@shware/workflow 3.3.0 → 4.0.0

package/dist/apns.d.mts

@@ -14,13 +14,18 @@ import { PushRenderer } from "./push.mjs";
  * workerd under `wrangler dev` does not (the connection is dropped), so a local
  * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.
  */
-export interface ApnsPushOptions {
+/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */
+export interface ApnsProviderTokenOptions {
   /** The key's 10-character id, shown next to it in the developer portal. */
   keyId: string;
   /** The Apple Developer team id. */
   teamId: string;
   /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */
   privateKey: string;
+}
+export interface ApnsPushOptions {
+  /** The provider token the requests are signed with — shared by every sender on the same key. */
+  credentials: ApnsProviderToken;
   /** The app's bundle id — APNs's `apns-topic`. */
   topic: string;
   /**
@@ -39,24 +44,65 @@ export interface ApnsPushOptions {
   origin?: string;
   /** Fetch implementation (defaults to the global one). */
   fetch?: typeof fetch;
-  /** Called for a token APNs reports as gone (`Unregistered`, `BadDeviceToken`); `channelsFromConfig` passes it on to the DeviceDirectory's `disable`. */
-  onUnregistered?: (message: OutboundMessage) => Promise<void> | void;
 }
 export declare const APNS_HOSTS: {
   readonly sandbox: 'https://api.sandbox.push.apple.com';
   readonly production: 'https://api.push.apple.com';
 };
+/**
+ * How an APNs answer is classified, after Apple's response table
+ * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):
+ *
+ * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the
+ *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles
+ *   undelivered and the host forgets the token.
+ * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but
+ *   just as well for a token of the other environment (a sandbox build pushed through the
+ *   production host), which would answer for every device at once; the copy settles with the
+ *   reason, so the report shows it, and nothing is deleted on a guess.
+ * - configuration: the topic, certificate or provider key is wrong. Every device on this app
+ *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,
+ *   the deployment is not.
+ * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,
+ *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.
+ * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,
+ *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.
+ */
+export declare const DEAD_TOKEN_REASONS: ReadonlySet<string>;
+/**
+ * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the
+ * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the
+ * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —
+ * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose
+ * the node id at its end, and two nodes of one instance would collapse into one notification.
+ */
+export declare function apnsIdFromKey(idempotencyKey: string): Promise<string>;
+/**
+ * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple
+ * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent
+ * callers on a fresh or aged token share the one signing in flight, and a signing that failed is
+ * not kept, so the next call tries again. One instance serves every sender built on the key — a
+ * host keeps it across runs, and builds the senders per run.
+ */
+export declare class ApnsProviderToken {
+  private readonly options;
+  private signed;
+  private signing;
+  constructor(options: ApnsProviderTokenOptions);
+  /** The current token, signed now if there is none or it has aged out. */
+  token(now?: number): Promise<string>;
+  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */
+  invalidate(): void;
+}
 export declare class ApnsPushSender implements MessageSender {
   private readonly options;
-  private token;
   constructor(options: ApnsPushOptions);
   send(message: OutboundMessage): Promise<void | SendResult>;
-  private providerToken;
 }
 /** APNs error bodies are `{ "reason": "…" }`. */
 export declare function apnsReason(body: string): string;
 /** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */
-export declare function signApnsJwt(key: Pick<ApnsPushOptions, 'keyId' | 'teamId' | 'privateKey'>, nowMs?: number): Promise<string>;
+export declare function signApnsJwt(key: ApnsProviderTokenOptions, nowMs?: number): Promise<string>;
 /** The `.p8` as it is usually shipped in a secret: base64 of the file. */
 export declare function apnsKeyFromBase64(value: string): string;
 //#endregion

package/dist/apns.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apns.d.mts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;iBAiBiB;;EAEf;;EAEA;;EAEA;;EAEA;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;EAEf,kBAAkB,SAAS,oBAAoB;;qBAGpC;WACX;WACA;;qBAcW,0BAA0B;mBAGR;UAFrB;EAER,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;UAsDvC;;;wBAYA,WAAW;;wBAUL,YACpB,KAAK,KAAK,qDACV,iBACC;;wBAoBa,kBAAkB"}
+{"version":3,"file":"apns.d.mts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAmBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}

package/dist/apns.mjs

@@ -1,21 +1,93 @@
+import { PermanentError, isRetryableStatus } from "./engine/retry.mjs";
 import { base64url, pemToDer } from "./jwt.mjs";
 //#region src/apns.ts
 const APNS_HOSTS = {
 	sandbox: "https://api.sandbox.push.apple.com",
 	production: "https://api.push.apple.com"
 };
-/** Reasons APNs gives for a token that will never deliver again — not worth a retry. */
-const DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set([
-	"Unregistered",
-	"BadDeviceToken",
+/**
+* How an APNs answer is classified, after Apple's response table
+* (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):
+*
+* - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the
+*   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles
+*   undelivered and the host forgets the token.
+* - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but
+*   just as well for a token of the other environment (a sandbox build pushed through the
+*   production host), which would answer for every device at once; the copy settles with the
+*   reason, so the report shows it, and nothing is deleted on a guess.
+* - configuration: the topic, certificate or provider key is wrong. Every device on this app
+*   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,
+*   the deployment is not.
+* - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,
+*   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.
+* - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,
+*   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.
+*/
+const DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set(["Unregistered", "ExpiredToken"]);
+/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */
+const CONFIGURATION_REASONS = /* @__PURE__ */ new Set([
 	"DeviceTokenNotForTopic",
-	"ExpiredToken"
+	"TopicDisallowed",
+	"BadTopic",
+	"MissingTopic",
+	"BadCertificate",
+	"BadCertificateEnvironment",
+	"Forbidden",
+	"InvalidProviderToken",
+	"MissingProviderToken"
 ]);
+/**
+* The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the
+* first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the
+* same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —
+* collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose
+* the node id at its end, and two nodes of one instance would collapse into one notification.
+*/
+async function apnsIdFromKey(idempotencyKey) {
+	const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(idempotencyKey))).slice(0, 16);
+	bytes[6] = bytes[6] & 15 | 128;
+	bytes[8] = bytes[8] & 63 | 128;
+	const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
 /** Apple: reuse a provider token for at least 20 minutes, never past 60. */
 const TOKEN_TTL_MS = 3e6;
+/**
+* The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple
+* answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent
+* callers on a fresh or aged token share the one signing in flight, and a signing that failed is
+* not kept, so the next call tries again. One instance serves every sender built on the key — a
+* host keeps it across runs, and builds the senders per run.
+*/
+var ApnsProviderToken = class {
+	options;
+	signed;
+	signing;
+	constructor(options) {
+		this.options = options;
+	}
+	/** The current token, signed now if there is none or it has aged out. */
+	async token(now = Date.now()) {
+		if (this.signed !== void 0 && now - this.signed.issuedAt < TOKEN_TTL_MS) return this.signed.value;
+		this.signing ??= signApnsJwt(this.options, now).then((value) => {
+			this.signed = {
+				value,
+				issuedAt: now
+			};
+			return value;
+		}).finally(() => {
+			this.signing = void 0;
+		});
+		return this.signing;
+	}
+	/** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */
+	invalidate() {
+		this.signed = void 0;
+	}
+};
 var ApnsPushSender = class {
 	options;
-	token;
 	constructor(options) {
 		this.options = options;
 	}
@@ -26,13 +98,17 @@ var ApnsPushSender = class {
 		const mutable = image !== void 0 || message.tracking?.data?.delivered_url !== void 0;
 		const upstream = APNS_HOSTS[this.options.environment];
 		const origin = this.options.origin ?? upstream;
-		const response = await (this.options.fetch ?? fetch)(`${origin}/3/device/${message.recipient}`, {
+		const doFetch = this.options.fetch ?? fetch;
+		const copyId = await apnsIdFromKey(message.idempotencyKey);
+		const response = await doFetch(`${origin}/3/device/${message.recipient}`, {
 			method: "POST",
 			headers: {
-				authorization: `bearer ${await this.providerToken()}`,
+				authorization: `bearer ${await this.options.credentials.token()}`,
 				"apns-topic": this.options.topic,
 				"apns-push-type": "alert",
 				"apns-priority": "10",
+				"apns-id": copyId,
+				"apns-collapse-id": copyId,
 				"content-type": "application/json",
 				...this.options.origin === void 0 ? {} : { "apns-relay-upstream": upstream }
 			},
@@ -54,26 +130,29 @@ var ApnsPushSender = class {
 		});
 		if (response.ok) return;
 		const text = await response.text();
-		const reason = apnsReason(text);
-		if (response.status === 410 || DEAD_TOKEN_REASONS.has(reason)) {
-			console.warn(`[apns] token gone for user ${message.userId}: ${reason || response.status}`);
-			await this.options.onUnregistered?.(message);
+		const { status } = response;
+		const reason = apnsReason(text) || (status === 410 ? "Unregistered" : "");
+		if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {
+			console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);
 			return {
 				delivered: false,
-				reason: reason || `HTTP ${response.status}`
+				reason
 			};
 		}
-		throw new Error(`APNs send failed: ${response.status} ${text}`);
-	}
-	async providerToken() {
-		const now = Date.now();
-		if (this.token !== void 0 && now - this.token.issuedAt < TOKEN_TTL_MS) return this.token.value;
-		const value = await signApnsJwt(this.options, now);
-		this.token = {
-			value,
-			issuedAt: now
-		};
-		return value;
+		if (reason === "BadDeviceToken") {
+			console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);
+			return {
+				delivered: false,
+				reason
+			};
+		}
+		if (reason === "ExpiredProviderToken") {
+			this.options.credentials.invalidate();
+			throw new Error(`APNs send failed: ${status} ${reason} (provider token renewed for the retry)`);
+		}
+		if (CONFIGURATION_REASONS.has(reason)) throw new PermanentError(`APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`);
+		if (isRetryableStatus(status)) throw new Error(`APNs send failed: ${status} ${reason || text}`);
+		throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);
 	}
 };
 /** APNs error bodies are `{ "reason": "…" }`. */
@@ -106,11 +185,16 @@ async function signApnsJwt(key, nowMs = Date.now()) {
 }
 /** The `.p8` as it is usually shipped in a secret: base64 of the file. */
 function apnsKeyFromBase64(value) {
-	const pem = atob(value);
-	if (!pem.includes("-----BEGIN PRIVATE KEY-----")) throw new Error("APNs key is not a PKCS #8 PEM (.p8) file");
+	let pem;
+	try {
+		pem = atob(value);
+	} catch (error) {
+		throw new PermanentError("APNs key is not base64 (expected the .p8 file, base64-encoded)", { cause: error });
+	}
+	if (!pem.includes("-----BEGIN PRIVATE KEY-----")) throw new PermanentError("APNs key is not a PKCS #8 PEM (.p8) file");
 	return pem;
 }
 //#endregion
-export { APNS_HOSTS, ApnsPushSender, apnsKeyFromBase64, apnsReason, signApnsJwt };
+export { APNS_HOSTS, ApnsProviderToken, ApnsPushSender, DEAD_TOKEN_REASONS, apnsIdFromKey, apnsKeyFromBase64, apnsReason, signApnsJwt };
 
 //# sourceMappingURL=apns.mjs.map

package/dist/apns.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apns.mjs","names":[],"sources":["../src/apns.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\nexport interface ApnsPushOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n  /** Called for a token APNs reports as gone (`Unregistered`, `BadDeviceToken`); `channelsFromConfig` passes it on to the DeviceDirectory's `disable`. */\n  onUnregistered?: (message: OutboundMessage) => Promise<void> | void;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/** Reasons APNs gives for a token that will never deliver again — not worth a retry. */\nconst DEAD_TOKEN_REASONS = new Set([\n  'Unregistered',\n  'BadDeviceToken',\n  'DeviceTokenNotForTopic',\n  'ExpiredToken',\n]);\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\nexport class ApnsPushSender implements MessageSender {\n  private token: { value: string; issuedAt: number } | undefined;\n\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.providerToken()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const reason = apnsReason(text);\n    if (response.status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason || response.status}`);\n      await this.options.onUnregistered?.(message);\n      return { delivered: false, reason: reason || `HTTP ${response.status}` };\n    }\n    throw new Error(`APNs send failed: ${response.status} ${text}`);\n  }\n\n  private async providerToken(): Promise<string> {\n    const now = Date.now();\n    if (this.token !== undefined && now - this.token.issuedAt < TOKEN_TTL_MS) {\n      return this.token.value;\n    }\n    const value = await signApnsJwt(this.options, now);\n    this.token = { value, issuedAt: now };\n    return value;\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: Pick<ApnsPushOptions, 'keyId' | 'teamId' | 'privateKey'>,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  const pem = atob(value);\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new Error('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;AA8CA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;AAGA,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,eAAe;AAErB,IAAa,iBAAb,MAAqD;CAGtB;CAF7B;CAEA,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EAGtC,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAEP,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,cAAc;IAClD,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,SAAS,WAAW,IAAI;EAC9B,IAAI,SAAS,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAG7D,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,UAAU,SAAS,QAAQ;GACzF,MAAM,KAAK,QAAQ,iBAAiB,OAAO;GAC3C,OAAO;IAAE,WAAW;IAAO,QAAQ,UAAU,QAAQ,SAAS;GAAS;EACzE;EACA,MAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,GAAG,MAAM;CAChE;CAEA,MAAc,gBAAiC;EAC7C,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,KAAK,UAAU,KAAA,KAAa,MAAM,KAAK,MAAM,WAAW,cAC1D,OAAO,KAAK,MAAM;EAEpB,MAAM,QAAQ,MAAM,YAAY,KAAK,SAAS,GAAG;EACjD,KAAK,QAAQ;GAAE;GAAO,UAAU;EAAI;EACpC,OAAO;CACT;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,MAAM,MAAM,KAAK,KAAK;CACtB,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAI,MAAM,0CAA0C;CAE5D,OAAO;AACT"}
+{"version":3,"file":"apns.mjs","names":[],"sources":["../src/apns.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = atob(value);\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;AAmDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAM,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAC7E,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAI,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAI,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAI,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAI,eAAe,0CAA0C;CAErE,OAAO;AACT"}

package/dist/aws/engine-step.cjs

@@ -44,10 +44,6 @@ var AwsEngineStep = class {
 		if (!(ms > 0)) return;
 		await this.context.wait(name, { seconds: Math.ceil(ms / 1e3) });
 	}
-	async sleepUntil(name, timestampMs) {
-		const remaining = await this.context.step(`${name}:remaining`, async () => timestampMs - Date.now());
-		await this.sleep(name, remaining);
-	}
 	async subscribe(name, events, options = {}) {
 		const generation = ++this.generation;
 		const { deadlineMs } = options;
@@ -82,7 +78,11 @@ var AwsEngineStep = class {
 		if (armed !== void 0) armed.settled = true;
 		this.armed = void 0;
 	}
-	async waitForWake(name, _timeoutMs) {
+	/**
+	* The timeout is ignored on purpose: the callback's own timeout was set from the deadline
+	* when it was armed (`subscribe`), and only its expiry says the wait timed out.
+	*/
+	async waitForWake(name, _wait) {
 		const armed = this.armed;
 		if (armed === void 0) throw new Error(`waitForWake '${name}' without a subscribe: nothing is armed to wake it`);
 		try {

package/dist/aws/engine-step.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"engine-step.cjs","names":["isRetryable","CallbackTimeoutError"],"sources":["../../src/aws/engine-step.ts"],"sourcesContent":["import {\n  CallbackTimeoutError,\n  type DurableContext,\n  type DurablePromise,\n  type RetryDecision,\n} from '@aws/durable-execution-sdk-js';\nimport type { EngineStep } from '../engine/ports';\nimport { isRetryable } from '../engine/retry';\nimport type { ExecutionRegistry, JourneyStore } from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * EngineStep over a Lambda durable execution.\n *\n * Steps, sleeps and wakes map onto the SDK's `step`, `wait` and callbacks. A wake handle is a\n * callback, which is one-shot, so every wait arms a fresh one (the interpreter subscribes on\n * every attempt): created where the durable context allows it — outside any step, so its id\n * replays — then recorded in Postgres together with the subscription rows, numbered by a\n * generation so a late wake or cleanup of an older wait cannot touch a newer one. The callback\n * is only a hint; the facts the wait re-checks are Postgres'.\n */\n\n/** What the step retries, bounded: 6 attempts with exponential backoff up to a minute. */\nexport function stepRetry(error: Error, attempt: number): RetryDecision {\n  if (!isRetryable(error) || attempt >= 6) return { shouldRetry: false };\n  return { shouldRetry: true, delay: { seconds: Math.min(60, 2 ** attempt) } };\n}\n\ninterface Armed {\n  promise: DurablePromise<string>;\n  callbackId: string;\n  generation: number;\n  /** The wait consumed it (woken or timed out): there is nothing left to close. */\n  settled: boolean;\n}\n\nexport class AwsEngineStep implements EngineStep {\n  private generation = 0;\n  private armed: Armed | undefined;\n\n  constructor(\n    private readonly context: DurableContext,\n    private readonly store: JourneyStore,\n    private readonly executions: ExecutionRegistry,\n    private readonly lambda: LambdaApi,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.context.step(name, () => fn(), { retryStrategy: stepRetry });\n  }\n\n  async sleep(name: string, ms: number): Promise<void> {\n    // A wait is whole seconds: rounded up, so it never ends early; nothing to wait at zero\n    if (!(ms > 0)) return;\n    await this.context.wait(name, { seconds: Math.ceil(ms / 1000) });\n  }\n\n  async sleepUntil(name: string, timestampMs: number): Promise<void> {\n    // The remaining time is checkpointed: a replay must not recompute it from a later clock\n    const remaining = await this.context.step(\n      `${name}:remaining`,\n      async () => timestampMs - Date.now()\n    );\n    await this.sleep(name, remaining);\n  }\n\n  async subscribe(\n    name: string,\n    events: readonly string[],\n    options: { deadlineMs?: number } = {}\n  ): Promise<void> {\n    const generation = ++this.generation;\n    const { deadlineMs } = options;\n    // The callback's own timeout is the wait's deadline: fixed when it is created\n    const seconds =\n      deadlineMs === undefined\n        ? undefined\n        : await this.context.step(`${name}:timeout`, async () =>\n            Math.max(1, Math.ceil((deadlineMs - Date.now()) / 1000))\n          );\n    const [promise, callbackId] = await this.context.createCallback(\n      `${name}:callback`,\n      seconds === undefined ? {} : { timeout: { seconds } }\n    );\n    const previous = this.armed;\n    this.armed = { promise, callbackId, generation, settled: false };\n    await this.context.step(\n      name,\n      async () => {\n        // Rows first, then the callback: a wake that lands in between finds the rows and the\n        // callback of the last wait — its completion is refused, and this wait checks the facts\n        await this.store.subscribe(this.instanceId, this.userId, events, Date.now());\n        await this.executions.armCallback(this.instanceId, {\n          id: callbackId,\n          generation,\n          deadlineAt: deadlineMs,\n        });\n        if (previous !== undefined && !previous.settled) {\n          await this.lambda.completeCallback(previous.callbackId, '{}');\n        }\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (previous !== undefined) previous.settled = true;\n  }\n\n  async unsubscribe(name: string): Promise<void> {\n    const armed = this.armed;\n    await this.context.step(\n      name,\n      async () => {\n        await this.store.unsubscribe(this.instanceId);\n        if (armed === undefined) return;\n        await this.executions.clearCallback(this.instanceId, armed.generation);\n        // The condition held before the wait parked: its callback is closed through the public\n        // API (a closed one answers false), rather than left open until it times out\n        if (!armed.settled) await this.lambda.completeCallback(armed.callbackId, '{}');\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (armed !== undefined) armed.settled = true;\n    this.armed = undefined;\n  }\n\n  async waitForWake(name: string, _timeoutMs: number): Promise<'event' | 'timeout'> {\n    const armed = this.armed;\n    if (armed === undefined) {\n      throw new Error(`waitForWake '${name}' without a subscribe: nothing is armed to wake it`);\n    }\n    try {\n      await armed.promise;\n      return 'event';\n    } catch (error) {\n      // Only the callback's own expiry is a timeout; any other failure is a failure\n      if (error instanceof CallbackTimeoutError) return 'timeout';\n      throw error;\n    } finally {\n      armed.settled = true;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuBA,SAAgB,UAAU,OAAc,SAAgC;CACtE,IAAI,CAACA,qBAAAA,YAAY,KAAK,KAAK,WAAW,GAAG,OAAO,EAAE,aAAa,MAAM;CACrE,OAAO;EAAE,aAAa;EAAM,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE;CAAE;AAC7E;AAUA,IAAa,gBAAb,MAAiD;CAK5B;CACA;CACA;CACA;CACA;CACA;CATnB,aAAqB;CACrB;CAEA,YACE,SACA,OACA,YACA,QACA,QACA,YACA;EANiB,KAAA,UAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;EACA,KAAA,SAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;CAEH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,QAAQ,KAAK,YAAY,GAAG,GAAG,EAAE,eAAe,UAAU,CAAC;CACzE;CAEA,MAAM,MAAM,MAAc,IAA2B;EAEnD,IAAI,EAAE,KAAK,IAAI;EACf,MAAM,KAAK,QAAQ,KAAK,MAAM,EAAE,SAAS,KAAK,KAAK,KAAK,GAAI,EAAE,CAAC;CACjE;CAEA,MAAM,WAAW,MAAc,aAAoC;EAEjE,MAAM,YAAY,MAAM,KAAK,QAAQ,KACnC,GAAG,KAAK,aACR,YAAY,cAAc,KAAK,IAAI,CACrC;EACA,MAAM,KAAK,MAAM,MAAM,SAAS;CAClC;CAEA,MAAM,UACJ,MACA,QACA,UAAmC,CAAC,GACrB;EACf,MAAM,aAAa,EAAE,KAAK;EAC1B,MAAM,EAAE,eAAe;EAEvB,MAAM,UACJ,eAAe,KAAA,IACX,KAAA,IACA,MAAM,KAAK,QAAQ,KAAK,GAAG,KAAK,WAAW,YACzC,KAAK,IAAI,GAAG,KAAK,MAAM,aAAa,KAAK,IAAI,KAAK,GAAI,CAAC,CACzD;EACN,MAAM,CAAC,SAAS,cAAc,MAAM,KAAK,QAAQ,eAC/C,GAAG,KAAK,YACR,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CACtD;EACA,MAAM,WAAW,KAAK;EACtB,KAAK,QAAQ;GAAE;GAAS;GAAY;GAAY,SAAS;EAAM;EAC/D,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GAGV,MAAM,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC;GAC3E,MAAM,KAAK,WAAW,YAAY,KAAK,YAAY;IACjD,IAAI;IACJ;IACA,YAAY;GACd,CAAC;GACD,IAAI,aAAa,KAAA,KAAa,CAAC,SAAS,SACtC,MAAM,KAAK,OAAO,iBAAiB,SAAS,YAAY,IAAI;EAEhE,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,aAAa,KAAA,GAAW,SAAS,UAAU;CACjD;CAEA,MAAM,YAAY,MAA6B;EAC7C,MAAM,QAAQ,KAAK;EACnB,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GACV,MAAM,KAAK,MAAM,YAAY,KAAK,UAAU;GAC5C,IAAI,UAAU,KAAA,GAAW;GACzB,MAAM,KAAK,WAAW,cAAc,KAAK,YAAY,MAAM,UAAU;GAGrE,IAAI,CAAC,MAAM,SAAS,MAAM,KAAK,OAAO,iBAAiB,MAAM,YAAY,IAAI;EAC/E,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,UAAU,KAAA,GAAW,MAAM,UAAU;EACzC,KAAK,QAAQ,KAAA;CACf;CAEA,MAAM,YAAY,MAAc,YAAkD;EAChF,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,gBAAgB,KAAK,mDAAmD;EAE1F,IAAI;GACF,MAAM,MAAM;GACZ,OAAO;EACT,SAAS,OAAO;GAEd,IAAI,iBAAiBC,8BAAAA,sBAAsB,OAAO;GAClD,MAAM;EACR,UAAU;GACR,MAAM,UAAU;EAClB;CACF;AACF"}
+{"version":3,"file":"engine-step.cjs","names":["isRetryable","CallbackTimeoutError"],"sources":["../../src/aws/engine-step.ts"],"sourcesContent":["import {\n  CallbackTimeoutError,\n  type DurableContext,\n  type DurablePromise,\n  type RetryDecision,\n} from '@aws/durable-execution-sdk-js';\nimport type { EngineStep } from '../engine/ports';\nimport { isRetryable } from '../engine/retry';\nimport type { ExecutionRegistry, JourneyStore } from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * EngineStep over a Lambda durable execution.\n *\n * Steps, sleeps and wakes map onto the SDK's `step`, `wait` and callbacks. A wake handle is a\n * callback, which is one-shot, so every wait arms a fresh one (the interpreter subscribes on\n * every attempt): created where the durable context allows it — outside any step, so its id\n * replays — then recorded in Postgres together with the subscription rows, numbered by a\n * generation so a late wake or cleanup of an older wait cannot touch a newer one. The callback\n * is only a hint; the facts the wait re-checks are Postgres'.\n */\n\n/** What the step retries, bounded: 6 attempts with exponential backoff up to a minute. */\nexport function stepRetry(error: Error, attempt: number): RetryDecision {\n  if (!isRetryable(error) || attempt >= 6) return { shouldRetry: false };\n  return { shouldRetry: true, delay: { seconds: Math.min(60, 2 ** attempt) } };\n}\n\ninterface Armed {\n  promise: DurablePromise<string>;\n  callbackId: string;\n  generation: number;\n  /** The wait consumed it (woken or timed out): there is nothing left to close. */\n  settled: boolean;\n}\n\nexport class AwsEngineStep implements EngineStep {\n  private generation = 0;\n  private armed: Armed | undefined;\n\n  constructor(\n    private readonly context: DurableContext,\n    private readonly store: JourneyStore,\n    private readonly executions: ExecutionRegistry,\n    private readonly lambda: LambdaApi,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.context.step(name, () => fn(), { retryStrategy: stepRetry });\n  }\n\n  async sleep(name: string, ms: number): Promise<void> {\n    // A wait is whole seconds: rounded up, so it never ends early; nothing to wait at zero\n    if (!(ms > 0)) return;\n    await this.context.wait(name, { seconds: Math.ceil(ms / 1000) });\n  }\n\n  async subscribe(\n    name: string,\n    events: readonly string[],\n    options: { deadlineMs?: number } = {}\n  ): Promise<void> {\n    const generation = ++this.generation;\n    const { deadlineMs } = options;\n    // The callback's own timeout is the wait's deadline: fixed when it is created\n    const seconds =\n      deadlineMs === undefined\n        ? undefined\n        : await this.context.step(`${name}:timeout`, async () =>\n            Math.max(1, Math.ceil((deadlineMs - Date.now()) / 1000))\n          );\n    const [promise, callbackId] = await this.context.createCallback(\n      `${name}:callback`,\n      seconds === undefined ? {} : { timeout: { seconds } }\n    );\n    const previous = this.armed;\n    this.armed = { promise, callbackId, generation, settled: false };\n    await this.context.step(\n      name,\n      async () => {\n        // Rows first, then the callback: a wake that lands in between finds the rows and the\n        // callback of the last wait — its completion is refused, and this wait checks the facts\n        await this.store.subscribe(this.instanceId, this.userId, events, Date.now());\n        await this.executions.armCallback(this.instanceId, {\n          id: callbackId,\n          generation,\n          deadlineAt: deadlineMs,\n        });\n        if (previous !== undefined && !previous.settled) {\n          await this.lambda.completeCallback(previous.callbackId, '{}');\n        }\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (previous !== undefined) previous.settled = true;\n  }\n\n  async unsubscribe(name: string): Promise<void> {\n    const armed = this.armed;\n    await this.context.step(\n      name,\n      async () => {\n        await this.store.unsubscribe(this.instanceId);\n        if (armed === undefined) return;\n        await this.executions.clearCallback(this.instanceId, armed.generation);\n        // The condition held before the wait parked: its callback is closed through the public\n        // API (a closed one answers false), rather than left open until it times out\n        if (!armed.settled) await this.lambda.completeCallback(armed.callbackId, '{}');\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (armed !== undefined) armed.settled = true;\n    this.armed = undefined;\n  }\n\n  /**\n   * The timeout is ignored on purpose: the callback's own timeout was set from the deadline\n   * when it was armed (`subscribe`), and only its expiry says the wait timed out.\n   */\n  async waitForWake(\n    name: string,\n    _wait: { timeoutMs: number; deadlineMs: number }\n  ): Promise<'event' | 'timeout'> {\n    const armed = this.armed;\n    if (armed === undefined) {\n      throw new Error(`waitForWake '${name}' without a subscribe: nothing is armed to wake it`);\n    }\n    try {\n      await armed.promise;\n      return 'event';\n    } catch (error) {\n      // Only the callback's own expiry is a timeout; any other failure is a failure\n      if (error instanceof CallbackTimeoutError) return 'timeout';\n      throw error;\n    } finally {\n      armed.settled = true;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuBA,SAAgB,UAAU,OAAc,SAAgC;CACtE,IAAI,CAACA,qBAAAA,YAAY,KAAK,KAAK,WAAW,GAAG,OAAO,EAAE,aAAa,MAAM;CACrE,OAAO;EAAE,aAAa;EAAM,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE;CAAE;AAC7E;AAUA,IAAa,gBAAb,MAAiD;CAK5B;CACA;CACA;CACA;CACA;CACA;CATnB,aAAqB;CACrB;CAEA,YACE,SACA,OACA,YACA,QACA,QACA,YACA;EANiB,KAAA,UAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;EACA,KAAA,SAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;CAEH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,QAAQ,KAAK,YAAY,GAAG,GAAG,EAAE,eAAe,UAAU,CAAC;CACzE;CAEA,MAAM,MAAM,MAAc,IAA2B;EAEnD,IAAI,EAAE,KAAK,IAAI;EACf,MAAM,KAAK,QAAQ,KAAK,MAAM,EAAE,SAAS,KAAK,KAAK,KAAK,GAAI,EAAE,CAAC;CACjE;CAEA,MAAM,UACJ,MACA,QACA,UAAmC,CAAC,GACrB;EACf,MAAM,aAAa,EAAE,KAAK;EAC1B,MAAM,EAAE,eAAe;EAEvB,MAAM,UACJ,eAAe,KAAA,IACX,KAAA,IACA,MAAM,KAAK,QAAQ,KAAK,GAAG,KAAK,WAAW,YACzC,KAAK,IAAI,GAAG,KAAK,MAAM,aAAa,KAAK,IAAI,KAAK,GAAI,CAAC,CACzD;EACN,MAAM,CAAC,SAAS,cAAc,MAAM,KAAK,QAAQ,eAC/C,GAAG,KAAK,YACR,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CACtD;EACA,MAAM,WAAW,KAAK;EACtB,KAAK,QAAQ;GAAE;GAAS;GAAY;GAAY,SAAS;EAAM;EAC/D,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GAGV,MAAM,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC;GAC3E,MAAM,KAAK,WAAW,YAAY,KAAK,YAAY;IACjD,IAAI;IACJ;IACA,YAAY;GACd,CAAC;GACD,IAAI,aAAa,KAAA,KAAa,CAAC,SAAS,SACtC,MAAM,KAAK,OAAO,iBAAiB,SAAS,YAAY,IAAI;EAEhE,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,aAAa,KAAA,GAAW,SAAS,UAAU;CACjD;CAEA,MAAM,YAAY,MAA6B;EAC7C,MAAM,QAAQ,KAAK;EACnB,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GACV,MAAM,KAAK,MAAM,YAAY,KAAK,UAAU;GAC5C,IAAI,UAAU,KAAA,GAAW;GACzB,MAAM,KAAK,WAAW,cAAc,KAAK,YAAY,MAAM,UAAU;GAGrE,IAAI,CAAC,MAAM,SAAS,MAAM,KAAK,OAAO,iBAAiB,MAAM,YAAY,IAAI;EAC/E,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,UAAU,KAAA,GAAW,MAAM,UAAU;EACzC,KAAK,QAAQ,KAAA;CACf;;;;;CAMA,MAAM,YACJ,MACA,OAC8B;EAC9B,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,gBAAgB,KAAK,mDAAmD;EAE1F,IAAI;GACF,MAAM,MAAM;GACZ,OAAO;EACT,SAAS,OAAO;GAEd,IAAI,iBAAiBC,8BAAAA,sBAAsB,OAAO;GAClD,MAAM;EACR,UAAU;GACR,MAAM,UAAU;EAClB;CACF;AACF"}

package/dist/aws/engine-step.d.cts

@@ -27,12 +27,18 @@ export declare class AwsEngineStep implements EngineStep {
   constructor(context: DurableContext, store: JourneyStore, executions: ExecutionRegistry, lambda: LambdaApi, userId: string, instanceId: string);
   do<T>(name: string, fn: () => Promise<T>): Promise<T>;
   sleep(name: string, ms: number): Promise<void>;
-  sleepUntil(name: string, timestampMs: number): Promise<void>;
   subscribe(name: string, events: readonly string[], options?: {
     deadlineMs?: number;
   }): Promise<void>;
   unsubscribe(name: string): Promise<void>;
-  waitForWake(name: string, _timeoutMs: number): Promise<'event' | 'timeout'>;
+  /**
+   * The timeout is ignored on purpose: the callback's own timeout was set from the deadline
+   * when it was armed (`subscribe`), and only its expiry says the wait timed out.
+   */
+  waitForWake(name: string, _wait: {
+    timeoutMs: number;
+    deadlineMs: number;
+  }): Promise<'event' | 'timeout'>;
 }
 //#endregion
 //# sourceMappingURL=engine-step.d.cts.map

package/dist/aws/engine-step.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-step.d.cts","names":[],"sources":["../../src/aws/engine-step.ts"],"mappings":";;;;;;;;;;;;;;;;wBAuBgB,UAAU,OAAO,OAAO,kBAAkB;qBAa7C,yBAAyB;mBAKjB;mBACA;mBACA;mBACA;mBACA;mBACA;UATX;UACA;EAER,YACmB,SAAS,gBACT,OAAO,cACP,YAAY,mBACZ,QAAQ,WACR,gBACA;EAGnB,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;EAI7C,MAAM,cAAc,aAAa;EAMjC,WAAW,cAAc,sBAAsB;EAS/C,UACJ,cACA,2BACA;IAAW;MACV;EAoCG,YAAY,eAAe;EAkB3B,YAAY,cAAc,qBAAqB"}
+{"version":3,"file":"engine-step.d.cts","names":[],"sources":["../../src/aws/engine-step.ts"],"mappings":";;;;;;;;;;;;;;;;wBAuBgB,UAAU,OAAO,OAAO,kBAAkB;qBAa7C,yBAAyB;mBAKjB;mBACA;mBACA;mBACA;mBACA;mBACA;UATX;UACA;EAER,YACmB,SAAS,gBACT,OAAO,cACP,YAAY,mBACZ,QAAQ,WACR,gBACA;EAGnB,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;EAI7C,MAAM,cAAc,aAAa;EAMjC,UACJ,cACA,2BACA;IAAW;MACV;EAoCG,YAAY,eAAe;;;;;EAsB3B,YACJ,cACA;IAAS;IAAmB;MAC3B"}

package/dist/aws/engine-step.d.mts

@@ -27,12 +27,18 @@ export declare class AwsEngineStep implements EngineStep {
   constructor(context: DurableContext, store: JourneyStore, executions: ExecutionRegistry, lambda: LambdaApi, userId: string, instanceId: string);
   do<T>(name: string, fn: () => Promise<T>): Promise<T>;
   sleep(name: string, ms: number): Promise<void>;
-  sleepUntil(name: string, timestampMs: number): Promise<void>;
   subscribe(name: string, events: readonly string[], options?: {
     deadlineMs?: number;
   }): Promise<void>;
   unsubscribe(name: string): Promise<void>;
-  waitForWake(name: string, _timeoutMs: number): Promise<'event' | 'timeout'>;
+  /**
+   * The timeout is ignored on purpose: the callback's own timeout was set from the deadline
+   * when it was armed (`subscribe`), and only its expiry says the wait timed out.
+   */
+  waitForWake(name: string, _wait: {
+    timeoutMs: number;
+    deadlineMs: number;
+  }): Promise<'event' | 'timeout'>;
 }
 //#endregion
 //# sourceMappingURL=engine-step.d.mts.map

package/dist/aws/engine-step.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-step.d.mts","names":[],"sources":["../../src/aws/engine-step.ts"],"mappings":";;;;;;;;;;;;;;;;wBAuBgB,UAAU,OAAO,OAAO,kBAAkB;qBAa7C,yBAAyB;mBAKjB;mBACA;mBACA;mBACA;mBACA;mBACA;UATX;UACA;EAER,YACmB,SAAS,gBACT,OAAO,cACP,YAAY,mBACZ,QAAQ,WACR,gBACA;EAGnB,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;EAI7C,MAAM,cAAc,aAAa;EAMjC,WAAW,cAAc,sBAAsB;EAS/C,UACJ,cACA,2BACA;IAAW;MACV;EAoCG,YAAY,eAAe;EAkB3B,YAAY,cAAc,qBAAqB"}
+{"version":3,"file":"engine-step.d.mts","names":[],"sources":["../../src/aws/engine-step.ts"],"mappings":";;;;;;;;;;;;;;;;wBAuBgB,UAAU,OAAO,OAAO,kBAAkB;qBAa7C,yBAAyB;mBAKjB;mBACA;mBACA;mBACA;mBACA;mBACA;UATX;UACA;EAER,YACmB,SAAS,gBACT,OAAO,cACP,YAAY,mBACZ,QAAQ,WACR,gBACA;EAGnB,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;EAI7C,MAAM,cAAc,aAAa;EAMjC,UACJ,cACA,2BACA;IAAW;MACV;EAoCG,YAAY,eAAe;;;;;EAsB3B,YACJ,cACA;IAAS;IAAmB;MAC3B"}

package/dist/aws/engine-step.mjs

@@ -43,10 +43,6 @@ var AwsEngineStep = class {
 		if (!(ms > 0)) return;
 		await this.context.wait(name, { seconds: Math.ceil(ms / 1e3) });
 	}
-	async sleepUntil(name, timestampMs) {
-		const remaining = await this.context.step(`${name}:remaining`, async () => timestampMs - Date.now());
-		await this.sleep(name, remaining);
-	}
 	async subscribe(name, events, options = {}) {
 		const generation = ++this.generation;
 		const { deadlineMs } = options;
@@ -81,7 +77,11 @@ var AwsEngineStep = class {
 		if (armed !== void 0) armed.settled = true;
 		this.armed = void 0;
 	}
-	async waitForWake(name, _timeoutMs) {
+	/**
+	* The timeout is ignored on purpose: the callback's own timeout was set from the deadline
+	* when it was armed (`subscribe`), and only its expiry says the wait timed out.
+	*/
+	async waitForWake(name, _wait) {
 		const armed = this.armed;
 		if (armed === void 0) throw new Error(`waitForWake '${name}' without a subscribe: nothing is armed to wake it`);
 		try {

package/dist/aws/engine-step.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"engine-step.mjs","names":[],"sources":["../../src/aws/engine-step.ts"],"sourcesContent":["import {\n  CallbackTimeoutError,\n  type DurableContext,\n  type DurablePromise,\n  type RetryDecision,\n} from '@aws/durable-execution-sdk-js';\nimport type { EngineStep } from '../engine/ports';\nimport { isRetryable } from '../engine/retry';\nimport type { ExecutionRegistry, JourneyStore } from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * EngineStep over a Lambda durable execution.\n *\n * Steps, sleeps and wakes map onto the SDK's `step`, `wait` and callbacks. A wake handle is a\n * callback, which is one-shot, so every wait arms a fresh one (the interpreter subscribes on\n * every attempt): created where the durable context allows it — outside any step, so its id\n * replays — then recorded in Postgres together with the subscription rows, numbered by a\n * generation so a late wake or cleanup of an older wait cannot touch a newer one. The callback\n * is only a hint; the facts the wait re-checks are Postgres'.\n */\n\n/** What the step retries, bounded: 6 attempts with exponential backoff up to a minute. */\nexport function stepRetry(error: Error, attempt: number): RetryDecision {\n  if (!isRetryable(error) || attempt >= 6) return { shouldRetry: false };\n  return { shouldRetry: true, delay: { seconds: Math.min(60, 2 ** attempt) } };\n}\n\ninterface Armed {\n  promise: DurablePromise<string>;\n  callbackId: string;\n  generation: number;\n  /** The wait consumed it (woken or timed out): there is nothing left to close. */\n  settled: boolean;\n}\n\nexport class AwsEngineStep implements EngineStep {\n  private generation = 0;\n  private armed: Armed | undefined;\n\n  constructor(\n    private readonly context: DurableContext,\n    private readonly store: JourneyStore,\n    private readonly executions: ExecutionRegistry,\n    private readonly lambda: LambdaApi,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.context.step(name, () => fn(), { retryStrategy: stepRetry });\n  }\n\n  async sleep(name: string, ms: number): Promise<void> {\n    // A wait is whole seconds: rounded up, so it never ends early; nothing to wait at zero\n    if (!(ms > 0)) return;\n    await this.context.wait(name, { seconds: Math.ceil(ms / 1000) });\n  }\n\n  async sleepUntil(name: string, timestampMs: number): Promise<void> {\n    // The remaining time is checkpointed: a replay must not recompute it from a later clock\n    const remaining = await this.context.step(\n      `${name}:remaining`,\n      async () => timestampMs - Date.now()\n    );\n    await this.sleep(name, remaining);\n  }\n\n  async subscribe(\n    name: string,\n    events: readonly string[],\n    options: { deadlineMs?: number } = {}\n  ): Promise<void> {\n    const generation = ++this.generation;\n    const { deadlineMs } = options;\n    // The callback's own timeout is the wait's deadline: fixed when it is created\n    const seconds =\n      deadlineMs === undefined\n        ? undefined\n        : await this.context.step(`${name}:timeout`, async () =>\n            Math.max(1, Math.ceil((deadlineMs - Date.now()) / 1000))\n          );\n    const [promise, callbackId] = await this.context.createCallback(\n      `${name}:callback`,\n      seconds === undefined ? {} : { timeout: { seconds } }\n    );\n    const previous = this.armed;\n    this.armed = { promise, callbackId, generation, settled: false };\n    await this.context.step(\n      name,\n      async () => {\n        // Rows first, then the callback: a wake that lands in between finds the rows and the\n        // callback of the last wait — its completion is refused, and this wait checks the facts\n        await this.store.subscribe(this.instanceId, this.userId, events, Date.now());\n        await this.executions.armCallback(this.instanceId, {\n          id: callbackId,\n          generation,\n          deadlineAt: deadlineMs,\n        });\n        if (previous !== undefined && !previous.settled) {\n          await this.lambda.completeCallback(previous.callbackId, '{}');\n        }\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (previous !== undefined) previous.settled = true;\n  }\n\n  async unsubscribe(name: string): Promise<void> {\n    const armed = this.armed;\n    await this.context.step(\n      name,\n      async () => {\n        await this.store.unsubscribe(this.instanceId);\n        if (armed === undefined) return;\n        await this.executions.clearCallback(this.instanceId, armed.generation);\n        // The condition held before the wait parked: its callback is closed through the public\n        // API (a closed one answers false), rather than left open until it times out\n        if (!armed.settled) await this.lambda.completeCallback(armed.callbackId, '{}');\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (armed !== undefined) armed.settled = true;\n    this.armed = undefined;\n  }\n\n  async waitForWake(name: string, _timeoutMs: number): Promise<'event' | 'timeout'> {\n    const armed = this.armed;\n    if (armed === undefined) {\n      throw new Error(`waitForWake '${name}' without a subscribe: nothing is armed to wake it`);\n    }\n    try {\n      await armed.promise;\n      return 'event';\n    } catch (error) {\n      // Only the callback's own expiry is a timeout; any other failure is a failure\n      if (error instanceof CallbackTimeoutError) return 'timeout';\n      throw error;\n    } finally {\n      armed.settled = true;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAuBA,SAAgB,UAAU,OAAc,SAAgC;CACtE,IAAI,CAAC,YAAY,KAAK,KAAK,WAAW,GAAG,OAAO,EAAE,aAAa,MAAM;CACrE,OAAO;EAAE,aAAa;EAAM,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE;CAAE;AAC7E;AAUA,IAAa,gBAAb,MAAiD;CAK5B;CACA;CACA;CACA;CACA;CACA;CATnB,aAAqB;CACrB;CAEA,YACE,SACA,OACA,YACA,QACA,QACA,YACA;EANiB,KAAA,UAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;EACA,KAAA,SAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;CAEH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,QAAQ,KAAK,YAAY,GAAG,GAAG,EAAE,eAAe,UAAU,CAAC;CACzE;CAEA,MAAM,MAAM,MAAc,IAA2B;EAEnD,IAAI,EAAE,KAAK,IAAI;EACf,MAAM,KAAK,QAAQ,KAAK,MAAM,EAAE,SAAS,KAAK,KAAK,KAAK,GAAI,EAAE,CAAC;CACjE;CAEA,MAAM,WAAW,MAAc,aAAoC;EAEjE,MAAM,YAAY,MAAM,KAAK,QAAQ,KACnC,GAAG,KAAK,aACR,YAAY,cAAc,KAAK,IAAI,CACrC;EACA,MAAM,KAAK,MAAM,MAAM,SAAS;CAClC;CAEA,MAAM,UACJ,MACA,QACA,UAAmC,CAAC,GACrB;EACf,MAAM,aAAa,EAAE,KAAK;EAC1B,MAAM,EAAE,eAAe;EAEvB,MAAM,UACJ,eAAe,KAAA,IACX,KAAA,IACA,MAAM,KAAK,QAAQ,KAAK,GAAG,KAAK,WAAW,YACzC,KAAK,IAAI,GAAG,KAAK,MAAM,aAAa,KAAK,IAAI,KAAK,GAAI,CAAC,CACzD;EACN,MAAM,CAAC,SAAS,cAAc,MAAM,KAAK,QAAQ,eAC/C,GAAG,KAAK,YACR,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CACtD;EACA,MAAM,WAAW,KAAK;EACtB,KAAK,QAAQ;GAAE;GAAS;GAAY;GAAY,SAAS;EAAM;EAC/D,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GAGV,MAAM,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC;GAC3E,MAAM,KAAK,WAAW,YAAY,KAAK,YAAY;IACjD,IAAI;IACJ;IACA,YAAY;GACd,CAAC;GACD,IAAI,aAAa,KAAA,KAAa,CAAC,SAAS,SACtC,MAAM,KAAK,OAAO,iBAAiB,SAAS,YAAY,IAAI;EAEhE,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,aAAa,KAAA,GAAW,SAAS,UAAU;CACjD;CAEA,MAAM,YAAY,MAA6B;EAC7C,MAAM,QAAQ,KAAK;EACnB,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GACV,MAAM,KAAK,MAAM,YAAY,KAAK,UAAU;GAC5C,IAAI,UAAU,KAAA,GAAW;GACzB,MAAM,KAAK,WAAW,cAAc,KAAK,YAAY,MAAM,UAAU;GAGrE,IAAI,CAAC,MAAM,SAAS,MAAM,KAAK,OAAO,iBAAiB,MAAM,YAAY,IAAI;EAC/E,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,UAAU,KAAA,GAAW,MAAM,UAAU;EACzC,KAAK,QAAQ,KAAA;CACf;CAEA,MAAM,YAAY,MAAc,YAAkD;EAChF,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,gBAAgB,KAAK,mDAAmD;EAE1F,IAAI;GACF,MAAM,MAAM;GACZ,OAAO;EACT,SAAS,OAAO;GAEd,IAAI,iBAAiB,sBAAsB,OAAO;GAClD,MAAM;EACR,UAAU;GACR,MAAM,UAAU;EAClB;CACF;AACF"}
+{"version":3,"file":"engine-step.mjs","names":[],"sources":["../../src/aws/engine-step.ts"],"sourcesContent":["import {\n  CallbackTimeoutError,\n  type DurableContext,\n  type DurablePromise,\n  type RetryDecision,\n} from '@aws/durable-execution-sdk-js';\nimport type { EngineStep } from '../engine/ports';\nimport { isRetryable } from '../engine/retry';\nimport type { ExecutionRegistry, JourneyStore } from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * EngineStep over a Lambda durable execution.\n *\n * Steps, sleeps and wakes map onto the SDK's `step`, `wait` and callbacks. A wake handle is a\n * callback, which is one-shot, so every wait arms a fresh one (the interpreter subscribes on\n * every attempt): created where the durable context allows it — outside any step, so its id\n * replays — then recorded in Postgres together with the subscription rows, numbered by a\n * generation so a late wake or cleanup of an older wait cannot touch a newer one. The callback\n * is only a hint; the facts the wait re-checks are Postgres'.\n */\n\n/** What the step retries, bounded: 6 attempts with exponential backoff up to a minute. */\nexport function stepRetry(error: Error, attempt: number): RetryDecision {\n  if (!isRetryable(error) || attempt >= 6) return { shouldRetry: false };\n  return { shouldRetry: true, delay: { seconds: Math.min(60, 2 ** attempt) } };\n}\n\ninterface Armed {\n  promise: DurablePromise<string>;\n  callbackId: string;\n  generation: number;\n  /** The wait consumed it (woken or timed out): there is nothing left to close. */\n  settled: boolean;\n}\n\nexport class AwsEngineStep implements EngineStep {\n  private generation = 0;\n  private armed: Armed | undefined;\n\n  constructor(\n    private readonly context: DurableContext,\n    private readonly store: JourneyStore,\n    private readonly executions: ExecutionRegistry,\n    private readonly lambda: LambdaApi,\n    private readonly userId: string,\n    private readonly instanceId: string\n  ) {}\n\n  do<T>(name: string, fn: () => Promise<T>): Promise<T> {\n    return this.context.step(name, () => fn(), { retryStrategy: stepRetry });\n  }\n\n  async sleep(name: string, ms: number): Promise<void> {\n    // A wait is whole seconds: rounded up, so it never ends early; nothing to wait at zero\n    if (!(ms > 0)) return;\n    await this.context.wait(name, { seconds: Math.ceil(ms / 1000) });\n  }\n\n  async subscribe(\n    name: string,\n    events: readonly string[],\n    options: { deadlineMs?: number } = {}\n  ): Promise<void> {\n    const generation = ++this.generation;\n    const { deadlineMs } = options;\n    // The callback's own timeout is the wait's deadline: fixed when it is created\n    const seconds =\n      deadlineMs === undefined\n        ? undefined\n        : await this.context.step(`${name}:timeout`, async () =>\n            Math.max(1, Math.ceil((deadlineMs - Date.now()) / 1000))\n          );\n    const [promise, callbackId] = await this.context.createCallback(\n      `${name}:callback`,\n      seconds === undefined ? {} : { timeout: { seconds } }\n    );\n    const previous = this.armed;\n    this.armed = { promise, callbackId, generation, settled: false };\n    await this.context.step(\n      name,\n      async () => {\n        // Rows first, then the callback: a wake that lands in between finds the rows and the\n        // callback of the last wait — its completion is refused, and this wait checks the facts\n        await this.store.subscribe(this.instanceId, this.userId, events, Date.now());\n        await this.executions.armCallback(this.instanceId, {\n          id: callbackId,\n          generation,\n          deadlineAt: deadlineMs,\n        });\n        if (previous !== undefined && !previous.settled) {\n          await this.lambda.completeCallback(previous.callbackId, '{}');\n        }\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (previous !== undefined) previous.settled = true;\n  }\n\n  async unsubscribe(name: string): Promise<void> {\n    const armed = this.armed;\n    await this.context.step(\n      name,\n      async () => {\n        await this.store.unsubscribe(this.instanceId);\n        if (armed === undefined) return;\n        await this.executions.clearCallback(this.instanceId, armed.generation);\n        // The condition held before the wait parked: its callback is closed through the public\n        // API (a closed one answers false), rather than left open until it times out\n        if (!armed.settled) await this.lambda.completeCallback(armed.callbackId, '{}');\n      },\n      { retryStrategy: stepRetry }\n    );\n    if (armed !== undefined) armed.settled = true;\n    this.armed = undefined;\n  }\n\n  /**\n   * The timeout is ignored on purpose: the callback's own timeout was set from the deadline\n   * when it was armed (`subscribe`), and only its expiry says the wait timed out.\n   */\n  async waitForWake(\n    name: string,\n    _wait: { timeoutMs: number; deadlineMs: number }\n  ): Promise<'event' | 'timeout'> {\n    const armed = this.armed;\n    if (armed === undefined) {\n      throw new Error(`waitForWake '${name}' without a subscribe: nothing is armed to wake it`);\n    }\n    try {\n      await armed.promise;\n      return 'event';\n    } catch (error) {\n      // Only the callback's own expiry is a timeout; any other failure is a failure\n      if (error instanceof CallbackTimeoutError) return 'timeout';\n      throw error;\n    } finally {\n      armed.settled = true;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAuBA,SAAgB,UAAU,OAAc,SAAgC;CACtE,IAAI,CAAC,YAAY,KAAK,KAAK,WAAW,GAAG,OAAO,EAAE,aAAa,MAAM;CACrE,OAAO;EAAE,aAAa;EAAM,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE;CAAE;AAC7E;AAUA,IAAa,gBAAb,MAAiD;CAK5B;CACA;CACA;CACA;CACA;CACA;CATnB,aAAqB;CACrB;CAEA,YACE,SACA,OACA,YACA,QACA,QACA,YACA;EANiB,KAAA,UAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;EACA,KAAA,SAAA;EACA,KAAA,SAAA;EACA,KAAA,aAAA;CAChB;CAEH,GAAM,MAAc,IAAkC;EACpD,OAAO,KAAK,QAAQ,KAAK,YAAY,GAAG,GAAG,EAAE,eAAe,UAAU,CAAC;CACzE;CAEA,MAAM,MAAM,MAAc,IAA2B;EAEnD,IAAI,EAAE,KAAK,IAAI;EACf,MAAM,KAAK,QAAQ,KAAK,MAAM,EAAE,SAAS,KAAK,KAAK,KAAK,GAAI,EAAE,CAAC;CACjE;CAEA,MAAM,UACJ,MACA,QACA,UAAmC,CAAC,GACrB;EACf,MAAM,aAAa,EAAE,KAAK;EAC1B,MAAM,EAAE,eAAe;EAEvB,MAAM,UACJ,eAAe,KAAA,IACX,KAAA,IACA,MAAM,KAAK,QAAQ,KAAK,GAAG,KAAK,WAAW,YACzC,KAAK,IAAI,GAAG,KAAK,MAAM,aAAa,KAAK,IAAI,KAAK,GAAI,CAAC,CACzD;EACN,MAAM,CAAC,SAAS,cAAc,MAAM,KAAK,QAAQ,eAC/C,GAAG,KAAK,YACR,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CACtD;EACA,MAAM,WAAW,KAAK;EACtB,KAAK,QAAQ;GAAE;GAAS;GAAY;GAAY,SAAS;EAAM;EAC/D,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GAGV,MAAM,KAAK,MAAM,UAAU,KAAK,YAAY,KAAK,QAAQ,QAAQ,KAAK,IAAI,CAAC;GAC3E,MAAM,KAAK,WAAW,YAAY,KAAK,YAAY;IACjD,IAAI;IACJ;IACA,YAAY;GACd,CAAC;GACD,IAAI,aAAa,KAAA,KAAa,CAAC,SAAS,SACtC,MAAM,KAAK,OAAO,iBAAiB,SAAS,YAAY,IAAI;EAEhE,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,aAAa,KAAA,GAAW,SAAS,UAAU;CACjD;CAEA,MAAM,YAAY,MAA6B;EAC7C,MAAM,QAAQ,KAAK;EACnB,MAAM,KAAK,QAAQ,KACjB,MACA,YAAY;GACV,MAAM,KAAK,MAAM,YAAY,KAAK,UAAU;GAC5C,IAAI,UAAU,KAAA,GAAW;GACzB,MAAM,KAAK,WAAW,cAAc,KAAK,YAAY,MAAM,UAAU;GAGrE,IAAI,CAAC,MAAM,SAAS,MAAM,KAAK,OAAO,iBAAiB,MAAM,YAAY,IAAI;EAC/E,GACA,EAAE,eAAe,UAAU,CAC7B;EACA,IAAI,UAAU,KAAA,GAAW,MAAM,UAAU;EACzC,KAAK,QAAQ,KAAA;CACf;;;;;CAMA,MAAM,YACJ,MACA,OAC8B;EAC9B,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,gBAAgB,KAAK,mDAAmD;EAE1F,IAAI;GACF,MAAM,MAAM;GACZ,OAAO;EACT,SAAS,OAAO;GAEd,IAAI,iBAAiB,sBAAsB,OAAO;GAClD,MAAM;EACR,UAAU;GACR,MAAM,UAAU;EAClB;CACF;AACF"}

package/dist/aws/index.cjs

@@ -1,9 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_http2_client = require("../http2-client.cjs");
+const require_engine_retry = require("../engine/retry.cjs");
 const require_aws_engine_step = require("./engine-step.cjs");
 const require_aws_function_url = require("./function-url.cjs");
 const require_engine_duration = require("../engine/duration.cjs");
-const require_host_router = require("../host/router.cjs");
+const require_host_fresh_read = require("../host/fresh-read.cjs");
+const require_host_ingest = require("../host/ingest.cjs");
 const require_host_execute = require("../host/execute.cjs");
 const require_host_journey_host = require("../host/journey-host.cjs");
 const require_aws_instances = require("./instances.cjs");
@@ -100,6 +102,11 @@ function journeyLambda(options) {
 	const run = async (input, context) => {
 		const { store, env, executions } = open(context);
 		const { instanceId, params } = input;
+		const record = await require_host_fresh_read.readWithRetry(() => executions.get(instanceId), {
+			what: "run entry",
+			instanceId
+		});
+		if (record === void 0 || record.stoppedAt !== void 0 || record.input !== JSON.stringify(input)) throw new require_engine_retry.PermanentError("journeyLambda: run input is not a recorded start");
 		await context.step("$workflow:started", async () => {
 			await executions.markSubmitted(instanceId, context.executionContext.durableExecutionArn, Date.now());
 		});
@@ -128,11 +135,45 @@ function journeyLambda(options) {
 		if (method === "GET" || method === "HEAD") return serve();
 		return context.step("http", serve, { retryStrategy: () => ({ shouldRetry: false }) });
 	};
-	const sweep = (context) => context.step("sweep", async () => {
-		const { store, env } = open(context);
-		await host.applyOwnBundle(env, bundleVersion());
-		return require_host_router.sweepSegments(env, store);
-	}, { retryStrategy: () => ({ shouldRetry: false }) });
+	/**
+	* The sweep as durable steps, one per page of users: an invocation cut short (the function's
+	* timeout) is re-invoked, and the re-invocation replays the pages already checkpointed
+	* instead of evaluating everyone again. No step retries on its own — a page that failed is
+	* evaluated again by the next tick.
+	*/
+	const sweep = async (context) => {
+		const once = { retryStrategy: () => ({ shouldRetry: false }) };
+		await context.step("sweep:maintain", async () => {
+			const { store, env } = open(context);
+			await host.applyOwnBundle(env, bundleVersion());
+			await require_host_ingest.sweepMaintenance(env, store);
+		}, once);
+		let users = 0;
+		const started = [];
+		let after;
+		for (let n = 0;; n++) {
+			const page = await context.step(`sweep:page:${n}`, async () => {
+				const { store, env } = open(context);
+				return require_host_ingest.sweepSegmentsPaged(env, store, {
+					after,
+					limit: 500
+				});
+			}, once);
+			users += page.users;
+			started.push(...page.started);
+			if (!page.more || page.lastUserId === void 0) break;
+			after = page.lastUserId;
+		}
+		const sizes = await context.step("sweep:snapshot", async () => {
+			const { store } = open(context);
+			return await store.reporting?.snapshotSegments(Date.now()) ?? [];
+		}, once);
+		return {
+			users,
+			started,
+			sizes
+		};
+	};
 	const durable = (0, _aws_durable_execution_sdk_js.withDurableExecution)(async (input, context) => {
 		if (require_aws_function_url.isFunctionUrlEvent(input)) return http(input, context);
 		if (require_aws_instances.isRunInput(input)) return run(input, context);