@shware/workflow 2.0.1 → 3.1.0

package/dist/transports/ses.d.mts

@@ -0,0 +1,39 @@
+import { EmailTransport } from "../email-sender.mjs";
+//#region src/transports/ses.d.ts
+/**
+ * `@shware/workflow/transports/ses` — email through Amazon SES (the v2 `SendEmail` API) over
+ * plain `fetch` with a SigV4 signature, so the same transport runs in a Lambda and in a Worker.
+ * Nothing here loads the AWS SDK or a Node-only credential chain.
+ */
+export interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  /** Present for temporary credentials (a role's): signed with the request. */
+  sessionToken?: string | undefined;
+}
+/** Called on every send, so rotated temporary credentials are picked up rather than frozen. */
+export type AwsCredentialProvider = () => AwsCredentials | Promise<AwsCredentials>;
+export interface SesEmailTransportOptions {
+  region: string;
+  /**
+   * Fixed credentials, or a provider read on every send. Defaults to the process environment's
+   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, read at send time —
+   * a Lambda's execution role. A Worker passes them explicitly from its validated env.
+   */
+  credentials?: AwsCredentials | AwsCredentialProvider;
+  /** An SES configuration set (event publishing, a dedicated IP pool). */
+  configurationSetName?: string;
+  /** Defaults to `https://email.<region>.amazonaws.com`. */
+  endpoint?: string;
+  fetch?: typeof fetch;
+}
+/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */
+export declare class SesSendError extends Error {
+  readonly status: number;
+  readonly type: string | undefined;
+  readonly name = "SesSendError";
+  constructor(status: number, type: string | undefined, message: string);
+}
+export declare function sesEmailTransport(options: SesEmailTransportOptions): EmailTransport;
+//#endregion
+//# sourceMappingURL=ses.d.mts.map

package/dist/transports/ses.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses.d.mts","names":[],"sources":["../../src/transports/ses.ts"],"mappings":";;;;;;;iBAUiB;EACf;EACA;;EAEA;;;YAIU,8BAA8B,iBAAiB,QAAQ;iBAElD;EACf;;;;;;EAMA,cAAc,iBAAiB;;EAE/B;;EAEA;EACA,eAAe;;;qBAIJ,qBAAqB;WAGrB;WACA;WAHO;EAClB,YACW,gBACA,0BACT;;wBAoBY,kBAAkB,SAAS,2BAA2B"}

package/dist/transports/ses.mjs

@@ -0,0 +1,89 @@
+import { mimeAddress } from "../email.mjs";
+import { signRequest } from "./sigv4.mjs";
+//#region src/transports/ses.ts
+/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */
+var SesSendError = class extends Error {
+	status;
+	type;
+	name = "SesSendError";
+	constructor(status, type, message) {
+		super(`SES SendEmail failed (${status}${type === void 0 ? "" : ` ${type}`}): ${message}`);
+		this.status = status;
+		this.type = type;
+	}
+};
+function environmentCredentials() {
+	const env = globalThis.process?.env;
+	const accessKeyId = env?.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = env?.AWS_SECRET_ACCESS_KEY;
+	if (accessKeyId === void 0 || secretAccessKey === void 0) throw new Error("sesEmailTransport: no credentials — pass `credentials`, or run where AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set (a Lambda execution role)");
+	return {
+		accessKeyId,
+		secretAccessKey,
+		sessionToken: env?.AWS_SESSION_TOKEN
+	};
+}
+function sesEmailTransport(options) {
+	const endpoint = (options.endpoint ?? `https://email.${options.region}.amazonaws.com`).replace(/\/$/, "");
+	const credentials = async () => {
+		const configured = options.credentials;
+		if (configured === void 0) return environmentCredentials();
+		return typeof configured === "function" ? configured() : configured;
+	};
+	const fetchImpl = options.fetch ?? fetch;
+	return { async send(message) {
+		const body = JSON.stringify({
+			FromEmailAddress: mimeAddress(message.from),
+			Destination: { ToAddresses: [message.to] },
+			...message.replyTo === void 0 ? {} : { ReplyToAddresses: [mimeAddress(message.replyTo)] },
+			Content: { Simple: {
+				Subject: {
+					Data: message.subject,
+					Charset: "UTF-8"
+				},
+				Body: { Html: {
+					Data: message.html,
+					Charset: "UTF-8"
+				} }
+			} },
+			...options.configurationSetName === void 0 ? {} : { ConfigurationSetName: options.configurationSetName }
+		});
+		const url = `${endpoint}/v2/email/outbound-emails`;
+		const headers = await signRequest({
+			method: "POST",
+			url,
+			headers: { "content-type": "application/json" },
+			body,
+			credentials: await credentials(),
+			region: options.region,
+			service: "ses"
+		});
+		const response = await fetchImpl(url, {
+			method: "POST",
+			headers,
+			body
+		});
+		const text = await response.text();
+		if (!response.ok) {
+			let detail = text;
+			try {
+				const parsed = JSON.parse(text);
+				const said = parsed.message ?? parsed.Message;
+				if (typeof said === "string") detail = said;
+			} catch {}
+			const type = response.headers.get("x-amzn-errortype")?.split(":")[0];
+			throw new SesSendError(response.status, type, detail);
+		}
+		let messageId;
+		try {
+			messageId = JSON.parse(text).MessageId;
+		} catch {
+			messageId = void 0;
+		}
+		return typeof messageId === "string" ? { providerMessageId: messageId } : {};
+	} };
+}
+//#endregion
+export { SesSendError, sesEmailTransport };
+
+//# sourceMappingURL=ses.mjs.map

package/dist/transports/ses.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses.mjs","names":[],"sources":["../../src/transports/ses.ts"],"sourcesContent":["import { mimeAddress } from '../email';\nimport type { EmailMessage, EmailTransport } from '../email-sender';\nimport { signRequest } from './sigv4';\n\n/**\n * `@shware/workflow/transports/ses` — email through Amazon SES (the v2 `SendEmail` API) over\n * plain `fetch` with a SigV4 signature, so the same transport runs in a Lambda and in a Worker.\n * Nothing here loads the AWS SDK or a Node-only credential chain.\n */\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** Present for temporary credentials (a role's): signed with the request. */\n  sessionToken?: string | undefined;\n}\n\n/** Called on every send, so rotated temporary credentials are picked up rather than frozen. */\nexport type AwsCredentialProvider = () => AwsCredentials | Promise<AwsCredentials>;\n\nexport interface SesEmailTransportOptions {\n  region: string;\n  /**\n   * Fixed credentials, or a provider read on every send. Defaults to the process environment's\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, read at send time —\n   * a Lambda's execution role. A Worker passes them explicitly from its validated env.\n   */\n  credentials?: AwsCredentials | AwsCredentialProvider;\n  /** An SES configuration set (event publishing, a dedicated IP pool). */\n  configurationSetName?: string;\n  /** Defaults to `https://email.<region>.amazonaws.com`. */\n  endpoint?: string;\n  fetch?: typeof fetch;\n}\n\n/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */\nexport class SesSendError extends Error {\n  override readonly name = 'SesSendError';\n  constructor(\n    readonly status: number,\n    readonly type: string | undefined,\n    message: string\n  ) {\n    super(`SES SendEmail failed (${status}${type === undefined ? '' : ` ${type}`}): ${message}`);\n  }\n}\n\nfunction environmentCredentials(): AwsCredentials {\n  // Read through globalThis: a Worker has no `process`, and must pass credentials instead\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process\n    ?.env;\n  const accessKeyId = env?.AWS_ACCESS_KEY_ID;\n  const secretAccessKey = env?.AWS_SECRET_ACCESS_KEY;\n  if (accessKeyId === undefined || secretAccessKey === undefined) {\n    throw new Error(\n      'sesEmailTransport: no credentials — pass `credentials`, or run where AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set (a Lambda execution role)'\n    );\n  }\n  return { accessKeyId, secretAccessKey, sessionToken: env?.AWS_SESSION_TOKEN };\n}\n\nexport function sesEmailTransport(options: SesEmailTransportOptions): EmailTransport {\n  const endpoint = (options.endpoint ?? `https://email.${options.region}.amazonaws.com`).replace(\n    /\\/$/,\n    ''\n  );\n  const credentials = async (): Promise<AwsCredentials> => {\n    const configured = options.credentials;\n    if (configured === undefined) return environmentCredentials();\n    return typeof configured === 'function' ? configured() : configured;\n  };\n  const fetchImpl = options.fetch ?? fetch;\n\n  return {\n    async send(message: EmailMessage) {\n      const body = JSON.stringify({\n        FromEmailAddress: mimeAddress(message.from),\n        Destination: { ToAddresses: [message.to] },\n        ...(message.replyTo === undefined\n          ? {}\n          : { ReplyToAddresses: [mimeAddress(message.replyTo)] }),\n        Content: {\n          Simple: {\n            Subject: { Data: message.subject, Charset: 'UTF-8' },\n            Body: { Html: { Data: message.html, Charset: 'UTF-8' } },\n          },\n        },\n        ...(options.configurationSetName === undefined\n          ? {}\n          : { ConfigurationSetName: options.configurationSetName }),\n      });\n      const url = `${endpoint}/v2/email/outbound-emails`;\n      const headers = await signRequest({\n        method: 'POST',\n        url,\n        headers: { 'content-type': 'application/json' },\n        body,\n        credentials: await credentials(),\n        region: options.region,\n        service: 'ses',\n      });\n      // No retries here: the durable step owns them, and counts them — SES cannot de-duplicate,\n      // so every extra attempt of an accepted send is another chance to deliver twice\n      const response = await fetchImpl(url, { method: 'POST', headers, body });\n      const text = await response.text();\n      if (!response.ok) {\n        let detail = text;\n        try {\n          const parsed = JSON.parse(text) as { message?: unknown; Message?: unknown };\n          const said = parsed.message ?? parsed.Message;\n          if (typeof said === 'string') detail = said;\n        } catch {\n          // Not JSON: the raw body says what went wrong\n        }\n        const type = response.headers.get('x-amzn-errortype')?.split(':')[0];\n        throw new SesSendError(response.status, type, detail);\n      }\n      let messageId: unknown;\n      try {\n        messageId = (JSON.parse(text) as { MessageId?: unknown }).MessageId;\n      } catch {\n        messageId = undefined;\n      }\n      return typeof messageId === 'string' ? { providerMessageId: messageId } : {};\n    },\n  };\n}\n"],"mappings":";;;;AAoCA,IAAa,eAAb,cAAkC,MAAM;CAG3B;CACA;CAHX,OAAyB;CACzB,YACE,QACA,MACA,SACA;EACA,MAAM,yBAAyB,SAAS,SAAS,KAAA,IAAY,KAAK,IAAI,OAAO,KAAK,SAAS;EAJlF,KAAA,SAAA;EACA,KAAA,OAAA;CAIX;AACF;AAEA,SAAS,yBAAyC;CAEhD,MAAM,MAAO,WAA0E,SACnF;CACJ,MAAM,cAAc,KAAK;CACzB,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,KAAA,KAAa,oBAAoB,KAAA,GACnD,MAAM,IAAI,MACR,oJACF;CAEF,OAAO;EAAE;EAAa;EAAiB,cAAc,KAAK;CAAkB;AAC9E;AAEA,SAAgB,kBAAkB,SAAmD;CACnF,MAAM,YAAY,QAAQ,YAAY,iBAAiB,QAAQ,OAAO,gBAAA,CAAiB,QACrF,OACA,EACF;CACA,MAAM,cAAc,YAAqC;EACvD,MAAM,aAAa,QAAQ;EAC3B,IAAI,eAAe,KAAA,GAAW,OAAO,uBAAuB;EAC5D,OAAO,OAAO,eAAe,aAAa,WAAW,IAAI;CAC3D;CACA,MAAM,YAAY,QAAQ,SAAS;CAEnC,OAAO,EACL,MAAM,KAAK,SAAuB;EAChC,MAAM,OAAO,KAAK,UAAU;GAC1B,kBAAkB,YAAY,QAAQ,IAAI;GAC1C,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE;GACzC,GAAI,QAAQ,YAAY,KAAA,IACpB,CAAC,IACD,EAAE,kBAAkB,CAAC,YAAY,QAAQ,OAAO,CAAC,EAAE;GACvD,SAAS,EACP,QAAQ;IACN,SAAS;KAAE,MAAM,QAAQ;KAAS,SAAS;IAAQ;IACnD,MAAM,EAAE,MAAM;KAAE,MAAM,QAAQ;KAAM,SAAS;IAAQ,EAAE;GACzD,EACF;GACA,GAAI,QAAQ,yBAAyB,KAAA,IACjC,CAAC,IACD,EAAE,sBAAsB,QAAQ,qBAAqB;EAC3D,CAAC;EACD,MAAM,MAAM,GAAG,SAAS;EACxB,MAAM,UAAU,MAAM,YAAY;GAChC,QAAQ;GACR;GACA,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;GACA,aAAa,MAAM,YAAY;GAC/B,QAAQ,QAAQ;GAChB,SAAS;EACX,CAAC;EAGD,MAAM,WAAW,MAAM,UAAU,KAAK;GAAE,QAAQ;GAAQ;GAAS;EAAK,CAAC;EACvE,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,CAAC,SAAS,IAAI;GAChB,IAAI,SAAS;GACb,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,IAAI;IAC9B,MAAM,OAAO,OAAO,WAAW,OAAO;IACtC,IAAI,OAAO,SAAS,UAAU,SAAS;GACzC,QAAQ,CAER;GACA,MAAM,OAAO,SAAS,QAAQ,IAAI,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;GAClE,MAAM,IAAI,aAAa,SAAS,QAAQ,MAAM,MAAM;EACtD;EACA,IAAI;EACJ,IAAI;GACF,YAAa,KAAK,MAAM,IAAI,CAAC,CAA6B;EAC5D,QAAQ;GACN,YAAY,KAAA;EACd;EACA,OAAO,OAAO,cAAc,WAAW,EAAE,mBAAmB,UAAU,IAAI,CAAC;CAC7E,EACF;AACF"}

package/dist/transports/sigv4.cjs

@@ -0,0 +1,83 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/transports/sigv4.ts
+const utf8 = new TextEncoder();
+function hex(bytes) {
+	return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256(data) {
+	return hex(await crypto.subtle.digest("SHA-256", utf8.encode(data)));
+}
+async function hmac(key, data) {
+	const imported = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return crypto.subtle.sign("HMAC", imported, utf8.encode(data));
+}
+/** RFC 3986 encoding, as SigV4 wants it: only unreserved characters stay. */
+function encode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** Each path segment encoded once (the URL already decoded it). */
+function canonicalPath(pathname) {
+	return pathname.split("/").map((segment) => encode(decodeURIComponent(segment))).join("/");
+}
+/**
+* The query as sent, each name and value re-encoded. Parsed by hand: URLSearchParams reads `+`
+* as a space, which would sign a value other than the one on the wire.
+*/
+function canonicalQuery(search) {
+	if (search === "" || search === "?") return "";
+	return search.slice(1).split("&").filter((pair) => pair !== "").map((pair) => {
+		const at = pair.indexOf("=");
+		const name = at === -1 ? pair : pair.slice(0, at);
+		const value = at === -1 ? "" : pair.slice(at + 1);
+		return [encode(decodeURIComponent(name)), encode(decodeURIComponent(value))];
+	}).sort(([a, av], [b, bv]) => a === b ? av < bv ? -1 : av > bv ? 1 : 0 : a < b ? -1 : 1).map(([name, value]) => `${name}=${value}`).join("&");
+}
+/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */
+async function signRequest(request) {
+	const url = new URL(request.url);
+	const datetime = request.datetime ?? (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+	const date = datetime.slice(0, 8);
+	const { accessKeyId, secretAccessKey, sessionToken } = request.credentials;
+	const headers = {};
+	for (const [name, value] of Object.entries(request.headers ?? {})) headers[name.toLowerCase()] = value.trim().replace(/\s+/g, " ");
+	headers.host = url.host;
+	headers["x-amz-date"] = datetime;
+	if (sessionToken !== void 0) headers["x-amz-security-token"] = sessionToken;
+	const names = Object.keys(headers).sort();
+	const signedHeaders = names.join(";");
+	const canonical = [
+		request.method.toUpperCase(),
+		canonicalPath(url.pathname),
+		canonicalQuery(url.search),
+		...names.map((name) => `${name}:${headers[name]}`),
+		"",
+		signedHeaders,
+		await sha256(request.body ?? "")
+	].join("\n");
+	const scope = `${date}/${request.region}/${request.service}/aws4_request`;
+	const toSign = [
+		"AWS4-HMAC-SHA256",
+		datetime,
+		scope,
+		await sha256(canonical)
+	].join("\n");
+	let key = await hmac(utf8.encode(`AWS4${secretAccessKey}`), date);
+	for (const part of [
+		request.region,
+		request.service,
+		"aws4_request"
+	]) key = await hmac(key, part);
+	const signature = hex(await hmac(key, toSign));
+	const { host: _host, ...sent } = headers;
+	return {
+		...sent,
+		authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+	};
+}
+//#endregion
+exports.signRequest = signRequest;
+
+//# sourceMappingURL=sigv4.cjs.map

package/dist/transports/sigv4.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.cjs","names":[],"sources":["../../src/transports/sigv4.ts"],"sourcesContent":["/**\n * AWS Signature Version 4 over WebCrypto, which a Worker and Node both have: enough to sign\n * the JSON API calls the transports make. Headers are signed as given (plus `host` and\n * `x-amz-date`); the payload hash is the body's SHA-256.\n * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html\n */\n\nexport interface SigV4Credentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n}\n\nexport interface SigV4Request {\n  method: string;\n  url: string;\n  headers?: Record<string, string>;\n  body?: string;\n  credentials: SigV4Credentials;\n  region: string;\n  service: string;\n  /** `YYYYMMDD'T'HHMMSS'Z'`; now by default. */\n  datetime?: string;\n}\n\nconst utf8 = new TextEncoder();\n\nfunction hex(bytes: ArrayBuffer): string {\n  return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nasync function sha256(data: string): Promise<string> {\n  return hex(await crypto.subtle.digest('SHA-256', utf8.encode(data)));\n}\n\nasync function hmac(\n  key: ArrayBuffer | Uint8Array<ArrayBuffer>,\n  data: string\n): Promise<ArrayBuffer> {\n  const imported = await crypto.subtle.importKey(\n    'raw',\n    key,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  return crypto.subtle.sign('HMAC', imported, utf8.encode(data));\n}\n\n/** RFC 3986 encoding, as SigV4 wants it: only unreserved characters stay. */\nfunction encode(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`\n  );\n}\n\n/** Each path segment encoded once (the URL already decoded it). */\nfunction canonicalPath(pathname: string): string {\n  return pathname\n    .split('/')\n    .map((segment) => encode(decodeURIComponent(segment)))\n    .join('/');\n}\n\n/**\n * The query as sent, each name and value re-encoded. Parsed by hand: URLSearchParams reads `+`\n * as a space, which would sign a value other than the one on the wire.\n */\nfunction canonicalQuery(search: string): string {\n  if (search === '' || search === '?') return '';\n  return search\n    .slice(1)\n    .split('&')\n    .filter((pair) => pair !== '')\n    .map((pair) => {\n      const at = pair.indexOf('=');\n      const name = at === -1 ? pair : pair.slice(0, at);\n      const value = at === -1 ? '' : pair.slice(at + 1);\n      return [encode(decodeURIComponent(name)), encode(decodeURIComponent(value))] as const;\n    })\n    .sort(([a, av], [b, bv]) => (a === b ? (av < bv ? -1 : av > bv ? 1 : 0) : a < b ? -1 : 1))\n    .map(([name, value]) => `${name}=${value}`)\n    .join('&');\n}\n\n/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */\nexport async function signRequest(request: SigV4Request): Promise<Record<string, string>> {\n  const url = new URL(request.url);\n  const datetime = request.datetime ?? new Date().toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const date = datetime.slice(0, 8);\n  const { accessKeyId, secretAccessKey, sessionToken } = request.credentials;\n\n  const headers: Record<string, string> = {};\n  for (const [name, value] of Object.entries(request.headers ?? {})) {\n    headers[name.toLowerCase()] = value.trim().replace(/\\s+/g, ' ');\n  }\n  headers.host = url.host;\n  headers['x-amz-date'] = datetime;\n  if (sessionToken !== undefined) headers['x-amz-security-token'] = sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const signedHeaders = names.join(';');\n  const canonical = [\n    request.method.toUpperCase(),\n    canonicalPath(url.pathname),\n    canonicalQuery(url.search),\n    ...names.map((name) => `${name}:${headers[name]}`),\n    '',\n    signedHeaders,\n    await sha256(request.body ?? ''),\n  ].join('\\n');\n\n  const scope = `${date}/${request.region}/${request.service}/aws4_request`;\n  const toSign = ['AWS4-HMAC-SHA256', datetime, scope, await sha256(canonical)].join('\\n');\n\n  let key = await hmac(utf8.encode(`AWS4${secretAccessKey}`), date);\n  for (const part of [request.region, request.service, 'aws4_request']) {\n    key = await hmac(key, part);\n  }\n  const signature = hex(await hmac(key, toSign));\n\n  const { host: _host, ...sent } = headers;\n  return {\n    ...sent,\n    authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,\n  };\n}\n"],"mappings":";;AAyBA,MAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,IAAI,OAA4B;CACvC,OAAO,CAAC,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AACvF;AAEA,eAAe,OAAO,MAA+B;CACnD,OAAO,IAAI,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC;AACrE;AAEA,eAAe,KACb,KACA,MACsB;CACtB,MAAM,WAAW,MAAM,OAAO,OAAO,UACnC,OACA,KACA;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CACA,OAAO,OAAO,OAAO,KAAK,QAAQ,UAAU,KAAK,OAAO,IAAI,CAAC;AAC/D;;AAGA,SAAS,OAAO,OAAuB;CACrC,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,MAAM,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtD;AACF;;AAGA,SAAS,cAAc,UAA0B;CAC/C,OAAO,SACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY,OAAO,mBAAmB,OAAO,CAAC,CAAC,CAAC,CACrD,KAAK,GAAG;AACb;;;;;AAMA,SAAS,eAAe,QAAwB;CAC9C,IAAI,WAAW,MAAM,WAAW,KAAK,OAAO;CAC5C,OAAO,OACJ,MAAM,CAAC,CAAC,CACR,MAAM,GAAG,CAAC,CACV,QAAQ,SAAS,SAAS,EAAE,CAAC,CAC7B,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,MAAM,OAAO,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;EAChD,MAAM,QAAQ,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;EAChD,OAAO,CAAC,OAAO,mBAAmB,IAAI,CAAC,GAAG,OAAO,mBAAmB,KAAK,CAAC,CAAC;CAC7E,CAAC,CAAC,CACD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,QAAS,MAAM,IAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,IAAK,IAAI,IAAI,KAAK,CAAE,CAAC,CACzF,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,CAAC,CAC1C,KAAK,GAAG;AACb;;AAGA,eAAsB,YAAY,SAAwD;CACxF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,WAAW,QAAQ,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CACzF,MAAM,OAAO,SAAS,MAAM,GAAG,CAAC;CAChC,MAAM,EAAE,aAAa,iBAAiB,iBAAiB,QAAQ;CAE/D,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAC9D,QAAQ,KAAK,YAAY,KAAK,MAAM,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG;CAEhE,QAAQ,OAAO,IAAI;CACnB,QAAQ,gBAAgB;CACxB,IAAI,iBAAiB,KAAA,GAAW,QAAQ,0BAA0B;CAElE,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,gBAAgB,MAAM,KAAK,GAAG;CACpC,MAAM,YAAY;EAChB,QAAQ,OAAO,YAAY;EAC3B,cAAc,IAAI,QAAQ;EAC1B,eAAe,IAAI,MAAM;EACzB,GAAG,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,QAAQ,OAAO;EACjD;EACA;EACA,MAAM,OAAO,QAAQ,QAAQ,EAAE;CACjC,CAAC,CAAC,KAAK,IAAI;CAEX,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,OAAO,GAAG,QAAQ,QAAQ;CAC3D,MAAM,SAAS;EAAC;EAAoB;EAAU;EAAO,MAAM,OAAO,SAAS;CAAC,CAAC,CAAC,KAAK,IAAI;CAEvF,IAAI,MAAM,MAAM,KAAK,KAAK,OAAO,OAAO,iBAAiB,GAAG,IAAI;CAChE,KAAK,MAAM,QAAQ;EAAC,QAAQ;EAAQ,QAAQ;EAAS;CAAc,GACjE,MAAM,MAAM,KAAK,KAAK,IAAI;CAE5B,MAAM,YAAY,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;CAE7C,MAAM,EAAE,MAAM,OAAO,GAAG,SAAS;CACjC,OAAO;EACL,GAAG;EACH,eAAe,+BAA+B,YAAY,GAAG,MAAM,kBAAkB,cAAc,cAAc;CACnH;AACF"}

package/dist/transports/sigv4.d.cts

@@ -0,0 +1,27 @@
+//#region src/transports/sigv4.d.ts
+/**
+ * AWS Signature Version 4 over WebCrypto, which a Worker and Node both have: enough to sign
+ * the JSON API calls the transports make. Headers are signed as given (plus `host` and
+ * `x-amz-date`); the payload hash is the body's SHA-256.
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+ */
+export interface SigV4Credentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string | undefined;
+}
+export interface SigV4Request {
+  method: string;
+  url: string;
+  headers?: Record<string, string>;
+  body?: string;
+  credentials: SigV4Credentials;
+  region: string;
+  service: string;
+  /** `YYYYMMDD'T'HHMMSS'Z'`; now by default. */
+  datetime?: string;
+}
+/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */
+export declare function signRequest(request: SigV4Request): Promise<Record<string, string>>;
+//#endregion
+//# sourceMappingURL=sigv4.d.cts.map

package/dist/transports/sigv4.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.cts","names":[],"sources":["../../src/transports/sigv4.ts"],"mappings":";;;;;;;iBAOiB;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA,UAAU;EACV;EACA,aAAa;EACb;EACA;;EAEA;;;wBAiEoB,YAAY,SAAS,eAAe,QAAQ"}

package/dist/transports/sigv4.d.mts

@@ -0,0 +1,27 @@
+//#region src/transports/sigv4.d.ts
+/**
+ * AWS Signature Version 4 over WebCrypto, which a Worker and Node both have: enough to sign
+ * the JSON API calls the transports make. Headers are signed as given (plus `host` and
+ * `x-amz-date`); the payload hash is the body's SHA-256.
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+ */
+export interface SigV4Credentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string | undefined;
+}
+export interface SigV4Request {
+  method: string;
+  url: string;
+  headers?: Record<string, string>;
+  body?: string;
+  credentials: SigV4Credentials;
+  region: string;
+  service: string;
+  /** `YYYYMMDD'T'HHMMSS'Z'`; now by default. */
+  datetime?: string;
+}
+/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */
+export declare function signRequest(request: SigV4Request): Promise<Record<string, string>>;
+//#endregion
+//# sourceMappingURL=sigv4.d.mts.map

package/dist/transports/sigv4.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.mts","names":[],"sources":["../../src/transports/sigv4.ts"],"mappings":";;;;;;;iBAOiB;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA,UAAU;EACV;EACA,aAAa;EACb;EACA;;EAEA;;;wBAiEoB,YAAY,SAAS,eAAe,QAAQ"}

package/dist/transports/sigv4.mjs

@@ -0,0 +1,82 @@
+//#region src/transports/sigv4.ts
+const utf8 = new TextEncoder();
+function hex(bytes) {
+	return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256(data) {
+	return hex(await crypto.subtle.digest("SHA-256", utf8.encode(data)));
+}
+async function hmac(key, data) {
+	const imported = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return crypto.subtle.sign("HMAC", imported, utf8.encode(data));
+}
+/** RFC 3986 encoding, as SigV4 wants it: only unreserved characters stay. */
+function encode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** Each path segment encoded once (the URL already decoded it). */
+function canonicalPath(pathname) {
+	return pathname.split("/").map((segment) => encode(decodeURIComponent(segment))).join("/");
+}
+/**
+* The query as sent, each name and value re-encoded. Parsed by hand: URLSearchParams reads `+`
+* as a space, which would sign a value other than the one on the wire.
+*/
+function canonicalQuery(search) {
+	if (search === "" || search === "?") return "";
+	return search.slice(1).split("&").filter((pair) => pair !== "").map((pair) => {
+		const at = pair.indexOf("=");
+		const name = at === -1 ? pair : pair.slice(0, at);
+		const value = at === -1 ? "" : pair.slice(at + 1);
+		return [encode(decodeURIComponent(name)), encode(decodeURIComponent(value))];
+	}).sort(([a, av], [b, bv]) => a === b ? av < bv ? -1 : av > bv ? 1 : 0 : a < b ? -1 : 1).map(([name, value]) => `${name}=${value}`).join("&");
+}
+/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */
+async function signRequest(request) {
+	const url = new URL(request.url);
+	const datetime = request.datetime ?? (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+	const date = datetime.slice(0, 8);
+	const { accessKeyId, secretAccessKey, sessionToken } = request.credentials;
+	const headers = {};
+	for (const [name, value] of Object.entries(request.headers ?? {})) headers[name.toLowerCase()] = value.trim().replace(/\s+/g, " ");
+	headers.host = url.host;
+	headers["x-amz-date"] = datetime;
+	if (sessionToken !== void 0) headers["x-amz-security-token"] = sessionToken;
+	const names = Object.keys(headers).sort();
+	const signedHeaders = names.join(";");
+	const canonical = [
+		request.method.toUpperCase(),
+		canonicalPath(url.pathname),
+		canonicalQuery(url.search),
+		...names.map((name) => `${name}:${headers[name]}`),
+		"",
+		signedHeaders,
+		await sha256(request.body ?? "")
+	].join("\n");
+	const scope = `${date}/${request.region}/${request.service}/aws4_request`;
+	const toSign = [
+		"AWS4-HMAC-SHA256",
+		datetime,
+		scope,
+		await sha256(canonical)
+	].join("\n");
+	let key = await hmac(utf8.encode(`AWS4${secretAccessKey}`), date);
+	for (const part of [
+		request.region,
+		request.service,
+		"aws4_request"
+	]) key = await hmac(key, part);
+	const signature = hex(await hmac(key, toSign));
+	const { host: _host, ...sent } = headers;
+	return {
+		...sent,
+		authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+	};
+}
+//#endregion
+export { signRequest };
+
+//# sourceMappingURL=sigv4.mjs.map

package/dist/transports/sigv4.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.mjs","names":[],"sources":["../../src/transports/sigv4.ts"],"sourcesContent":["/**\n * AWS Signature Version 4 over WebCrypto, which a Worker and Node both have: enough to sign\n * the JSON API calls the transports make. Headers are signed as given (plus `host` and\n * `x-amz-date`); the payload hash is the body's SHA-256.\n * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html\n */\n\nexport interface SigV4Credentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n}\n\nexport interface SigV4Request {\n  method: string;\n  url: string;\n  headers?: Record<string, string>;\n  body?: string;\n  credentials: SigV4Credentials;\n  region: string;\n  service: string;\n  /** `YYYYMMDD'T'HHMMSS'Z'`; now by default. */\n  datetime?: string;\n}\n\nconst utf8 = new TextEncoder();\n\nfunction hex(bytes: ArrayBuffer): string {\n  return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nasync function sha256(data: string): Promise<string> {\n  return hex(await crypto.subtle.digest('SHA-256', utf8.encode(data)));\n}\n\nasync function hmac(\n  key: ArrayBuffer | Uint8Array<ArrayBuffer>,\n  data: string\n): Promise<ArrayBuffer> {\n  const imported = await crypto.subtle.importKey(\n    'raw',\n    key,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  return crypto.subtle.sign('HMAC', imported, utf8.encode(data));\n}\n\n/** RFC 3986 encoding, as SigV4 wants it: only unreserved characters stay. */\nfunction encode(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`\n  );\n}\n\n/** Each path segment encoded once (the URL already decoded it). */\nfunction canonicalPath(pathname: string): string {\n  return pathname\n    .split('/')\n    .map((segment) => encode(decodeURIComponent(segment)))\n    .join('/');\n}\n\n/**\n * The query as sent, each name and value re-encoded. Parsed by hand: URLSearchParams reads `+`\n * as a space, which would sign a value other than the one on the wire.\n */\nfunction canonicalQuery(search: string): string {\n  if (search === '' || search === '?') return '';\n  return search\n    .slice(1)\n    .split('&')\n    .filter((pair) => pair !== '')\n    .map((pair) => {\n      const at = pair.indexOf('=');\n      const name = at === -1 ? pair : pair.slice(0, at);\n      const value = at === -1 ? '' : pair.slice(at + 1);\n      return [encode(decodeURIComponent(name)), encode(decodeURIComponent(value))] as const;\n    })\n    .sort(([a, av], [b, bv]) => (a === b ? (av < bv ? -1 : av > bv ? 1 : 0) : a < b ? -1 : 1))\n    .map(([name, value]) => `${name}=${value}`)\n    .join('&');\n}\n\n/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */\nexport async function signRequest(request: SigV4Request): Promise<Record<string, string>> {\n  const url = new URL(request.url);\n  const datetime = request.datetime ?? new Date().toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const date = datetime.slice(0, 8);\n  const { accessKeyId, secretAccessKey, sessionToken } = request.credentials;\n\n  const headers: Record<string, string> = {};\n  for (const [name, value] of Object.entries(request.headers ?? {})) {\n    headers[name.toLowerCase()] = value.trim().replace(/\\s+/g, ' ');\n  }\n  headers.host = url.host;\n  headers['x-amz-date'] = datetime;\n  if (sessionToken !== undefined) headers['x-amz-security-token'] = sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const signedHeaders = names.join(';');\n  const canonical = [\n    request.method.toUpperCase(),\n    canonicalPath(url.pathname),\n    canonicalQuery(url.search),\n    ...names.map((name) => `${name}:${headers[name]}`),\n    '',\n    signedHeaders,\n    await sha256(request.body ?? ''),\n  ].join('\\n');\n\n  const scope = `${date}/${request.region}/${request.service}/aws4_request`;\n  const toSign = ['AWS4-HMAC-SHA256', datetime, scope, await sha256(canonical)].join('\\n');\n\n  let key = await hmac(utf8.encode(`AWS4${secretAccessKey}`), date);\n  for (const part of [request.region, request.service, 'aws4_request']) {\n    key = await hmac(key, part);\n  }\n  const signature = hex(await hmac(key, toSign));\n\n  const { host: _host, ...sent } = headers;\n  return {\n    ...sent,\n    authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,\n  };\n}\n"],"mappings":";AAyBA,MAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,IAAI,OAA4B;CACvC,OAAO,CAAC,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AACvF;AAEA,eAAe,OAAO,MAA+B;CACnD,OAAO,IAAI,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC;AACrE;AAEA,eAAe,KACb,KACA,MACsB;CACtB,MAAM,WAAW,MAAM,OAAO,OAAO,UACnC,OACA,KACA;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CACA,OAAO,OAAO,OAAO,KAAK,QAAQ,UAAU,KAAK,OAAO,IAAI,CAAC;AAC/D;;AAGA,SAAS,OAAO,OAAuB;CACrC,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,MAAM,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtD;AACF;;AAGA,SAAS,cAAc,UAA0B;CAC/C,OAAO,SACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY,OAAO,mBAAmB,OAAO,CAAC,CAAC,CAAC,CACrD,KAAK,GAAG;AACb;;;;;AAMA,SAAS,eAAe,QAAwB;CAC9C,IAAI,WAAW,MAAM,WAAW,KAAK,OAAO;CAC5C,OAAO,OACJ,MAAM,CAAC,CAAC,CACR,MAAM,GAAG,CAAC,CACV,QAAQ,SAAS,SAAS,EAAE,CAAC,CAC7B,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,MAAM,OAAO,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;EAChD,MAAM,QAAQ,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;EAChD,OAAO,CAAC,OAAO,mBAAmB,IAAI,CAAC,GAAG,OAAO,mBAAmB,KAAK,CAAC,CAAC;CAC7E,CAAC,CAAC,CACD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,QAAS,MAAM,IAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,IAAK,IAAI,IAAI,KAAK,CAAE,CAAC,CACzF,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,CAAC,CAC1C,KAAK,GAAG;AACb;;AAGA,eAAsB,YAAY,SAAwD;CACxF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,WAAW,QAAQ,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CACzF,MAAM,OAAO,SAAS,MAAM,GAAG,CAAC;CAChC,MAAM,EAAE,aAAa,iBAAiB,iBAAiB,QAAQ;CAE/D,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAC9D,QAAQ,KAAK,YAAY,KAAK,MAAM,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG;CAEhE,QAAQ,OAAO,IAAI;CACnB,QAAQ,gBAAgB;CACxB,IAAI,iBAAiB,KAAA,GAAW,QAAQ,0BAA0B;CAElE,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,gBAAgB,MAAM,KAAK,GAAG;CACpC,MAAM,YAAY;EAChB,QAAQ,OAAO,YAAY;EAC3B,cAAc,IAAI,QAAQ;EAC1B,eAAe,IAAI,MAAM;EACzB,GAAG,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,QAAQ,OAAO;EACjD;EACA;EACA,MAAM,OAAO,QAAQ,QAAQ,EAAE;CACjC,CAAC,CAAC,KAAK,IAAI;CAEX,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,OAAO,GAAG,QAAQ,QAAQ;CAC3D,MAAM,SAAS;EAAC;EAAoB;EAAU;EAAO,MAAM,OAAO,SAAS;CAAC,CAAC,CAAC,KAAK,IAAI;CAEvF,IAAI,MAAM,MAAM,KAAK,KAAK,OAAO,OAAO,iBAAiB,GAAG,IAAI;CAChE,KAAK,MAAM,QAAQ;EAAC,QAAQ;EAAQ,QAAQ;EAAS;CAAc,GACjE,MAAM,MAAM,KAAK,KAAK,IAAI;CAE5B,MAAM,YAAY,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;CAE7C,MAAM,EAAE,MAAM,OAAO,GAAG,SAAS;CACjC,OAAO;EACL,GAAG;EACH,eAAe,+BAA+B,YAAY,GAAG,MAAM,kBAAkB,cAAc,cAAc;CACnH;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/workflow",
-  "version": "2.0.1",
+  "version": "3.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShwareHQ/shware-sdk.git"
@@ -43,6 +43,16 @@
         "default": "./dist/cloudflare/index.cjs"
       }
     },
+    "./aws": {
+      "import": {
+        "types": "./dist/aws/index.d.mts",
+        "default": "./dist/aws/index.mjs"
+      },
+      "require": {
+        "types": "./dist/aws/index.d.cts",
+        "default": "./dist/aws/index.cjs"
+      }
+    },
     "./store": {
       "import": {
         "types": "./dist/store/index.d.mts",
@@ -93,6 +103,36 @@
         "default": "./dist/email-context.cjs"
       }
     },
+    "./email-sender": {
+      "import": {
+        "types": "./dist/email-sender.d.mts",
+        "default": "./dist/email-sender.mjs"
+      },
+      "require": {
+        "types": "./dist/email-sender.d.cts",
+        "default": "./dist/email-sender.cjs"
+      }
+    },
+    "./transports/ses": {
+      "import": {
+        "types": "./dist/transports/ses.d.mts",
+        "default": "./dist/transports/ses.mjs"
+      },
+      "require": {
+        "types": "./dist/transports/ses.d.cts",
+        "default": "./dist/transports/ses.cjs"
+      }
+    },
+    "./transports/cloudflare-email": {
+      "import": {
+        "types": "./dist/transports/cloudflare-email.d.mts",
+        "default": "./dist/transports/cloudflare-email.mjs"
+      },
+      "require": {
+        "types": "./dist/transports/cloudflare-email.d.cts",
+        "default": "./dist/transports/cloudflare-email.cjs"
+      }
+    },
     "./push": {
       "import": {
         "types": "./dist/push.d.mts",
@@ -163,8 +203,12 @@
     "ms": "^2.1.3"
   },
   "devDependencies": {
+    "@aws-sdk/client-lambda": "^3.1152.0",
+    "@aws/durable-execution-sdk-js": "^2.7.0",
+    "@aws/durable-execution-sdk-js-testing": "^1.3.1",
     "@electric-sql/pglite": "^0.5.10",
     "@repo/typescript-config": "0.0.0",
+    "@types/aws-lambda": "^8.10.164",
     "@types/ms": "^2.1.0",
     "@types/node": "^26.6.5",
     "@types/react": "^19.3.0",
@@ -177,12 +221,20 @@
     "zod": "^4.6.7"
   },
   "peerDependencies": {
+    "@aws-sdk/client-lambda": "^3.1152.0",
+    "@aws/durable-execution-sdk-js": "^2.7.0",
     "postgres": ">=3.4.0",
     "react": ">=19",
     "react-dom": ">=19",
     "zod": "^4.6.5"
   },
   "peerDependenciesMeta": {
+    "@aws-sdk/client-lambda": {
+      "optional": true
+    },
+    "@aws/durable-execution-sdk-js": {
+      "optional": true
+    },
     "postgres": {
       "optional": true
     },

package/dist/cloudflare/channels.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"channels.cjs","names":["resolveRuntime","CfEmailSender","registryRenderer","registryPushRenderer","removeDevice","ApnsPushSender","apnsKeyFromBase64","apnsEnvironment","FcmPushSender","serviceAccountFromBase64","WebPushSender","routeByPlatform","indexTemplates","DiscordWebhookSender","lookupTemplate","renderDiscordContent","SlackWebhookSender","renderSlackContent","routeByChannel"],"sources":["../../src/cloudflare/channels.ts"],"sourcesContent":["import { ApnsPushSender, apnsKeyFromBase64 } from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport type { MessageSender, OutboundMessage } from '../engine/ports';\nimport { FcmPushSender, serviceAccountFromBase64 } from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport { WebPushSender } from '../webpush';\nimport type { JourneyEnv } from './bindings';\nimport { removeDevice } from './router';\nimport { CfEmailSender, routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the `EMAIL` binding with the configured addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/** A sender that fails every message with the reason the channel cannot deliver. */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new Error(`cannot send '${message.template}' on ${message.channel}: ${reason}`);\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    throw new Error(`${name} is not set: the environment must hold it for the configured channel`);\n  }\n  return value;\n}\n\n/**\n * A sender built on its first message. A platform's secret is only required\n * when something is actually sent there: a journey that only emails must not\n * fail because the APNs key is missing from a local `.dev.vars`.\n */\nfunction lazy(build: () => MessageSender): MessageSender {\n  let sender: MessageSender | undefined;\n  return {\n    async send(message) {\n      sender ??= build();\n      return sender.send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    fetch?: typeof fetch;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    if (env.EMAIL === undefined) return unavailable('no EMAIL (send_email) binding');\n    // Each template names its own sender: there is no global one to require\n    return new CfEmailSender({\n      binding: env.EMAIL,\n      render: registryRenderer(registry, config.email),\n    });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    // A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n    // waits that read devices, as a removal through the API does\n    const onUnregistered = async (message: OutboundMessage) => {\n      if (message.device !== undefined && options.store !== undefined) {\n        await removeDevice(env, message.device.token, options.store);\n      }\n    };\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      platforms.ios = lazy(\n        () =>\n          new ApnsPushSender({\n            keyId: apns.keyId,\n            teamId: apns.teamId,\n            privateKey: apnsKeyFromBase64(requireSecret(env, 'APNS_PRIVATE_KEY_BASE64')),\n            topic: apns.topic,\n            environment: apnsEnvironment(apns, mode),\n            render,\n            onUnregistered,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = lazy(\n        () =>\n          new FcmPushSender({\n            serviceAccount: serviceAccountFromBase64(\n              requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64')\n            ),\n            render,\n            onUnregistered,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = lazy(\n        () =>\n          new WebPushSender({\n            vapid: {\n              subject: webPush.subject,\n              publicKey: requireSecret(env, 'VAPID_PUBLIC_KEY'),\n              privateKey: requireSecret(env, 'VAPID_PRIVATE_KEY'),\n            },\n            render,\n            onUnregistered,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new Error(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAOA,gBAAAA,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;AAGA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAI,MAAM,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAAQ;CACtF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAChD,MAAM,IAAI,MAAM,GAAG,KAAK,qEAAqE;CAE/F,OAAO;AACT;;;;;;AAOA,SAAS,KAAK,OAA2C;CACvD,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM;EACjB,OAAO,OAAO,KAAK,OAAO;CAC5B,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAII,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAE5B,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,IAAI,IAAI,UAAU,KAAA,GAAW,OAAO,YAAY,+BAA+B;EAE/E,OAAO,IAAIC,2BAAAA,cAAc;GACvB,SAAS,IAAI;GACb,QAAQC,oBAAAA,iBAAiB,UAAU,OAAO,KAAK;EACjD,CAAC;CACH;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAASC,aAAAA,qBAAqB,QAAQ;EAG5C,MAAM,iBAAiB,OAAO,YAA6B;GACzD,IAAI,QAAQ,WAAW,KAAA,KAAa,QAAQ,UAAU,KAAA,GACpD,MAAMC,0BAAAA,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;EAE/D;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GACX,UAAU,MAAM,WAEZ,IAAIC,aAAAA,eAAe;GACjB,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,YAAYC,aAAAA,kBAAkB,cAAc,KAAK,yBAAyB,CAAC;GAC3E,OAAO,KAAK;GACZ,aAAaC,eAAAA,gBAAgB,MAAM,IAAI;GACvC;GACA;GACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;GAC/E,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,WAEhB,IAAIC,YAAAA,cAAc;GAChB,gBAAgBC,YAAAA,yBACd,cAAc,KAAK,uCAAuC,CAC5D;GACA;GACA;GACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;GACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,WAEZ,IAAIC,gBAAAA,cAAc;GAChB,OAAO;IACL,SAAS,QAAQ;IACjB,WAAW,cAAc,KAAK,kBAAkB;IAChD,YAAY,cAAc,KAAK,mBAAmB;GACpD;GACA;GACA;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAOC,2BAAAA,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAI,MACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQC,kBAAAA,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAIC,iBAAAA,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWC,kBAAAA,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAASC,kBAAAA,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQH,kBAAAA,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAII,iBAAAA,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWF,kBAAAA,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAASG,kBAAAA,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAOC,2BAAAA,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}

package/dist/cloudflare/channels.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"channels.d.cts","names":[],"sources":["../../src/cloudflare/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;wBAkCgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;YA4CA,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;EACR,eAAe;IAEhB"}

package/dist/cloudflare/channels.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"channels.d.mts","names":[],"sources":["../../src/cloudflare/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;wBAkCgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;YA4CA,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;EACR,eAAe;IAEhB"}

package/dist/cloudflare/channels.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"channels.mjs","names":[],"sources":["../../src/cloudflare/channels.ts"],"sourcesContent":["import { ApnsPushSender, apnsKeyFromBase64 } from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport type { MessageSender, OutboundMessage } from '../engine/ports';\nimport { FcmPushSender, serviceAccountFromBase64 } from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport { WebPushSender } from '../webpush';\nimport type { JourneyEnv } from './bindings';\nimport { removeDevice } from './router';\nimport { CfEmailSender, routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the `EMAIL` binding with the configured addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/** A sender that fails every message with the reason the channel cannot deliver. */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new Error(`cannot send '${message.template}' on ${message.channel}: ${reason}`);\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    throw new Error(`${name} is not set: the environment must hold it for the configured channel`);\n  }\n  return value;\n}\n\n/**\n * A sender built on its first message. A platform's secret is only required\n * when something is actually sent there: a journey that only emails must not\n * fail because the APNs key is missing from a local `.dev.vars`.\n */\nfunction lazy(build: () => MessageSender): MessageSender {\n  let sender: MessageSender | undefined;\n  return {\n    async send(message) {\n      sender ??= build();\n      return sender.send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    fetch?: typeof fetch;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    if (env.EMAIL === undefined) return unavailable('no EMAIL (send_email) binding');\n    // Each template names its own sender: there is no global one to require\n    return new CfEmailSender({\n      binding: env.EMAIL,\n      render: registryRenderer(registry, config.email),\n    });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    // A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n    // waits that read devices, as a removal through the API does\n    const onUnregistered = async (message: OutboundMessage) => {\n      if (message.device !== undefined && options.store !== undefined) {\n        await removeDevice(env, message.device.token, options.store);\n      }\n    };\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      platforms.ios = lazy(\n        () =>\n          new ApnsPushSender({\n            keyId: apns.keyId,\n            teamId: apns.teamId,\n            privateKey: apnsKeyFromBase64(requireSecret(env, 'APNS_PRIVATE_KEY_BASE64')),\n            topic: apns.topic,\n            environment: apnsEnvironment(apns, mode),\n            render,\n            onUnregistered,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = lazy(\n        () =>\n          new FcmPushSender({\n            serviceAccount: serviceAccountFromBase64(\n              requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64')\n            ),\n            render,\n            onUnregistered,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = lazy(\n        () =>\n          new WebPushSender({\n            vapid: {\n              subject: webPush.subject,\n              publicKey: requireSecret(env, 'VAPID_PUBLIC_KEY'),\n              privateKey: requireSecret(env, 'VAPID_PRIVATE_KEY'),\n            },\n            render,\n            onUnregistered,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new Error(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAO,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;AAGA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAI,MAAM,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAAQ;CACtF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAChD,MAAM,IAAI,MAAM,GAAG,KAAK,qEAAqE;CAE/F,OAAO;AACT;;;;;;AAOA,SAAS,KAAK,OAA2C;CACvD,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM;EACjB,OAAO,OAAO,KAAK,OAAO;CAC5B,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAII,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAE5B,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,IAAI,IAAI,UAAU,KAAA,GAAW,OAAO,YAAY,+BAA+B;EAE/E,OAAO,IAAI,cAAc;GACvB,SAAS,IAAI;GACb,QAAQ,iBAAiB,UAAU,OAAO,KAAK;EACjD,CAAC;CACH;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAAS,qBAAqB,QAAQ;EAG5C,MAAM,iBAAiB,OAAO,YAA6B;GACzD,IAAI,QAAQ,WAAW,KAAA,KAAa,QAAQ,UAAU,KAAA,GACpD,MAAM,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;EAE/D;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GACX,UAAU,MAAM,WAEZ,IAAI,eAAe;GACjB,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,YAAY,kBAAkB,cAAc,KAAK,yBAAyB,CAAC;GAC3E,OAAO,KAAK;GACZ,aAAa,gBAAgB,MAAM,IAAI;GACvC;GACA;GACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;GAC/E,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,WAEhB,IAAI,cAAc;GAChB,gBAAgB,yBACd,cAAc,KAAK,uCAAuC,CAC5D;GACA;GACA;GACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;GACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,WAEZ,IAAI,cAAc;GAChB,OAAO;IACL,SAAS,QAAQ;IACjB,WAAW,cAAc,KAAK,kBAAkB;IAChD,YAAY,cAAc,KAAK,mBAAmB;GACpD;GACA;GACA;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAO,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAI,MACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQ,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAI,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAW,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAAS,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQ,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAI,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAW,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAAS,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAO,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}