic.mapping?.['title'];
+            const mappedBody = topic.mapping?.['body'];
+            const mapped = typeof mappedTitle === 'string' && typeof mappedBody === 'string';
+            if (hostTemplate && !mapped) {
+                continue;
+            }
+            const texts = mapped
+                ? [mappedTitle, mappedBody]
+                : topic.copy === undefined
+                    ? []
+                    : Object.values(topic.copy).flatMap((localeCopy) => [localeCopy.title, localeCopy.body]);
+            for (const text of texts) {
+                try {
+                    fillNotificationTemplate(text, data);
+                }
+                catch (error) {
+                    throw invalidInput(`Invalid reminder: ${describe(error)}`, error);
+                }
+            }
+        }
+    }
+}
+/** A holder still owns the row: its claim lease has not ended. */
+function liveClaim(row, at) {
+    return row.state.status === 'in-flight'
+        && row.state.claim !== undefined
+        && Date.parse(row.state.leaseUntil) > at;
+}
 /**
  * Why a reminder's `link` cannot reach the player through `provider`, or
  * `undefined`. A provider whose entry needs a link (Devvit) needs the
  * reminder's or the topic mapping's, as the gate does at send time
  * (`link-missing`), and a given link must match the provider's mapping rule
  * for `link`, so a bad one is refused when it is set rather than spent when
- * it fires.
+ * it fires. A rule that does not compile is a configuration error, not a
+ * pass: an uncompilable pattern must not fail open.
  */
 function reminderLinkIssue(provider, topic, link) {
     if (link !== undefined) {
+        const configuration = reminderLinkRuleConfigurationIssue(provider);
+        if (configuration !== undefined) {
+            return { configuration: true, message: configuration };
+        }
         const pattern = provider.validation.mapping['link']?.pattern;
-        if (pattern !== undefined) {
-            let rule;
-            try {
-                rule = new RegExp(pattern, 'u');
-            }
-            catch {
-                return undefined;
-            }
-            if (!rule.test(link)) {
-                return `link does not match provider ${provider.entry.provider}'s link rule.`;
-            }
+        if (pattern !== undefined && !new RegExp(pattern, 'u').test(link)) {
+            return {
+                configuration: false,
+                message: `link does not match provider ${provider.entry.provider}'s link rule.`,
+            };
         }
         return undefined;
     }
     if (provider.entry.link && typeof topic.mapping?.['link'] !== 'string') {
-        return `provider ${provider.entry.provider} sends need a link, and neither the reminder nor the topic mapping has one.`;
+        return {
+            configuration: false,
+            message: `provider ${provider.entry.provider} sends need a link, and neither the reminder nor the topic mapping has one.`,
+        };
     }
     return undefined;
 }
+/** An uncompilable link rule, or `undefined`. The pattern is the deployment's. */
+function reminderLinkRuleConfigurationIssue(provider) {
+    const pattern = provider.validation.mapping['link']?.pattern;
+    if (pattern === undefined) {
+        return undefined;
+    }
+    try {
+        new RegExp(pattern, 'u');
+        return undefined;
+    }
+    catch (error) {
+        return `provider ${provider.entry.provider}'s link rule does not compile (${describe(error)}).`;
+    }
+}
 /** A scheduler batch: clamped to 1 to 1000; anything that is not a number is the default, 100. */
 function batchLimit(limit) {
     const asked = typeof limit === 'number' && Number.isFinite(limit) ? Math.floor(limit) : 100;
@@ -2602,7 +2784,9 @@ function deliveryAnswerOf(answer) {
                 }
                 : { status: 'rejected', reason: answer.reason };
         case 'ambiguous':
-            return { status: 'ambiguous' };
+            return typeof answer.providerCode === 'string'
+                ? { status: 'ambiguous', providerCode: answer.providerCode.slice(0, 64) }
+                : { status: 'ambiguous' };
         default:
             return undefined;
     }

package/dist/notifications/store-conformance.js

@@ -110,6 +110,8 @@ export async function runNotificationStoreConformance(createStore) {
     equal(Date.parse((await store.getEndpoint({ provider: 'fcm', installationId: 'i-7' }))?.sessionExpiresAt ?? ''), Date.parse(at(60_000)), 'endpoints: only the named session moves');
     equal(await store.extendSessionEndpoints({ sessionId: 'extended' }), 1, 'endpoints: a session that no longer ends clears the end');
     equal((await store.getEndpoint({ provider: 'fcm', installationId: 'i-5' }))?.sessionExpiresAt, undefined, 'endpoints: the cleared end reads back');
+    equal(await store.extendSessionEndpoints({ sessionId: 'extended', expiresAt: at(180_000) }), 0, 'endpoints: a cleared end stays cleared when a later end is reported');
+    equal((await store.getEndpoint({ provider: 'fcm', installationId: 'i-5' }))?.sessionExpiresAt, undefined, 'endpoints: extending a cleared session does not restore an end');
     await store.removeSessionEndpoints({ sessionId: 'extended' });
     await store.removeSessionEndpoints({ sessionId: 'other' });
     equal(await store.removeSessionEndpoints({ sessionId: 'shared' }), 2, 'endpoints: the session end unbinds what it registered');
@@ -203,6 +205,23 @@ export async function runNotificationStoreConformance(createStore) {
         });
     }
     deepEqual(await store.listDueSends({ at: at(100), limit: 2 }), ['k-2', 'k-4'], 'sends: due earliest first, limited');
+    for (const key of ['k-tie-b', 'k-tie-a']) {
+        await store.createSend({
+            ...send,
+            key,
+            request: { ...send.request, idempotencyKey: key },
+            rows: [{
+                    ...send.rows[0],
+                    key: `${key}:i-1`,
+                    state: { status: 'deferred', reason: 'quiet-hours', until: at(5) },
+                }],
+        });
+    }
+    deepEqual(await store.listDueSends({ at: at(5), limit: 10 }), ['k-tie-a', 'k-tie-b'], 'sends: the same due time is ordered by key');
+    for (const key of ['k-tie-a', 'k-tie-b']) {
+        const held = await store.getSend(key);
+        ok(await store.updateSend({ key, version: held?.version ?? '', send: undefined }), 'sends: the tie-break fixtures are removed before purge');
+    }
     // History: one entry per send and provider, read from a time on.
     await store.addHistory({
         sendKey: 'h-1',

package/dist/notifications/store.d.ts

@@ -306,7 +306,11 @@ export interface NotificationStore {
   }): Promise<boolean>;
   /** The player's sends with at least one `in-flight` row. */
   listInFlightSends(player: string): Promise<readonly NotificationStoredSend[]>;
-  /** Up to `limit` send keys with a row due at `at` (`notificationSendDueAt`), earliest first. */
+  /**
+  * Up to `limit` send keys with a row due at `at` (`notificationSendDueAt`),
+  * earliest first, then by key. Equal due times use the same order as the
+  * D1 store (`due_at_ms, send_key`) and a Redis sorted set's score ties.
+  */
   listDueSends(input: {
     readonly at: string;
     readonly limit: number;

package/dist/notifications/store.js

@@ -340,7 +340,7 @@ export function createInMemoryNotificationStore() {
                 const due = notificationSendDueAt(send);
                 return due !== undefined && Date.parse(due) <= now ? [{ key: send.key, due: Date.parse(due) }] : [];
             })
-                .sort((left, right) => left.due - right.due)
+                .sort((left, right) => left.due - right.due || compareCodePoints(left.key, right.key))
                 .slice(0, Math.max(0, limit))
                 .map((entry) => entry.key);
         },