@phuzle/relay 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Phuzle Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,44 @@
+# @phuzle/relay
+
+Send **end-to-end encrypted** push notifications through [Relay](https://relay.phuzle.com) from Node, Bun or a shell.
+The message is encrypted on your machine, one envelope per paired phone; Relay only routes ciphertext.
+
+```bash
+npm i @phuzle/relay        # or: bun add @phuzle/relay
+```
+
+```ts
+import { Relay, RelayError } from "@phuzle/relay";
+
+const relay = new Relay({ apiKey: process.env.RELAY_API_KEY! }); // or Relay.fromEnv()
+
+try {
+  const r = await relay.send({
+    topic: "acme-alerts",
+    title: "api-3 is unhealthy",
+    body: "3 failed health checks in a row",
+    priority: "urgent",
+    idempotencyKey: "healthcheck-api-3-2026-10-05T10",
+  });
+  console.log(r.accepted, r.rejected, r.missing);
+} catch (e) {
+  if (e instanceof RelayError) console.error(e.status, e.code, e.message);
+}
+```
+
+- Plaintext over 2 KiB throws `PayloadTooLargeError`.
+- `idempotencyKey` makes retries safe for 24 hours; transient failures are retried for you (`maxRetries`).
+- Buttons (`actions`), images, scheduling (`deliverAt`, `delaySeconds`), `repeat` until acknowledged and `escalate` to another topic are supported.
+- Point `baseUrl` at a local, staging or self-hosted Relay (default `https://relay.phuzle.com`).
+
+## Command line
+
+```bash
+export RELAY_API_KEY=rly_...
+npx @phuzle/relay send --topic acme-alerts --title "Backup finished" --body "412 GB in 6 min"
+# installed globally: relay send …
+```
+
+Exit code `0` on success, `1` with a one-line reason on failure. `relay` with no arguments prints every option.
+
+Requires Node 20+ (or Bun). Documentation: <https://docs.phuzle.com/relay>. MIT licensed.

package/cli.js

@@ -0,0 +1,583 @@
+#!/usr/bin/env node
+
+// ../core/src/encoding.ts
+function b64urlEncode(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64urlDecode(text) {
+  const pad = "=".repeat((4 - text.length % 4) % 4);
+  const bin = atob(text.replace(/-/g, "+").replace(/_/g, "/") + pad);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+var enc = new TextEncoder();
+var utf8 = (s) => enc.encode(s);
+
+// ../core/src/crypto/suite.ts
+import { Chacha20Poly1305 } from "@hpke/chacha20poly1305";
+import { CipherSuite, HkdfSha256 } from "@hpke/core";
+import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
+var suite = new CipherSuite({
+  kem: new DhkemX25519HkdfSha256(),
+  kdf: new HkdfSha256(),
+  aead: new Chacha20Poly1305()
+});
+
+// ../core/src/crypto/envelope.ts
+var MAX_PLAINTEXT_BYTES = 2048;
+var PayloadTooLargeError = class extends Error {
+  constructor(size) {
+    super(`Payload is ${size} bytes; limit is ${MAX_PLAINTEXT_BYTES}`);
+    this.name = "PayloadTooLargeError";
+  }
+};
+var infoFor = (c) => utf8(`relay/v1\0${c.deviceId}\0${c.messageId}\0${c.topicId}`);
+async function seal(encPub, ctx, plaintext, ekm) {
+  const pt = utf8(plaintext);
+  if (pt.length > MAX_PLAINTEXT_BYTES)
+    throw new PayloadTooLargeError(pt.length);
+  const recipientPublicKey = await suite.kem.deserializePublicKey(encPub);
+  const sender = await suite.createSenderContext({
+    recipientPublicKey,
+    info: infoFor(ctx),
+    ...ekm ? { ekm } : {}
+  });
+  const ct = new Uint8Array(await sender.seal(pt));
+  return {
+    deviceId: ctx.deviceId,
+    enc: b64urlEncode(new Uint8Array(sender.enc)),
+    ct: b64urlEncode(ct)
+  };
+}
+
+// ../core/src/crypto/keys.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { sha256 } from "@noble/hashes/sha2";
+function bindingMessage(encPub, idPub) {
+  return utf8(`relay-bind-v1
+${b64urlEncode(encPub)}
+${b64urlEncode(idPub)}`);
+}
+function verifyBinding(sig, encPub, idPub) {
+  try {
+    return ed25519.verify(sig, bindingMessage(encPub, idPub), idPub);
+  } catch {
+    return false;
+  }
+}
+
+// ../core/src/crypto/signing.ts
+import { ed25519 as ed255192 } from "@noble/curves/ed25519";
+import { sha256 as sha2562 } from "@noble/hashes/sha2";
+
+// ../core/src/lib/glyphs.ts
+var GLYPHS = [
+  "activity",
+  "alert",
+  "battery",
+  "bell",
+  "bug",
+  "calendar",
+  "cart",
+  "check",
+  "clock",
+  "cloud",
+  "cpu",
+  "credit-card",
+  "database",
+  "dollar",
+  "error",
+  "flame",
+  "git-branch",
+  "git-pr",
+  "globe",
+  "heart",
+  "info",
+  "key",
+  "lock",
+  "mail",
+  "moon",
+  "package",
+  "phone",
+  "power",
+  "rocket",
+  "server",
+  "shield",
+  "star",
+  "success",
+  "terminal",
+  "thermometer",
+  "trending-down",
+  "trending-up",
+  "users",
+  "wifi",
+  "zap"
+];
+var isGlyph = (v) => typeof v === "string" && GLYPHS.includes(v);
+
+// ../core/src/lib/ids.ts
+var CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function ulid(now = Date.now()) {
+  let t = now;
+  let time = "";
+  for (let i = 0; i < 10; i++) {
+    time = CROCKFORD[t % 32] + time;
+    t = Math.floor(t / 32);
+  }
+  const r = crypto.getRandomValues(new Uint8Array(16));
+  let rand = "";
+  for (let i = 0; i < 16; i++) rand += CROCKFORD[r[i] % 32];
+  return time + rand;
+}
+
+// src/index.ts
+var deliverAtIso = (m) => {
+  if (m.deliverAt !== void 0 && m.delaySeconds !== void 0)
+    throw new RelayError(
+      "Use deliverAt or delaySeconds, not both",
+      0,
+      "invalid_message"
+    );
+  const d = m.deliverAt !== void 0 ? new Date(m.deliverAt) : m.delaySeconds !== void 0 ? new Date(Date.now() + m.delaySeconds * 1e3) : void 0;
+  if (d && Number.isNaN(d.getTime()))
+    throw new RelayError("deliverAt is not a valid date", 0, "invalid_message");
+  return d?.toISOString();
+};
+var checkRepeat = (r) => {
+  if (!r) return;
+  if (!Number.isInteger(r.everySeconds) || r.everySeconds < 60 || r.everySeconds > 86400)
+    throw new RelayError(
+      "repeat.everySeconds must be 60 to 86400",
+      0,
+      "invalid_message"
+    );
+  if (!Number.isInteger(r.times) || r.times < 1 || r.times > 20)
+    throw new RelayError("repeat.times must be 1 to 20", 0, "invalid_message");
+};
+var RelayError = class extends Error {
+  constructor(message, status, code, retryAfterSeconds) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.name = "RelayError";
+  }
+  status;
+  code;
+  retryAfterSeconds;
+};
+var DEFAULT_URL = "https://relay.phuzle.com";
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var Relay = class _Relay {
+  constructor(opts) {
+    this.opts = opts;
+    if (!opts.apiKey?.startsWith("rly_"))
+      throw new RelayError(
+        "apiKey must be a Relay API key (rly_\u2026)",
+        0,
+        "bad_api_key"
+      );
+    const base = (opts.baseUrl || DEFAULT_URL).trim();
+    if (!/^https?:\/\/[^\s/]+/i.test(base))
+      throw new RelayError(
+        `baseUrl must be an http(s) URL, got "${base}"`,
+        0,
+        "bad_base_url"
+      );
+    this.base = base.replace(/\/+$/, "");
+    this.doFetch = opts.fetch ?? fetch;
+    this.retries = opts.maxRetries ?? 2;
+  }
+  opts;
+  base;
+  doFetch;
+  retries;
+  cache = /* @__PURE__ */ new Map();
+  /** Trust-on-first-use: a device id must keep the same identity key, or something is swapping keys (crypto-spec §3, T4). */
+  pinned = /* @__PURE__ */ new Map();
+  /** Reads `RELAY_API_KEY` and, optionally, `RELAY_API_URL`; `overrides` win over the environment. */
+  static fromEnv(env = process.env, overrides = {}) {
+    return new _Relay({
+      apiKey: env.RELAY_API_KEY ?? "",
+      baseUrl: overrides.baseUrl || env.RELAY_API_URL,
+      ...overrides.fetch && { fetch: overrides.fetch },
+      ...overrides.maxRetries !== void 0 && {
+        maxRetries: overrides.maxRetries
+      }
+    });
+  }
+  async send(m) {
+    checkRepeat(m.repeat);
+    checkRepeat(m.escalate?.repeat);
+    if (m.escalate && (!Number.isFinite(m.escalate.afterSeconds) || m.escalate.afterSeconds < 30))
+      throw new RelayError(
+        "escalate.afterSeconds must be at least 30",
+        0,
+        "invalid_message"
+      );
+    const result = await this.sendCore(m);
+    if (!m.escalate) return result;
+    const e = m.escalate;
+    const base = new Date(deliverAtIso(m) ?? Date.now());
+    result.escalation = await this.sendCore({
+      ...m,
+      topic: e.topic,
+      title: e.title ?? m.title,
+      body: e.body ?? m.body,
+      priority: e.priority ?? "urgent",
+      repeat: e.repeat,
+      escalate: void 0,
+      idempotencyKey: void 0,
+      delaySeconds: void 0,
+      deliverAt: new Date(base.getTime() + e.afterSeconds * 1e3),
+      unlessAcked: result.messageId
+    });
+    return result;
+  }
+  async sendCore(m) {
+    const plaintext = buildPlaintext(m);
+    let result = await this.sendOnce(
+      m,
+      plaintext,
+      await this.recipients(m.topic)
+    );
+    if (result.missing.length > 0) {
+      const fresh = await this.recipients(m.topic, true);
+      const only = {
+        ...fresh,
+        recipients: fresh.recipients.filter(
+          (r) => result.missing.includes(r.deviceId)
+        )
+      };
+      if (only.recipients.length > 0) {
+        const extra = await this.sendOnce(
+          { ...m, idempotencyKey: void 0 },
+          plaintext,
+          only
+        );
+        result = {
+          ...result,
+          accepted: result.accepted + extra.accepted,
+          // `extra.missing` lists devices we deliberately left out of the second request; keep only ones we still failed to reach.
+          missing: result.missing.filter(
+            (id) => !only.recipients.some((r) => r.deviceId === id) || extra.rejected.some((x) => x.deviceId === id)
+          ),
+          rejected: [...result.rejected, ...extra.rejected]
+        };
+      }
+    }
+    return result;
+  }
+  async sendOnce(m, plaintext, set) {
+    if (set.recipients.length === 0)
+      throw new RelayError(
+        `No devices are subscribed to ${m.topic} yet \u2014 pair a phone first.`,
+        0,
+        "no_recipients"
+      );
+    const messageId = ulid();
+    const body = JSON.stringify({ v: 1, id: messageId, ...plaintext });
+    const envelopes = await Promise.all(
+      set.recipients.map(
+        (r) => seal(
+          b64urlDecode(r.encPub),
+          { messageId, topicId: set.topicId, deviceId: r.deviceId },
+          body
+        )
+      )
+    );
+    const res = await this.request(
+      "POST",
+      "/v1/trigger",
+      {
+        topic: m.topic,
+        messageId,
+        priority: m.priority ?? "default",
+        ttlSeconds: m.ttlSeconds ?? 86400,
+        ...m.collapseKey ? { collapseKey: m.collapseKey } : {},
+        ...deliverAtIso(m) ? { deliverAt: deliverAtIso(m) } : {},
+        ...m.repeat ? { repeat: m.repeat } : {},
+        ...m.unlessAcked ? { unlessAcked: m.unlessAcked } : {},
+        envelopes
+      },
+      { "Idempotency-Key": m.idempotencyKey ?? messageId }
+    );
+    return res;
+  }
+  /** Recipients for a topic, verified and cached by ETag (a cheap conditional GET on every send keeps the key set fresh). */
+  async recipients(topic, bypass = false) {
+    const cached = this.cache.get(topic);
+    const res = await this.raw(
+      "GET",
+      `/v1/trigger/recipients?topic=${encodeURIComponent(topic)}`,
+      void 0,
+      !bypass && cached ? { "If-None-Match": cached.etag } : {}
+    );
+    if (res.status === 304 && cached) return cached.set;
+    const set = await this.parse(res);
+    for (const r of set.recipients) {
+      if (!verifyBinding(
+        b64urlDecode(r.bindSig),
+        b64urlDecode(r.encPub),
+        b64urlDecode(r.idPub)
+      ))
+        throw new RelayError(
+          `Device ${r.deviceId} returned an invalid key binding`,
+          0,
+          "bad_key_binding"
+        );
+      const pin = this.pinned.get(r.deviceId);
+      if (pin && pin !== r.idPub)
+        throw new RelayError(
+          `Device ${r.deviceId} changed its identity key`,
+          0,
+          "key_changed"
+        );
+      this.pinned.set(r.deviceId, r.idPub);
+    }
+    const etag = res.headers.get("etag");
+    if (etag) this.cache.set(topic, { etag, set });
+    return set;
+  }
+  async request(method, path, body, headers = {}) {
+    let attempt = 0;
+    for (; ; ) {
+      try {
+        return await this.parse(await this.raw(method, path, body, headers));
+      } catch (e) {
+        const transient = e instanceof RelayError ? e.status >= 500 || e.status === 0 && e.code === "network" : false;
+        if (!transient || attempt >= this.retries) throw e;
+        await sleep(250 * 2 ** attempt++);
+      }
+    }
+  }
+  async raw(method, path, body, headers = {}) {
+    try {
+      return await this.doFetch(this.base + path, {
+        method,
+        headers: {
+          authorization: `Bearer ${this.opts.apiKey}`,
+          accept: "application/json",
+          ...body !== void 0 ? { "content-type": "application/json" } : {},
+          ...headers
+        },
+        body: body !== void 0 ? JSON.stringify(body) : void 0
+      });
+    } catch {
+      throw new RelayError("Couldn't reach Relay", 0, "network");
+    }
+  }
+  async parse(res) {
+    const text = await res.text();
+    const json = text ? safeJson(text) : void 0;
+    if (res.ok) return json;
+    const retry = Number(res.headers.get("retry-after"));
+    throw new RelayError(
+      json?.error ?? `Relay returned ${res.status}`,
+      res.status,
+      json?.code ?? `http_${res.status}`,
+      Number.isFinite(retry) && retry > 0 ? retry : void 0
+    );
+  }
+};
+var safeJson = (t) => {
+  try {
+    return JSON.parse(t);
+  } catch {
+    return void 0;
+  }
+};
+function buildPlaintext(m) {
+  const bad = (msg, code) => new RelayError(msg, 0, code);
+  if (!m.title?.trim()) throw bad("A title is required", "invalid_message");
+  if (m.title.length > 120)
+    throw bad("Title is limited to 120 characters", "invalid_message");
+  if ((m.body?.length ?? 0) > 1e3)
+    throw bad("Body is limited to 1000 characters", "invalid_message");
+  if ((m.tags?.length ?? 0) > 5 || m.tags?.some((t) => t.length > 24))
+    throw bad("Up to 5 tags, 24 characters each", "invalid_message");
+  if (m.icon !== void 0 && !isGlyph(m.icon))
+    throw bad(
+      `Unknown icon "${m.icon}". Use one of: ${GLYPHS.join(", ")}`,
+      "invalid_message"
+    );
+  if (m.url && !/^https:\/\//i.test(m.url))
+    throw bad("url must be https", "invalid_message");
+  if (m.image && (!/^https:\/\//i.test(m.image) || m.image.length > 1e3))
+    throw bad(
+      "image must be an https link of at most 1000 characters",
+      "invalid_message"
+    );
+  if ((m.actions?.length ?? 0) > 3)
+    throw bad("At most 3 actions", "invalid_message");
+  for (const raw of m.actions ?? []) {
+    const a = raw;
+    if (!a.label?.trim() || a.label.length > 30)
+      throw bad(
+        "Action labels are required and limited to 30 characters",
+        "invalid_message"
+      );
+    if (a.link !== void 0 && a.request !== void 0)
+      throw bad(
+        `Action "${a.label}": use either request or link, not both`,
+        "invalid_message"
+      );
+    if (a.link !== void 0) {
+      if (!/^https:\/\//i.test(a.link))
+        throw bad(`Action "${a.label}": link must be https`, "invalid_message");
+      if (a.link.length > 1e3)
+        throw bad(
+          `Action "${a.label}": link is limited to 1000 characters`,
+          "invalid_message"
+        );
+    } else if (!a.request?.url || !/^https:\/\//i.test(a.request.url))
+      throw bad(`Action "${a.label}": url must be https`, "invalid_message");
+  }
+  const actions = m.actions?.map((a, i) => {
+    const id = a.id ?? `a${i + 1}`;
+    if (a.link !== void 0) return { id, label: a.label, link: a.link };
+    return {
+      style: "default",
+      confirm: a.style === "destructive",
+      retry: false,
+      ...a,
+      id
+    };
+  });
+  return {
+    ts: Math.floor(Date.now() / 1e3),
+    title: m.title,
+    ...m.body ? { body: m.body } : {},
+    priority: m.priority ?? "default",
+    ...m.tags?.length ? { tags: m.tags } : {},
+    ...m.icon ? { icon: m.icon } : {},
+    ...m.url ? { url: m.url } : {},
+    ...m.image ? { image: m.image } : {},
+    ...m.group ? { group: m.group } : {},
+    ...actions ? { actions } : {}
+  };
+}
+
+// src/cli.ts
+var USAGE = `relay send --topic <org-topic> --title <text> [--body <text>] [--priority min|low|default|high|urgent]
+           [--url <https url>] [--image <https url>] [--icon <name>] [--tag <t>]... [--group <g>] [--ttl <seconds>]
+           [--api-url <https://your-relay>] [--action "Label=METHOD https://url"]... [--link "Label=https://url"]...
+           (up to 3 buttons in total. --action sends a request from the phone; add "!" after the label for destructive: "Reboot!=POST \u2026".
+            --link just opens the page in the browser: "Dashboard=https://app.example.com/deploys/42")
+           [--at <ISO time> | --delay 10m] [--repeat 5m:3] [--escalate-topic <org-topic> --escalate-after 10m [--escalate-title <text>]]
+           (--delay/--at hold delivery; --repeat re-sends every 5 minutes up to 3 more times until a phone acknowledges it;
+            --escalate-* notifies another topic if nobody acknowledged in time. Durations: 90s, 10m, 2h, 1d.)
+Environment: RELAY_API_KEY (required), RELAY_API_URL or --api-url (default https://relay.phuzle.com)
+The message is encrypted on this machine; Relay only routes ciphertext.`;
+function parse(argv) {
+  const flags = /* @__PURE__ */ new Map();
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith("--")) continue;
+    const v = argv[i + 1] && !argv[i + 1].startsWith("--") ? argv[++i] : "true";
+    flags.set(a.slice(2), [...flags.get(a.slice(2)) ?? [], v]);
+  }
+  return flags;
+}
+function action(spec) {
+  const eq = spec.indexOf("=");
+  if (eq < 1)
+    throw new Error(`Bad --action "${spec}". Use "Label=METHOD https://url"`);
+  let label = spec.slice(0, eq).trim();
+  const destructive = label.endsWith("!");
+  if (destructive) label = label.slice(0, -1);
+  const [method, url] = spec.slice(eq + 1).trim().split(/\s+/, 2);
+  if (!url) throw new Error(`Bad --action "${spec}": missing URL`);
+  return {
+    label,
+    style: destructive ? "destructive" : "default",
+    request: {
+      method: method.toUpperCase(),
+      url
+    }
+  };
+}
+function repeatSpec(s) {
+  const [every, times] = s.split(":");
+  if (!every || !times)
+    throw new Error(
+      `Bad --repeat "${s}". Use 5m:3 (every 5 minutes, up to 3 more times)`
+    );
+  return { everySeconds: duration(every, "--repeat"), times: Number(times) };
+}
+function duration(s, flag = "duration") {
+  const m = /^(\d+(?:\.\d+)?)\s*([smhd]?)$/i.exec(s.trim());
+  if (!m) throw new Error(`Bad ${flag} "${s}". Use 90s, 10m, 2h or 1d`);
+  const n = Number(m[1]) * { "": 1, s: 1, m: 60, h: 3600, d: 86400 }[m[2].toLowerCase()];
+  return Math.round(n);
+}
+function link(spec) {
+  const eq = spec.indexOf("=");
+  if (eq < 1) throw new Error(`Bad --link "${spec}". Use "Label=https://url"`);
+  const url = spec.slice(eq + 1).trim();
+  if (!url) throw new Error(`Bad --link "${spec}": missing URL`);
+  return { label: spec.slice(0, eq).trim(), link: url };
+}
+async function main(argv, env = process.env, out = console) {
+  const [cmd, ...rest] = argv;
+  if (cmd !== "send" || rest.includes("--help")) {
+    out.log(USAGE);
+    return cmd === "send" || !cmd ? 0 : 1;
+  }
+  const f = parse(rest);
+  const one = (k) => f.get(k)?.[0];
+  try {
+    const topic = one("topic");
+    if (!topic || !one("title"))
+      throw new Error("--topic and --title are required");
+    const r = await Relay.fromEnv(env, { baseUrl: one("api-url") }).send({
+      topic,
+      title: one("title"),
+      body: one("body"),
+      priority: one("priority"),
+      url: one("url"),
+      image: one("image"),
+      icon: one("icon"),
+      group: one("group"),
+      tags: f.get("tag"),
+      ttlSeconds: one("ttl") ? Number(one("ttl")) : void 0,
+      deliverAt: one("at"),
+      delaySeconds: one("delay") ? duration(one("delay"), "--delay") : void 0,
+      repeat: one("repeat") ? repeatSpec(one("repeat")) : void 0,
+      escalate: one("escalate-topic") ? {
+        topic: one("escalate-topic"),
+        afterSeconds: duration(
+          one("escalate-after") ?? "",
+          "--escalate-after"
+        ),
+        title: one("escalate-title")
+      } : void 0,
+      actions: [
+        ...f.get("action")?.map(action) ?? [],
+        ...f.get("link")?.map(link) ?? []
+      ]
+    });
+    if (r.scheduledFor) out.log(`scheduled for ${r.scheduledFor}`);
+    if (r.escalation)
+      out.log(
+        `escalation to ${one("escalate-topic")} armed: ${r.escalation.messageId}`
+      );
+    out.log(
+      `sent ${r.messageId} \u2192 ${r.accepted} device${r.accepted === 1 ? "" : "s"}${r.rejected.length ? ` (${r.rejected.length} rejected)` : ""}`
+    );
+    return 0;
+  } catch (e) {
+    out.error(
+      e instanceof RelayError ? `relay: ${e.message} [${e.code}]${e.retryAfterSeconds ? ` (retry in ${e.retryAfterSeconds}s)` : ""}` : `relay: ${e.message}`
+    );
+    return 1;
+  }
+}
+if (import.meta.main) process.exit(await main(process.argv.slice(2)));
+export {
+  duration,
+  main
+};