@shware/workflow 3.3.0 → 4.1.0

package/dist/host/channels.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_engine_retry = require("../engine/retry.cjs");
 const require_apns = require("../apns.cjs");
 const require_templates = require("../templates.cjs");
 const require_config = require("../config.cjs");
@@ -9,7 +10,7 @@ const require_push = require("../push.cjs");
 const require_react_email = require("../react-email.cjs");
 const require_webhooks = require("../webhooks.cjs");
 const require_webpush = require("../webpush.cjs");
-const require_host_router = require("./router.cjs");
+const require_host_ingest = require("./ingest.cjs");
 const require_host_senders = require("./senders.cjs");
 //#region src/host/channels.ts
 /**
@@ -30,31 +31,63 @@ function journeyMode(env) {
 function runtimeFromConfig(config, env) {
 	return require_runtime.resolveRuntime(config?.runtime, journeyMode(env));
 }
-/** A sender that fails every message with the reason the channel cannot deliver. */
+/**
+* A sender that fails every message with the reason the channel cannot deliver — for good: the
+* configuration is the same on every attempt, so the step does not retry into it.
+*/
 function unavailable(reason) {
 	return { async send(message) {
-		throw new Error(`cannot send '${message.template}' on ${message.channel}: ${reason}`);
+		throw new require_engine_retry.PermanentError(`cannot send '${message.template}' on ${message.channel}: ${reason}`);
 	} };
 }
 function requireSecret(env, name) {
 	const value = env[name];
-	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} is not set: the environment must hold it for the configured channel`);
+	if (typeof value !== "string" || value.length === 0) throw new require_engine_retry.PermanentError(`${name} is not set: the environment must hold it for the configured channel`);
 	return value;
 }
+function createProviderCache() {
+	const credentials = /* @__PURE__ */ new Map();
+	return { get(key, build) {
+		if (!credentials.has(key)) credentials.set(key, build());
+		return credentials.get(key);
+	} };
+}
+/** A number for each fetch implementation, so a credential minted through one is not reused with another. */
+const identities = /* @__PURE__ */ new WeakMap();
+let nextIdentity = 1;
+function identity(value) {
+	if (value === void 0) return "global";
+	let id = identities.get(value);
+	if (id === void 0) {
+		id = nextIdentity++;
+		identities.set(value, id);
+	}
+	return String(id);
+}
+/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */
+async function secretDigest(secret) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
+	return Array.from(new Uint8Array(digest).slice(0, 4), (b) => b.toString(16).padStart(2, "0")).join("");
+}
 /**
-* A sender built on its first message. A platform's secret is only required
-* when something is actually sent there: a journey that only emails must not
-* fail because the APNs key is missing from a local `.dev.vars`.
+* A sender built on its first message, then kept for this call. `build` reads the secrets (and
+* so may throw a `PermanentError` naming the missing variable): a platform's secret is only
+* required when something is actually sent there, so a journey that only emails must not fail
+* because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.
 */
 function lazy(build) {
 	let sender;
 	return { async send(message) {
-		sender ??= build();
-		return sender.send(message);
+		sender ??= build().catch((error) => {
+			sender = void 0;
+			throw error;
+		});
+		return (await sender).send(message);
 	} };
 }
 function channelsFromConfig(config, env, options = {}) {
 	const mode = journeyMode(env);
+	const providers = options.providers ?? createProviderCache();
 	const email = () => {
 		const registry = config.templates?.email;
 		if (registry === void 0) return unavailable("no email templates are registered");
@@ -69,41 +102,85 @@ function channelsFromConfig(config, env, options = {}) {
 		const registry = config.templates?.push;
 		if (registry === void 0) return unavailable("no push templates are registered");
 		const render = require_push.registryPushRenderer(registry);
-		const onUnregistered = async (message) => {
-			if (message.device !== void 0 && options.store !== void 0) await require_host_router.removeDevice(env, message.device.token, options.store);
-		};
+		/**
+		* A token the provider reports as gone is forgotten (nothing left to deliver to), waking the
+		* waits that read devices, as a removal through the API does. Done here, per run, on the
+		* settled result, so the credential cached across runs (see `ProviderCache`) never holds a
+		* run's store.
+		*/
+		const dropDeadTokens = (provider, deadTokenReasons) => ({ async send(message) {
+			const result = await provider.send(message);
+			if (result !== void 0 && deadTokenReasons.has(result.reason) && message.device !== void 0 && options.store !== void 0) await require_host_ingest.removeDevice(env, message.device.token, options.store);
+			return result;
+		} });
 		const platforms = {};
 		const apns = config.apns;
-		if (apns !== void 0) platforms.ios = lazy(() => new require_apns.ApnsPushSender({
-			keyId: apns.keyId,
-			teamId: apns.teamId,
-			privateKey: require_apns.apnsKeyFromBase64(requireSecret(env, "APNS_PRIVATE_KEY_BASE64")),
-			topic: apns.topic,
-			environment: require_config.apnsEnvironment(apns, mode),
-			render,
-			onUnregistered,
-			...env.APNS_RELAY_ORIGIN === void 0 ? {} : { origin: env.APNS_RELAY_ORIGIN },
-			...(options.apnsFetch ?? options.fetch) === void 0 ? {} : { fetch: options.apnsFetch ?? options.fetch }
-		}));
+		if (apns !== void 0) {
+			const apnsFetch = options.apnsFetch ?? options.fetch;
+			const environment = require_config.apnsEnvironment(apns, mode);
+			platforms.ios = dropDeadTokens(lazy(async () => {
+				const secret = requireSecret(env, "APNS_PRIVATE_KEY_BASE64");
+				const credentials = providers.get(JSON.stringify([
+					"apns",
+					apns.keyId,
+					apns.teamId,
+					await secretDigest(secret)
+				]), () => new require_apns.ApnsProviderToken({
+					keyId: apns.keyId,
+					teamId: apns.teamId,
+					privateKey: require_apns.apnsKeyFromBase64(secret)
+				}));
+				return new require_apns.ApnsPushSender({
+					credentials,
+					topic: apns.topic,
+					environment,
+					render,
+					...env.APNS_RELAY_ORIGIN === void 0 ? {} : { origin: env.APNS_RELAY_ORIGIN },
+					...apnsFetch === void 0 ? {} : { fetch: apnsFetch }
+				});
+			}), require_apns.DEAD_TOKEN_REASONS);
+		}
 		const fcm = config.fcm;
-		if (fcm !== void 0) platforms.android = lazy(() => new require_fcm.FcmPushSender({
-			serviceAccount: require_fcm.serviceAccountFromBase64(requireSecret(env, "GOOGLE_APPLICATION_CREDENTIALS_BASE64")),
-			render,
-			onUnregistered,
-			...fcm.androidChannelId === void 0 ? {} : { android: { channel_id: fcm.androidChannelId } },
-			...options.fetch === void 0 ? {} : { fetch: options.fetch }
-		}));
+		if (fcm !== void 0) platforms.android = dropDeadTokens(lazy(async () => {
+			const secret = requireSecret(env, "GOOGLE_APPLICATION_CREDENTIALS_BASE64");
+			const serviceAccount = require_fcm.serviceAccountFromBase64(secret);
+			const credentials = providers.get(JSON.stringify([
+				"fcm",
+				serviceAccount.client_email,
+				serviceAccount.project_id,
+				identity(options.fetch),
+				await secretDigest(secret)
+			]), () => new require_fcm.FcmAccessToken({
+				serviceAccount,
+				...options.fetch === void 0 ? {} : { fetch: options.fetch }
+			}));
+			return new require_fcm.FcmPushSender({
+				credentials,
+				render,
+				...fcm.androidChannelId === void 0 ? {} : { android: { channel_id: fcm.androidChannelId } },
+				...options.fetch === void 0 ? {} : { fetch: options.fetch }
+			});
+		}), require_fcm.DEAD_TOKEN_REASONS);
 		const webPush = config.webPush;
-		if (webPush !== void 0) platforms.web = lazy(() => new require_webpush.WebPushSender({
-			vapid: {
+		if (webPush !== void 0) platforms.web = dropDeadTokens(lazy(async () => {
+			const publicKey = requireSecret(env, "VAPID_PUBLIC_KEY");
+			const privateKey = requireSecret(env, "VAPID_PRIVATE_KEY");
+			const credentials = providers.get(JSON.stringify([
+				"vapid",
+				webPush.subject,
+				publicKey,
+				await secretDigest(privateKey)
+			]), () => new require_webpush.VapidSigner({
 				subject: webPush.subject,
-				publicKey: requireSecret(env, "VAPID_PUBLIC_KEY"),
-				privateKey: requireSecret(env, "VAPID_PRIVATE_KEY")
-			},
-			render,
-			onUnregistered,
-			...options.fetch === void 0 ? {} : { fetch: options.fetch }
-		}));
+				publicKey,
+				privateKey
+			}));
+			return new require_webpush.WebPushSender({
+				credentials,
+				render,
+				...options.fetch === void 0 ? {} : { fetch: options.fetch }
+			});
+		}), require_webpush.DEAD_TOKEN_REASONS);
 		if (Object.keys(platforms).length === 0) return unavailable("none of apns, fcm or webPush is configured");
 		return require_host_senders.routeByPlatform(platforms);
 	};
@@ -113,7 +190,7 @@ function channelsFromConfig(config, env, options = {}) {
 	*/
 	const webhookUrl = (channel, template) => {
 		const url = template.webhook(env);
-		if (typeof url !== "string" || url === "") throw new Error(`${channel} template '${template.id}': its webhook URL is not set in the environment`);
+		if (typeof url !== "string" || url === "") throw new require_engine_retry.PermanentError(`${channel} template '${template.id}': its webhook URL is not set in the environment`);
 		return url;
 	};
 	const discord = () => {
@@ -155,6 +232,7 @@ function channelsFromConfig(config, env, options = {}) {
 }
 //#endregion
 exports.channelsFromConfig = channelsFromConfig;
+exports.createProviderCache = createProviderCache;
 exports.journeyMode = journeyMode;
 exports.runtimeFromConfig = runtimeFromConfig;
 

package/dist/host/channels.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"channels.cjs","names":["resolveRuntime","EmailSender","registryRenderer","registryPushRenderer","removeDevice","ApnsPushSender","apnsKeyFromBase64","apnsEnvironment","FcmPushSender","serviceAccountFromBase64","WebPushSender","routeByPlatform","indexTemplates","DiscordWebhookSender","lookupTemplate","renderDiscordContent","SlackWebhookSender","renderSlackContent","routeByChannel"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import { ApnsPushSender, apnsKeyFromBase64 } from '../apns';\nimport type { JourneyEnv } from '../cloudflare/bindings';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender, OutboundMessage } from '../engine/ports';\nimport { FcmPushSender, serviceAccountFromBase64 } from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport { WebPushSender } from '../webpush';\nimport { removeDevice } from './router';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/** A sender that fails every message with the reason the channel cannot deliver. */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new Error(`cannot send '${message.template}' on ${message.channel}: ${reason}`);\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    throw new Error(`${name} is not set: the environment must hold it for the configured channel`);\n  }\n  return value;\n}\n\n/**\n * A sender built on its first message. A platform's secret is only required\n * when something is actually sent there: a journey that only emails must not\n * fail because the APNs key is missing from a local `.dev.vars`.\n */\nfunction lazy(build: () => MessageSender): MessageSender {\n  let sender: MessageSender | undefined;\n  return {\n    async send(message) {\n      sender ??= build();\n      return sender.send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    // A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n    // waits that read devices, as a removal through the API does\n    const onUnregistered = async (message: OutboundMessage) => {\n      if (message.device !== undefined && options.store !== undefined) {\n        await removeDevice(env, message.device.token, options.store);\n      }\n    };\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      platforms.ios = lazy(\n        () =>\n          new ApnsPushSender({\n            keyId: apns.keyId,\n            teamId: apns.teamId,\n            privateKey: apnsKeyFromBase64(requireSecret(env, 'APNS_PRIVATE_KEY_BASE64')),\n            topic: apns.topic,\n            environment: apnsEnvironment(apns, mode),\n            render,\n            onUnregistered,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...((options.apnsFetch ?? options.fetch) === undefined\n              ? {}\n              : { fetch: options.apnsFetch ?? options.fetch }),\n          })\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = lazy(\n        () =>\n          new FcmPushSender({\n            serviceAccount: serviceAccountFromBase64(\n              requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64')\n            ),\n            render,\n            onUnregistered,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = lazy(\n        () =>\n          new WebPushSender({\n            vapid: {\n              subject: webPush.subject,\n              publicKey: requireSecret(env, 'VAPID_PUBLIC_KEY'),\n              privateKey: requireSecret(env, 'VAPID_PRIVATE_KEY'),\n            },\n            render,\n            onUnregistered,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          })\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new Error(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAOA,gBAAAA,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;AAGA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAI,MAAM,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAAQ;CACtF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAChD,MAAM,IAAI,MAAM,GAAG,KAAK,qEAAqE;CAE/F,OAAO;AACT;;;;;;AAOA,SAAS,KAAK,OAA2C;CACvD,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM;EACjB,OAAO,OAAO,KAAK,OAAO;CAC5B,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAQI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAE5B,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAIC,qBAAAA,YAAY;GAAE;GAAW,QAAQC,oBAAAA,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAASC,aAAAA,qBAAqB,QAAQ;EAG5C,MAAM,iBAAiB,OAAO,YAA6B;GACzD,IAAI,QAAQ,WAAW,KAAA,KAAa,QAAQ,UAAU,KAAA,GACpD,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;EAE/D;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GACX,UAAU,MAAM,WAEZ,IAAIC,aAAAA,eAAe;GACjB,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,YAAYC,aAAAA,kBAAkB,cAAc,KAAK,yBAAyB,CAAC;GAC3E,OAAO,KAAK;GACZ,aAAaC,eAAAA,gBAAgB,MAAM,IAAI;GACvC;GACA;GACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;GAC/E,IAAK,QAAQ,aAAa,QAAQ,WAAW,KAAA,IACzC,CAAC,IACD,EAAE,OAAO,QAAQ,aAAa,QAAQ,MAAM;EAClD,CAAC,CACL;EAEF,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,WAEhB,IAAIC,YAAAA,cAAc;GAChB,gBAAgBC,YAAAA,yBACd,cAAc,KAAK,uCAAuC,CAC5D;GACA;GACA;GACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;GACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,WAEZ,IAAIC,gBAAAA,cAAc;GAChB,OAAO;IACL,SAAS,QAAQ;IACjB,WAAW,cAAc,KAAK,kBAAkB;IAChD,YAAY,cAAc,KAAK,mBAAmB;GACpD;GACA;GACA;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC,CACL;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAOC,qBAAAA,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAI,MACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQC,kBAAAA,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAIC,iBAAAA,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWC,kBAAAA,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAASC,kBAAAA,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQH,kBAAAA,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAII,iBAAAA,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWF,kBAAAA,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAASG,kBAAAA,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAOC,qBAAAA,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}
+{"version":3,"file":"channels.cjs","names":["resolveRuntime","PermanentError","EmailSender","registryRenderer","registryPushRenderer","removeDevice","apnsEnvironment","ApnsProviderToken","apnsKeyFromBase64","ApnsPushSender","APNS_DEAD_TOKEN_REASONS","serviceAccountFromBase64","FcmAccessToken","FcmPushSender","FCM_DEAD_TOKEN_REASONS","VapidSigner","WebPushSender","WEB_PUSH_DEAD_TOKEN_REASONS","routeByPlatform","indexTemplates","DiscordWebhookSender","lookupTemplate","renderDiscordContent","SlackWebhookSender","renderSlackContent","routeByChannel"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import {\n  DEAD_TOKEN_REASONS as APNS_DEAD_TOKEN_REASONS,\n  ApnsProviderToken,\n  ApnsPushSender,\n  apnsKeyFromBase64,\n} from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender } from '../engine/ports';\nimport { PermanentError } from '../engine/retry';\nimport {\n  DEAD_TOKEN_REASONS as FCM_DEAD_TOKEN_REASONS,\n  FcmAccessToken,\n  FcmPushSender,\n  serviceAccountFromBase64,\n} from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport {\n  VapidSigner,\n  DEAD_TOKEN_REASONS as WEB_PUSH_DEAD_TOKEN_REASONS,\n  WebPushSender,\n} from '../webpush';\nimport { removeDevice } from './ingest';\nimport type { JourneyEnv } from './platform';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/**\n * A sender that fails every message with the reason the channel cannot deliver — for good: the\n * configuration is the same on every attempt, so the step does not retry into it.\n */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new PermanentError(\n        `cannot send '${message.template}' on ${message.channel}: ${reason}`\n      );\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    // Missing on this attempt, missing on the next: the deployment has to change, not the step\n    throw new PermanentError(\n      `${name} is not set: the environment must hold it for the configured channel`\n    );\n  }\n  return value;\n}\n\n/**\n * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long\n * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every\n * instance) and builds the senders anew each time; what must outlive the run is the credential\n * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a\n * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access\n * token is good for an hour, the VAPID key import is wasted work twice.\n *\n * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the\n * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is\n * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,\n * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded\n * host mints a new credential instead of reusing the old, and the secret itself is in no key and\n * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:\n * the sender is built per call around the shared credential.\n */\nexport interface ProviderCache {\n  /** The credential under `key`, built on the first call and returned as is after that. */\n  get<T>(key: string, build: () => T): T;\n}\n\nexport function createProviderCache(): ProviderCache {\n  const credentials = new Map<string, unknown>();\n  return {\n    get<T>(key: string, build: () => T): T {\n      if (!credentials.has(key)) credentials.set(key, build());\n      return credentials.get(key) as T;\n    },\n  };\n}\n\n/** A number for each fetch implementation, so a credential minted through one is not reused with another. */\nconst identities = new WeakMap<object, number>();\nlet nextIdentity = 1;\nfunction identity(value: object | undefined): string {\n  if (value === undefined) return 'global';\n  let id = identities.get(value);\n  if (id === undefined) {\n    id = nextIdentity++;\n    identities.set(value, id);\n  }\n  return String(id);\n}\n\n/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */\nasync function secretDigest(secret: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return Array.from(new Uint8Array(digest).slice(0, 4), (b) =>\n    b.toString(16).padStart(2, '0')\n  ).join('');\n}\n\n/**\n * A sender built on its first message, then kept for this call. `build` reads the secrets (and\n * so may throw a `PermanentError` naming the missing variable): a platform's secret is only\n * required when something is actually sent there, so a journey that only emails must not fail\n * because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.\n */\nfunction lazy(build: () => Promise<MessageSender>): MessageSender {\n  let sender: Promise<MessageSender> | undefined;\n  return {\n    async send(message) {\n      sender ??= build().catch((error: unknown) => {\n        sender = undefined;\n        throw error;\n      });\n      return (await sender).send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n    /**\n     * Where the provider credentials live across runs (`createProviderCache`): the host's, made\n     * once with it. Without one, this call's credentials are its own — nothing is reused.\n     */\n    providers?: ProviderCache | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n  const providers = options.providers ?? createProviderCache();\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    /**\n     * A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n     * waits that read devices, as a removal through the API does. Done here, per run, on the\n     * settled result, so the credential cached across runs (see `ProviderCache`) never holds a\n     * run's store.\n     */\n    const dropDeadTokens = (\n      provider: MessageSender,\n      deadTokenReasons: ReadonlySet<string>\n    ): MessageSender => ({\n      async send(message) {\n        const result = await provider.send(message);\n        if (\n          result !== undefined &&\n          deadTokenReasons.has(result.reason) &&\n          message.device !== undefined &&\n          options.store !== undefined\n        ) {\n          await removeDevice(env, message.device.token, options.store);\n        }\n        return result;\n      },\n    });\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      const apnsFetch = options.apnsFetch ?? options.fetch;\n      const environment = apnsEnvironment(apns, mode);\n      platforms.ios = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'APNS_PRIVATE_KEY_BASE64');\n          const credentials = providers.get(\n            JSON.stringify(['apns', apns.keyId, apns.teamId, await secretDigest(secret)]),\n            () =>\n              new ApnsProviderToken({\n                keyId: apns.keyId,\n                teamId: apns.teamId,\n                privateKey: apnsKeyFromBase64(secret),\n              })\n          );\n          return new ApnsPushSender({\n            credentials,\n            topic: apns.topic,\n            environment,\n            render,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...(apnsFetch === undefined ? {} : { fetch: apnsFetch }),\n          });\n        }),\n        APNS_DEAD_TOKEN_REASONS\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64');\n          const serviceAccount = serviceAccountFromBase64(secret);\n          // The token endpoint is called through the fetch: another fetch is another credential\n          const credentials = providers.get(\n            JSON.stringify([\n              'fcm',\n              serviceAccount.client_email,\n              serviceAccount.project_id,\n              identity(options.fetch),\n              await secretDigest(secret),\n            ]),\n            () =>\n              new FcmAccessToken({\n                serviceAccount,\n                ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n              })\n          );\n          return new FcmPushSender({\n            credentials,\n            render,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        FCM_DEAD_TOKEN_REASONS\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = dropDeadTokens(\n        lazy(async () => {\n          const publicKey = requireSecret(env, 'VAPID_PUBLIC_KEY');\n          const privateKey = requireSecret(env, 'VAPID_PRIVATE_KEY');\n          const credentials = providers.get(\n            JSON.stringify(['vapid', webPush.subject, publicKey, await secretDigest(privateKey)]),\n            () => new VapidSigner({ subject: webPush.subject, publicKey, privateKey })\n          );\n          return new WebPushSender({\n            credentials,\n            render,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        WEB_PUSH_DEAD_TOKEN_REASONS\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new PermanentError(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAOA,gBAAAA,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;;;;AAMA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAIC,qBAAAA,eACR,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAC9D;CACF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAEhD,MAAM,IAAIA,qBAAAA,eACR,GAAG,KAAK,qEACV;CAEF,OAAO;AACT;AAuBA,SAAgB,sBAAqC;CACnD,MAAM,8BAAc,IAAI,IAAqB;CAC7C,OAAO,EACL,IAAO,KAAa,OAAmB;EACrC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,MAAM,CAAC;EACvD,OAAO,YAAY,IAAI,GAAG;CAC5B,EACF;AACF;;AAGA,MAAM,6BAAa,IAAI,QAAwB;AAC/C,IAAI,eAAe;AACnB,SAAS,SAAS,OAAmC;CACnD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,KAAK,WAAW,IAAI,KAAK;CAC7B,IAAI,OAAO,KAAA,GAAW;EACpB,KAAK;EACL,WAAW,IAAI,OAAO,EAAE;CAC1B;CACA,OAAO,OAAO,EAAE;AAClB;;AAGA,eAAe,aAAa,QAAiC;CAC3D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC;CACrF,OAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MACrD,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAChC,CAAC,CAAC,KAAK,EAAE;AACX;;;;;;;AAQA,SAAS,KAAK,OAAoD;CAChE,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC3C,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,QAAQ,MAAM,OAAA,CAAQ,KAAK,OAAO;CACpC,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAaI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,YAAY,QAAQ,aAAa,oBAAoB;CAE3D,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAIC,qBAAAA,YAAY;GAAE;GAAW,QAAQC,oBAAAA,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAASC,aAAAA,qBAAqB,QAAQ;;;;;;;EAO5C,MAAM,kBACJ,UACA,sBACmB,EACnB,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;GAC1C,IACE,WAAW,KAAA,KACX,iBAAiB,IAAI,OAAO,MAAM,KAClC,QAAQ,WAAW,KAAA,KACnB,QAAQ,UAAU,KAAA,GAElB,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;GAE7D,OAAO;EACT,EACF;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;GAC/C,MAAM,cAAcC,eAAAA,gBAAgB,MAAM,IAAI;GAC9C,UAAU,MAAM,eACd,KAAK,YAAY;IACf,MAAM,SAAS,cAAc,KAAK,yBAAyB;IAC3D,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;KAAC;KAAQ,KAAK;KAAO,KAAK;KAAQ,MAAM,aAAa,MAAM;IAAC,CAAC,SAE1E,IAAIC,aAAAA,kBAAkB;KACpB,OAAO,KAAK;KACZ,QAAQ,KAAK;KACb,YAAYC,aAAAA,kBAAkB,MAAM;IACtC,CAAC,CACL;IACA,OAAO,IAAIC,aAAAA,eAAe;KACxB;KACA,OAAO,KAAK;KACZ;KACA;KACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;KAC/E,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU;IACxD,CAAC;GACH,CAAC,GACDC,aAAAA,kBACF;EACF;EACA,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,eAClB,KAAK,YAAY;GACf,MAAM,SAAS,cAAc,KAAK,uCAAuC;GACzE,MAAM,iBAAiBC,YAAAA,yBAAyB,MAAM;GAEtD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IACb;IACA,eAAe;IACf,eAAe;IACf,SAAS,QAAQ,KAAK;IACtB,MAAM,aAAa,MAAM;GAC3B,CAAC,SAEC,IAAIC,YAAAA,eAAe;IACjB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC,CACL;GACA,OAAO,IAAIC,YAAAA,cAAc;IACvB;IACA;IACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;IACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,YAAAA,kBACF;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,eACd,KAAK,YAAY;GACf,MAAM,YAAY,cAAc,KAAK,kBAAkB;GACvD,MAAM,aAAa,cAAc,KAAK,mBAAmB;GACzD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IAAC;IAAS,QAAQ;IAAS;IAAW,MAAM,aAAa,UAAU;GAAC,CAAC,SAC9E,IAAIC,gBAAAA,YAAY;IAAE,SAAS,QAAQ;IAAS;IAAW;GAAW,CAAC,CAC3E;GACA,OAAO,IAAIC,gBAAAA,cAAc;IACvB;IACA;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,gBAAAA,kBACF;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAOC,qBAAAA,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAIjB,qBAAAA,eACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQkB,kBAAAA,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAIC,iBAAAA,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWC,kBAAAA,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAASC,kBAAAA,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQH,kBAAAA,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAII,iBAAAA,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWF,kBAAAA,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAASG,kBAAAA,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAOC,qBAAAA,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}

package/dist/host/channels.d.cts

@@ -1,5 +1,5 @@
 import { MessageSender } from "../engine/ports.cjs";
-import { JourneyEnv } from "../cloudflare/bindings.cjs";
+import { JourneyEnv } from "./platform.cjs";
 import { JourneyStore } from "../store/index.cjs";
 import { JourneyMode, JourneyRuntimeOptions } from "../runtime.cjs";
 import { JourneyConfig } from "../config.cjs";
@@ -19,6 +19,27 @@ import { EmailTransport } from "../email-sender.cjs";
 export declare function journeyMode(env: JourneyEnv): JourneyMode;
 /** The runtime options for this environment's mode. */
 export declare function runtimeFromConfig(config: Pick<JourneyConfig, 'runtime'> | undefined, env: JourneyEnv): Required<JourneyRuntimeOptions>;
+/**
+ * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long
+ * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every
+ * instance) and builds the senders anew each time; what must outlive the run is the credential
+ * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a
+ * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access
+ * token is good for an hour, the VAPID key import is wasted work twice.
+ *
+ * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the
+ * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is
+ * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,
+ * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded
+ * host mints a new credential instead of reusing the old, and the secret itself is in no key and
+ * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:
+ * the sender is built per call around the shared credential.
+ */
+export interface ProviderCache {
+  /** The credential under `key`, built on the first call and returned as is after that. */
+  get<T>(key: string, build: () => T): T;
+}
+export declare function createProviderCache(): ProviderCache;
 /** The channels slice of the config — what `channelsFromConfig` reads. */
 export type ChannelsConfig = Pick<JourneyConfig, 'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'>;
 export declare function channelsFromConfig(config: ChannelsConfig, env: JourneyEnv, options?: {
@@ -29,6 +50,11 @@ export declare function channelsFromConfig(config: ChannelsConfig, env: JourneyE
   fetch?: typeof fetch;
   /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */
   apnsFetch?: typeof fetch | undefined;
+  /**
+   * Where the provider credentials live across runs (`createProviderCache`): the host's, made
+   * once with it. Without one, this call's credentials are its own — nothing is reused.
+   */
+  providers?: ProviderCache | undefined;
 }): MessageSender;
 //#endregion
 //# sourceMappingURL=channels.d.cts.map

package/dist/host/channels.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.cts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAmCgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;YA4CA,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;IAEpB"}
+{"version":3,"file":"channels.d.cts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAkDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAmD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}

package/dist/host/channels.d.mts

@@ -1,5 +1,5 @@
 import { MessageSender } from "../engine/ports.mjs";
-import { JourneyEnv } from "../cloudflare/bindings.mjs";
+import { JourneyEnv } from "./platform.mjs";
 import { JourneyStore } from "../store/index.mjs";
 import { JourneyMode, JourneyRuntimeOptions } from "../runtime.mjs";
 import { JourneyConfig } from "../config.mjs";
@@ -19,6 +19,27 @@ import { EmailTransport } from "../email-sender.mjs";
 export declare function journeyMode(env: JourneyEnv): JourneyMode;
 /** The runtime options for this environment's mode. */
 export declare function runtimeFromConfig(config: Pick<JourneyConfig, 'runtime'> | undefined, env: JourneyEnv): Required<JourneyRuntimeOptions>;
+/**
+ * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long
+ * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every
+ * instance) and builds the senders anew each time; what must outlive the run is the credential
+ * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a
+ * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access
+ * token is good for an hour, the VAPID key import is wasted work twice.
+ *
+ * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the
+ * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is
+ * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,
+ * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded
+ * host mints a new credential instead of reusing the old, and the secret itself is in no key and
+ * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:
+ * the sender is built per call around the shared credential.
+ */
+export interface ProviderCache {
+  /** The credential under `key`, built on the first call and returned as is after that. */
+  get<T>(key: string, build: () => T): T;
+}
+export declare function createProviderCache(): ProviderCache;
 /** The channels slice of the config — what `channelsFromConfig` reads. */
 export type ChannelsConfig = Pick<JourneyConfig, 'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'>;
 export declare function channelsFromConfig(config: ChannelsConfig, env: JourneyEnv, options?: {
@@ -29,6 +50,11 @@ export declare function channelsFromConfig(config: ChannelsConfig, env: JourneyE
   fetch?: typeof fetch;
   /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */
   apnsFetch?: typeof fetch | undefined;
+  /**
+   * Where the provider credentials live across runs (`createProviderCache`): the host's, made
+   * once with it. Without one, this call's credentials are its own — nothing is reused.
+   */
+  providers?: ProviderCache | undefined;
 }): MessageSender;
 //#endregion
 //# sourceMappingURL=channels.d.mts.map

package/dist/host/channels.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.mts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAmCgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;YA4CA,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;IAEpB"}
+{"version":3,"file":"channels.d.mts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAkDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAmD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}

package/dist/host/channels.mjs

@@ -1,14 +1,15 @@
-import { ApnsPushSender, apnsKeyFromBase64 } from "../apns.mjs";
+import { PermanentError } from "../engine/retry.mjs";
+import { ApnsProviderToken, ApnsPushSender, DEAD_TOKEN_REASONS, apnsKeyFromBase64 } from "../apns.mjs";
 import { indexTemplates, lookupTemplate, renderDiscordContent, renderSlackContent } from "../templates.mjs";
 import { apnsEnvironment } from "../config.mjs";
 import { EmailSender } from "../email-sender.mjs";
-import { FcmPushSender, serviceAccountFromBase64 } from "../fcm.mjs";
+import { DEAD_TOKEN_REASONS as DEAD_TOKEN_REASONS$1, FcmAccessToken, FcmPushSender, serviceAccountFromBase64 } from "../fcm.mjs";
 import { resolveRuntime } from "../runtime.mjs";
 import { registryPushRenderer } from "../push.mjs";
 import { registryRenderer } from "../react-email.mjs";
 import { DiscordWebhookSender, SlackWebhookSender } from "../webhooks.mjs";
-import { WebPushSender } from "../webpush.mjs";
-import { removeDevice } from "./router.mjs";
+import { DEAD_TOKEN_REASONS as DEAD_TOKEN_REASONS$2, VapidSigner, WebPushSender } from "../webpush.mjs";
+import { removeDevice } from "./ingest.mjs";
 import { routeByChannel, routeByPlatform } from "./senders.mjs";
 //#region src/host/channels.ts
 /**
@@ -29,31 +30,63 @@ function journeyMode(env) {
 function runtimeFromConfig(config, env) {
 	return resolveRuntime(config?.runtime, journeyMode(env));
 }
-/** A sender that fails every message with the reason the channel cannot deliver. */
+/**
+* A sender that fails every message with the reason the channel cannot deliver — for good: the
+* configuration is the same on every attempt, so the step does not retry into it.
+*/
 function unavailable(reason) {
 	return { async send(message) {
-		throw new Error(`cannot send '${message.template}' on ${message.channel}: ${reason}`);
+		throw new PermanentError(`cannot send '${message.template}' on ${message.channel}: ${reason}`);
 	} };
 }
 function requireSecret(env, name) {
 	const value = env[name];
-	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} is not set: the environment must hold it for the configured channel`);
+	if (typeof value !== "string" || value.length === 0) throw new PermanentError(`${name} is not set: the environment must hold it for the configured channel`);
 	return value;
 }
+function createProviderCache() {
+	const credentials = /* @__PURE__ */ new Map();
+	return { get(key, build) {
+		if (!credentials.has(key)) credentials.set(key, build());
+		return credentials.get(key);
+	} };
+}
+/** A number for each fetch implementation, so a credential minted through one is not reused with another. */
+const identities = /* @__PURE__ */ new WeakMap();
+let nextIdentity = 1;
+function identity(value) {
+	if (value === void 0) return "global";
+	let id = identities.get(value);
+	if (id === void 0) {
+		id = nextIdentity++;
+		identities.set(value, id);
+	}
+	return String(id);
+}
+/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */
+async function secretDigest(secret) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
+	return Array.from(new Uint8Array(digest).slice(0, 4), (b) => b.toString(16).padStart(2, "0")).join("");
+}
 /**
-* A sender built on its first message. A platform's secret is only required
-* when something is actually sent there: a journey that only emails must not
-* fail because the APNs key is missing from a local `.dev.vars`.
+* A sender built on its first message, then kept for this call. `build` reads the secrets (and
+* so may throw a `PermanentError` naming the missing variable): a platform's secret is only
+* required when something is actually sent there, so a journey that only emails must not fail
+* because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.
 */
 function lazy(build) {
 	let sender;
 	return { async send(message) {
-		sender ??= build();
-		return sender.send(message);
+		sender ??= build().catch((error) => {
+			sender = void 0;
+			throw error;
+		});
+		return (await sender).send(message);
 	} };
 }
 function channelsFromConfig(config, env, options = {}) {
 	const mode = journeyMode(env);
+	const providers = options.providers ?? createProviderCache();
 	const email = () => {
 		const registry = config.templates?.email;
 		if (registry === void 0) return unavailable("no email templates are registered");
@@ -68,41 +101,85 @@ function channelsFromConfig(config, env, options = {}) {
 		const registry = config.templates?.push;
 		if (registry === void 0) return unavailable("no push templates are registered");
 		const render = registryPushRenderer(registry);
-		const onUnregistered = async (message) => {
-			if (message.device !== void 0 && options.store !== void 0) await removeDevice(env, message.device.token, options.store);
-		};
+		/**
+		* A token the provider reports as gone is forgotten (nothing left to deliver to), waking the
+		* waits that read devices, as a removal through the API does. Done here, per run, on the
+		* settled result, so the credential cached across runs (see `ProviderCache`) never holds a
+		* run's store.
+		*/
+		const dropDeadTokens = (provider, deadTokenReasons) => ({ async send(message) {
+			const result = await provider.send(message);
+			if (result !== void 0 && deadTokenReasons.has(result.reason) && message.device !== void 0 && options.store !== void 0) await removeDevice(env, message.device.token, options.store);
+			return result;
+		} });
 		const platforms = {};
 		const apns = config.apns;
-		if (apns !== void 0) platforms.ios = lazy(() => new ApnsPushSender({
-			keyId: apns.keyId,
-			teamId: apns.teamId,
-			privateKey: apnsKeyFromBase64(requireSecret(env, "APNS_PRIVATE_KEY_BASE64")),
-			topic: apns.topic,
-			environment: apnsEnvironment(apns, mode),
-			render,
-			onUnregistered,
-			...env.APNS_RELAY_ORIGIN === void 0 ? {} : { origin: env.APNS_RELAY_ORIGIN },
-			...(options.apnsFetch ?? options.fetch) === void 0 ? {} : { fetch: options.apnsFetch ?? options.fetch }
-		}));
+		if (apns !== void 0) {
+			const apnsFetch = options.apnsFetch ?? options.fetch;
+			const environment = apnsEnvironment(apns, mode);
+			platforms.ios = dropDeadTokens(lazy(async () => {
+				const secret = requireSecret(env, "APNS_PRIVATE_KEY_BASE64");
+				const credentials = providers.get(JSON.stringify([
+					"apns",
+					apns.keyId,
+					apns.teamId,
+					await secretDigest(secret)
+				]), () => new ApnsProviderToken({
+					keyId: apns.keyId,
+					teamId: apns.teamId,
+					privateKey: apnsKeyFromBase64(secret)
+				}));
+				return new ApnsPushSender({
+					credentials,
+					topic: apns.topic,
+					environment,
+					render,
+					...env.APNS_RELAY_ORIGIN === void 0 ? {} : { origin: env.APNS_RELAY_ORIGIN },
+					...apnsFetch === void 0 ? {} : { fetch: apnsFetch }
+				});
+			}), DEAD_TOKEN_REASONS);
+		}
 		const fcm = config.fcm;
-		if (fcm !== void 0) platforms.android = lazy(() => new FcmPushSender({
-			serviceAccount: serviceAccountFromBase64(requireSecret(env, "GOOGLE_APPLICATION_CREDENTIALS_BASE64")),
-			render,
-			onUnregistered,
-			...fcm.androidChannelId === void 0 ? {} : { android: { channel_id: fcm.androidChannelId } },
-			...options.fetch === void 0 ? {} : { fetch: options.fetch }
-		}));
+		if (fcm !== void 0) platforms.android = dropDeadTokens(lazy(async () => {
+			const secret = requireSecret(env, "GOOGLE_APPLICATION_CREDENTIALS_BASE64");
+			const serviceAccount = serviceAccountFromBase64(secret);
+			const credentials = providers.get(JSON.stringify([
+				"fcm",
+				serviceAccount.client_email,
+				serviceAccount.project_id,
+				identity(options.fetch),
+				await secretDigest(secret)
+			]), () => new FcmAccessToken({
+				serviceAccount,
+				...options.fetch === void 0 ? {} : { fetch: options.fetch }
+			}));
+			return new FcmPushSender({
+				credentials,
+				render,
+				...fcm.androidChannelId === void 0 ? {} : { android: { channel_id: fcm.androidChannelId } },
+				...options.fetch === void 0 ? {} : { fetch: options.fetch }
+			});
+		}), DEAD_TOKEN_REASONS$1);
 		const webPush = config.webPush;
-		if (webPush !== void 0) platforms.web = lazy(() => new WebPushSender({
-			vapid: {
+		if (webPush !== void 0) platforms.web = dropDeadTokens(lazy(async () => {
+			const publicKey = requireSecret(env, "VAPID_PUBLIC_KEY");
+			const privateKey = requireSecret(env, "VAPID_PRIVATE_KEY");
+			const credentials = providers.get(JSON.stringify([
+				"vapid",
+				webPush.subject,
+				publicKey,
+				await secretDigest(privateKey)
+			]), () => new VapidSigner({
 				subject: webPush.subject,
-				publicKey: requireSecret(env, "VAPID_PUBLIC_KEY"),
-				privateKey: requireSecret(env, "VAPID_PRIVATE_KEY")
-			},
-			render,
-			onUnregistered,
-			...options.fetch === void 0 ? {} : { fetch: options.fetch }
-		}));
+				publicKey,
+				privateKey
+			}));
+			return new WebPushSender({
+				credentials,
+				render,
+				...options.fetch === void 0 ? {} : { fetch: options.fetch }
+			});
+		}), DEAD_TOKEN_REASONS$2);
 		if (Object.keys(platforms).length === 0) return unavailable("none of apns, fcm or webPush is configured");
 		return routeByPlatform(platforms);
 	};
@@ -112,7 +189,7 @@ function channelsFromConfig(config, env, options = {}) {
 	*/
 	const webhookUrl = (channel, template) => {
 		const url = template.webhook(env);
-		if (typeof url !== "string" || url === "") throw new Error(`${channel} template '${template.id}': its webhook URL is not set in the environment`);
+		if (typeof url !== "string" || url === "") throw new PermanentError(`${channel} template '${template.id}': its webhook URL is not set in the environment`);
 		return url;
 	};
 	const discord = () => {
@@ -153,6 +230,6 @@ function channelsFromConfig(config, env, options = {}) {
 	});
 }
 //#endregion
-export { channelsFromConfig, journeyMode, runtimeFromConfig };
+export { channelsFromConfig, createProviderCache, journeyMode, runtimeFromConfig };
 
 //# sourceMappingURL=channels.mjs.map