@shware/workflow 4.0.0 → 4.1.1

package/README.md

@@ -666,8 +666,10 @@ Secrets never go in the config; the Worker reads them from its environment:
 | `VAPID_PUBLIC_KEY`, `VAPID_PRIVATE_KEY` | The Web Push key pair                                      |
 | `APNS_RELAY_ORIGIN`                     | Development only: the local APNs relay                     |
 
-`journeyWorker` also takes `observer`, `messages` and `runtime` overrides, and
-`contractMode: 'report'` to log contract refusals instead of answering 400.
+`journeyWorker` (and `journeyLambda`) also take `observer`, `messages` and `runtime` overrides,
+`contractMode: 'report'` to log contract refusals instead of answering 400, and `authorize` to
+replace the `API_TOKEN` bearer with a check of your own (see
+[AWS deployment notes](#aws-deployment-notes)).
 
 ## `JourneyClient`
 
@@ -751,7 +753,8 @@ The compiled IR lives in D1 with the routes, never in a KV namespace: KV is even
 while the routes in D1 are not, so an instance started in another colo right after a deploy could
 miss its IR.
 
-A Worker on Postgres needs only `JOURNEY`. Add the `EMAIL` send_email binding
+The Worker needs the `nodejs_compat` compatibility flag (the bearer check uses
+`node:crypto`'s `timingSafeEqual`). A Worker on Postgres needs only `JOURNEY`. Add the `EMAIL` send_email binding
 when it sends through Cloudflare Email (`cloudflareEmailTransport({ binding: env.EMAIL })`), and a `triggers.crons` entry with `scheduled`
 exported to run the segment sweep.
 
@@ -796,6 +799,30 @@ There are no migrations, and re-applying the file is not one: every statement is
 the first insert needing a new column fails. Recreate it instead. The demo has
 `pnpm db:reset`. The `events` key is `(user_id, id)`, and `workflow_ir` holds the compiled IR.
 
+### Cloudflare deployment notes
+
+- **Email transport.** Pass `email` explicitly: `cloudflareEmailTransport({ binding: env.EMAIL })`
+  for Cloudflare Email, or `sesEmailTransport({ region, credentials })` with credentials from the
+  Worker's env, since a Worker has no execution role. A Worker whose workflows email without one
+  fails at startup.
+- **List-Unsubscribe.** Cloudflare Email rejects a `List-Unsubscribe` header with a non-TLS URI, so
+  the one-click header is only sent with an https `WORKFLOW_ORIGIN`. `wrangler dev` on
+  `http://localhost` sends none.
+- **Workflows limits** (paid plan):
+  - An instance's wall time is unlimited.
+  - A single `step.sleep` lasts at most 365 days.
+  - 10,000 steps per instance by default, configurable up to 25,000. Sleeps do not count, but every
+    wait attempt costs a few steps.
+  - A step's result is at most 1 MiB.
+  - A completed instance's state is kept 30 days.
+- **Authorization.** Set `API_TOKEN` with `wrangler secret put`, or pass `authorize` (below).
+  The tracking routes (`/t/...`) stay public by design.
+- **Deploying.** With the `CF_VERSION_METADATA` binding and a Postgres store, each `wrangler deploy`
+  makes its own bundle live (see [Postgres](#postgres)). On D1, call `POST /bundle/deploy`.
+- **APNs in development.** `wrangler dev` (workerd) cannot make HTTP/2 subrequests: run
+  `@shware/workflow/apns-relay` and point `APNS_RELAY_ORIGIN` at it. A deployed Worker needs no
+  relay.
+
 ## AWS Lambda
 
 The same config runs as one Lambda durable function behind a Function URL, on
@@ -879,14 +906,114 @@ Workflow:
     FunctionUrlConfig: { AuthType: NONE, InvokeMode: BUFFERED }
 ```
 
-The execution role needs the durable checkpoint permissions,
-`lambda:InvokeFunction` on its own versions, `lambda:SendDurableExecutionCallbackSuccess`,
-`lambda:GetDurableExecution`, `lambda:ListDurableExecutionsByFunction` and
-`lambda:StopDurableExecution`, plus `ses:SendEmail` when it sends through SES.
-With `AuthType: NONE`, scope the public `lambda:InvokeFunction` grant to
-`lambda:InvokedViaFunctionUrl = true` so the URL cannot be used to invoke the
-function directly. APNs goes over Node's HTTP/2 client; a custom domain needs
-CloudFront (or another HTTPS proxy) in front of the Function URL.
+### AWS deployment notes
+
+Checked against a real durable Lambda (Node 24, us-east-1).
+
+**Function URL: `AuthType: NONE`, with the API protected in the app.** Not every caller can
+sign a request:
+
+| Caller                                     | Routes                                                   |
+| ------------------------------------------ | -------------------------------------------------------- |
+| Your backend                               | `/events`, `/identify`, `/devices`, `/users/forget`, ... |
+| Recipients' mail clients and browsers      | `/t/o`, `/t/l`, `/t/u`                                   |
+| Gmail / Yahoo one-click unsubscribe        | `POST /t/u/<message>` (RFC 8058)                         |
+| iOS notification extension, service worker | `POST /t/d`, `POST /t/p`                                 |
+
+An alias has one URL and one auth type, and the tracking and one-click routes must stay public:
+
+- `AWS_IAM` would break those routes. SigV4 also takes the `Authorization` header, so the bearer
+  could not travel with it.
+- CloudFront's origin access control (OAC) does not help either: with OAC, every POST must carry
+  the body's SHA-256 in `x-amz-content-sha256`, and a mail provider's one-click POST does not.
+
+Keep the routes public and protect the API in the app: the `API_TOKEN` bearer by default, or
+your own `authorize`. Production refuses to serve without one of the two.
+
+**Your own authorization.** `authorize(request, env)` replaces the bearer check on every API
+route, in any format you choose: an HMAC over the body, a JWT, a header your proxy adds. It
+receives a copy of the request, so it can read the body, and the env the host validated. True
+lets the request through, false answers 401, and a throw answers 500 rather than letting the
+request in. The tracking routes and `/health` never ask it. `bearerMatches` and
+`timingSafeEqual` are exported for building one:
+
+```ts
+import { journeyLambda, timingSafeEqual } from '@shware/workflow/aws';
+
+journeyLambda({
+  // ...
+  authorize: async (request, env) =>
+    timingSafeEqual(
+      request.headers.get('x-signature') ?? '',
+      await hmac(env.SECRET, await request.text())
+    ),
+});
+```
+
+**Resource policy.** Grant `lambda:InvokeFunctionUrl` to everyone (`FunctionUrlAuthType: NONE`)
+and `lambda:InvokeFunction` only with `lambda:InvokedViaFunctionUrl = true`, so the URL cannot
+be used to invoke the function directly.
+
+**Put CloudFront and WAF in front, without OAC.** A custom domain needs CloudFront (or another
+HTTPS proxy) anyway; Route 53 alone cannot terminate TLS for a Function URL. Add a rate-based WAF
+rule there: every request that reaches the function starts a durable execution and is billed,
+even one the app answers 401. Reserved concurrency caps what a flood can cost.
+
+**What a request costs.** Every Function URL request is a durable execution of its own:
+
+| Execution                                   | Durable ops | Per million |
+| ------------------------------------------- | ----------- | ----------- |
+| `GET` (pixel, redirect, `/health`), no step | 1           | about $9    |
+| `POST` (an event, an identify), one step    | 2           | about $17   |
+| A plain, non-durable Lambda for comparison  | -           | about $1    |
+| A journey: email, delay, one wake-up, email | 24          | about $190  |
+
+Durable operations cost $8 per million, on top of Lambda's request and duration charges. That is
+negligible at thousands of requests a month and worth a second, non-durable function for HTTP at
+tens of millions. Server-side latency stays small: `/health` takes about 6 ms, a write 40–300 ms.
+
+**Quotas.**
+
+- Starting durable executions: 3,000 per second (6,000 in us-east-1, us-west-2 and eu-west-1).
+  HTTP requests and journey starts share it.
+- 30,000 operations per execution, which cannot be raised. A wait attempt costs about five: the
+  callback plus four steps.
+- 1 MB per operation's payload. Reads (`GET`, `HEAD`) are answered outside a step so their bodies
+  are not checkpointed.
+
+**Timeouts and retention.**
+
+- Set `DurableConfig.ExecutionTimeout` to the longest journey (waits, delays and the goal
+  window), up to 366 days, and pass the same value as `journeyLambda({ executionTimeoutMs })`: a
+  workflow that could outlive it fails at startup instead of being stopped midway.
+- `RetentionPeriodInDays` (1–90) only keeps history after an execution ends. Keep `startRetryMs`
+  (12 hours) well under it.
+- Keep `stopDrainMs` (15 minutes) at least the function's `Timeout`: a stop does not interrupt a
+  running invocation.
+
+**Execution role.**
+
+- `AWSLambdaBasicDurableExecutionRolePolicy` (checkpoints, state, logs).
+- On `arn:...:function:<name>` and `arn:...:function:<name>:*`: `lambda:InvokeFunction`,
+  `lambda:SendDurableExecutionCallbackSuccess`, `lambda:GetDurableExecution`,
+  `lambda:StopDurableExecution` and `lambda:ListDurableExecutionsByFunction`. Durable execution
+  ARNs carry the version, so an unqualified ARN alone matches nothing.
+- `ses:SendEmail` when sending through SES.
+
+**Versions.**
+
+- Publish numbered versions behind the `live` alias. `$LATEST` lets a paused execution resume on
+  changed code.
+- Do not delete a version while executions are pinned to it.
+- Rolling the alias back does not roll the routes back: the newer bundle stays live until
+  `POST /bundle/deploy` from the restored version.
+
+**Emails.** The one-click unsubscribe header needs an https `WORKFLOW_ORIGIN`; over http no
+`List-Unsubscribe` is sent. Mailbox providers honour the header only when DKIM signs it, so check
+one real message for `dkim=pass` with `list-unsubscribe` in `h=`.
+
+**Memory.** Size it for the app; the store is remote. APNs goes over the package's Node HTTP/2
+client, because Node 24's `fetch` speaks HTTP/1.1 only (see `src/http2-client.ts`).
 
 ## Postgres
 
@@ -963,8 +1090,9 @@ On Postgres the engine also keeps:
 
 `handleRequest` serves the ingest API:
 
-- `GET /health` is the only unauthenticated one. The bearer scheme is matched
-  case-insensitively and compared in constant time.
+- `GET /health` is the only unauthenticated one. Every other route asks the
+  host's `authorize`, or without one the `API_TOKEN` bearer: its scheme is
+  matched case-insensitively and the token compared in constant time.
 - `POST /events` takes `{ userId, event, payload?, ts?, id? }` and answers with
   the id the occurrence was recorded under. Event names beginning with `$` are
   reserved for internal use. `ts` is epoch milliseconds: a non-negative integer

package/dist/apns.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_engine_retry = require("./engine/retry.cjs");
 const require_jwt = require("./jwt.cjs");
+let node_buffer = require("node:buffer");
 //#region src/apns.ts
 const APNS_HOSTS = {
 	sandbox: "https://api.sandbox.push.apple.com",
@@ -49,7 +50,7 @@ async function apnsIdFromKey(idempotencyKey) {
 	const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(idempotencyKey))).slice(0, 16);
 	bytes[6] = bytes[6] & 15 | 128;
 	bytes[8] = bytes[8] & 63 | 128;
-	const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	const hex = node_buffer.Buffer.from(bytes).toString("hex");
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 /** Apple: reuse a provider token for at least 20 minutes, never past 60. */
@@ -188,7 +189,7 @@ async function signApnsJwt(key, nowMs = Date.now()) {
 function apnsKeyFromBase64(value) {
 	let pem;
 	try {
-		pem = atob(value);
+		pem = node_buffer.Buffer.from(value, "base64").toString();
 	} catch (error) {
 		throw new require_engine_retry.PermanentError("APNs key is not base64 (expected the .p8 file, base64-encoded)", { cause: error });
 	}

package/dist/apns.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apns.cjs","names":["PermanentError","isRetryableStatus","base64url","pemToDer"],"sources":["../src/apns.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = atob(value);\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;;AAmDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAM,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAC7E,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAIA,qBAAAA,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAIC,qBAAAA,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAID,qBAAAA,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAASE,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAASA,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACAC,YAAAA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EAEd,MAAM,IAAIF,qBAAAA,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAIA,qBAAAA,eAAe,0CAA0C;CAErE,OAAO;AACT"}
+{"version":3,"file":"apns.cjs","names":["Buffer","PermanentError","isRetryableStatus","base64url","pemToDer"],"sources":["../src/apns.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Buffer.from(bytes).toString('hex');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = Buffer.from(value, 'base64').toString();\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;;;AAoDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAMA,YAAAA,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,KAAK;CAC7C,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAIC,qBAAAA,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAIC,qBAAAA,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAID,qBAAAA,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAASE,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAASA,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACAC,YAAAA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAMH,YAAAA,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS;CAC9C,SAAS,OAAO;EAEd,MAAM,IAAIC,qBAAAA,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAIA,qBAAAA,eAAe,0CAA0C;CAErE,OAAO;AACT"}

package/dist/apns.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"apns.d.cts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAmBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}
+{"version":3,"file":"apns.d.cts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAoBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}

package/dist/apns.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apns.d.mts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAmBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}
+{"version":3,"file":"apns.d.mts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAoBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}

package/dist/apns.mjs

@@ -1,5 +1,6 @@
 import { PermanentError, isRetryableStatus } from "./engine/retry.mjs";
 import { base64url, pemToDer } from "./jwt.mjs";
+import { Buffer } from "node:buffer";
 //#region src/apns.ts
 const APNS_HOSTS = {
 	sandbox: "https://api.sandbox.push.apple.com",
@@ -48,7 +49,7 @@ async function apnsIdFromKey(idempotencyKey) {
 	const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(idempotencyKey))).slice(0, 16);
 	bytes[6] = bytes[6] & 15 | 128;
 	bytes[8] = bytes[8] & 63 | 128;
-	const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	const hex = Buffer.from(bytes).toString("hex");
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 /** Apple: reuse a provider token for at least 20 minutes, never past 60. */
@@ -187,7 +188,7 @@ async function signApnsJwt(key, nowMs = Date.now()) {
 function apnsKeyFromBase64(value) {
 	let pem;
 	try {
-		pem = atob(value);
+		pem = Buffer.from(value, "base64").toString();
 	} catch (error) {
 		throw new PermanentError("APNs key is not base64 (expected the .p8 file, base64-encoded)", { cause: error });
 	}

package/dist/apns.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apns.mjs","names":[],"sources":["../src/apns.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = atob(value);\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;AAmDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAM,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAC7E,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAI,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAI,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAI,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAI,eAAe,0CAA0C;CAErE,OAAO;AACT"}
+{"version":3,"file":"apns.mjs","names":[],"sources":["../src/apns.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Buffer.from(bytes).toString('hex');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = Buffer.from(value, 'base64').toString();\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;;AAoDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,KAAK;CAC7C,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAI,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAI,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAI,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAM,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS;CAC9C,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAI,eAAe,0CAA0C;CAErE,OAAO;AACT"}

package/dist/aws/function-url.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_buffer = require("node:buffer");
 //#region src/aws/function-url.ts
 /**
 * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps
@@ -9,17 +10,8 @@ function isFunctionUrlEvent(event) {
 	const { requestContext, rawPath } = event;
 	return typeof rawPath === "string" && typeof requestContext === "object" && requestContext !== null && typeof requestContext.http === "object" && requestContext.http !== null && typeof requestContext.http.method === "string";
 }
-function fromBase64(value) {
-	const binary = atob(value);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-function toBase64(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
-	return btoa(binary);
-}
+const fromBase64 = (value) => new Uint8Array(node_buffer.Buffer.from(value, "base64"));
+const toBase64 = (bytes) => node_buffer.Buffer.from(bytes).toString("base64");
 function toRequest(event) {
 	const method = event.requestContext.http.method.toUpperCase();
 	const headers = new Headers();

package/dist/aws/function-url.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.cjs","names":[],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nfunction fromBase64(value: string): Uint8Array {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = '';\n  for (let i = 0; i < bytes.length; i += 0x8000) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n  }\n  return btoa(binary);\n}\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;;AA+BA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,SAAS,WAAW,OAA2B;CAC7C,MAAM,SAAS,KAAK,KAAK;CACzB,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;CACtE,OAAO;AACT;AAEA,SAAS,SAAS,OAA2B;CAC3C,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,OACrC,UAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;CAEhE,OAAO,KAAK,MAAM;AACpB;AAEA,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}
+{"version":3,"file":"function-url.cjs","names":["Buffer"],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nconst fromBase64 = (value: string): Uint8Array => new Uint8Array(Buffer.from(value, 'base64'));\nconst toBase64 = (bytes: Uint8Array): string => Buffer.from(bytes).toString('base64');\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;;;AAgCA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,MAAM,cAAc,UAA8B,IAAI,WAAWA,YAAAA,OAAO,KAAK,OAAO,QAAQ,CAAC;AAC7F,MAAM,YAAY,UAA8BA,YAAAA,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;AAEpF,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}

package/dist/aws/function-url.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.d.cts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAKiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAgC7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}
+{"version":3,"file":"function-url.d.cts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAMiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAoB7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}

package/dist/aws/function-url.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.d.mts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAKiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAgC7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}
+{"version":3,"file":"function-url.d.mts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAMiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAoB7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}

package/dist/aws/function-url.mjs

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 //#region src/aws/function-url.ts
 /**
 * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps
@@ -8,17 +9,8 @@ function isFunctionUrlEvent(event) {
 	const { requestContext, rawPath } = event;
 	return typeof rawPath === "string" && typeof requestContext === "object" && requestContext !== null && typeof requestContext.http === "object" && requestContext.http !== null && typeof requestContext.http.method === "string";
 }
-function fromBase64(value) {
-	const binary = atob(value);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-function toBase64(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
-	return btoa(binary);
-}
+const fromBase64 = (value) => new Uint8Array(Buffer.from(value, "base64"));
+const toBase64 = (bytes) => Buffer.from(bytes).toString("base64");
 function toRequest(event) {
 	const method = event.requestContext.http.method.toUpperCase();
 	const headers = new Headers();

package/dist/aws/function-url.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.mjs","names":[],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nfunction fromBase64(value: string): Uint8Array {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = '';\n  for (let i = 0; i < bytes.length; i += 0x8000) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n  }\n  return btoa(binary);\n}\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;AA+BA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,SAAS,WAAW,OAA2B;CAC7C,MAAM,SAAS,KAAK,KAAK;CACzB,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;CACtE,OAAO;AACT;AAEA,SAAS,SAAS,OAA2B;CAC3C,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,OACrC,UAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;CAEhE,OAAO,KAAK,MAAM;AACpB;AAEA,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}
+{"version":3,"file":"function-url.mjs","names":[],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nconst fromBase64 = (value: string): Uint8Array => new Uint8Array(Buffer.from(value, 'base64'));\nconst toBase64 = (bytes: Uint8Array): string => Buffer.from(bytes).toString('base64');\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;;AAgCA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,MAAM,cAAc,UAA8B,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AAC7F,MAAM,YAAY,UAA8B,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;AAEpF,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}

package/dist/aws/index.cjs

@@ -7,6 +7,7 @@ const require_engine_duration = require("../engine/duration.cjs");
 const require_host_fresh_read = require("../host/fresh-read.cjs");
 const require_host_ingest = require("../host/ingest.cjs");
 const require_host_execute = require("../host/execute.cjs");
+const require_host_auth = require("../host/auth.cjs");
 const require_host_journey_host = require("../host/journey-host.cjs");
 const require_aws_instances = require("./instances.cjs");
 const require_aws_lambda_api = require("./lambda-api.cjs");
@@ -197,6 +198,7 @@ exports.AwsEngineStep = require_aws_engine_step.AwsEngineStep;
 exports.AwsInstances = require_aws_instances.AwsInstances;
 exports.RUN_EVENT_TYPE = require_aws_instances.RUN_EVENT_TYPE;
 exports.SWEEP_EVENT_TYPE = SWEEP_EVENT_TYPE;
+exports.bearerMatches = require_host_auth.bearerMatches;
 exports.executionName = require_aws_instances.executionName;
 exports.fromResponse = require_aws_function_url.fromResponse;
 exports.isFunctionUrlEvent = require_aws_function_url.isFunctionUrlEvent;
@@ -204,6 +206,7 @@ exports.isRunInput = require_aws_instances.isRunInput;
 exports.journeyLambda = journeyLambda;
 exports.sdkLambdaApi = require_aws_lambda_api.sdkLambdaApi;
 exports.stepRetry = require_aws_engine_step.stepRetry;
+exports.timingSafeEqual = require_host_auth.timingSafeEqual;
 exports.toRequest = require_aws_function_url.toRequest;
 
 //# sourceMappingURL=index.cjs.map