@raybase/core 0.0.2 → 0.3.4

package/dist/notifications.js

@@ -0,0 +1,1625 @@
+import { z } from "zod";
+import { isHostUserId } from "./host-user.js";
+import { hasAdminAccess, normalizeStoredAdminRole } from "./admin-role.js";
+import { integer, longText, raybaseSystemTable, text } from "./schema.js";
+import { addDuration, durationMs, truncateEventData, truncateJson } from "./jobs.js";
+import { sha256Hex, stableJson } from "./internal.js";
+import { raybaseRuntimeProfile, raybaseRuntimeScope } from "./platform.js";
+import { nowIso, q, randomId } from "./sql.js";
+import { wallNowIso, wallNowMs } from "./clock.js";
+import { sendWebPushPrivately } from "./webpush-private.js";
+export const raybaseNotificationDeliveryJobName = "raybase.notifications.deliver";
+export const raybaseNotificationServicePrincipal = "raybase-notifications";
+export const raybaseNotificationJobPrefix = "raybase.notifications.";
+export const raybaseNotificationsTableName = "_notifications";
+export const raybaseNotificationRecipientsTableName = "_notification_recipients";
+export const raybaseNotificationSubscriptionsTableName = "_notification_subscriptions";
+export const raybaseNotificationDeliveriesTableName = "_notification_deliveries";
+export const raybaseNotificationAttemptsTableName = "_notification_attempts";
+export const raybaseNotificationThrottleWindowsTableName = "_notification_throttle_windows";
+export const raybaseInboundEventsTableName = "_inbound_events";
+export const defaultNotificationSubscriptionOrganizationId = "default";
+export class NotificationError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "NotificationError";
+    }
+}
+export function defineNotifications(notifications) {
+    validateNotifications(notifications);
+    return notifications;
+}
+export function mergeRaybaseNotifications(base, contribution, options = {}) {
+    if (!base && !contribution)
+        return undefined;
+    const duplicateLabel = options.duplicateLabel ?? "Raybase notification";
+    const channels = mergeNotificationRecord(base?.channels, contribution?.channels, `${duplicateLabel} channel`);
+    const inbound = mergeNotificationRecord(base?.inbound, contribution?.inbound, `${duplicateLabel} inbound adapter`);
+    const feed = base?.feed || contribution?.feed
+        ? { ...(base?.feed ?? {}), ...(contribution?.feed ?? {}) }
+        : undefined;
+    const merged = {
+        ...(base ?? {}),
+        ...(contribution ?? {}),
+        ...(feed ? { feed } : {}),
+        ...(channels ? { channels } : {}),
+        ...(inbound ? { inbound } : {})
+    };
+    if (options.validate !== false)
+        validateNotifications(merged);
+    return merged;
+}
+function mergeNotificationRecord(base, contribution, duplicateLabel) {
+    if (!base && !contribution)
+        return undefined;
+    const result = { ...(base ?? {}) };
+    for (const [key, value] of Object.entries(contribution ?? {})) {
+        if (Object.prototype.hasOwnProperty.call(result, key)) {
+            throw new Error(`Duplicate ${duplicateLabel}: ${key}`);
+        }
+        result[key] = value;
+    }
+    return result;
+}
+export const notificationRecipient = {
+    user(userId) {
+        return { kind: "user", userId };
+    },
+    role(role) {
+        return { kind: "role", role };
+    },
+    operator(role) {
+        return { kind: "operator", role };
+    },
+    currentUser() {
+        return { kind: "current-user" };
+    }
+};
+export const notificationDefaults = {
+    maxRecipientsPerSend: 100,
+    maxRecipientsHardLimit: 500,
+    maxBodyBytes: 2048,
+    maxMetadataBytes: 32 * 1024,
+    maxChannelTargetsBytes: 8 * 1024,
+    maxInboundBodyBytes: 256 * 1024,
+    maxAttemptSummaryBytes: 8 * 1024,
+    deliveryMaxAttempts: 3,
+    deliveryTimeoutMs: 10_000,
+    throttleKeyMaxLength: 128,
+    throttleMinIntervalMs: 60_000,
+    throttleMaxIntervalMs: 30 * 24 * 60 * 60 * 1000
+};
+export function resolveNotificationConfig(config, notifications) {
+    const input = config.notifications ?? {};
+    const enabled = input.enabled === true || Boolean(notifications);
+    const maxRecipientsPerSend = positiveInteger(input.maxRecipientsPerSend, notificationDefaults.maxRecipientsPerSend, "notifications.maxRecipientsPerSend");
+    if (maxRecipientsPerSend > notificationDefaults.maxRecipientsHardLimit) {
+        throw new Error(`notifications.maxRecipientsPerSend must not exceed ${notificationDefaults.maxRecipientsHardLimit}`);
+    }
+    return {
+        enabled,
+        maxRecipientsPerSend,
+        maxBodyBytes: positiveInteger(input.maxBodyBytes, notificationDefaults.maxBodyBytes, "notifications.maxBodyBytes"),
+        maxMetadataBytes: positiveInteger(input.maxMetadataBytes, notificationDefaults.maxMetadataBytes, "notifications.maxMetadataBytes"),
+        maxChannelTargetsBytes: positiveInteger(input.maxChannelTargetsBytes, notificationDefaults.maxChannelTargetsBytes, "notifications.maxChannelTargetsBytes"),
+        maxInboundBodyBytes: positiveInteger(input.maxInboundBodyBytes, notificationDefaults.maxInboundBodyBytes, "notifications.maxInboundBodyBytes"),
+        feed: {
+            enabled: input.feed?.enabled !== false,
+            endpoint: normalizeEndpoint(input.feed?.endpoint ?? "/api/notifications")
+        },
+        delivery: {
+            maxAttempts: positiveInteger(input.delivery?.maxAttempts, notificationDefaults.deliveryMaxAttempts, "notifications.delivery.maxAttempts"),
+            timeoutMs: positiveInteger(input.delivery?.timeoutMs, notificationDefaults.deliveryTimeoutMs, "notifications.delivery.timeoutMs")
+        }
+    };
+}
+function positiveInteger(value, fallback, name) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isInteger(value) || Number(value) <= 0)
+        throw new Error(`${name} must be a positive integer`);
+    return Number(value);
+}
+function normalizeEndpoint(endpoint) {
+    return endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+}
+export function validateNotifications(notifications) {
+    const names = new Set();
+    for (const [key, adapter] of Object.entries(notifications.channels ?? {})) {
+        if (key === "feed" || (key === "webpush" && (adapter.name !== "raybase-webpush" || adapter.channel !== "webpush"))) {
+            throw new Error(`Notification channel "${key}" is reserved`);
+        }
+        if (!adapter.name.trim())
+            throw new Error(`Notification channel ${key} adapter must declare a name`);
+        if (!adapter.channel.trim())
+            throw new Error(`Notification channel ${key} adapter must declare a channel`);
+        const id = `${adapter.channel}:${adapter.name}`;
+        if (names.has(id))
+            throw new Error(`Duplicate notification adapter ${id}`);
+        names.add(id);
+    }
+    const paths = new Set();
+    for (const [key, adapter] of Object.entries(notifications.inbound ?? {})) {
+        if (!adapter.name.trim())
+            throw new Error(`Inbound notification adapter ${key} must declare a name`);
+        if (!adapter.path.startsWith("/"))
+            throw new Error(`Inbound notification adapter ${key} path must start with "/"`);
+        if (reservedInboundPath(adapter.path))
+            throw new Error(`Inbound notification adapter ${key} path collides with a Raybase route`);
+        if (paths.has(adapter.path))
+            throw new Error(`Duplicate inbound notification path: ${adapter.path}`);
+        paths.add(adapter.path);
+    }
+}
+export function reservedInboundPath(path) {
+    return (path === "/api/notifications" ||
+        path.startsWith("/api/notifications/") ||
+        path === "/api/auth" ||
+        path.startsWith("/api/auth/") ||
+        path === "/api/admin" ||
+        path.startsWith("/api/admin/") ||
+        path === "/api/data" ||
+        path.startsWith("/api/data/") ||
+        path === "/api/realtime");
+}
+export const raybaseNotificationSystemTables = [
+    raybaseSystemTable(raybaseNotificationsTableName, {
+        id: text({ primaryKey: true, required: true }),
+        kind: text(),
+        severity: text({ required: true }),
+        title: text({ required: true }),
+        body: longText(),
+        targetHref: text(),
+        targetEntityType: text(),
+        targetEntityId: text(),
+        channelsJson: longText({ required: true }),
+        channelTargetsJson: longText(),
+        metadataJson: longText(),
+        dedupeKey: text(),
+        actorKind: text({ required: true }),
+        actorId: text(),
+        sourceType: text(),
+        sourceId: text(),
+        createdAt: text({ required: true }),
+        expiresAt: text()
+    }, {
+        indexes: [
+            { columns: ["dedupeKey"], unique: true, where: '"dedupeKey" IS NOT NULL', name: "_notifications_dedupe_idx" },
+            ["createdAt"]
+        ]
+    }),
+    raybaseSystemTable(raybaseNotificationRecipientsTableName, {
+        id: text({ primaryKey: true, required: true }),
+        notificationId: text({ required: true }),
+        recipientKind: text({ required: true }),
+        recipientSubjectId: text({ required: true }),
+        recipientRole: text(),
+        recipientSeq: integer({ required: true }),
+        feedStatus: text({ required: true }),
+        readAt: text(),
+        archivedAt: text(),
+        createdAt: text({ required: true })
+    }, {
+        indexes: [
+            { columns: ["recipientSubjectId", "feedStatus", "recipientSeq"], name: "_notification_recipients_user_idx" },
+            ["notificationId"]
+        ]
+    }),
+    raybaseSystemTable(raybaseNotificationSubscriptionsTableName, {
+        id: text({ primaryKey: true, required: true }),
+        organizationId: text({ required: true }),
+        userId: text({ required: true }),
+        kind: text({ required: true }),
+        enabled: integer({ required: true }),
+        channelsJson: longText({ required: true }),
+        createdAt: text({ required: true }),
+        updatedAt: text({ required: true })
+    }, {
+        label: "Notification subscriptions",
+        indexes: [
+            { columns: ["organizationId", "userId", "kind"], unique: true, name: "_notification_subscriptions_user_kind_idx" },
+            { columns: ["organizationId", "kind", "enabled"], name: "_notification_subscriptions_kind_idx" }
+        ]
+    }),
+    raybaseSystemTable(raybaseNotificationDeliveriesTableName, {
+        id: text({ primaryKey: true, required: true }),
+        notificationId: text({ required: true }),
+        recipientId: text(),
+        recipientSubjectId: text(),
+        recipientEmail: text(),
+        recipientName: text(),
+        channel: text({ required: true }),
+        adapter: text({ required: true }),
+        status: text({ required: true }),
+        attempt: integer({ required: true }),
+        maxAttempts: integer({ required: true }),
+        idempotencyKey: text(),
+        availableAt: text({ required: true }),
+        lastAttemptAt: text(),
+        deliveredAt: text(),
+        failedAt: text(),
+        providerMessageId: text(),
+        lastErrorJson: longText(),
+        createdAt: text({ required: true }),
+        updatedAt: text({ required: true })
+    }, {
+        indexes: [
+            { columns: ["adapter", "channel", "idempotencyKey"], unique: true, where: '"idempotencyKey" IS NOT NULL', name: "_notification_deliveries_idempotency_idx" },
+            { columns: ["status", "availableAt"], name: "_notification_deliveries_due_idx" },
+            ["notificationId"],
+            ["recipientSubjectId"]
+        ]
+    }),
+    raybaseSystemTable(raybaseNotificationAttemptsTableName, {
+        id: text({ primaryKey: true, required: true }),
+        deliveryId: text({ required: true }),
+        attempt: integer({ required: true }),
+        status: text({ required: true }),
+        startedAt: text({ required: true }),
+        endedAt: text(),
+        durationMs: integer(),
+        requestSummaryJson: longText(),
+        responseSummaryJson: longText(),
+        errorJson: longText()
+    }, { indexes: [["deliveryId"], ["startedAt"]] }),
+    raybaseSystemTable(raybaseNotificationThrottleWindowsTableName, {
+        id: text({ primaryKey: true, required: true }),
+        throttleKey: text({ required: true }),
+        recipientSubjectId: text({ required: true }),
+        lastSentAt: text({ required: true }),
+        windowExpiresAt: text({ required: true }),
+        suppressedCount: integer({ required: true }),
+        firstSuppressedAt: text(),
+        lastSuppressedJson: longText(),
+        updatedAt: text({ required: true })
+    }, {
+        label: "Notification throttles",
+        indexes: [
+            { columns: ["throttleKey", "recipientSubjectId"], unique: true, name: "_notification_throttle_windows_unique_idx" },
+            ["windowExpiresAt"]
+        ]
+    }),
+    raybaseSystemTable(raybaseInboundEventsTableName, {
+        id: text({ primaryKey: true, required: true }),
+        adapter: text({ required: true }),
+        path: text({ required: true }),
+        status: text({ required: true }),
+        verified: integer({ required: true }),
+        idempotencyKey: text(),
+        providerEventId: text(),
+        actorKind: text({ required: true }),
+        actorId: text(),
+        payloadJson: longText(),
+        resultJson: longText(),
+        errorJson: longText(),
+        receivedAt: text({ required: true }),
+        processedAt: text()
+    }, {
+        indexes: [
+            { columns: ["adapter", "idempotencyKey"], unique: true, where: '"idempotencyKey" IS NOT NULL', name: "_inbound_events_idempotency_idx" },
+            ["receivedAt"],
+            ["status"]
+        ]
+    })
+];
+function assertEnabled(resolved) {
+    if (!resolved.enabled)
+        throw new NotificationError("Notifications are not enabled", "disabled");
+}
+export function createDisabledNotificationsRuntime() {
+    const fail = () => {
+        throw new NotificationError("Notifications are not enabled", "disabled");
+    };
+    return {
+        enabled: false,
+        feedEnabled: false,
+        send: fail,
+        list: fail,
+        unreadCount: fail,
+        markRead: fail,
+        markAllRead: fail,
+        archive: fail
+    };
+}
+function normalizeSubscriptionChannels(channels) {
+    const normalized = Array.from(new Set((channels ?? ["feed"]).map((channel) => channel.trim()).filter(Boolean)));
+    return normalized.length ? normalized : ["feed"];
+}
+function subscriptionChannelsFromJson(value) {
+    if (!value)
+        return ["feed"];
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? normalizeSubscriptionChannels(parsed.filter((channel) => typeof channel === "string")) : ["feed"];
+    }
+    catch {
+        return ["feed"];
+    }
+}
+function notificationSubscriptionFromRow(row) {
+    return {
+        id: row.id,
+        organizationId: row.organizationId ?? defaultNotificationSubscriptionOrganizationId,
+        userId: row.userId,
+        kind: row.kind,
+        enabled: Boolean(row.enabled),
+        channels: subscriptionChannelsFromJson(row.channelsJson),
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+export async function getNotificationSubscription(db, input) {
+    const organizationId = input.organizationId ?? defaultNotificationSubscriptionOrganizationId;
+    const row = await db.first(`SELECT "id", "organizationId", "userId", "kind", "enabled", "channelsJson", "createdAt", "updatedAt"
+     FROM ${q(raybaseNotificationSubscriptionsTableName)}
+     WHERE "organizationId" = ? AND "userId" = ? AND "kind" = ? LIMIT 1`, [organizationId, input.userId, input.kind]);
+    return row ? notificationSubscriptionFromRow(row) : null;
+}
+export async function setNotificationSubscription(db, input) {
+    const organizationId = input.organizationId ?? defaultNotificationSubscriptionOrganizationId;
+    const existing = await getNotificationSubscription(db, { ...input, organizationId });
+    const now = nowIso();
+    const id = existing?.id ?? randomId("notifsub");
+    const channels = normalizeSubscriptionChannels(input.channels ?? existing?.channels);
+    await db.run(`INSERT INTO ${q(raybaseNotificationSubscriptionsTableName)}
+      ("id", "organizationId", "userId", "kind", "enabled", "channelsJson", "createdAt", "updatedAt")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT("organizationId", "userId", "kind") DO UPDATE SET
+      "enabled" = excluded."enabled",
+      "channelsJson" = excluded."channelsJson",
+      "updatedAt" = excluded."updatedAt"`, [id, organizationId, input.userId, input.kind, input.enabled ? 1 : 0, stableJson(channels), existing?.createdAt ?? now, now]);
+    return {
+        id,
+        organizationId,
+        userId: input.userId,
+        kind: input.kind,
+        enabled: input.enabled,
+        channels,
+        createdAt: existing?.createdAt ?? now,
+        updatedAt: now
+    };
+}
+export async function listNotificationSubscribers(db, kind, input = {}) {
+    const organizationId = input.organizationId ?? defaultNotificationSubscriptionOrganizationId;
+    const rows = await db.all(`SELECT "userId", "channelsJson"
+     FROM ${q(raybaseNotificationSubscriptionsTableName)}
+     WHERE "organizationId" = ? AND "kind" = ? AND "enabled" = 1
+     ORDER BY "updatedAt" DESC`, [organizationId, kind]);
+    return rows.map((row) => ({
+        userId: row.userId,
+        channels: subscriptionChannelsFromJson(row.channelsJson)
+    }));
+}
+export function createNotificationsRuntime(options) {
+    const resolved = resolveNotificationConfig(options.config, options.notifications);
+    if (!resolved.enabled)
+        return createDisabledNotificationsRuntime();
+    const runtime = {
+        enabled: true,
+        feedEnabled: resolved.feed.enabled,
+        async send(input) {
+            return sendNotification(options, resolved, input);
+        },
+        async list(listOptions) {
+            const subjectId = requireCurrentSubject(options.currentUser);
+            const limit = Math.min(Math.max(1, Number(listOptions?.limit ?? 50)), 100);
+            const where = [`r."recipientSubjectId" = ?`, `r."feedStatus" != 'none'`];
+            const params = [subjectId];
+            if (listOptions?.status && listOptions.status !== "all") {
+                where.push(`r."feedStatus" = ?`);
+                params.push(listOptions.status);
+            }
+            const cursor = listOptions?.cursor ?? listOptions?.since;
+            if (cursor !== undefined) {
+                where.push(`r."recipientSeq" > ?`);
+                params.push(Math.max(0, Math.trunc(cursor)));
+            }
+            params.push(limit + 1);
+            const rows = await options.db.all(`SELECT r."id" AS "feedItemId", r."notificationId", r."feedStatus", r."readAt", r."archivedAt", r."recipientSeq", r."createdAt",
+                n."id", n."kind", n."severity", n."title", n."body", n."targetHref", n."targetEntityType", n."targetEntityId",
+                n."metadataJson", n."expiresAt"
+         FROM ${q(raybaseNotificationRecipientsTableName)} r
+         INNER JOIN ${q(raybaseNotificationsTableName)} n ON n."id" = r."notificationId"
+         WHERE ${where.join(" AND ")}
+         ORDER BY r."recipientSeq" DESC
+         LIMIT ?`, params);
+            const page = rows.slice(0, limit).map(feedRowToItem);
+            return {
+                items: page,
+                nextCursor: rows.length > limit ? page.at(-1)?.recipientSeq ?? null : null
+            };
+        },
+        async unreadCount() {
+            const subjectId = requireCurrentSubject(options.currentUser);
+            return unreadCount(options.db, subjectId);
+        },
+        async markRead(feedItemId) {
+            const subjectId = requireCurrentSubject(options.currentUser);
+            const now = nowIso();
+            await options.db.run(`UPDATE ${q(raybaseNotificationRecipientsTableName)}
+         SET "feedStatus" = 'read', "readAt" = COALESCE("readAt", ?)
+         WHERE "id" = ? AND "recipientSubjectId" = ? AND "feedStatus" != 'archived' AND "feedStatus" != 'none'`, [now, feedItemId, subjectId]);
+            const item = await getFeedItem(options.db, subjectId, feedItemId);
+            if (!item)
+                throw new NotificationError("Notification feed item was not found", "not-found");
+            await pushFeedUpdate(options, subjectId, "read", item);
+            return item;
+        },
+        async markAllRead() {
+            const subjectId = requireCurrentSubject(options.currentUser);
+            const now = nowIso();
+            const before = await unreadCount(options.db, subjectId);
+            await options.db.run(`UPDATE ${q(raybaseNotificationRecipientsTableName)}
+         SET "feedStatus" = 'read', "readAt" = COALESCE("readAt", ?)
+         WHERE "recipientSubjectId" = ? AND "feedStatus" = 'unread'`, [now, subjectId]);
+            const after = await unreadCount(options.db, subjectId);
+            return { updated: before.unread - after.unread, unread: after.unread, seq: after.seq };
+        },
+        async archive(feedItemId) {
+            const subjectId = requireCurrentSubject(options.currentUser);
+            const now = nowIso();
+            await options.db.run(`UPDATE ${q(raybaseNotificationRecipientsTableName)}
+         SET "feedStatus" = 'archived', "archivedAt" = COALESCE("archivedAt", ?)
+         WHERE "id" = ? AND "recipientSubjectId" = ? AND "feedStatus" != 'none'`, [now, feedItemId, subjectId]);
+            const item = await getFeedItem(options.db, subjectId, feedItemId);
+            if (!item)
+                throw new NotificationError("Notification feed item was not found", "not-found");
+            await pushFeedUpdate(options, subjectId, "archived", item);
+            return item;
+        }
+    };
+    return runtime;
+}
+async function sendNotification(options, resolved, input) {
+    assertEnabled(resolved);
+    const adapters = options.notifications?.channels ?? {};
+    const channels = normalizeChannels(input.channels);
+    const externalChannels = channels.filter((channel) => channel !== "feed");
+    for (const channel of externalChannels) {
+        if (!adapters[channel])
+            throw new NotificationError(`Unknown notification channel: ${channel}`, "invalid-channel");
+    }
+    if (!input.title || typeof input.title !== "string")
+        throw new NotificationError("Notification title is required", "invalid-input");
+    if (input.title.length > 200)
+        throw new NotificationError("Notification title must be 200 characters or fewer", "payload-too-large");
+    assertUtf8Bytes(input.body ?? "", resolved.maxBodyBytes, "Notification body");
+    const metadataJson = checkedStoredJson(redactSecrets(input.metadata), resolved.maxMetadataBytes, "Notification metadata");
+    const channelTargetsJson = checkedStoredJson(redactSecrets(input.channelTargets), resolved.maxChannelTargetsBytes, "Notification channel targets");
+    const severity = input.severity ?? "info";
+    if (!["info", "success", "warning", "error"].includes(severity)) {
+        throw new NotificationError(`Invalid notification severity: ${severity}`, "invalid-input");
+    }
+    if (input.expiresAt && !Number.isFinite(new Date(input.expiresAt).getTime())) {
+        throw new NotificationError("Notification expiresAt must be an ISO timestamp", "invalid-input");
+    }
+    if (input.dedupeKey) {
+        const existing = await options.db.first(`SELECT "id" FROM ${q(raybaseNotificationsTableName)} WHERE "dedupeKey" = ?`, [input.dedupeKey]);
+        if (existing)
+            return dedupedResult(options.db, existing.id);
+    }
+    const wantsFeed = channels.includes("feed");
+    const recipients = await resolveRecipients(options, input.to ?? [], resolved);
+    if (wantsFeed && recipients.length === 0) {
+        throw new NotificationError("Feed notifications require at least one authenticated recipient", "recipient-unavailable");
+    }
+    if (!wantsFeed && externalChannels.length === 0) {
+        throw new NotificationError("Notification channels must not be empty", "invalid-input");
+    }
+    const createdAt = nowIso();
+    const throttle = input.throttle ? normalizeThrottle(input.throttle) : null;
+    const throttleResult = throttle
+        ? await applyNotificationThrottle(options, throttle, recipients, input, createdAt)
+        : { allowed: recipients, throttled: [] };
+    if (recipients.length > 0 && throttleResult.allowed.length === 0) {
+        return { deduped: false, recipients: [], deliveries: [], throttled: throttleResult.throttled, skipped: [] };
+    }
+    const activeWebPushSubjects = externalChannels.includes("webpush")
+        ? await options.activeWebPushSubjectIds?.(throttleResult.allowed.map((recipient) => recipient.recipientSubjectId)) ?? new Set()
+        : null;
+    const notificationId = randomId("notif");
+    const actor = options.actor ?? (options.currentUser ? { kind: "user", id: options.currentUser.id } : { kind: "service", id: null });
+    await options.db.run(`INSERT INTO ${q(raybaseNotificationsTableName)}
+      ("id", "kind", "severity", "title", "body", "targetHref", "targetEntityType", "targetEntityId", "channelsJson",
+       "channelTargetsJson", "metadataJson", "dedupeKey", "actorKind", "actorId", "sourceType", "sourceId", "createdAt", "expiresAt")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+        notificationId,
+        input.kind ?? null,
+        severity,
+        input.title,
+        input.body ?? null,
+        input.target?.href ?? null,
+        input.target?.entity?.type ?? null,
+        input.target?.entity?.id ?? null,
+        stableJson(channels),
+        channelTargetsJson,
+        metadataJson,
+        input.dedupeKey ?? null,
+        actor.kind,
+        actor.id ?? null,
+        options.source?.type ?? null,
+        options.source?.id ?? null,
+        createdAt,
+        input.expiresAt ?? null
+    ]);
+    const result = { notificationId, deduped: false, recipients: [], deliveries: [], throttled: throttleResult.throttled, skipped: [] };
+    const recipientRows = [];
+    const explicitEmailTarget = emailChannelTarget(input.channelTargets);
+    for (const recipient of throttleResult.allowed) {
+        const seq = await nextRecipientSeq(options.db, recipient.recipientSubjectId);
+        const recipientId = randomId("nrec");
+        const feedStatus = wantsFeed ? "unread" : "none";
+        await options.db.run(`INSERT INTO ${q(raybaseNotificationRecipientsTableName)}
+        ("id", "notificationId", "recipientKind", "recipientSubjectId", "recipientRole", "recipientSeq", "feedStatus", "readAt", "archivedAt", "createdAt")
+       VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?)`, [
+            recipientId,
+            notificationId,
+            recipient.recipientKind,
+            recipient.recipientSubjectId,
+            recipient.recipientRole ?? null,
+            seq,
+            feedStatus,
+            createdAt
+        ]);
+        recipientRows.push({ ...recipient, id: recipientId, feedStatus, seq });
+        result.recipients.push({
+            recipientSubjectId: recipient.recipientSubjectId,
+            recipientKind: recipient.recipientKind,
+            feedItemId: wantsFeed ? recipientId : undefined
+        });
+    }
+    if (activeWebPushSubjects) {
+        for (const recipient of recipientRows) {
+            if (!activeWebPushSubjects.has(recipient.recipientSubjectId)) {
+                result.skipped.push({ recipientSubjectId: recipient.recipientSubjectId, channel: "webpush", reason: "no-subscriptions" });
+            }
+        }
+    }
+    for (const channel of externalChannels) {
+        const adapter = adapters[channel];
+        const targets = channel === "webpush"
+            ? recipientRows.filter((recipient) => activeWebPushSubjects?.has(recipient.recipientSubjectId))
+            : recipientRows.length ? recipientRows : [null];
+        for (const recipient of targets) {
+            const deliveryId = randomId("ndel");
+            const recipientSubjectId = recipient?.recipientSubjectId ?? null;
+            const recipientEmail = recipient?.recipientEmail ?? (channel === "email" ? explicitEmailTarget?.email : null) ?? null;
+            const recipientName = recipient?.recipientName ?? (channel === "email" ? explicitEmailTarget?.name : null) ?? null;
+            const idempotencyKey = input.dedupeKey ? `${input.dedupeKey}:${channel}:${recipientSubjectId ?? "target"}` : null;
+            await options.db.run(`INSERT INTO ${q(raybaseNotificationDeliveriesTableName)}
+          ("id", "notificationId", "recipientId", "recipientSubjectId", "recipientEmail", "recipientName", "channel", "adapter", "status", "attempt", "maxAttempts",
+           "idempotencyKey", "availableAt", "lastAttemptAt", "deliveredAt", "failedAt", "providerMessageId", "lastErrorJson", "createdAt", "updatedAt")
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, ?, ?, ?, NULL, NULL, NULL, NULL, NULL, ?, ?)`, [
+                deliveryId,
+                notificationId,
+                recipient?.id ?? null,
+                recipientSubjectId,
+                recipientEmail,
+                recipientName,
+                channel,
+                adapter.name,
+                resolved.delivery.maxAttempts,
+                idempotencyKey,
+                createdAt,
+                createdAt,
+                createdAt
+            ]);
+            result.deliveries.push({ deliveryId, channel, adapter: adapter.name, recipientSubjectId: recipientSubjectId ?? undefined, recipientEmail: recipientEmail ?? undefined });
+        }
+    }
+    if (wantsFeed) {
+        for (const recipient of recipientRows) {
+            const item = await getFeedItem(options.db, recipient.recipientSubjectId, recipient.id);
+            if (item)
+                await pushFeedUpdate(options, recipient.recipientSubjectId, "created", item);
+        }
+    }
+    if (result.deliveries.length)
+        await options.enqueueDelivery?.();
+    return result;
+}
+async function dedupedResult(db, notificationId) {
+    const recipients = await db.all(`SELECT "id", "recipientSubjectId", "recipientKind", "feedStatus"
+     FROM ${q(raybaseNotificationRecipientsTableName)}
+     WHERE "notificationId" = ?
+     ORDER BY "createdAt" ASC
+     LIMIT 100`, [notificationId]);
+    const deliveries = await db.all(`SELECT "id", "channel", "adapter", "recipientSubjectId", "recipientEmail"
+     FROM ${q(raybaseNotificationDeliveriesTableName)}
+     WHERE "notificationId" = ?
+     ORDER BY "createdAt" ASC
+     LIMIT 100`, [notificationId]);
+    return {
+        notificationId,
+        deduped: true,
+        recipients: recipients.map((row) => ({
+            recipientSubjectId: row.recipientSubjectId,
+            recipientKind: row.recipientKind,
+            feedItemId: row.feedStatus !== "none" ? row.id : undefined
+        })),
+        deliveries: deliveries.map((row) => ({
+            deliveryId: row.id,
+            channel: row.channel,
+            adapter: row.adapter,
+            recipientSubjectId: row.recipientSubjectId ?? undefined,
+            recipientEmail: row.recipientEmail ?? undefined
+        })),
+        throttled: [],
+        skipped: []
+    };
+}
+function normalizeThrottle(input) {
+    const key = typeof input.key === "string" ? input.key.trim() : "";
+    if (!key)
+        throw new NotificationError("Notification throttle key is required", "invalid-input");
+    if (key.length > notificationDefaults.throttleKeyMaxLength) {
+        throw new NotificationError(`Notification throttle key must be ${notificationDefaults.throttleKeyMaxLength} characters or fewer`, "invalid-input");
+    }
+    if (input.minInterval === undefined || input.minInterval === null || input.minInterval === "") {
+        throw new NotificationError("Notification throttle minInterval must be a valid duration", "invalid-input");
+    }
+    let parsedMs;
+    try {
+        parsedMs = durationMs(input.minInterval);
+    }
+    catch {
+        throw new NotificationError("Notification throttle minInterval must be a valid duration", "invalid-input");
+    }
+    const minIntervalMs = Math.min(notificationDefaults.throttleMaxIntervalMs, Math.max(notificationDefaults.throttleMinIntervalMs, parsedMs));
+    return { key, minIntervalMs };
+}
+async function applyNotificationThrottle(options, throttle, recipients, input, now) {
+    const allowed = [];
+    const throttled = [];
+    const nowMs = Date.parse(now);
+    const windowExpiresAt = new Date(nowMs + throttle.minIntervalMs).toISOString();
+    for (const recipient of recipients) {
+        const claimed = await options.db.first(`INSERT INTO ${q(raybaseNotificationThrottleWindowsTableName)}
+        ("id", "throttleKey", "recipientSubjectId", "lastSentAt", "windowExpiresAt", "suppressedCount", "firstSuppressedAt", "lastSuppressedJson", "updatedAt")
+       VALUES (?, ?, ?, ?, ?, 0, NULL, NULL, ?)
+       ON CONFLICT("throttleKey", "recipientSubjectId") DO UPDATE SET
+         "lastSentAt" = excluded."lastSentAt",
+         "windowExpiresAt" = excluded."windowExpiresAt",
+         "suppressedCount" = 0,
+         "firstSuppressedAt" = NULL,
+         "lastSuppressedJson" = NULL,
+         "updatedAt" = excluded."updatedAt"
+       WHERE "windowExpiresAt" <= ?
+       RETURNING "id", "windowExpiresAt"`, [randomId("nthrottle"), throttle.key, recipient.recipientSubjectId, now, windowExpiresAt, now, now]);
+        if (claimed) {
+            allowed.push(recipient);
+            continue;
+        }
+        const suppressedJson = truncateJson({
+            title: input.title,
+            kind: input.kind ?? null,
+            createdAt: now
+        }, notificationDefaults.maxMetadataBytes).json;
+        const suppressed = await options.db.first(`UPDATE ${q(raybaseNotificationThrottleWindowsTableName)}
+       SET "suppressedCount" = "suppressedCount" + 1,
+           "firstSuppressedAt" = COALESCE("firstSuppressedAt", ?),
+           "lastSuppressedJson" = ?,
+           "updatedAt" = ?
+       WHERE "throttleKey" = ? AND "recipientSubjectId" = ? AND "windowExpiresAt" > ?
+       RETURNING "id", "windowExpiresAt"`, [now, suppressedJson, now, throttle.key, recipient.recipientSubjectId, now]);
+        if (suppressed) {
+            throttled.push({ recipientSubjectId: recipient.recipientSubjectId, until: suppressed.windowExpiresAt });
+            await options.audit?.("notification.throttled", raybaseNotificationThrottleWindowsTableName, suppressed.id, {
+                throttleKey: throttle.key,
+                recipientSubjectId: recipient.recipientSubjectId,
+                until: suppressed.windowExpiresAt
+            });
+            continue;
+        }
+        throw new NotificationError("Notification throttle window changed while sending; retry the send", "recipient-unavailable");
+    }
+    return { allowed, throttled };
+}
+function normalizeChannels(channels) {
+    const normalized = channels === undefined ? ["feed"] : Array.from(new Set(channels.map((channel) => channel.trim()).filter(Boolean)));
+    if (!normalized.length)
+        throw new NotificationError("Notification channels must not be empty", "invalid-input");
+    return normalized;
+}
+async function resolveRecipients(options, recipients, resolved) {
+    const output = new Map();
+    const directory = raybaseRuntimeProfile(options.env)?.directory?.notificationRecipients;
+    for (const recipient of recipients) {
+        if (recipient.kind === "current-user") {
+            if (!options.currentUser)
+                throw new NotificationError("current-user recipient requires a signed-in request context", "auth-required");
+            if (!options.currentUser.disabled) {
+                output.set(options.currentUser.id, {
+                    recipientKind: "user",
+                    recipientSubjectId: options.currentUser.id,
+                    recipientEmail: options.currentUser.email || null,
+                    recipientName: options.currentUser.name || null
+                });
+            }
+            continue;
+        }
+        const query = recipient.kind === "user"
+            ? { kind: "user", subjectId: recipient.userId }
+            : recipient.kind === "role"
+                ? { kind: "role", role: recipient.role }
+                : { kind: "operator", role: recipient.role };
+        if (directory) {
+            const users = await directory(query, options.env, raybaseRuntimeScope(options.env));
+            for (const user of users) {
+                output.set(user.subjectId, {
+                    recipientKind: recipient.kind,
+                    recipientSubjectId: user.subjectId,
+                    ...(query.kind !== "user" ? { recipientRole: user.role ?? query.role ?? null } : {}),
+                    recipientEmail: user.email ?? null,
+                    recipientName: user.name ?? null
+                });
+            }
+            continue;
+        }
+        if (recipient.kind === "user") {
+            const user = await activeUser(options.db, recipient.userId);
+            if (user)
+                output.set(user.id, { recipientKind: "user", recipientSubjectId: user.id, recipientEmail: user.email || null, recipientName: user.name || null });
+            continue;
+        }
+        if (recipient.kind === "role") {
+            const users = await activeUsers(options.db);
+            for (const user of users) {
+                const roles = parseRoles(user.appRoles);
+                if (roles.includes(recipient.role)) {
+                    output.set(user.id, { recipientKind: "role", recipientSubjectId: user.id, recipientRole: recipient.role, recipientEmail: user.email || null, recipientName: user.name || null });
+                }
+            }
+            continue;
+        }
+        if (recipient.kind === "operator") {
+            const users = await activeUsers(options.db);
+            for (const user of users) {
+                const operatorRole = normalizeStoredAdminRole(user.operatorRole);
+                if (hasAdminAccess(operatorRole)) {
+                    if (!recipient.role || recipient.role === operatorRole) {
+                        output.set(user.id, { recipientKind: "operator", recipientSubjectId: user.id, recipientRole: recipient.role ?? operatorRole, recipientEmail: user.email || null, recipientName: user.name || null });
+                    }
+                }
+            }
+        }
+    }
+    if (output.size > resolved.maxRecipientsPerSend) {
+        throw new NotificationError(`Notification resolved ${output.size} recipients, exceeding the configured maximum ${resolved.maxRecipientsPerSend}`, "recipient-unavailable");
+    }
+    return [...output.values()];
+}
+async function activeUser(db, userId) {
+    const row = await db.first(`SELECT "id", "email", "name", "operatorRole", "appRoles", "banned" FROM "_auth_users" WHERE "id" = ?`, [userId]);
+    return row && !Boolean(row.banned) ? hostUserRowCeiling(row) : null;
+}
+async function activeUsers(db) {
+    const rows = await db.all(`SELECT "id", "email", "name", "operatorRole", "appRoles", "banned" FROM "_auth_users"`);
+    return rows.filter((row) => !Boolean(row.banned)).map(hostUserRowCeiling);
+}
+// Host users always hold the plain user role, so role-targeted notifications
+// (admins, operators) never reach one whose row was edited.
+function hostUserRowCeiling(row) {
+    return isHostUserId(row.id) ? { ...row, operatorRole: null, appRoles: JSON.stringify(["user"]) } : row;
+}
+function parseRoles(value) {
+    if (Array.isArray(value))
+        return Array.from(new Set(["user", ...value.map(String).filter(Boolean)]));
+    if (typeof value === "string" && value.trim()) {
+        try {
+            const parsed = JSON.parse(value);
+            if (Array.isArray(parsed))
+                return Array.from(new Set(["user", ...parsed.map(String).filter(Boolean)]));
+        }
+        catch {
+            return Array.from(new Set(["user", ...value.split(",").map((role) => role.trim()).filter(Boolean)]));
+        }
+        return Array.from(new Set(["user", value]));
+    }
+    return ["user"];
+}
+async function nextRecipientSeq(db, subjectId) {
+    const row = await db.first(`SELECT COALESCE(MAX("recipientSeq"), 0) + 1 AS "seq"
+     FROM ${q(raybaseNotificationRecipientsTableName)}
+     WHERE "recipientSubjectId" = ?`, [subjectId]);
+    return Number(row?.seq ?? 1);
+}
+function requireCurrentSubject(user) {
+    if (!user?.id)
+        throw new NotificationError("Notification feed requires a signed-in user", "auth-required");
+    return user.id;
+}
+async function unreadCount(db, subjectId) {
+    const row = await db.first(`SELECT
+       SUM(CASE WHEN "feedStatus" = 'unread' THEN 1 ELSE 0 END) AS "unread",
+       COALESCE(MAX("recipientSeq"), 0) AS "seq"
+     FROM ${q(raybaseNotificationRecipientsTableName)}
+     WHERE "recipientSubjectId" = ? AND "feedStatus" != 'none'`, [subjectId]);
+    return { unread: Number(row?.unread ?? 0), seq: Number(row?.seq ?? 0) };
+}
+async function getFeedItem(db, subjectId, feedItemId) {
+    const row = await db.first(`SELECT r."id" AS "feedItemId", r."notificationId", r."feedStatus", r."readAt", r."archivedAt", r."recipientSeq", r."createdAt",
+            n."id", n."kind", n."severity", n."title", n."body", n."targetHref", n."targetEntityType", n."targetEntityId",
+            n."metadataJson", n."expiresAt"
+     FROM ${q(raybaseNotificationRecipientsTableName)} r
+     INNER JOIN ${q(raybaseNotificationsTableName)} n ON n."id" = r."notificationId"
+     WHERE r."id" = ? AND r."recipientSubjectId" = ? AND r."feedStatus" != 'none'`, [feedItemId, subjectId]);
+    return row ? feedRowToItem(row) : null;
+}
+function feedRowToItem(row) {
+    return {
+        id: row.feedItemId,
+        notificationId: row.notificationId,
+        kind: row.kind,
+        severity: row.severity,
+        title: row.title,
+        body: row.body,
+        target: row.targetHref || row.targetEntityType || row.targetEntityId
+            ? {
+                href: row.targetHref ?? undefined,
+                entity: row.targetEntityType && row.targetEntityId ? { type: row.targetEntityType, id: row.targetEntityId } : undefined
+            }
+            : undefined,
+        metadata: safeParseJson(row.metadataJson),
+        feedStatus: row.feedStatus,
+        readAt: row.readAt,
+        archivedAt: row.archivedAt,
+        recipientSeq: Number(row.recipientSeq),
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt
+    };
+}
+async function pushFeedUpdate(options, subjectId, event, item) {
+    if (!options.notifyFeed)
+        return;
+    const count = await unreadCount(options.db, subjectId);
+    await options.notifyFeed({ subjectId, event, item, unread: count.unread, seq: count.seq });
+}
+function checkedStoredJson(value, maxBytes, label) {
+    if (value === undefined)
+        return null;
+    const json = stableJson(value);
+    assertUtf8Bytes(json, maxBytes, label);
+    return json;
+}
+function assertUtf8Bytes(value, maxBytes, label) {
+    if (new TextEncoder().encode(value).byteLength > maxBytes) {
+        throw new NotificationError(`${label} exceeds ${maxBytes} bytes`, "payload-too-large");
+    }
+}
+function safeParseJson(value) {
+    if (!value)
+        return undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+function redactSecrets(value, depth = 0) {
+    if (Array.isArray(value))
+        return value.map((item) => redactSecrets(item, depth + 1));
+    if (!value || typeof value !== "object")
+        return value;
+    if (depth > 8)
+        return "[truncated]";
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        /secret|token|password|key|authorization|signature/i.test(key) ? "[redacted]" : redactSecrets(item, depth + 1)
+    ]));
+}
+export async function claimAndRunNotificationDeliveries(options) {
+    const resolved = resolveNotificationConfig(options.config, options.notifications);
+    assertEnabled(resolved);
+    const adapters = options.notifications?.channels ?? {};
+    const appNow = nowIso();
+    const wallNow = wallNowIso();
+    const rows = await options.db.all(`SELECT "id"
+     FROM ${q(raybaseNotificationDeliveriesTableName)}
+     WHERE ("status" = 'pending' AND "availableAt" <= ?)
+        OR ("status" = 'failed' AND "availableAt" <= ?)
+     ORDER BY "availableAt" ASC
+     LIMIT 25`, [appNow, wallNow]);
+    let processed = 0;
+    for (const row of rows) {
+        const claimedAt = nowIso();
+        await options.db.run(`UPDATE ${q(raybaseNotificationDeliveriesTableName)}
+       SET "status" = 'leased', "updatedAt" = ?
+       WHERE "id" = ? AND "status" IN ('pending', 'failed')`, [claimedAt, row.id]);
+        const delivery = await getDelivery(options.db, row.id);
+        if (!delivery || delivery.status !== "leased")
+            continue;
+        const adapter = adapters[delivery.channel];
+        if (!adapter) {
+            await failDelivery(options.db, delivery, new Error(`Notification adapter ${delivery.channel} is not configured`), "permanent");
+            processed += 1;
+            continue;
+        }
+        await runDelivery(options, adapter, delivery);
+        processed += 1;
+    }
+    return { processed };
+}
+async function runDelivery(options, adapter, delivery) {
+    const startedAt = nowIso();
+    const attempt = delivery.attempt + 1;
+    const attemptId = randomId("natt");
+    const startedMs = wallNowMs();
+    const isLocal = options.isLocal === true;
+    if (isLocal && !adapter.allowLocalSend) {
+        const requestSummary = truncateJson({ skippedLocal: true, channel: delivery.channel, adapter: adapter.name, notification: delivery.notification }, notificationDefaults.maxAttemptSummaryBytes).json;
+        await options.db.run(`INSERT INTO ${q(raybaseNotificationAttemptsTableName)}
+        ("id", "deliveryId", "attempt", "status", "startedAt", "endedAt", "durationMs", "requestSummaryJson", "responseSummaryJson", "errorJson")
+       VALUES (?, ?, ?, 'skipped_local', ?, ?, ?, ?, NULL, NULL)`, [attemptId, delivery.id, attempt, startedAt, nowIso(), 0, requestSummary]);
+        await options.db.run(`UPDATE ${q(raybaseNotificationDeliveriesTableName)}
+       SET "status" = 'skipped_local', "attempt" = ?, "lastAttemptAt" = ?, "updatedAt" = ?
+       WHERE "id" = ?`, [attempt, startedAt, nowIso(), delivery.id]);
+        return;
+    }
+    try {
+        const publicContext = {
+            env: options.env,
+            isLocal,
+            now: startedAt
+        };
+        const result = delivery.channel === "webpush"
+            ? await sendWebPushPrivately(adapter, delivery, publicContext, { db: options.db, audit: options.audit })
+            : await adapter.send(delivery, publicContext);
+        const endedAt = nowIso();
+        await options.db.run(`INSERT INTO ${q(raybaseNotificationAttemptsTableName)}
+        ("id", "deliveryId", "attempt", "status", "startedAt", "endedAt", "durationMs", "requestSummaryJson", "responseSummaryJson", "errorJson")
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)`, [
+            attemptId,
+            delivery.id,
+            attempt,
+            result.status === "skipped" ? "skipped_local" : "delivered",
+            startedAt,
+            endedAt,
+            wallNowMs() - startedMs,
+            truncateJson(redactSecrets(result.requestSummary), notificationDefaults.maxAttemptSummaryBytes).json,
+            truncateJson(redactSecrets(result.responseSummary), notificationDefaults.maxAttemptSummaryBytes).json
+        ]);
+        await options.db.run(`UPDATE ${q(raybaseNotificationDeliveriesTableName)}
+       SET "status" = ?, "attempt" = ?, "lastAttemptAt" = ?, "deliveredAt" = ?, "providerMessageId" = ?, "updatedAt" = ?
+       WHERE "id" = ?`, [result.status === "skipped" ? "skipped_local" : "delivered", attempt, startedAt, endedAt, result.providerMessageId ?? null, endedAt, delivery.id]);
+    }
+    catch (error) {
+        await failDelivery(options.db, { ...delivery, attempt }, error, adapter.classifyError?.(error) ?? defaultErrorClassification(error));
+    }
+}
+async function failDelivery(db, delivery, error, classification) {
+    const endedAt = nowIso();
+    const endedWallAt = wallNowIso();
+    const attempt = Math.max(delivery.attempt, 1);
+    const terminal = classification === "permanent" || attempt >= delivery.maxAttempts;
+    const status = terminal ? "permanent_failure" : "failed";
+    const errorJson = truncateEventData({
+        message: error instanceof Error ? error.message : String(error),
+        name: error instanceof Error ? error.name : "Error"
+    });
+    const errorEvidence = error && typeof error === "object" ? error : {};
+    const requestSummaryJson = errorEvidence.requestSummary === undefined
+        ? null
+        : truncateJson(redactSecrets(errorEvidence.requestSummary), notificationDefaults.maxAttemptSummaryBytes).json;
+    const responseSummaryJson = errorEvidence.responseSummary === undefined
+        ? null
+        : truncateJson(redactSecrets(errorEvidence.responseSummary), notificationDefaults.maxAttemptSummaryBytes).json;
+    await db.run(`INSERT INTO ${q(raybaseNotificationAttemptsTableName)}
+      ("id", "deliveryId", "attempt", "status", "startedAt", "endedAt", "durationMs", "requestSummaryJson", "responseSummaryJson", "errorJson")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [randomId("natt"), delivery.id, attempt, status, delivery.lastAttemptAt ?? endedAt, endedAt, 0, requestSummaryJson, responseSummaryJson, errorJson]);
+    await db.run(`UPDATE ${q(raybaseNotificationDeliveriesTableName)}
+     SET "status" = ?, "attempt" = ?, "lastAttemptAt" = ?, "failedAt" = ?, "availableAt" = ?, "lastErrorJson" = ?, "updatedAt" = ?
+     WHERE "id" = ?`, [
+        status,
+        attempt,
+        endedAt,
+        endedAt,
+        terminal ? endedAt : addDuration(endedWallAt, `${Math.min(3600, 30 * 2 ** Math.max(0, attempt - 1))} seconds`),
+        errorJson,
+        endedAt,
+        delivery.id
+    ]);
+}
+function defaultErrorClassification(error) {
+    const status = typeof error === "object" && error ? Number(error.status) : 0;
+    if (status === 408 || status === 409 || status === 425 || status === 429 || status >= 500 || !status)
+        return "retry";
+    return "permanent";
+}
+async function getDelivery(db, deliveryId) {
+    const row = await db.first(`SELECT d.*, n."kind" AS "notificationKind", n."severity" AS "notificationSeverity", n."title" AS "notificationTitle",
+            n."body" AS "notificationBody", n."targetHref", n."targetEntityType", n."targetEntityId", n."metadataJson",
+            n."actorKind" AS "notificationActorKind", n."actorId" AS "notificationActorId", n."createdAt" AS "notificationCreatedAt"
+     FROM ${q(raybaseNotificationDeliveriesTableName)} d
+     INNER JOIN ${q(raybaseNotificationsTableName)} n ON n."id" = d."notificationId"
+     WHERE d."id" = ?`, [deliveryId]);
+    return row ? deliveryRow(row) : null;
+}
+function deliveryRow(row) {
+    return {
+        id: String(row.id),
+        notificationId: String(row.notificationId),
+        recipientId: row.recipientId ? String(row.recipientId) : null,
+        recipientSubjectId: row.recipientSubjectId ? String(row.recipientSubjectId) : null,
+        recipientEmail: row.recipientEmail ? String(row.recipientEmail) : null,
+        recipientName: row.recipientName ? String(row.recipientName) : null,
+        channel: String(row.channel),
+        adapter: String(row.adapter),
+        status: String(row.status),
+        attempt: Number(row.attempt ?? 0),
+        maxAttempts: Number(row.maxAttempts ?? 1),
+        idempotencyKey: row.idempotencyKey ? String(row.idempotencyKey) : null,
+        availableAt: String(row.availableAt),
+        lastAttemptAt: row.lastAttemptAt ? String(row.lastAttemptAt) : null,
+        deliveredAt: row.deliveredAt ? String(row.deliveredAt) : null,
+        failedAt: row.failedAt ? String(row.failedAt) : null,
+        providerMessageId: row.providerMessageId ? String(row.providerMessageId) : null,
+        lastErrorJson: row.lastErrorJson ? String(row.lastErrorJson) : null,
+        createdAt: String(row.createdAt),
+        updatedAt: String(row.updatedAt),
+        notification: {
+            id: String(row.notificationId),
+            kind: row.notificationKind ? String(row.notificationKind) : null,
+            severity: String(row.notificationSeverity),
+            title: String(row.notificationTitle),
+            body: row.notificationBody ? String(row.notificationBody) : null,
+            targetHref: row.targetHref ? String(row.targetHref) : null,
+            targetEntityType: row.targetEntityType ? String(row.targetEntityType) : null,
+            targetEntityId: row.targetEntityId ? String(row.targetEntityId) : null,
+            metadata: safeParseJson(row.metadataJson ? String(row.metadataJson) : null),
+            actorKind: String(row.notificationActorKind),
+            actorId: row.notificationActorId ? String(row.notificationActorId) : null,
+            createdAt: String(row.notificationCreatedAt)
+        }
+    };
+}
+export async function notificationAdminSummary(db, notifications) {
+    const deliveryCounts = await db.all(`SELECT "status", "channel", "adapter", COUNT(*) AS "count"
+     FROM ${q(raybaseNotificationDeliveriesTableName)}
+     GROUP BY "status", "channel", "adapter"
+     ORDER BY "status", "channel", "adapter"`);
+    const inboundCounts = await db.all(`SELECT "status", "adapter", COUNT(*) AS "count"
+     FROM ${q(raybaseInboundEventsTableName)}
+     GROUP BY "status", "adapter"
+     ORDER BY "status", "adapter"`);
+    return {
+        deliveryCounts: deliveryCounts.map((row) => ({ ...row, count: Number(row.count) })),
+        inboundCounts: inboundCounts.map((row) => ({ ...row, count: Number(row.count) })),
+        adapters: Object.values(notifications?.channels ?? {}).map((adapter) => ({
+            channel: adapter.channel,
+            adapter: adapter.name,
+            description: adapter.description
+        }))
+    };
+}
+export async function notificationThrottleWindowsQuery(db, options = {}) {
+    await compactNotificationThrottleWindows(db);
+    const where = [];
+    const params = [];
+    if (options.activeOnly !== false) {
+        where.push(`"windowExpiresAt" > ?`);
+        params.push(nowIso());
+    }
+    params.push(Math.min(Math.max(1, options.limit ?? 50), 200), Math.max(0, options.offset ?? 0));
+    const rows = await db.all(`SELECT *
+     FROM ${q(raybaseNotificationThrottleWindowsTableName)}
+     ${where.length ? `WHERE ${where.join(" AND ")}` : ""}
+     ORDER BY "windowExpiresAt" ASC, "updatedAt" DESC
+     LIMIT ? OFFSET ?`, params);
+    return { throttles: rows.map(notificationThrottleWindowRow) };
+}
+export async function resetNotificationThrottleWindow(db, id) {
+    const row = await db.first(`SELECT * FROM ${q(raybaseNotificationThrottleWindowsTableName)} WHERE "id" = ?`, [id]);
+    if (!row)
+        throw new NotificationError("Notification throttle window was not found", "not-found");
+    await db.run(`DELETE FROM ${q(raybaseNotificationThrottleWindowsTableName)} WHERE "id" = ?`, [id]);
+    return { ok: true, throttle: notificationThrottleWindowRow(row) };
+}
+export async function compactNotificationThrottleWindows(db, now = nowIso()) {
+    const expired = await db.all(`SELECT "id"
+     FROM ${q(raybaseNotificationThrottleWindowsTableName)}
+     WHERE "windowExpiresAt" <= ? AND "suppressedCount" = 0
+     LIMIT 500`, [now]);
+    for (const row of expired) {
+        await db.run(`DELETE FROM ${q(raybaseNotificationThrottleWindowsTableName)} WHERE "id" = ?`, [row.id]);
+    }
+    return { deleted: expired.length };
+}
+function notificationThrottleWindowRow(row) {
+    const subjectId = String(row.recipientSubjectId ?? "");
+    return {
+        id: String(row.id),
+        throttleKey: String(row.throttleKey),
+        recipientSubjectId: subjectId,
+        maskedRecipientSubjectId: maskSubjectId(subjectId),
+        lastSentAt: String(row.lastSentAt),
+        windowExpiresAt: String(row.windowExpiresAt),
+        suppressedCount: Number(row.suppressedCount ?? 0),
+        firstSuppressedAt: row.firstSuppressedAt ? String(row.firstSuppressedAt) : null,
+        lastSuppressed: safeParseJson(row.lastSuppressedJson),
+        updatedAt: String(row.updatedAt)
+    };
+}
+export async function notificationDeliveriesQuery(db, options = {}) {
+    const where = [];
+    const params = [];
+    if (options.status) {
+        where.push(`"status" = ?`);
+        params.push(options.status);
+    }
+    if (options.channel) {
+        where.push(`"channel" = ?`);
+        params.push(options.channel);
+    }
+    if (options.adapter) {
+        where.push(`"adapter" = ?`);
+        params.push(options.adapter);
+    }
+    params.push(Math.min(Math.max(1, options.limit ?? 50), 200), Math.max(0, options.offset ?? 0));
+    const rows = await db.all(`SELECT * FROM ${q(raybaseNotificationDeliveriesTableName)}
+     ${where.length ? `WHERE ${where.join(" AND ")}` : ""}
+     ORDER BY "createdAt" DESC
+     LIMIT ? OFFSET ?`, params);
+    return { deliveries: rows.map(redactRow) };
+}
+export async function notificationDeliveryDetail(db, deliveryId) {
+    const delivery = await getDelivery(db, deliveryId);
+    if (!delivery)
+        return null;
+    const attempts = await db.all(`SELECT * FROM ${q(raybaseNotificationAttemptsTableName)} WHERE "deliveryId" = ? ORDER BY "attempt" ASC`, [deliveryId]);
+    return { delivery: redactRow(delivery), attempts: attempts.map(redactRow) };
+}
+export async function retryNotificationDelivery(db, deliveryId) {
+    const row = await db.first(`SELECT "status" FROM ${q(raybaseNotificationDeliveriesTableName)} WHERE "id" = ?`, [deliveryId]);
+    if (!row)
+        throw new NotificationError("Notification delivery was not found", "not-found");
+    if (row.status !== "failed" && row.status !== "permanent_failure") {
+        throw new NotificationError(`Cannot retry notification delivery in status ${row.status}`, "invalid-input");
+    }
+    await db.run(`UPDATE ${q(raybaseNotificationDeliveriesTableName)}
+     SET "status" = 'pending', "availableAt" = ?, "failedAt" = NULL, "updatedAt" = ?
+     WHERE "id" = ?`, [nowIso(), nowIso(), deliveryId]);
+    return { ok: true, previousStatus: row.status };
+}
+export async function notificationInboundEventsQuery(db, options = {}) {
+    const where = [];
+    const params = [];
+    if (options.status) {
+        where.push(`"status" = ?`);
+        params.push(options.status);
+    }
+    if (options.adapter) {
+        where.push(`"adapter" = ?`);
+        params.push(options.adapter);
+    }
+    params.push(Math.min(Math.max(1, options.limit ?? 50), 200), Math.max(0, options.offset ?? 0));
+    const rows = await db.all(`SELECT "id", "adapter", "path", "status", "verified", "idempotencyKey", "providerEventId", "actorKind", "actorId", "receivedAt", "processedAt"
+     FROM ${q(raybaseInboundEventsTableName)}
+     ${where.length ? `WHERE ${where.join(" AND ")}` : ""}
+     ORDER BY "receivedAt" DESC
+     LIMIT ? OFFSET ?`, params);
+    return { events: rows.map(redactRow) };
+}
+export async function notificationInboundEventDetail(db, eventId) {
+    const row = await db.first(`SELECT * FROM ${q(raybaseInboundEventsTableName)} WHERE "id" = ?`, [eventId]);
+    return row ? redactRow(row) : null;
+}
+function redactRow(row) {
+    const redacted = redactSecrets(row);
+    if (typeof redacted.recipientEmail === "string")
+        redacted.recipientEmail = maskEmail(redacted.recipientEmail);
+    if (redacted.delivery && typeof redacted.delivery === "object" && typeof redacted.delivery.recipientEmail === "string") {
+        redacted.delivery.recipientEmail = maskEmail(String(redacted.delivery.recipientEmail));
+    }
+    return redacted;
+}
+function emailChannelTarget(targets) {
+    const emailTarget = targets?.email;
+    if (typeof emailTarget === "string")
+        return normalizeEmailTarget(emailTarget);
+    if (!emailTarget || typeof emailTarget !== "object" || Array.isArray(emailTarget))
+        return null;
+    const target = emailTarget;
+    const to = target.to;
+    if (typeof to === "string") {
+        const normalized = normalizeEmailTarget(to);
+        const name = typeof target.name === "string" && target.name.trim() ? target.name.trim() : normalized?.name;
+        return normalized ? { email: normalized.email, name } : null;
+    }
+    if (to && typeof to === "object" && !Array.isArray(to)) {
+        const value = to;
+        if (typeof value.email === "string") {
+            const normalized = normalizeEmailTarget(value.email);
+            const name = typeof value.name === "string" && value.name.trim() ? value.name.trim() : undefined;
+            return normalized ? { email: normalized.email, name } : null;
+        }
+    }
+    return null;
+}
+function normalizeEmailTarget(value) {
+    const email = value.trim().toLowerCase();
+    if (!/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(email))
+        return null;
+    return { email };
+}
+function maskEmail(value) {
+    const [local = "", domain = ""] = value.split("@");
+    if (!domain)
+        return "[redacted-email]";
+    return `${local.slice(0, 2)}${local.length > 2 ? "***" : "*"}@${domain}`;
+}
+function maskSubjectId(value) {
+    if (!value)
+        return "";
+    if (value.length <= 12)
+        return "redacted";
+    return `${value.slice(0, 6)}...${value.slice(-4)}`;
+}
+export function createNotificationsOperatorEvidenceProvider(dbForContext, notifications) {
+    return {
+        id: "notifications",
+        label: "Notifications",
+        scopes: ["operator:notifications:read"],
+        tools: [
+            {
+                name: "notification_health_summary",
+                description: "Summarize notification adapters, delivery counts, and inbound webhook health.",
+                scopes: ["operator:notifications:read"],
+                inputSchema: z.object({}).strict(),
+                handler: async (_args, ctx) => {
+                    const summary = await notificationAdminSummary(dbForContext({ env: ctx.env }), notifications);
+                    return {
+                        content: [{ type: "text", text: "Notification health summary." }],
+                        structuredContent: summary
+                    };
+                }
+            },
+            {
+                name: "notification_deliveries_query",
+                description: "Query notification deliveries with redacted payload and error evidence.",
+                scopes: ["operator:notifications:read"],
+                inputSchema: z.object({ status: z.string().optional(), channel: z.string().optional(), adapter: z.string().optional(), limit: z.number().optional(), offset: z.number().optional() }).strict(),
+                handler: async (args, ctx) => ({
+                    content: [{ type: "text", text: "Notification deliveries." }],
+                    structuredContent: await notificationDeliveriesQuery(dbForContext({ env: ctx.env }), args)
+                })
+            },
+            {
+                name: "notification_delivery_detail",
+                description: "Inspect a notification delivery and its attempts.",
+                scopes: ["operator:notifications:read"],
+                inputSchema: z.object({ deliveryId: z.string().min(1) }).strict(),
+                handler: async (args, ctx) => {
+                    const detail = await notificationDeliveryDetail(dbForContext({ env: ctx.env }), String(args.deliveryId));
+                    return {
+                        content: [{ type: "text", text: detail ? "Notification delivery detail." : "Notification delivery not found." }],
+                        structuredContent: { detail }
+                    };
+                }
+            },
+            {
+                name: "notification_inbound_events_query",
+                description: "Query inbound notification/webhook receipts.",
+                scopes: ["operator:notifications:read"],
+                inputSchema: z.object({ status: z.string().optional(), adapter: z.string().optional(), limit: z.number().optional(), offset: z.number().optional() }).strict(),
+                handler: async (args, ctx) => ({
+                    content: [{ type: "text", text: "Inbound notification events." }],
+                    structuredContent: await notificationInboundEventsQuery(dbForContext({ env: ctx.env }), args)
+                })
+            },
+            {
+                name: "notification_inbound_event_detail",
+                description: "Inspect an inbound notification/webhook receipt.",
+                scopes: ["operator:notifications:read"],
+                inputSchema: z.object({ eventId: z.string().min(1) }).strict(),
+                handler: async (args, ctx) => {
+                    const detail = await notificationInboundEventDetail(dbForContext({ env: ctx.env }), String(args.eventId));
+                    return {
+                        content: [{ type: "text", text: detail ? "Inbound notification event detail." : "Inbound notification event not found." }],
+                        structuredContent: { detail }
+                    };
+                }
+            }
+        ],
+        resources: [
+            {
+                uri: "raybase://notifications/summary",
+                name: "Notification Summary",
+                description: "Notification adapter and delivery health summary.",
+                scopes: ["operator:notifications:read"],
+                read: async (ctx) => ({
+                    uri: "raybase://notifications/summary",
+                    mimeType: "application/json",
+                    text: JSON.stringify(await notificationAdminSummary(dbForContext({ env: ctx.env }), notifications), null, 2)
+                })
+            },
+            {
+                uri: "raybase://notifications/failures",
+                name: "Notification Failures",
+                description: "Recent failed notification delivery evidence.",
+                scopes: ["operator:notifications:read"],
+                read: async (ctx) => {
+                    const db = dbForContext({ env: ctx.env });
+                    const failed = await notificationDeliveriesQuery(db, { status: "failed", limit: 50 });
+                    const permanent = await notificationDeliveriesQuery(db, { status: "permanent_failure", limit: 50 });
+                    return {
+                        uri: "raybase://notifications/failures",
+                        mimeType: "application/json",
+                        text: JSON.stringify({ failed: failed.deliveries, permanentFailures: permanent.deliveries }, null, 2)
+                    };
+                }
+            },
+            {
+                uri: "raybase://notifications/inbound/recent",
+                name: "Recent Inbound Notification Events",
+                description: "Recent inbound webhook receipts and statuses.",
+                scopes: ["operator:notifications:read"],
+                read: async (ctx) => ({
+                    uri: "raybase://notifications/inbound/recent",
+                    mimeType: "application/json",
+                    text: JSON.stringify(await notificationInboundEventsQuery(dbForContext({ env: ctx.env }), { limit: 50 }), null, 2)
+                })
+            }
+        ]
+    };
+}
+export async function handleInboundNotification(options) {
+    const resolved = resolveNotificationConfig(options.config, options.notifications);
+    assertEnabled(resolved);
+    const adapter = options.adapter;
+    const rawBody = new Uint8Array(await options.request.arrayBuffer());
+    if (rawBody.byteLength > resolved.maxInboundBodyBytes) {
+        return Response.json({ error: "Inbound notification body is too large" }, { status: 413 });
+    }
+    const receivedAt = nowIso();
+    const ctx = { env: options.env, request: options.request };
+    const requestFor = () => new Request(options.request.url, { method: options.request.method, headers: options.request.headers, body: rawBody });
+    try {
+        await adapter.verify(requestFor(), rawBody, ctx);
+    }
+    catch (error) {
+        const eventId = randomId("inbound");
+        await options.db.run(`INSERT INTO ${q(raybaseInboundEventsTableName)}
+        ("id", "adapter", "path", "status", "verified", "idempotencyKey", "providerEventId", "actorKind", "actorId", "payloadJson", "resultJson", "errorJson", "receivedAt", "processedAt")
+       VALUES (?, ?, ?, 'verification_failed', 0, NULL, NULL, 'service', ?, NULL, NULL, ?, ?, ?)`, [
+            eventId,
+            adapter.name,
+            new URL(options.request.url).pathname,
+            `webhook:${adapter.name}`,
+            truncateEventData({ message: error instanceof Error ? error.message : String(error), headers: redactedHeaders(options.request.headers) }),
+            receivedAt,
+            nowIso()
+        ]);
+        return Response.json({ error: "Webhook verification failed" }, { status: 401 });
+    }
+    let parsed;
+    try {
+        parsed = await adapter.parse(requestFor(), rawBody, ctx);
+    }
+    catch (error) {
+        const eventId = randomId("inbound");
+        await options.db.run(`INSERT INTO ${q(raybaseInboundEventsTableName)}
+        ("id", "adapter", "path", "status", "verified", "idempotencyKey", "providerEventId", "actorKind", "actorId", "payloadJson", "resultJson", "errorJson", "receivedAt", "processedAt")
+       VALUES (?, ?, ?, 'parse_failed', 1, NULL, NULL, 'service', ?, NULL, NULL, ?, ?, ?)`, [eventId, adapter.name, new URL(options.request.url).pathname, `webhook:${adapter.name}`, truncateEventData({ message: error instanceof Error ? error.message : String(error) }), receivedAt, nowIso()]);
+        return Response.json({ error: "Webhook parse failed" }, { status: 400 });
+    }
+    const idempotencyKey = parsed.idempotencyKey || (await sha256Hex(rawBody));
+    const duplicate = await options.db.first(`SELECT * FROM ${q(raybaseInboundEventsTableName)} WHERE "adapter" = ? AND "idempotencyKey" = ?`, [adapter.name, idempotencyKey]);
+    if (duplicate?.processedAt)
+        return Response.json({ ok: true, duplicate: true });
+    const eventId = duplicate?.id ? String(duplicate.id) : randomId("inbound");
+    const payloadJson = truncateJson(redactSecrets(parsed.payload), resolved.maxMetadataBytes).json;
+    if (!duplicate) {
+        await options.db.run(`INSERT INTO ${q(raybaseInboundEventsTableName)}
+        ("id", "adapter", "path", "status", "verified", "idempotencyKey", "providerEventId", "actorKind", "actorId", "payloadJson", "resultJson", "errorJson", "receivedAt", "processedAt")
+       VALUES (?, ?, ?, 'verified', 1, ?, ?, ?, ?, ?, NULL, NULL, ?, NULL)`, [
+            eventId,
+            adapter.name,
+            new URL(options.request.url).pathname,
+            idempotencyKey,
+            parsed.providerEventId ?? null,
+            parsed.actorKind ?? "service",
+            parsed.actorId ?? `webhook:${adapter.name}`,
+            payloadJson,
+            receivedAt
+        ]);
+    }
+    const event = {
+        id: eventId,
+        adapter: adapter.name,
+        path: new URL(options.request.url).pathname,
+        status: "verified",
+        verified: true,
+        idempotencyKey,
+        providerEventId: parsed.providerEventId ?? null,
+        actorKind: parsed.actorKind ?? "service",
+        actorId: parsed.actorId ?? `webhook:${adapter.name}`,
+        payload: parsed.payload,
+        receivedAt,
+        processedAt: null
+    };
+    try {
+        const result = await adapter.handle(event, {
+            env: options.env,
+            request: options.request,
+            event,
+            notifications: createNotificationsRuntime({ ...options, actor: { kind: "service", id: `webhook:${adapter.name}` }, currentUser: null }),
+            jobs: {
+                enqueue: options.enqueueJob ?? (async () => {
+                    throw new Error("Jobs are not configured for inbound notification handlers");
+                })
+            },
+            audit: options.audit ?? (async () => { })
+        });
+        await options.db.run(`UPDATE ${q(raybaseInboundEventsTableName)}
+       SET "status" = 'processed', "resultJson" = ?, "processedAt" = ?
+       WHERE "id" = ?`, [truncateEventData(result), nowIso(), eventId]);
+        await options.audit?.("notification.inbound.processed", raybaseInboundEventsTableName, eventId, { adapter: adapter.name });
+        return Response.json({ ok: true, eventId });
+    }
+    catch (error) {
+        await options.db.run(`UPDATE ${q(raybaseInboundEventsTableName)}
+       SET "status" = 'handler_failed', "errorJson" = ?, "processedAt" = ?
+       WHERE "id" = ?`, [truncateEventData({ message: error instanceof Error ? error.message : String(error), name: error instanceof Error ? error.name : "Error" }), nowIso(), eventId]);
+        return Response.json({ error: "Webhook handler failed", eventId }, { status: 500 });
+    }
+}
+function redactedHeaders(headers) {
+    const output = {};
+    for (const [key, value] of headers.entries()) {
+        output[key] = /authorization|cookie|signature|token|secret/i.test(key) ? "[redacted]" : value.slice(0, 200);
+    }
+    return output;
+}
+export function webhookOutboundAdapter(options) {
+    return {
+        name: options.name,
+        channel: "webhook",
+        description: "Signed Raybase webhook delivery",
+        allowLocalSend: options.allowLocalSend,
+        async send(delivery, ctx) {
+            const url = options.url(ctx.env);
+            const secret = options.signingSecret(ctx.env);
+            if (!url)
+                throw Object.assign(new Error("Webhook URL is missing"), { status: 400 });
+            if (!secret)
+                throw Object.assign(new Error("Webhook signing secret is missing"), { status: 400 });
+            const body = stableJson({
+                notification: delivery.notification,
+                delivery: {
+                    id: delivery.id,
+                    channel: delivery.channel,
+                    recipientSubjectId: delivery.recipientSubjectId,
+                    attempt: delivery.attempt + 1
+                }
+            });
+            const timestamp = String(Math.floor(wallNowMs() / 1000));
+            const signature = await hmacHex(secret, `${timestamp}.${body}`);
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort("timeout"), options.timeoutMs ?? notificationDefaults.deliveryTimeoutMs);
+            try {
+                const response = await fetch(url, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        "x-raybase-webhook-id": delivery.notificationId,
+                        "x-raybase-delivery-id": delivery.id,
+                        "x-raybase-timestamp": timestamp,
+                        "x-raybase-signature": `sha256=${signature}`,
+                        "idempotency-key": delivery.idempotencyKey ?? delivery.id,
+                        ...(options.headers?.(delivery, ctx) ?? {})
+                    },
+                    body,
+                    signal: controller.signal
+                });
+                const responseBody = await response.text().catch(() => "");
+                if (!response.ok) {
+                    throw Object.assign(new Error(`Webhook responded with ${response.status}`), {
+                        status: response.status,
+                        responseBody: responseBody.slice(0, 2000)
+                    });
+                }
+                return {
+                    status: "delivered",
+                    providerMessageId: response.headers.get("x-request-id") ?? response.headers.get("x-message-id") ?? undefined,
+                    requestSummary: { url: redactUrl(url), bytes: body.length },
+                    responseSummary: { status: response.status, body: responseBody.slice(0, 1000) }
+                };
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+        },
+        classifyError(error) {
+            return defaultErrorClassification(error);
+        },
+        async health(ctx) {
+            return {
+                ok: Boolean(options.url(ctx.env) && options.signingSecret(ctx.env)),
+                label: options.name,
+                details: {
+                    urlConfigured: Boolean(options.url(ctx.env)),
+                    signingSecretConfigured: Boolean(options.signingSecret(ctx.env))
+                }
+            };
+        }
+    };
+}
+export function webhookInboundAdapter(options) {
+    return {
+        name: options.name,
+        path: options.path,
+        async verify(request, rawBody, ctx) {
+            const secret = options.signingSecret(ctx.env);
+            if (!secret)
+                throw new Error("Webhook signing secret is missing");
+            const timestamp = request.headers.get("x-raybase-timestamp") ?? "";
+            const signature = request.headers.get("x-raybase-signature") ?? "";
+            if (!timestamp || !signature)
+                throw new Error("Missing webhook signature");
+            const timestampMs = Number(timestamp) * 1000;
+            if (!Number.isFinite(timestampMs))
+                throw new Error("Invalid webhook timestamp");
+            const replayWindowMs = (options.replayWindowSeconds ?? 300) * 1000;
+            if (Math.abs(wallNowMs() - timestampMs) > replayWindowMs)
+                throw new Error("Webhook timestamp is outside the replay window");
+            const rawBodyText = new TextDecoder().decode(rawBody);
+            const expected = await hmacHex(secret, `${timestamp}.${rawBodyText}`);
+            if (!constantTimeEqual(normalizeSignature(signature), expected))
+                throw new Error("Invalid webhook signature");
+            return true;
+        },
+        async parse(request, rawBody) {
+            if (options.parse)
+                return options.parse(request);
+            const idempotencyKey = request.headers.get("x-raybase-webhook-id") ??
+                request.headers.get("idempotency-key") ??
+                await sha256Hex(rawBody);
+            const payload = await request.json().catch(() => ({}));
+            return { idempotencyKey, providerEventId: request.headers.get("x-raybase-webhook-id") ?? undefined, payload };
+        },
+        handle: options.handle
+    };
+}
+function normalizeSignature(signature) {
+    return signature.startsWith("sha256=") ? signature.slice("sha256=".length) : signature;
+}
+function constantTimeEqual(left, right) {
+    const a = new TextEncoder().encode(left);
+    const b = new TextEncoder().encode(right);
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let index = 0; index < a.length; index += 1)
+        diff |= a[index] ^ b[index];
+    return diff === 0;
+}
+async function hmacHex(secret, value) {
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value));
+    return hex(new Uint8Array(signature));
+}
+function hex(bytes) {
+    return Array.from(bytes)
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+function redactUrl(value) {
+    try {
+        const url = new URL(value);
+        url.username = "";
+        url.password = "";
+        url.search = "";
+        return url.toString();
+    }
+    catch {
+        return "[invalid-url]";
+    }
+}
+export function notificationJobPrincipal() {
+    return { kind: "service", service: raybaseNotificationServicePrincipal };
+}
+//# sourceMappingURL=notifications.js.map