@ours.network/notifications 0.1.1 → 0.3.0

package/dist/presence.js

@@ -1,157 +1,67 @@
-// BUG-2 foreground-presence: a long-lived WebSocket per ONLINE recipient device.
-//
-// The panel opens a socket to /v1/presence while its PWA is foreground and lets
-// it die when the app closes/backgrounds (the OS tears the socket down on
-// suspend). A live authed socket for recipient R therefore means "R is
-// frontmost right now" — and the daemon SUPPRESSES R's WebPush while such a
-// socket exists (R already sees the message in-app). The socket dropping is the
-// ONLY liveness signal: instant, certain, and needing no message from the
-// client — which is why this survives an abrupt close that an app-level "I'm
-// gone" beacon never could.
-//
-// AUTH: the first frame is an opaque JSON object the daemon's `verify` inspects
-// (in practice { recipient, endpoint, auth } — R's own WebPush credential). The
-// daemon returns the recipient cid the socket is bound to, or null to reject. A
-// forged credential can only suppress that recipient's own pushes, so proving
-// possession of R's subscription is the right strength.
-//
-// LIVENESS of the socket itself: WS ping/pong (transport level, not an app
-// heartbeat) reaps half-open sockets — e.g. an iOS PWA backgrounded on a flaky
-// network whose TCP close hasn't propagated yet — within ~pingIntervalMs.
-import { WebSocketServer } from 'ws';
-// recipient_cid -> its live authed sockets (a recipient may have >1 device).
-export class PresenceRegistry {
-    online = new Map();
-    isOnline(cid) {
-        const s = this.online.get(cid);
-        return s !== undefined && s.size > 0;
-    }
-    add(cid, ws) {
-        let s = this.online.get(cid);
-        if (!s) {
-            s = new Set();
-            this.online.set(cid, s);
-        }
-        s.add(ws);
-    }
-    remove(cid, ws) {
-        const s = this.online.get(cid);
-        if (!s)
-            return false;
-        const had = s.delete(ws);
-        if (s.size === 0)
-            this.online.delete(cid);
-        return had && !this.isOnline(cid);
-    }
-    onlineCount() { return this.online.size; }
-    socketCount() { let n = 0; for (const s of this.online.values())
-        n += s.size; return n; }
-}
-export function attachPresenceServer(server, registry, deps) {
-    const path = deps.path ?? '/v1/presence';
-    const pingIntervalMs = deps.pingIntervalMs ?? 30_000;
-    const authTimeoutMs = deps.authTimeoutMs ?? 5_000;
-    const wss = new WebSocketServer({ noServer: true });
+import { timingSafeEqual } from 'node:crypto';
+import { WebSocket, WebSocketServer } from 'ws';
+const same = (a, b) => { const x = Buffer.from(a), y = Buffer.from(b); return x.length === y.length && timingSafeEqual(x, y); };
+/** Foreground is a property of one verified device, never the whole account. */
+export function attachPresence(server, store, users, options = { intervalMs: 15_000, freshnessMs: 45_000 }) {
+    const sockets = new WebSocketServer({ noServer: true, maxPayload: 4096 });
+    const active = new Map();
     server.on('upgrade', (req, socket, head) => {
-        let pathname = '/';
-        try {
-            pathname = new URL(req.url ?? '/', 'http://localhost').pathname;
-        }
-        catch { /* keep default */ }
-        if (pathname !== path) {
-            socket.destroy();
+        const user = users.find(c => same(req.headers.authorization ?? '', `Bearer ${c.token}`));
+        if (req.url !== '/api/v1/presence' || !user || req.headers.origin || req.headers.cookie || req.headers['sec-fetch-site'] || sockets.clients.size >= 128) {
+            socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
             return;
         }
-        wss.handleUpgrade(req, socket, head, (ws) => wss.emit('connection', ws, req));
-    });
-    wss.on('connection', (ws) => {
-        let boundCid = null;
-        let authed = false;
-        ws.isAlive = true;
-        ws.on('pong', () => { ws.isAlive = true; });
-        const authTimer = setTimeout(() => { if (!authed)
-            ws.close(4001, 'auth timeout'); }, authTimeoutMs);
-        ws.on('message', async (data) => {
-            if (authed)
-                return; // presence is passive after auth; ignore further frames
-            let msg;
-            try {
-                msg = JSON.parse(data.toString());
-            }
-            catch {
-                ws.close(4002, 'bad json');
-                return;
-            }
-            if (typeof msg !== 'object' || msg === null) {
-                ws.close(4003, 'bad auth frame');
-                return;
-            }
-            // Claim this socket's single auth attempt BEFORE the await: verify() yields,
-            // so a second frame racing in during it must not also authenticate. Without
-            // this, two frames for different cids can both register, but only the last
-            // boundCid is cleaned up on close — leaving the first cid "online" forever
-            // (permanent push suppression for that recipient).
-            authed = true;
-            clearTimeout(authTimer);
-            let cid = null;
-            try {
-                cid = await deps.verify(msg);
-            }
-            catch {
-                cid = null;
-            }
-            if (!cid) {
+        sockets.handleUpgrade(req, socket, head, ws => {
+            const deadline = setTimeout(() => ws.close(1008, 'device authentication required'), 5000);
+            deadline.unref();
+            ws.on('error', () => { });
+            ws.on('close', () => { clearTimeout(deadline); active.delete(ws); });
+            ws.on('pong', () => { const p = active.get(ws); if (p)
+                p.pong = true; });
+            ws.on('message', raw => {
                 try {
-                    ws.send(JSON.stringify({ ok: false, error: 'auth rejected' }));
+                    const value = JSON.parse(raw.toString());
+                    const p = active.get(ws);
+                    if (p) {
+                        if (value.type !== 'heartbeat' || !store.deviceStatus(p.user, p.id)) {
+                            ws.close(1008, 'invalid presence');
+                            return;
+                        }
+                        p.at = Date.now();
+                        return;
+                    }
+                    if (value.type !== 'hello' || typeof value.id !== 'string' || typeof value.endpoint !== 'string' || typeof value.auth !== 'string' || value.auth.length > 100)
+                        throw new Error('invalid device proof');
+                    const device = store.device(user.userId, value.id);
+                    if (!device || device.subscription.endpoint !== value.endpoint || !same(device.subscription.keys.auth, value.auth))
+                        throw new Error('invalid device proof');
+                    if ([...active.values()].filter(p => p.user === user.userId).length >= 32)
+                        throw new Error('presence capacity');
+                    clearTimeout(deadline);
+                    active.set(ws, { user: user.userId, id: value.id, at: Date.now(), pong: true });
+                    ws.send(JSON.stringify({ type: 'presence.ready' }));
                 }
-                catch { /* closing */ }
-                ws.close(4004, 'auth rejected');
-                return;
-            }
-            boundCid = cid;
-            registry.add(cid, ws);
-            deps.onChange?.(cid, true);
-            try {
-                ws.send(JSON.stringify({ ok: true }));
-            }
-            catch { /* closing */ }
+                catch {
+                    ws.close(1008, 'invalid device proof');
+                }
+            });
         });
-        const drop = () => {
-            clearTimeout(authTimer);
-            if (boundCid) {
-                const wentOffline = registry.remove(boundCid, ws);
-                if (wentOffline)
-                    deps.onChange?.(boundCid, false);
-                boundCid = null;
-            }
-        };
-        ws.on('close', drop);
-        ws.on('error', drop);
     });
-    // Transport-level keepalive: a socket that misses a pong round is terminated,
-    // which fires 'close' and clears its presence. Bounds the "backgrounded but
-    // socket not yet dropped" window to ~pingIntervalMs.
-    const pinger = setInterval(() => {
-        for (const ws of wss.clients) {
-            if (ws.isAlive === false) {
+    const online = (user, id) => [...active.values()].some(p => p.user === user && p.id === id && Date.now() - p.at < options.freshnessMs && store.deviceStatus(user, id));
+    const notify = (user) => { for (const [ws, p] of active)
+        if (p.user === user && ws.readyState === WebSocket.OPEN && online(p.user, p.id))
+            ws.send(JSON.stringify({ type: 'inbox.changed' })); };
+    const timer = setInterval(() => {
+        for (const [ws, p] of active) {
+            if (!p.pong || Date.now() - p.at >= options.freshnessMs || !store.deviceStatus(p.user, p.id)) {
                 ws.terminate();
                 continue;
             }
-            ws.isAlive = false;
-            try {
-                ws.ping();
-            }
-            catch { /* terminating */ }
+            p.pong = false;
+            ws.ping();
         }
-    }, pingIntervalMs);
-    if (typeof pinger.unref === 'function')
-        pinger.unref();
-    return {
-        close: () => new Promise((resolve) => {
-            clearInterval(pinger);
-            wss.close(() => resolve());
-            for (const ws of wss.clients)
-                ws.terminate();
-        }),
-    };
+    }, options.intervalMs);
+    timer.unref();
+    return { online, notify, close() { clearInterval(timer); for (const ws of sockets.clients)
+            ws.terminate(); sockets.close(); active.clear(); } };
 }

package/dist/server.d.ts

@@ -0,0 +1,26 @@
+import { type IncomingMessage } from 'node:http';
+import { type PushSubscription } from 'web-push';
+import { Store } from './store.js';
+export interface Credential {
+    token: string;
+    userId: string;
+    source?: string;
+}
+export interface Config {
+    host?: string;
+    port: number;
+    stateFile: string;
+    users: Credential[];
+    producers: Credential[];
+    vapid: {
+        subject: string;
+        publicKey: string;
+        privateKey: string;
+    };
+}
+export declare function createNotificationService(config: Config, send?: (subscription: PushSubscription, payload: string) => Promise<unknown>): {
+    server: import("http").Server<typeof IncomingMessage, typeof import("http").ServerResponse>;
+    store: Store;
+    drain: () => Promise<void>;
+    close(): Promise<void>;
+};

package/dist/server.js

@@ -0,0 +1,145 @@
+import { createServer } from 'node:http';
+import { timingSafeEqual } from 'node:crypto';
+import webpush from 'web-push';
+import { attachPresence } from './presence.js';
+import { Store } from './store.js';
+import { HttpError, object, subscription, target, text } from './validation.js';
+const same = (a, b) => {
+    const x = Buffer.from(a), y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+};
+async function body(req) {
+    if (!/^application\/json(?:;|$)/i.test(req.headers['content-type'] ?? ''))
+        throw new HttpError(415, 'expected JSON');
+    let raw = '';
+    for await (const chunk of req) {
+        raw += chunk.toString();
+        if (Buffer.byteLength(raw) > 16_384)
+            throw new HttpError(413, 'body too large');
+    }
+    try {
+        return object(JSON.parse(raw));
+    }
+    catch {
+        throw new HttpError(400, 'invalid JSON');
+    }
+}
+export function createNotificationService(config, send) {
+    const tokens = [...config.users, ...config.producers];
+    if (!tokens.length || tokens.some(c => typeof c.token !== 'string' || c.token.length < 32 || !c.userId || c.userId.length > 256)
+        || new Set(tokens.map(c => c.token)).size !== tokens.length || config.producers.some(c => !c.source))
+        throw new Error('invalid scoped credentials');
+    webpush.setVapidDetails(config.vapid.subject, config.vapid.publicKey, config.vapid.privateKey);
+    const store = new Store(config.stateFile);
+    const deliver = send ?? ((sub, payload) => webpush.sendNotification(sub, payload, { TTL: 3600, timeout: 10_000,
+        vapidDetails: config.vapid, contentEncoding: 'aes128gcm' }));
+    const rates = new Map();
+    const server = createServer(async (req, res) => {
+        res.setHeader('cache-control', 'no-store');
+        res.setHeader('content-type', 'application/json');
+        res.setHeader('x-content-type-options', 'nosniff');
+        try {
+            // Browser cookies and claimed user IDs have no authority here. Browser
+            // access goes through Fleet's authenticated same-origin/CSRF gateway.
+            if (req.headers.origin || req.headers.cookie || req.headers['sec-fetch-site'])
+                throw new HttpError(403, 'use authenticated gateway');
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            const producerRoute = url.pathname === '/api/v1/send';
+            const authorization = req.headers.authorization ?? '';
+            const credential = (producerRoute ? config.producers : config.users).find(c => same(authorization, `Bearer ${c.token}`));
+            if (!credential)
+                throw new HttpError(401, 'authentication required');
+            const key = credential.token;
+            let rate = rates.get(key);
+            if (!rate || rate.until <= Date.now()) {
+                rate = { count: 0, until: Date.now() + 60_000 };
+                rates.set(key, rate);
+            }
+            if (++rate.count > (producerRoute ? 600 : 180))
+                throw new HttpError(429, 'rate limit exceeded');
+            const user = credential.userId;
+            let result;
+            if (req.method === 'GET' && url.pathname === '/api/v1/push/config')
+                result = { publicKey: config.vapid.publicKey };
+            else if (req.method === 'GET' && url.pathname === '/api/v1/summary')
+                result = store.summary(user);
+            else if (req.method === 'GET' && url.pathname === '/api/v1/inbox') {
+                const limit = Number(url.searchParams.get('limit') ?? 50);
+                if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+                    throw new HttpError(400, 'invalid limit');
+                result = store.inbox(user, url.searchParams.get('before') ?? undefined, limit);
+            }
+            else if (req.method === 'GET' && url.pathname === '/api/v1/devices/status')
+                result = { active: store.deviceStatus(user, url.searchParams.get('id') ?? '') };
+            else if (req.method === 'POST' && url.pathname === '/api/v1/devices') {
+                result = store.ensureDevice(user, subscription((await body(req)).subscription));
+            }
+            else if (req.method === 'POST' && url.pathname === '/api/v1/devices/delete')
+                result = { removed: store.deleteDevice(user, text((await body(req)).id, 100)) };
+            else if (req.method === 'POST' && url.pathname === '/api/v1/read-target') {
+                const value = await body(req);
+                store.readTarget(user, target(value.url), value.revision);
+                result = { ok: true };
+            }
+            else if (req.method === 'POST' && url.pathname === '/api/v1/read') {
+                const ids = (await body(req)).ids;
+                if (!Array.isArray(ids) || ids.length > 100)
+                    throw new HttpError(400, 'invalid notification ids');
+                store.read(user, ids.map(id => text(id, 100)));
+                result = { ok: true };
+            }
+            else if (req.method === 'POST' && producerRoute) {
+                const value = await body(req);
+                if ('userId' in value || 'source' in value)
+                    throw new HttpError(400, 'recipient and source are credential scoped');
+                result = store.produce({ userId: user, source: credential.source, eventId: text(value.eventId, 512),
+                    title: text(value.title, 160), body: text(value.body, 512), url: target(value.url) });
+            }
+            else
+                throw new HttpError(404, 'route not found');
+            if (req.method === 'POST' && ['/api/v1/send', '/api/v1/read', '/api/v1/read-target'].includes(url.pathname))
+                presence.notify(user);
+            res.end(JSON.stringify(result));
+        }
+        catch (error) {
+            res.statusCode = error instanceof HttpError ? error.status : 500;
+            res.end(JSON.stringify({ error: { message: error instanceof HttpError ? error.message : 'notification service unavailable' } }));
+        }
+    });
+    const presence = attachPresence(server, store, config.users);
+    server.requestTimeout = 15_000;
+    server.headersTimeout = 10_000;
+    let draining;
+    const drain = () => draining ??= (async () => {
+        for (const j of store.due(Date.now())) {
+            if (!j.device || !j.notification || j.notification.readAt) {
+                store.finish(j.id, 'sent', Date.now());
+                continue;
+            }
+            if (presence.online(j.device.userId, j.device.id)) {
+                store.finish(j.id, 'sent', Date.now());
+                continue;
+            }
+            try {
+                await deliver(j.device.subscription, JSON.stringify({ v: 1, kind: 'notification', title: j.notification.title,
+                    body: j.notification.body, url: j.notification.url, notification_id: j.notification.id, tag: j.notification.id }));
+                store.finish(j.id, 'sent', Date.now());
+            }
+            catch (error) {
+                const status = error.statusCode;
+                store.finish(j.id, status === 404 || status === 410 ? 'gone' : 'retry', Date.now());
+            }
+        }
+    })().finally(() => { draining = undefined; });
+    const timer = setInterval(() => { void drain().catch(() => { }); }, 1000);
+    timer.unref();
+    return { server, store, drain, async close() {
+            clearInterval(timer);
+            presence.close();
+            await draining;
+            server.closeAllConnections();
+            if (server.listening)
+                await new Promise(resolve => server.close(() => resolve()));
+            store.close();
+        } };
+}

package/dist/store.d.ts

@@ -0,0 +1,63 @@
+import type { PushSubscription } from 'web-push';
+export interface Notification {
+    id: string;
+    userId: string;
+    source: string;
+    eventId: string;
+    title: string;
+    body: string;
+    url: string;
+    createdAt: string;
+    createdRevision?: number;
+    readAt: string | null;
+}
+interface Device {
+    id: string;
+    userId: string;
+    subscription: PushSubscription;
+}
+/** Single-writer local service. Mutations commit a fsynced atomic snapshot before acknowledgement. */
+export declare class Store {
+    private readonly file;
+    private state;
+    private readonly lockToken;
+    private closed;
+    constructor(file: string);
+    close(): void;
+    private commit;
+    ensureDevice(userId: string, subscription: PushSubscription): {
+        id: string;
+    };
+    deleteDevice(userId: string, id: string): boolean;
+    device(userId: string, id: string): Device | undefined;
+    deviceStatus(userId: string, id: string): boolean;
+    inbox(userId: string, before?: string, limit?: number): {
+        items: Notification[];
+        unread: number;
+        revision: number;
+        nextCursor: string | null | undefined;
+    };
+    summary(userId: string): {
+        unread: number;
+        revision: number;
+        chats: {
+            source: "work" | "messenger";
+            chat: string;
+            count: number;
+        }[];
+    };
+    readTarget(userId: string, url: string, revision: number): void;
+    read(userId: string, ids: string[]): void;
+    produce(value: Omit<Notification, 'id' | 'createdAt' | 'readAt'>): Notification;
+    due(now: number): {
+        device: Device | undefined;
+        notification: Notification | undefined;
+        id: string;
+        notificationId: string;
+        deviceId: string;
+        attempts: number;
+        due: number;
+    }[];
+    finish(id: string, status: 'sent' | 'gone' | 'retry', now: number): void;
+}
+export {};

package/dist/store.js

@@ -0,0 +1,181 @@
+import { chatTarget, chatKey } from './chat-target.js';
+import { randomUUID } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { HttpError } from './validation.js';
+/** Single-writer local service. Mutations commit a fsynced atomic snapshot before acknowledgement. */
+export class Store {
+    file;
+    state;
+    lockToken = `${process.pid}:${randomUUID()}`;
+    closed = false;
+    constructor(file) {
+        this.file = file;
+        mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+        const lock = file + '.lock';
+        let lockFd;
+        try {
+            lockFd = openSync(lock, 'wx', 0o600);
+        }
+        catch {
+            throw new Error('notification store already in use; inspect stale lock before manual recovery');
+        }
+        try {
+            writeFileSync(lockFd, this.lockToken);
+            fsyncSync(lockFd);
+        }
+        finally {
+            closeSync(lockFd);
+        }
+        try {
+            this.state = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { version: 1, revision: 0, devices: [], notifications: [], jobs: [] };
+            if (this.state.version !== 1 || !Array.isArray(this.state.notifications) || !Array.isArray(this.state.devices) || !Array.isArray(this.state.jobs))
+                throw new Error('invalid notification state');
+        }
+        catch (error) {
+            this.close();
+            throw error;
+        }
+    }
+    close() {
+        if (this.closed)
+            return;
+        if (readFileSync(this.file + '.lock', 'utf8') !== this.lockToken)
+            throw new Error('notification lock ownership changed');
+        unlinkSync(this.file + '.lock');
+        this.closed = true;
+    }
+    commit(change) {
+        const draft = structuredClone(this.state);
+        change(draft);
+        draft.revision++;
+        const tmp = this.file + '.tmp';
+        const fd = openSync(tmp, 'w', 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(draft));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, this.file);
+        const dir = openSync(dirname(this.file), 'r');
+        try {
+            fsyncSync(dir);
+        }
+        finally {
+            closeSync(dir);
+        }
+        this.state = draft;
+    }
+    ensureDevice(userId, subscription) {
+        const existing = this.state.devices.find(d => d.subscription.endpoint === subscription.endpoint);
+        if (existing && existing.userId !== userId)
+            throw new HttpError(409, 'subscription belongs to another account');
+        if (!existing && this.state.devices.filter(d => d.userId === userId).length >= 32)
+            throw new HttpError(429, 'device capacity exceeded');
+        const changed = existing && JSON.stringify(existing.subscription.keys) !== JSON.stringify(subscription.keys);
+        const id = changed ? randomUUID() : existing?.id ?? randomUUID();
+        this.commit(s => {
+            s.devices = s.devices.filter(d => d.id !== (existing?.id ?? id));
+            if (changed)
+                s.jobs = s.jobs.filter(j => j.deviceId !== existing.id);
+            s.devices.push({ id, userId, subscription });
+        });
+        return { id };
+    }
+    deleteDevice(userId, id) {
+        if (!this.state.devices.some(d => d.id === id && d.userId === userId))
+            return false;
+        this.commit(s => { s.devices = s.devices.filter(d => d.id !== id); s.jobs = s.jobs.filter(j => j.deviceId !== id); });
+        return true;
+    }
+    device(userId, id) { const d = this.state.devices.find(d => d.id === id && d.userId === userId); return d ? structuredClone(d) : undefined; }
+    deviceStatus(userId, id) { return this.state.devices.some(d => d.id === id && d.userId === userId); }
+    inbox(userId, before, limit = 50) {
+        const all = this.state.notifications.filter(n => n.userId === userId);
+        const index = before ? all.findIndex(n => n.id === before) : all.length;
+        if (index < 0)
+            throw new HttpError(400, 'invalid cursor');
+        const items = all.slice(Math.max(0, index - limit), index).reverse();
+        return { items, unread: all.filter(n => !n.readAt).length, revision: this.state.revision,
+            nextCursor: index > limit ? items.at(-1)?.id : null };
+    }
+    summary(userId) {
+        const unread = this.state.notifications.filter(n => n.userId === userId && !n.readAt);
+        const groups = new Map();
+        for (const n of unread) {
+            const target = chatTarget(n.url);
+            if (!target)
+                continue;
+            const key = chatKey(target), group = groups.get(key) ?? { ...target, count: 0 };
+            group.count++;
+            groups.set(key, group);
+        }
+        return { unread: unread.length, revision: this.state.revision, chats: [...groups.values()] };
+    }
+    readTarget(userId, url, revision) {
+        if (!Number.isSafeInteger(revision) || revision < 0 || revision > this.state.revision)
+            throw new HttpError(400, 'invalid observed revision');
+        const target = chatTarget(url);
+        if (!target)
+            throw new HttpError(400, 'expected chat target');
+        const key = chatKey(target);
+        const ids = this.state.notifications.filter(n => n.userId === userId && !n.readAt && (n.createdRevision ?? 0) <= revision && (() => {
+            const other = chatTarget(n.url);
+            return other && chatKey(other) === key;
+        })()).map(n => n.id);
+        if (ids.length)
+            this.read(userId, ids);
+    }
+    read(userId, ids) {
+        const chosen = new Set(ids);
+        const at = new Date().toISOString();
+        this.commit(s => {
+            for (const n of s.notifications)
+                if (n.userId === userId && chosen.has(n.id))
+                    n.readAt ??= at;
+            s.jobs = s.jobs.filter(j => !s.notifications.find(n => n.id === j.notificationId)?.readAt);
+        });
+    }
+    produce(value) {
+        const previous = this.state.notifications.find(n => n.userId === value.userId && n.source === value.source && n.eventId === value.eventId);
+        if (previous) {
+            if (previous.title !== value.title || previous.body !== value.body || previous.url !== value.url)
+                throw new HttpError(409, 'event id reused');
+            return previous;
+        }
+        // Explicit capacity failure instead of silently evicting unread history or dedupe records.
+        if (this.state.notifications.filter(n => n.userId === value.userId).length >= 10_000 || this.state.jobs.length >= 20_000)
+            throw new HttpError(503, 'notification capacity exceeded');
+        const n = { ...value, id: randomUUID(), createdAt: new Date().toISOString(), createdRevision: this.state.revision + 1, readAt: null };
+        this.commit(s => {
+            s.notifications.push(n);
+            for (const d of s.devices)
+                if (d.userId === n.userId)
+                    s.jobs.push({ id: randomUUID(), notificationId: n.id, deviceId: d.id, attempts: 0, due: Date.now() });
+        });
+        return n;
+    }
+    due(now) {
+        return this.state.jobs.filter(j => j.due <= now).slice(0, 32).map(j => ({ ...j,
+            device: this.state.devices.find(d => d.id === j.deviceId), notification: this.state.notifications.find(n => n.id === j.notificationId) }));
+    }
+    finish(id, status, now) {
+        this.commit(s => {
+            const j = s.jobs.find(j => j.id === id);
+            if (!j)
+                return;
+            if (status === 'gone') {
+                s.devices = s.devices.filter(d => d.id !== j.deviceId);
+                s.jobs = s.jobs.filter(v => v.deviceId !== j.deviceId);
+            }
+            else if (status === 'sent' || j.attempts >= 7)
+                s.jobs = s.jobs.filter(v => v.id !== id);
+            else {
+                j.attempts++;
+                j.due = now + Math.min(60_000 * 2 ** j.attempts, 3_600_000);
+            }
+        });
+    }
+}

package/dist/validation.d.ts

@@ -0,0 +1,9 @@
+import type { PushSubscription } from 'web-push';
+export declare class HttpError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare function text(value: unknown, max: number): string;
+export declare function object(value: unknown): Record<string, unknown>;
+export declare function target(value: unknown): string;
+export declare function subscription(value: unknown): PushSubscription;