@shware/workflow 0.0.0-stage → 0.1.0

package/dist/fcm.cjs

@@ -0,0 +1,125 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_jwt = require("./jwt.cjs");
+//#region src/fcm.ts
+/** Errors FCM reports for a token that will never deliver again — not worth a retry. */
+const DEAD_TOKEN_CODES = /* @__PURE__ */ new Set([
+	"UNREGISTERED",
+	"INVALID_ARGUMENT",
+	"SENDER_ID_MISMATCH"
+]);
+const SCOPE = "https://www.googleapis.com/auth/firebase.messaging";
+var FcmPushSender = class {
+	options;
+	token;
+	constructor(options) {
+		this.options = options;
+	}
+	async send(message) {
+		if (message.channel !== "push") throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);
+		if (message.recipient === void 0) throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);
+		const { title, body, image, url } = await this.options.render(message.template, message.props);
+		const { serviceAccount, android, apns } = this.options;
+		const response = await (this.options.fetch ?? fetch)(`https://fcm.googleapis.com/v1/projects/${serviceAccount.project_id}/messages:send`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${await this.accessToken()}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({ message: {
+				token: message.recipient,
+				notification: {
+					title,
+					body,
+					...image === void 0 ? {} : { image }
+				},
+				data: {
+					template: message.template,
+					idempotencyKey: message.idempotencyKey,
+					...url === void 0 ? {} : { url },
+					...message.tracking?.data
+				},
+				...android === void 0 ? {} : { android: { notification: android } },
+				apns: { payload: { aps: {
+					sound: "default",
+					...apns
+				} } }
+			} })
+		});
+		if (response.ok) return;
+		const text = await response.text();
+		if (DEAD_TOKEN_CODES.has(fcmErrorCode(text))) {
+			console.warn(`[fcm] token gone for user ${message.userId}: ${fcmErrorCode(text)}`);
+			await this.options.onUnregistered?.(message);
+			return {
+				delivered: false,
+				reason: fcmErrorCode(text)
+			};
+		}
+		throw new Error(`FCM send failed: ${response.status} ${text}`);
+	}
+	async accessToken() {
+		const now = Date.now();
+		if (this.token !== void 0 && this.token.expiresAt - 6e4 > now) return this.token.value;
+		const { serviceAccount } = this.options;
+		const tokenUri = serviceAccount.token_uri ?? "https://oauth2.googleapis.com/token";
+		const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);
+		const response = await (this.options.fetch ?? fetch)(tokenUri, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+				assertion
+			})
+		});
+		if (!response.ok) throw new Error(`FCM token exchange failed: ${response.status} ${await response.text()}`);
+		const json = await response.json();
+		this.token = {
+			value: json.access_token,
+			expiresAt: now + json.expires_in * 1e3
+		};
+		return json.access_token;
+	}
+};
+/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */
+function fcmErrorCode(body) {
+	try {
+		const parsed = JSON.parse(body);
+		return parsed.error?.details?.find((d) => d.errorCode !== void 0)?.errorCode ?? parsed.error?.status ?? "";
+	} catch {
+		return "";
+	}
+}
+/** RS256-sign the OAuth2 JWT assertion for a service account. */
+async function signJwt(account, audience, scope, nowMs = Date.now()) {
+	const iat = Math.floor(nowMs / 1e3);
+	const header = require_jwt.base64url(JSON.stringify({
+		alg: "RS256",
+		typ: "JWT"
+	}));
+	const claims = require_jwt.base64url(JSON.stringify({
+		iss: account.client_email,
+		scope,
+		aud: audience,
+		iat,
+		exp: iat + 3600
+	}));
+	const key = await crypto.subtle.importKey("pkcs8", require_jwt.pemToDer(account.private_key), {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(`${header}.${claims}`));
+	return `${header}.${claims}.${require_jwt.base64url(new Uint8Array(signature))}`;
+}
+/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */
+function serviceAccountFromBase64(value) {
+	const json = JSON.parse(atob(value));
+	if (!json.project_id || !json.client_email || !json.private_key) throw new Error("service account JSON is missing project_id, client_email or private_key");
+	return json;
+}
+//#endregion
+exports.FcmPushSender = FcmPushSender;
+exports.fcmErrorCode = fcmErrorCode;
+exports.serviceAccountFromBase64 = serviceAccountFromBase64;
+exports.signJwt = signJwt;
+
+//# sourceMappingURL=fcm.cjs.map

package/dist/fcm.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fcm.cjs","names":["base64url","pemToDer"],"sources":["../src/fcm.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmPushOptions {\n  serviceAccount: FcmServiceAccount;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n  /** Called for a token FCM reports as gone (`UNREGISTERED`); `channelsFromConfig` removes the device. */\n  onUnregistered?: (message: OutboundMessage) => Promise<void> | void;\n}\n\n/** Errors FCM reports for a token that will never deliver again — not worth a retry. */\nconst DEAD_TOKEN_CODES = new Set(['UNREGISTERED', 'INVALID_ARGUMENT', 'SENDER_ID_MISMATCH']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\nexport class FcmPushSender implements MessageSender {\n  private token: { value: string; expiresAt: number } | undefined;\n\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { serviceAccount, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${serviceAccount.project_id}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await this.accessToken()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    if (DEAD_TOKEN_CODES.has(fcmErrorCode(text))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${fcmErrorCode(text)}`);\n      await this.options.onUnregistered?.(message);\n      return { delivered: false, reason: fcmErrorCode(text) };\n    }\n    throw new Error(`FCM send failed: ${response.status} ${text}`);\n  }\n\n  private async accessToken(): Promise<string> {\n    const now = Date.now();\n    if (this.token !== undefined && this.token.expiresAt - 60_000 > now) return this.token.value;\n\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      throw new Error(`FCM token exchange failed: ${response.status} ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    this.token = { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n    return json.access_token;\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  const json = JSON.parse(atob(value)) as Partial<FcmServiceAccount>;\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new Error('service account JSON is missing project_id, client_email or private_key');\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;AAqCA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAgB;CAAoB;AAAoB,CAAC;AAE3F,MAAM,QAAQ;AAEd,IAAa,gBAAb,MAAoD;CAGrB;CAF7B;CAEA,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,gBAAgB,SAAS,SAAS,KAAK;EAG/C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,eAAe,WAAW,iBACpE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,YAAY;IAChD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,iBAAiB,IAAI,aAAa,IAAI,CAAC,GAAG;GAG5C,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,aAAa,IAAI,GAAG;GACjF,MAAM,KAAK,QAAQ,iBAAiB,OAAO;GAC3C,OAAO;IAAE,WAAW;IAAO,QAAQ,aAAa,IAAI;GAAE;EACxD;EACA,MAAM,IAAI,MAAM,oBAAoB,SAAS,OAAO,GAAG,MAAM;CAC/D;CAEA,MAAc,cAA+B;EAC3C,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,KAAK,UAAU,KAAA,KAAa,KAAK,MAAM,YAAY,MAAS,KAAK,OAAO,KAAK,MAAM;EAEvF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,8BAA8B,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK,GAAG;EAE1F,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,KAAK,QAAQ;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;EACjF,OAAO,KAAK;CACd;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAASA,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAASA,YAAAA,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACAC,YAAAA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,CAAC;CACnC,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO;AACT"}

package/dist/fcm.d.cts

@@ -0,0 +1,48 @@
+import { MessageSender, OutboundMessage, SendResult } from "./engine/ports.cjs";
+import "./engine/index.cjs";
+import { PushRenderer } from "./push.cjs";
+//#region src/fcm.d.ts
+/**
+ * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's
+ * HTTP v1 API, from a service account. No dependencies: the OAuth2 access
+ * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,
+ * Bun), so this runs wherever the engine runs.
+ *
+ * The recipient is an FCM registration token the app registered for the user
+ * (`registerDevice`); the engine sends one message per device.
+ */
+/** The fields of a Google service-account JSON this sender needs. */
+export interface FcmServiceAccount {
+  project_id: string;
+  client_email: string;
+  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */
+  private_key: string;
+  token_uri?: string;
+}
+export interface FcmPushOptions {
+  serviceAccount: FcmServiceAccount;
+  render: PushRenderer;
+  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */
+  android?: Record<string, unknown>;
+  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */
+  apns?: Record<string, unknown>;
+  /** Fetch implementation (defaults to the global one). */
+  fetch?: typeof fetch;
+  /** Called for a token FCM reports as gone (`UNREGISTERED`); `channelsFromConfig` removes the device. */
+  onUnregistered?: (message: OutboundMessage) => Promise<void> | void;
+}
+export declare class FcmPushSender implements MessageSender {
+  private readonly options;
+  private token;
+  constructor(options: FcmPushOptions);
+  send(message: OutboundMessage): Promise<void | SendResult>;
+  private accessToken;
+}
+/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */
+export declare function fcmErrorCode(body: string): string;
+/** RS256-sign the OAuth2 JWT assertion for a service account. */
+export declare function signJwt(account: FcmServiceAccount, audience: string, scope: string, nowMs?: number): Promise<string>;
+/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */
+export declare function serviceAccountFromBase64(value: string): FcmServiceAccount;
+//#endregion
+//# sourceMappingURL=fcm.d.cts.map

package/dist/fcm.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fcm.d.cts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAeiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;EAChB,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;EAEf,kBAAkB,SAAS,oBAAoB;;qBAQpC,yBAAyB;mBAGP;UAFrB;EAER,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;UAkDvC;;;wBA0BA,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}

package/dist/fcm.d.mts

@@ -0,0 +1,48 @@
+import { MessageSender, OutboundMessage, SendResult } from "./engine/ports.mjs";
+import "./engine/index.mjs";
+import { PushRenderer } from "./push.mjs";
+//#region src/fcm.d.ts
+/**
+ * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's
+ * HTTP v1 API, from a service account. No dependencies: the OAuth2 access
+ * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,
+ * Bun), so this runs wherever the engine runs.
+ *
+ * The recipient is an FCM registration token the app registered for the user
+ * (`registerDevice`); the engine sends one message per device.
+ */
+/** The fields of a Google service-account JSON this sender needs. */
+export interface FcmServiceAccount {
+  project_id: string;
+  client_email: string;
+  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */
+  private_key: string;
+  token_uri?: string;
+}
+export interface FcmPushOptions {
+  serviceAccount: FcmServiceAccount;
+  render: PushRenderer;
+  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */
+  android?: Record<string, unknown>;
+  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */
+  apns?: Record<string, unknown>;
+  /** Fetch implementation (defaults to the global one). */
+  fetch?: typeof fetch;
+  /** Called for a token FCM reports as gone (`UNREGISTERED`); `channelsFromConfig` removes the device. */
+  onUnregistered?: (message: OutboundMessage) => Promise<void> | void;
+}
+export declare class FcmPushSender implements MessageSender {
+  private readonly options;
+  private token;
+  constructor(options: FcmPushOptions);
+  send(message: OutboundMessage): Promise<void | SendResult>;
+  private accessToken;
+}
+/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */
+export declare function fcmErrorCode(body: string): string;
+/** RS256-sign the OAuth2 JWT assertion for a service account. */
+export declare function signJwt(account: FcmServiceAccount, audience: string, scope: string, nowMs?: number): Promise<string>;
+/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */
+export declare function serviceAccountFromBase64(value: string): FcmServiceAccount;
+//#endregion
+//# sourceMappingURL=fcm.d.mts.map

package/dist/fcm.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fcm.d.mts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAeiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;EAChB,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;EAEf,kBAAkB,SAAS,oBAAoB;;qBAQpC,yBAAyB;mBAGP;UAFrB;EAER,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;UAkDvC;;;wBA0BA,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}

package/dist/fcm.mjs

@@ -0,0 +1,121 @@
+import { base64url, pemToDer } from "./jwt.mjs";
+//#region src/fcm.ts
+/** Errors FCM reports for a token that will never deliver again — not worth a retry. */
+const DEAD_TOKEN_CODES = /* @__PURE__ */ new Set([
+	"UNREGISTERED",
+	"INVALID_ARGUMENT",
+	"SENDER_ID_MISMATCH"
+]);
+const SCOPE = "https://www.googleapis.com/auth/firebase.messaging";
+var FcmPushSender = class {
+	options;
+	token;
+	constructor(options) {
+		this.options = options;
+	}
+	async send(message) {
+		if (message.channel !== "push") throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);
+		if (message.recipient === void 0) throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);
+		const { title, body, image, url } = await this.options.render(message.template, message.props);
+		const { serviceAccount, android, apns } = this.options;
+		const response = await (this.options.fetch ?? fetch)(`https://fcm.googleapis.com/v1/projects/${serviceAccount.project_id}/messages:send`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${await this.accessToken()}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({ message: {
+				token: message.recipient,
+				notification: {
+					title,
+					body,
+					...image === void 0 ? {} : { image }
+				},
+				data: {
+					template: message.template,
+					idempotencyKey: message.idempotencyKey,
+					...url === void 0 ? {} : { url },
+					...message.tracking?.data
+				},
+				...android === void 0 ? {} : { android: { notification: android } },
+				apns: { payload: { aps: {
+					sound: "default",
+					...apns
+				} } }
+			} })
+		});
+		if (response.ok) return;
+		const text = await response.text();
+		if (DEAD_TOKEN_CODES.has(fcmErrorCode(text))) {
+			console.warn(`[fcm] token gone for user ${message.userId}: ${fcmErrorCode(text)}`);
+			await this.options.onUnregistered?.(message);
+			return {
+				delivered: false,
+				reason: fcmErrorCode(text)
+			};
+		}
+		throw new Error(`FCM send failed: ${response.status} ${text}`);
+	}
+	async accessToken() {
+		const now = Date.now();
+		if (this.token !== void 0 && this.token.expiresAt - 6e4 > now) return this.token.value;
+		const { serviceAccount } = this.options;
+		const tokenUri = serviceAccount.token_uri ?? "https://oauth2.googleapis.com/token";
+		const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);
+		const response = await (this.options.fetch ?? fetch)(tokenUri, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+				assertion
+			})
+		});
+		if (!response.ok) throw new Error(`FCM token exchange failed: ${response.status} ${await response.text()}`);
+		const json = await response.json();
+		this.token = {
+			value: json.access_token,
+			expiresAt: now + json.expires_in * 1e3
+		};
+		return json.access_token;
+	}
+};
+/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */
+function fcmErrorCode(body) {
+	try {
+		const parsed = JSON.parse(body);
+		return parsed.error?.details?.find((d) => d.errorCode !== void 0)?.errorCode ?? parsed.error?.status ?? "";
+	} catch {
+		return "";
+	}
+}
+/** RS256-sign the OAuth2 JWT assertion for a service account. */
+async function signJwt(account, audience, scope, nowMs = Date.now()) {
+	const iat = Math.floor(nowMs / 1e3);
+	const header = base64url(JSON.stringify({
+		alg: "RS256",
+		typ: "JWT"
+	}));
+	const claims = base64url(JSON.stringify({
+		iss: account.client_email,
+		scope,
+		aud: audience,
+		iat,
+		exp: iat + 3600
+	}));
+	const key = await crypto.subtle.importKey("pkcs8", pemToDer(account.private_key), {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(`${header}.${claims}`));
+	return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;
+}
+/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */
+function serviceAccountFromBase64(value) {
+	const json = JSON.parse(atob(value));
+	if (!json.project_id || !json.client_email || !json.private_key) throw new Error("service account JSON is missing project_id, client_email or private_key");
+	return json;
+}
+//#endregion
+export { FcmPushSender, fcmErrorCode, serviceAccountFromBase64, signJwt };
+
+//# sourceMappingURL=fcm.mjs.map

package/dist/fcm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fcm.mjs","names":[],"sources":["../src/fcm.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmPushOptions {\n  serviceAccount: FcmServiceAccount;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n  /** Called for a token FCM reports as gone (`UNREGISTERED`); `channelsFromConfig` removes the device. */\n  onUnregistered?: (message: OutboundMessage) => Promise<void> | void;\n}\n\n/** Errors FCM reports for a token that will never deliver again — not worth a retry. */\nconst DEAD_TOKEN_CODES = new Set(['UNREGISTERED', 'INVALID_ARGUMENT', 'SENDER_ID_MISMATCH']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\nexport class FcmPushSender implements MessageSender {\n  private token: { value: string; expiresAt: number } | undefined;\n\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { serviceAccount, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${serviceAccount.project_id}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await this.accessToken()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    if (DEAD_TOKEN_CODES.has(fcmErrorCode(text))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${fcmErrorCode(text)}`);\n      await this.options.onUnregistered?.(message);\n      return { delivered: false, reason: fcmErrorCode(text) };\n    }\n    throw new Error(`FCM send failed: ${response.status} ${text}`);\n  }\n\n  private async accessToken(): Promise<string> {\n    const now = Date.now();\n    if (this.token !== undefined && this.token.expiresAt - 60_000 > now) return this.token.value;\n\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      throw new Error(`FCM token exchange failed: ${response.status} ${await response.text()}`);\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    this.token = { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n    return json.access_token;\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  const json = JSON.parse(atob(value)) as Partial<FcmServiceAccount>;\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new Error('service account JSON is missing project_id, client_email or private_key');\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;AAqCA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAgB;CAAoB;AAAoB,CAAC;AAE3F,MAAM,QAAQ;AAEd,IAAa,gBAAb,MAAoD;CAGrB;CAF7B;CAEA,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,gBAAgB,SAAS,SAAS,KAAK;EAG/C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,eAAe,WAAW,iBACpE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,YAAY;IAChD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,iBAAiB,IAAI,aAAa,IAAI,CAAC,GAAG;GAG5C,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,aAAa,IAAI,GAAG;GACjF,MAAM,KAAK,QAAQ,iBAAiB,OAAO;GAC3C,OAAO;IAAE,WAAW;IAAO,QAAQ,aAAa,IAAI;GAAE;EACxD;EACA,MAAM,IAAI,MAAM,oBAAoB,SAAS,OAAO,GAAG,MAAM;CAC/D;CAEA,MAAc,cAA+B;EAC3C,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,KAAK,UAAU,KAAA,KAAa,KAAK,MAAM,YAAY,MAAS,KAAK,OAAO,KAAK,MAAM;EAEvF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,8BAA8B,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK,GAAG;EAE1F,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,KAAK,QAAQ;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;EACjF,OAAO,KAAK;CACd;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAAS,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,CAAC;CACnC,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO;AACT"}

package/dist/hash.cjs

@@ -0,0 +1,245 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/hash.ts
+/**
+* Content hashing — contentHash covers execution semantics only.
+*
+* Human-facing metadata (name / description, node labels) is excluded,
+* because it cannot change which path a user takes:
+* - rewording a description must not invalidate the version an in-flight
+*   journey is pinned to;
+* - nor should it surface as a change in `plan`.
+*
+* Storage, by contrast, always keeps the full IR (including the latest
+* description). contentHash carries exactly two responsibilities: deciding
+* whether semantics moved (plan / migration), and pinning a version for
+* in-flight instances. So after a description edit: the UI shows the new text,
+* plan reports no change, and in-flight users are untouched.
+*/
+/**
+* Keys excluded from hashing.
+* - meta: metadata at any level — workflow (name / description) and
+*   node/segment provenance (`loc`, the callsite source map)
+* - label: node and branch-arm names (UI titles / observability, never routing)
+* - reason: the exit / filter audit string. It is written into the audit log
+*   and shown in the studio, but no user takes a different path because of it —
+*   the same test as a description, so rewording one must not repin in-flight
+*   journeys or report as a semantic change in plan.
+* - contentHash: the hash itself
+*
+* Note that a cohort arm's `name` IS hashed: it becomes part of the node id
+* (`{id}.{armName}.{j}`), and node ids are durable step names — renaming an arm
+* changes execution identity.
+*/
+const UNHASHED_KEYS = /* @__PURE__ */ new Set([
+	"meta",
+	"label",
+	"reason",
+	"contentHash"
+]);
+/**
+* Provenance only. `loc` is a source map, not content: it moves with the
+* machine and with the directory the compile ran from, so plan compares full
+* content with it removed (see plan.ts) — otherwise CI, compiling from the
+* workspace root, reports every definition as metadata_only against a deploy
+* compiled from a package directory.
+*/
+const PROVENANCE_KEYS = /* @__PURE__ */ new Set(["loc"]);
+/**
+* Fields whose values are maps the *author* keys, not the IR: message props,
+* send_event payloads and action args. Everything inside them is execution
+* data and is hashed whole.
+*
+* This is what keeps the exclusion above positional. Stripping by name at every
+* depth used to reach inside these maps, so a prop or payload field that
+* happened to be called `label` (or `meta`) vanished from the hash: two sends
+* carrying different values hashed identically, `plan` reported a real change
+* as metadata-only, and the deploy wrote different content under the same KV
+* key that in-flight journeys are pinned to.
+*
+* These three are the only `z.record` fields in the IR (see ir.ts). A new one
+* has to be added here, or its contents become strippable by name again.
+*
+* It matters for every key above: a send_event payload may well carry a field
+* called `reason` (subscription_cancelled does), and dropping it would hash two
+* different sends the same.
+*/
+const AUTHOR_KEYED_FIELDS = /* @__PURE__ */ new Set([
+	"props",
+	"payload",
+	"args"
+]);
+/** Drop `keys` at the positions the IR defines them, never inside an author-keyed map. */
+function stripKeys(value, keys) {
+	if (Array.isArray(value)) return value.map((item) => stripKeys(item, keys));
+	if (value !== null && typeof value === "object") {
+		const out = {};
+		for (const [key, item] of Object.entries(value)) {
+			if (keys.has(key)) continue;
+			out[key] = AUTHOR_KEYED_FIELDS.has(key) ? item : stripKeys(item, keys);
+		}
+		return out;
+	}
+	return value;
+}
+/** Drop metadata at the positions the IR defines it, leaving execution semantics. */
+function stripMeta(value) {
+	return stripKeys(value, UNHASHED_KEYS);
+}
+/** Drop provenance, keeping the rest of the metadata — what plan compares. */
+function stripProvenance(value) {
+	return stripKeys(value, PROVENANCE_KEYS);
+}
+/** Canonical JSON: sorted keys, no whitespace — a stable hash input. */
+function canonicalJSON(value) {
+	if (value === void 0) return "null";
+	if (Array.isArray(value)) return `[${value.map(canonicalJSON).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJSON(value[key])}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+const K = new Uint32Array([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+const rotr = (x, n) => x >>> n | x << 32 - n;
+const utf8 = new TextEncoder();
+/** SHA-256 over the UTF-8 bytes of `input`, as 64 hex chars. */
+function sha256Hex(input) {
+	const data = utf8.encode(input);
+	const bitLenLo = data.length << 3 >>> 0;
+	const bitLenHi = Math.floor(data.length / 536870912);
+	const padded = new Uint8Array((data.length + 8 >> 6) + 1 << 6);
+	padded.set(data);
+	padded[data.length] = 128;
+	const view = new DataView(padded.buffer);
+	view.setUint32(padded.length - 8, bitLenHi);
+	view.setUint32(padded.length - 4, bitLenLo);
+	const state = new Uint32Array([
+		1779033703,
+		3144134277,
+		1013904242,
+		2773480762,
+		1359893119,
+		2600822924,
+		528734635,
+		1541459225
+	]);
+	const w = /* @__PURE__ */ new Uint32Array(64);
+	for (let offset = 0; offset < padded.length; offset += 64) {
+		for (let i = 0; i < 16; i++) w[i] = view.getUint32(offset + i * 4);
+		for (let i = 16; i < 64; i++) {
+			const w15 = w[i - 15];
+			const w2 = w[i - 2];
+			const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
+			const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
+			w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+		}
+		let [a, b, c, d, e, f, g, h] = state;
+		for (let i = 0; i < 64; i++) {
+			const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const t1 = h + s1 + ch + K[i] + w[i] >>> 0;
+			const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2 >>> 0;
+		}
+		state[0] = state[0] + a >>> 0;
+		state[1] = state[1] + b >>> 0;
+		state[2] = state[2] + c >>> 0;
+		state[3] = state[3] + d >>> 0;
+		state[4] = state[4] + e >>> 0;
+		state[5] = state[5] + f >>> 0;
+		state[6] = state[6] + g >>> 0;
+		state[7] = state[7] + h >>> 0;
+	}
+	return [...state].map((word) => word.toString(16).padStart(8, "0")).join("");
+}
+/**
+* Truncate to 128 bits (32 hex chars): collision-safe for content addressing at
+* any realistic definition count, and short enough for KV keys and instance ids.
+*/
+const contentHashOf = (input) => sha256Hex(input).slice(0, 32);
+/** Content hash of execution semantics (strip metadata → canonical JSON → truncated SHA-256). */
+function semanticHash(value) {
+	return contentHashOf(canonicalJSON(stripMeta(value)));
+}
+/** Canonical hash of the full content — used to tell "semantics unchanged, metadata edited" apart. */
+function fullHash(value) {
+	return contentHashOf(canonicalJSON(value));
+}
+//#endregion
+exports.canonicalJSON = canonicalJSON;
+exports.fullHash = fullHash;
+exports.semanticHash = semanticHash;
+exports.sha256Hex = sha256Hex;
+exports.stripMeta = stripMeta;
+exports.stripProvenance = stripProvenance;
+
+//# sourceMappingURL=hash.cjs.map