@shware/workflow 4.1.0 → 4.1.1

package/dist/apns.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_engine_retry = require("./engine/retry.cjs");
 const require_jwt = require("./jwt.cjs");
+let node_buffer = require("node:buffer");
 //#region src/apns.ts
 const APNS_HOSTS = {
 	sandbox: "https://api.sandbox.push.apple.com",
@@ -49,7 +50,7 @@ async function apnsIdFromKey(idempotencyKey) {
 	const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(idempotencyKey))).slice(0, 16);
 	bytes[6] = bytes[6] & 15 | 128;
 	bytes[8] = bytes[8] & 63 | 128;
-	const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	const hex = node_buffer.Buffer.from(bytes).toString("hex");
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 /** Apple: reuse a provider token for at least 20 minutes, never past 60. */
@@ -188,7 +189,7 @@ async function signApnsJwt(key, nowMs = Date.now()) {
 function apnsKeyFromBase64(value) {
 	let pem;
 	try {
-		pem = atob(value);
+		pem = node_buffer.Buffer.from(value, "base64").toString();
 	} catch (error) {
 		throw new require_engine_retry.PermanentError("APNs key is not base64 (expected the .p8 file, base64-encoded)", { cause: error });
 	}

package/dist/apns.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apns.cjs","names":["PermanentError","isRetryableStatus","base64url","pemToDer"],"sources":["../src/apns.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = atob(value);\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;;AAmDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAM,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAC7E,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAIA,qBAAAA,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAIC,qBAAAA,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAID,qBAAAA,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAASE,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAASA,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACAC,YAAAA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EAEd,MAAM,IAAIF,qBAAAA,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAIA,qBAAAA,eAAe,0CAA0C;CAErE,OAAO;AACT"}
+{"version":3,"file":"apns.cjs","names":["Buffer","PermanentError","isRetryableStatus","base64url","pemToDer"],"sources":["../src/apns.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Buffer.from(bytes).toString('hex');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = Buffer.from(value, 'base64').toString();\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;;;AAoDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAMA,YAAAA,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,KAAK;CAC7C,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAIC,qBAAAA,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAIC,qBAAAA,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAID,qBAAAA,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAASE,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAASA,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACAC,YAAAA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAMH,YAAAA,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS;CAC9C,SAAS,OAAO;EAEd,MAAM,IAAIC,qBAAAA,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAIA,qBAAAA,eAAe,0CAA0C;CAErE,OAAO;AACT"}

package/dist/apns.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"apns.d.cts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAmBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}
+{"version":3,"file":"apns.d.cts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAoBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}

package/dist/apns.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apns.d.mts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAmBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}
+{"version":3,"file":"apns.d.mts","names":[],"sources":["../src/apns.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAoBiB;;EAEf;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa;;EAEb;;;;;;;EAOA;EACA,QAAQ;;;;;;EAMR;;EAEA,eAAe;;qBAGJ;WACX;WACA;;;;;;;;;;;;;;;;;;;;;qBAsBW,oBAAoB;;;;;;;;wBAsBX,cAAc,yBAAyB;;;;;;;;qBAqBhD;mBAIkB;UAHrB;UACA;EAER,YAA6B,SAAS;;EAGhC,MAAM,eAAmB;;EAgB/B;;qBAKW,0BAA0B;mBACR;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAkFvC,WAAW;;wBAUL,YACpB,KAAK,0BACL,iBACC;;wBAoBa,kBAAkB"}

package/dist/apns.mjs

@@ -1,5 +1,6 @@
 import { PermanentError, isRetryableStatus } from "./engine/retry.mjs";
 import { base64url, pemToDer } from "./jwt.mjs";
+import { Buffer } from "node:buffer";
 //#region src/apns.ts
 const APNS_HOSTS = {
 	sandbox: "https://api.sandbox.push.apple.com",
@@ -48,7 +49,7 @@ async function apnsIdFromKey(idempotencyKey) {
 	const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(idempotencyKey))).slice(0, 16);
 	bytes[6] = bytes[6] & 15 | 128;
 	bytes[8] = bytes[8] & 63 | 128;
-	const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	const hex = Buffer.from(bytes).toString("hex");
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 /** Apple: reuse a provider token for at least 20 minutes, never past 60. */
@@ -187,7 +188,7 @@ async function signApnsJwt(key, nowMs = Date.now()) {
 function apnsKeyFromBase64(value) {
 	let pem;
 	try {
-		pem = atob(value);
+		pem = Buffer.from(value, "base64").toString();
 	} catch (error) {
 		throw new PermanentError("APNs key is not base64 (expected the .p8 file, base64-encoded)", { cause: error });
 	}

package/dist/apns.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apns.mjs","names":[],"sources":["../src/apns.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = atob(value);\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;AAmDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAM,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAC7E,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAI,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAI,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAI,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAI,eAAe,0CAA0C;CAErE,OAAO;AACT"}
+{"version":3,"file":"apns.mjs","names":[],"sources":["../src/apns.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/apns` — iOS push delivery straight to the Apple Push\n * Notification service, token-based (an APNs auth key, the `.p8` file from the\n * developer portal). No Firebase in between: the app registers the APNs device\n * token in its own device table, and the host's DeviceDirectory hands it to the\n * engine, which sends one message per device.\n * No dependencies: the provider JWT is ES256-signed with WebCrypto.\n *\n * APNs speaks HTTP/2 only. A deployed Worker's `fetch` negotiates it, but\n * workerd under `wrangler dev` does not (the connection is dropped), so a local\n * host points `origin` at the Node relay in `@shware/workflow/apns-relay`.\n */\n\n/** The APNs auth key — the `.p8` file from the developer portal, and the ids that name it. */\nexport interface ApnsProviderTokenOptions {\n  /** The key's 10-character id, shown next to it in the developer portal. */\n  keyId: string;\n  /** The Apple Developer team id. */\n  teamId: string;\n  /** The `.p8` file's contents: PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8, P-256). */\n  privateKey: string;\n}\n\nexport interface ApnsPushOptions {\n  /** The provider token the requests are signed with — shared by every sender on the same key. */\n  credentials: ApnsProviderToken;\n  /** The app's bundle id — APNs's `apns-topic`. */\n  topic: string;\n  /**\n   * Which APNs environment the device tokens come from: `sandbox` for builds\n   * signed with `aps-environment: development` (Xcode, the simulator),\n   * `production` for App Store and TestFlight builds. A token from one is\n   * `BadDeviceToken` on the other.\n   */\n  environment: 'sandbox' | 'production';\n  render: PushRenderer;\n  /**\n   * POST here instead of Apple's host — the dev relay, which forwards over\n   * HTTP/2. The real host still travels along (`apns-relay-upstream`), so the\n   * relay needs no configuration of its own.\n   */\n  origin?: string;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport const APNS_HOSTS = {\n  sandbox: 'https://api.sandbox.push.apple.com',\n  production: 'https://api.push.apple.com',\n} as const;\n\n/**\n * How an APNs answer is classified, after Apple's response table\n * (https://developer.apple.com/documentation/usernotifications/handling-notification-responses-from-apns):\n *\n * - dead token: HTTP 410 `Unregistered` (the app was removed, or the token is inactive for the\n *   topic) and 400 `ExpiredToken`. The device will never deliver again, so the copy settles\n *   undelivered and the host forgets the token.\n * - undelivered, device kept: 400 `BadDeviceToken`. Apple gives it for a malformed token but\n *   just as well for a token of the other environment (a sandbox build pushed through the\n *   production host), which would answer for every device at once; the copy settles with the\n *   reason, so the report shows it, and nothing is deleted on a guess.\n * - configuration: the topic, certificate or provider key is wrong. Every device on this app\n *   would answer the same, so it is a `PermanentError` and the devices are kept — they are fine,\n *   the deployment is not.\n * - transient: 429 (`TooManyRequests`, `TooManyProviderTokenUpdates`), 5xx (`InternalServerError`,\n *   `ServiceUnavailable`, `Shutdown`) and 403 `ExpiredProviderToken`, which a fresh token fixes.\n * - everything else (400 `BadMessageId`, `BadPriority`, `PayloadEmpty`, 413 `PayloadTooLarge`,\n *   404 `BadPath`, 405 `MethodNotAllowed`, …) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['Unregistered', 'ExpiredToken']);\n\n/** The app's topic, certificate or provider key is wrong: the request is refused for every device. */\nconst CONFIGURATION_REASONS: ReadonlySet<string> = new Set([\n  'DeviceTokenNotForTopic',\n  'TopicDisallowed',\n  'BadTopic',\n  'MissingTopic',\n  'BadCertificate',\n  'BadCertificateEnvironment',\n  'Forbidden',\n  'InvalidProviderToken',\n  'MissingProviderToken',\n]);\n\n/**\n * The copy's identity on the wire: a canonical UUID derived from the idempotency key (SHA-256, the\n * first 16 bytes laid out as an RFC 9562 v8 UUID). The same on every attempt, so a resend of the\n * same copy carries the same `apns-id` and — as `apns-collapse-id`, which is limited to 64 bytes —\n * collapses onto the first notification. The whole key is hashed: cut to 64 bytes it would lose\n * the node id at its end, and two nodes of one instance would collapse into one notification.\n */\nexport async function apnsIdFromKey(idempotencyKey: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest('SHA-256', new TextEncoder().encode(idempotencyKey))\n  );\n  const bytes = digest.slice(0, 16);\n  bytes[6] = (bytes[6] & 0x0f) | 0x80; // version 8: custom, deterministic\n  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant\n  const hex = Buffer.from(bytes).toString('hex');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Apple: reuse a provider token for at least 20 minutes, never past 60. */\nconst TOKEN_TTL_MS = 50 * 60_000;\n\n/**\n * The provider JWT for one APNs auth key, signed once and reused for `TOKEN_TTL_MS`: Apple\n * answers a sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`. Concurrent\n * callers on a fresh or aged token share the one signing in flight, and a signing that failed is\n * not kept, so the next call tries again. One instance serves every sender built on the key — a\n * host keeps it across runs, and builds the senders per run.\n */\nexport class ApnsProviderToken {\n  private signed: { value: string; issuedAt: number } | undefined;\n  private signing: Promise<string> | undefined;\n\n  constructor(private readonly options: ApnsProviderTokenOptions) {}\n\n  /** The current token, signed now if there is none or it has aged out. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.signed !== undefined && now - this.signed.issuedAt < TOKEN_TTL_MS) {\n      return this.signed.value;\n    }\n    this.signing ??= signApnsJwt(this.options, now)\n      .then((value) => {\n        this.signed = { value, issuedAt: now };\n        return value;\n      })\n      .finally(() => {\n        this.signing = undefined;\n      });\n    return this.signing;\n  }\n\n  /** Forget the token: APNs refused it (`ExpiredProviderToken`), so the next call signs a new one. */\n  invalidate(): void {\n    this.signed = undefined;\n  }\n}\n\nexport class ApnsPushSender implements MessageSender {\n  constructor(private readonly options: ApnsPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`ApnsPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`ApnsPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    // A notification service extension runs only for a mutable push: it attaches the image and\n    // reports the device delivery (`delivered_url`)\n    const mutable = image !== undefined || message.tracking?.data?.delivered_url !== undefined;\n    const upstream = APNS_HOSTS[this.options.environment];\n    const origin = this.options.origin ?? upstream;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const copyId = await apnsIdFromKey(message.idempotencyKey);\n    const response = await doFetch(`${origin}/3/device/${message.recipient}`, {\n      method: 'POST',\n      headers: {\n        authorization: `bearer ${await this.options.credentials.token()}`,\n        'apns-topic': this.options.topic,\n        'apns-push-type': 'alert',\n        'apns-priority': '10',\n        // A resend of the same copy (an at-least-once retry after APNs accepted the first attempt)\n        // carries the same id and collapses onto the first notification instead of showing twice\n        'apns-id': copyId,\n        'apns-collapse-id': copyId,\n        'content-type': 'application/json',\n        ...(this.options.origin === undefined ? {} : { 'apns-relay-upstream': upstream }),\n      },\n      body: JSON.stringify({\n        aps: {\n          alert: { title, body },\n          sound: 'default',\n          ...(mutable ? { 'mutable-content': 1 } : {}),\n        },\n        // The template key travels so the app can route a tap; the idempotency\n        // key lets the app de-duplicate a redelivered push.\n        template: message.template,\n        idempotencyKey: message.idempotencyKey,\n        ...(image === undefined ? {} : { image }),\n        ...(url === undefined ? {} : { url }),\n        ...message.tracking?.data,\n      }),\n    });\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    // A 410 without a body is still \"unregistered\": settle it under that reason\n    const reason = apnsReason(text) || (status === 410 ? 'Unregistered' : '');\n    if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[apns] token gone for user ${message.userId}: ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'BadDeviceToken') {\n      // The token or the environment: settled so the report says which device, nothing deleted\n      console.warn(`[apns] refused for user ${message.userId}: ${status} ${reason}`);\n      return { delivered: false, reason };\n    }\n    if (reason === 'ExpiredProviderToken') {\n      // The token aged out (clock skew, a long-lived isolate): sign a new one on the retry\n      this.options.credentials.invalidate();\n      throw new Error(\n        `APNs send failed: ${status} ${reason} (provider token renewed for the retry)`\n      );\n    }\n    if (CONFIGURATION_REASONS.has(reason)) {\n      throw new PermanentError(\n        `APNs refused the request for topic '${this.options.topic}' (${this.options.environment}): ${status} ${reason}`\n      );\n    }\n    if (isRetryableStatus(status)) {\n      throw new Error(`APNs send failed: ${status} ${reason || text}`);\n    }\n    throw new PermanentError(`APNs refused the request: ${status} ${reason || text}`);\n  }\n}\n\n/** APNs error bodies are `{ \"reason\": \"…\" }`. */\nexport function apnsReason(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { reason?: string };\n    return parsed.reason ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** ES256-sign the APNs provider token: header `kid`, claims `iss` (team) and `iat`. */\nexport async function signApnsJwt(\n  key: ApnsProviderTokenOptions,\n  nowMs = Date.now()\n): Promise<string> {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: key.keyId }));\n  const claims = base64url(JSON.stringify({ iss: key.teamId, iat: Math.floor(nowMs / 1000) }));\n  const cryptoKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(key.privateKey),\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  // WebCrypto's ECDSA signature is the raw r‖s pair, which is exactly JWS's ES256 encoding.\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    cryptoKey,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** The `.p8` as it is usually shipped in a secret: base64 of the file. */\nexport function apnsKeyFromBase64(value: string): string {\n  let pem: string;\n  try {\n    pem = Buffer.from(value, 'base64').toString();\n  } catch (error) {\n    // A secret that is not base64 is the same on every attempt: not worth a retry\n    throw new PermanentError('APNs key is not base64 (expected the .p8 file, base64-encoded)', {\n      cause: error,\n    });\n  }\n  if (!pem.includes('-----BEGIN PRIVATE KEY-----')) {\n    throw new PermanentError('APNs key is not a PKCS #8 PEM (.p8) file');\n  }\n  return pem;\n}\n"],"mappings":";;;;AAoDA,MAAa,aAAa;CACxB,SAAS;CACT,YAAY;AACd;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,cAAc,CAAC;;AAG/F,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,eAAsB,cAAc,gBAAyC;CAI3E,MAAM,QAAQ,IAHK,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAE7D,CAAC,CAAC,MAAM,GAAG,EAAE;CAChC,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,KAAM,MAAM,KAAK,KAAQ;CAC/B,MAAM,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,KAAK;CAC7C,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;AACzG;;AAGA,MAAM,eAAe;;;;;;;;AASrB,IAAa,oBAAb,MAA+B;CAIA;CAH7B;CACA;CAEA,YAAY,SAAoD;EAAnC,KAAA,UAAA;CAAoC;;CAGjE,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,MAAM,KAAK,OAAO,WAAW,cAC5D,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,YAAY,KAAK,SAAS,GAAG,CAAC,CAC5C,MAAM,UAAU;GACf,KAAK,SAAS;IAAE;IAAO,UAAU;GAAI;GACrC,OAAO;EACT,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;AACF;AAEA,IAAa,iBAAb,MAAqD;CACtB;CAA7B,YAAY,SAA2C;EAA1B,KAAA,UAAA;CAA2B;CAExD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,wCAAwC,QAAQ,QAAQ,EAAE;EAE5E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,2CAA2C,QAAQ,OAAO,EAAE;EAE9E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAG7F,MAAM,UAAU,UAAU,KAAA,KAAa,QAAQ,UAAU,MAAM,kBAAkB,KAAA;EACjF,MAAM,WAAW,WAAW,KAAK,QAAQ;EACzC,MAAM,SAAS,KAAK,QAAQ,UAAU;EACtC,MAAM,UAAU,KAAK,QAAQ,SAAS;EAEtC,MAAM,SAAS,MAAM,cAAc,QAAQ,cAAc;EACzD,MAAM,WAAW,MAAM,QAAQ,GAAG,OAAO,YAAY,QAAQ,aAAa;GACxE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,KAAK,QAAQ,YAAY,MAAM;IAC9D,cAAc,KAAK,QAAQ;IAC3B,kBAAkB;IAClB,iBAAiB;IAGjB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,GAAI,KAAK,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,SAAS;GACjF;GACA,MAAM,KAAK,UAAU;IACnB,KAAK;KACH,OAAO;MAAE;MAAO;KAAK;KACrB,OAAO;KACP,GAAI,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC;IAC5C;IAGA,UAAU,QAAQ;IAClB,gBAAgB,QAAQ;IACxB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;IACnC,GAAG,QAAQ,UAAU;GACvB,CAAC;EACH,CAAC;EACD,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EAEnB,MAAM,SAAS,WAAW,IAAI,MAAM,WAAW,MAAM,iBAAiB;EACtE,IAAI,WAAW,OAAO,mBAAmB,IAAI,MAAM,GAAG;GAGpD,QAAQ,KAAK,8BAA8B,QAAQ,OAAO,IAAI,QAAQ;GACtE,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,kBAAkB;GAE/B,QAAQ,KAAK,2BAA2B,QAAQ,OAAO,IAAI,OAAO,GAAG,QAAQ;GAC7E,OAAO;IAAE,WAAW;IAAO;GAAO;EACpC;EACA,IAAI,WAAW,wBAAwB;GAErC,KAAK,QAAQ,YAAY,WAAW;GACpC,MAAM,IAAI,MACR,qBAAqB,OAAO,GAAG,OAAO,wCACxC;EACF;EACA,IAAI,sBAAsB,IAAI,MAAM,GAClC,MAAM,IAAI,eACR,uCAAuC,KAAK,QAAQ,MAAM,KAAK,KAAK,QAAQ,YAAY,KAAK,OAAO,GAAG,QACzG;EAEF,IAAI,kBAAkB,MAAM,GAC1B,MAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG,UAAU,MAAM;EAEjE,MAAM,IAAI,eAAe,6BAA6B,OAAO,GAAG,UAAU,MAAM;CAClF;AACF;;AAGA,SAAgB,WAAW,MAAsB;CAC/C,IAAI;EAEF,OADe,KAAK,MAAM,IACd,CAAC,CAAC,UAAU;CAC1B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,YACpB,KACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK,IAAI;CAAM,CAAC,CAAC;CACzE,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK,IAAI;EAAQ,KAAK,KAAK,MAAM,QAAQ,GAAI;CAAE,CAAC,CAAC;CAC3F,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,SACA,SAAS,IAAI,UAAU,GACvB;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC;EAAE,MAAM;EAAS,MAAM;CAAU,GACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;CACJ,IAAI;EACF,MAAM,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS;CAC9C,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,kEAAkE,EACzF,OAAO,MACT,CAAC;CACH;CACA,IAAI,CAAC,IAAI,SAAS,6BAA6B,GAC7C,MAAM,IAAI,eAAe,0CAA0C;CAErE,OAAO;AACT"}

package/dist/aws/function-url.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_buffer = require("node:buffer");
 //#region src/aws/function-url.ts
 /**
 * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps
@@ -9,17 +10,8 @@ function isFunctionUrlEvent(event) {
 	const { requestContext, rawPath } = event;
 	return typeof rawPath === "string" && typeof requestContext === "object" && requestContext !== null && typeof requestContext.http === "object" && requestContext.http !== null && typeof requestContext.http.method === "string";
 }
-function fromBase64(value) {
-	const binary = atob(value);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-function toBase64(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
-	return btoa(binary);
-}
+const fromBase64 = (value) => new Uint8Array(node_buffer.Buffer.from(value, "base64"));
+const toBase64 = (bytes) => node_buffer.Buffer.from(bytes).toString("base64");
 function toRequest(event) {
 	const method = event.requestContext.http.method.toUpperCase();
 	const headers = new Headers();

package/dist/aws/function-url.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.cjs","names":[],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nfunction fromBase64(value: string): Uint8Array {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = '';\n  for (let i = 0; i < bytes.length; i += 0x8000) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n  }\n  return btoa(binary);\n}\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;;AA+BA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,SAAS,WAAW,OAA2B;CAC7C,MAAM,SAAS,KAAK,KAAK;CACzB,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;CACtE,OAAO;AACT;AAEA,SAAS,SAAS,OAA2B;CAC3C,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,OACrC,UAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;CAEhE,OAAO,KAAK,MAAM;AACpB;AAEA,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}
+{"version":3,"file":"function-url.cjs","names":["Buffer"],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nconst fromBase64 = (value: string): Uint8Array => new Uint8Array(Buffer.from(value, 'base64'));\nconst toBase64 = (bytes: Uint8Array): string => Buffer.from(bytes).toString('base64');\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;;;AAgCA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,MAAM,cAAc,UAA8B,IAAI,WAAWA,YAAAA,OAAO,KAAK,OAAO,QAAQ,CAAC;AAC7F,MAAM,YAAY,UAA8BA,YAAAA,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;AAEpF,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}

package/dist/aws/function-url.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.d.cts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAKiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAgC7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}
+{"version":3,"file":"function-url.d.cts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAMiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAoB7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}

package/dist/aws/function-url.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.d.mts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAKiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAgC7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}
+{"version":3,"file":"function-url.d.mts","names":[],"sources":["../../src/aws/function-url.ts"],"mappings":";;;;;iBAMiB;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;IACE;IACA;MAAQ;MAAgB;MAAmB;;;;iBAI9B;EACf;EACA,SAAS;EACT;EACA;EACA;;;;;;wBAOc,mBAAmB,iBAAiB,SAAS;wBAoB7C,UAAU,OAAO,mBAAmB;wBA4B9B,aAAa,UAAU,UAAU,iBAAiB,QAAQ"}

package/dist/aws/function-url.mjs

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 //#region src/aws/function-url.ts
 /**
 * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps
@@ -8,17 +9,8 @@ function isFunctionUrlEvent(event) {
 	const { requestContext, rawPath } = event;
 	return typeof rawPath === "string" && typeof requestContext === "object" && requestContext !== null && typeof requestContext.http === "object" && requestContext.http !== null && typeof requestContext.http.method === "string";
 }
-function fromBase64(value) {
-	const binary = atob(value);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-function toBase64(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
-	return btoa(binary);
-}
+const fromBase64 = (value) => new Uint8Array(Buffer.from(value, "base64"));
+const toBase64 = (bytes) => Buffer.from(bytes).toString("base64");
 function toRequest(event) {
 	const method = event.requestContext.http.method.toUpperCase();
 	const headers = new Headers();

package/dist/aws/function-url.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"function-url.mjs","names":[],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nfunction fromBase64(value: string): Uint8Array {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = '';\n  for (let i = 0; i < bytes.length; i += 0x8000) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n  }\n  return btoa(binary);\n}\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;AA+BA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,SAAS,WAAW,OAA2B;CAC7C,MAAM,SAAS,KAAK,KAAK;CACzB,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;CACtE,OAAO;AACT;AAEA,SAAS,SAAS,OAA2B;CAC3C,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,OACrC,UAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;CAEhE,OAAO,KAAK,MAAM;AACpB;AAEA,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}
+{"version":3,"file":"function-url.mjs","names":[],"sources":["../../src/aws/function-url.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n/**\n * Lambda Function URL events (payload format 2.0) as fetch `Request`s, and `Response`s back as\n * the result Lambda turns into the HTTP response — so the host's HTTP API runs unchanged.\n */\n\nexport interface FunctionUrlEvent {\n  version?: string;\n  rawPath: string;\n  rawQueryString?: string;\n  headers?: Record<string, string | undefined>;\n  cookies?: string[];\n  body?: string;\n  isBase64Encoded?: boolean;\n  requestContext: {\n    domainName?: string;\n    http: { method: string; sourceIp?: string; userAgent?: string };\n  };\n}\n\nexport interface FunctionUrlResult {\n  statusCode: number;\n  headers: Record<string, string>;\n  cookies?: string[];\n  body: string;\n  isBase64Encoded: boolean;\n}\n\n/**\n * An HTTP request, told apart by the event's own top-level shape — the Function URL wraps\n * every request in `requestContext.http`, so no request body can pass for anything else.\n */\nexport function isFunctionUrlEvent(event: unknown): event is FunctionUrlEvent {\n  if (typeof event !== 'object' || event === null) return false;\n  // Untrusted until checked: every level may be missing\n  const { requestContext, rawPath } = event as {\n    requestContext?: { http?: { method?: unknown } | null } | null;\n    rawPath?: unknown;\n  };\n  return (\n    typeof rawPath === 'string' &&\n    typeof requestContext === 'object' &&\n    requestContext !== null &&\n    typeof requestContext.http === 'object' &&\n    requestContext.http !== null &&\n    typeof requestContext.http.method === 'string'\n  );\n}\n\nconst fromBase64 = (value: string): Uint8Array => new Uint8Array(Buffer.from(value, 'base64'));\nconst toBase64 = (bytes: Uint8Array): string => Buffer.from(bytes).toString('base64');\n\nexport function toRequest(event: FunctionUrlEvent): Request {\n  const method = event.requestContext.http.method.toUpperCase();\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(event.headers ?? {})) {\n    if (value !== undefined) headers.set(name, value);\n  }\n  if (event.cookies !== undefined && event.cookies.length > 0) {\n    headers.set('cookie', event.cookies.join('; '));\n  }\n  const host = event.requestContext.domainName ?? headers.get('host') ?? 'localhost';\n  const query =\n    event.rawQueryString === undefined || event.rawQueryString === ''\n      ? ''\n      : `?${event.rawQueryString}`;\n  const hasBody = method !== 'GET' && method !== 'HEAD' && event.body !== undefined;\n  return new Request(`https://${host}${event.rawPath}${query}`, {\n    method,\n    headers,\n    ...(hasBody\n      ? { body: event.isBase64Encoded === true ? fromBase64(event.body ?? '') : event.body }\n      : {}),\n  });\n}\n\n/** Content types sent as text; everything else (a tracking pixel) goes back base64. */\nconst TEXTUAL =\n  /^(text\\/|application\\/(json|javascript|xml|x-www-form-urlencoded)|image\\/svg\\+xml)/i;\n\nexport async function fromResponse(response: Response, method: string): Promise<FunctionUrlResult> {\n  const headers: Record<string, string> = {};\n  const cookies: string[] = [];\n  response.headers.forEach((value, name) => {\n    if (name === 'set-cookie') cookies.push(value);\n    else headers[name] = value;\n  });\n  const contentType = response.headers.get('content-type') ?? '';\n  const head = method.toUpperCase() === 'HEAD';\n  const bytes = head ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());\n  const textual = bytes.length === 0 || TEXTUAL.test(contentType);\n  return {\n    statusCode: response.status,\n    headers,\n    ...(cookies.length === 0 ? {} : { cookies }),\n    body: textual ? new TextDecoder().decode(bytes) : toBase64(bytes),\n    isBase64Encoded: !textual,\n  };\n}\n"],"mappings":";;;;;;AAgCA,SAAgB,mBAAmB,OAA2C;CAC5E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,MAAM,EAAE,gBAAgB,YAAY;CAIpC,OACE,OAAO,YAAY,YACnB,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,OAAO,eAAe,SAAS,YAC/B,eAAe,SAAS,QACxB,OAAO,eAAe,KAAK,WAAW;AAE1C;AAEA,MAAM,cAAc,UAA8B,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AAC7F,MAAM,YAAY,UAA8B,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;AAEpF,SAAgB,UAAU,OAAkC;CAC1D,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;CAC5D,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAC5D,IAAI,UAAU,KAAA,GAAW,QAAQ,IAAI,MAAM,KAAK;CAElD,IAAI,MAAM,YAAY,KAAA,KAAa,MAAM,QAAQ,SAAS,GACxD,QAAQ,IAAI,UAAU,MAAM,QAAQ,KAAK,IAAI,CAAC;CAEhD,MAAM,OAAO,MAAM,eAAe,cAAc,QAAQ,IAAI,MAAM,KAAK;CACvE,MAAM,QACJ,MAAM,mBAAmB,KAAA,KAAa,MAAM,mBAAmB,KAC3D,KACA,IAAI,MAAM;CAChB,MAAM,UAAU,WAAW,SAAS,WAAW,UAAU,MAAM,SAAS,KAAA;CACxE,OAAO,IAAI,QAAQ,WAAW,OAAO,MAAM,UAAU,SAAS;EAC5D;EACA;EACA,GAAI,UACA,EAAE,MAAM,MAAM,oBAAoB,OAAO,WAAW,MAAM,QAAQ,EAAE,IAAI,MAAM,KAAK,IACnF,CAAC;CACP,CAAC;AACH;;AAGA,MAAM,UACJ;AAEF,eAAsB,aAAa,UAAoB,QAA4C;CACjG,MAAM,UAAkC,CAAC;CACzC,MAAM,UAAoB,CAAC;CAC3B,SAAS,QAAQ,SAAS,OAAO,SAAS;EACxC,IAAI,SAAS,cAAc,QAAQ,KAAK,KAAK;OACxC,QAAQ,QAAQ;CACvB,CAAC;CACD,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;CAE5D,MAAM,QADO,OAAO,YAAY,MAAM,yBACjB,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACnF,MAAM,UAAU,MAAM,WAAW,KAAK,QAAQ,KAAK,WAAW;CAC9D,OAAO;EACL,YAAY,SAAS;EACrB;EACA,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;EAC1C,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,SAAS,KAAK;EAChE,iBAAiB,CAAC;CACpB;AACF"}

package/dist/fcm.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_engine_retry = require("./engine/retry.cjs");
 const require_jwt = require("./jwt.cjs");
+let node_buffer = require("node:buffer");
 //#region src/fcm.ts
 /**
 * How an FCM v1 answer is classified, after the API's error codes
@@ -180,7 +181,7 @@ async function signJwt(account, audience, scope, nowMs = Date.now()) {
 function serviceAccountFromBase64(value) {
 	let json;
 	try {
-		json = JSON.parse(atob(value));
+		json = JSON.parse(node_buffer.Buffer.from(value, "base64").toString());
 	} catch (error) {
 		throw new require_engine_retry.PermanentError("service account is not base64-encoded JSON", { cause: error });
 	}

package/dist/fcm.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.cjs","names":["isRetryableStatus","PermanentError","base64url","pemToDer"],"sources":["../src/fcm.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(atob(value)) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAIA,qBAAAA,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAIC,qBAAAA,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAIA,qBAAAA,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAKD,qBAAAA,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAIC,qBAAAA,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAASC,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAASA,YAAAA,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACAC,YAAAA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,KAAK,KAAK,CAAC;CAC/B,SAAS,OAAO;EAEd,MAAM,IAAID,qBAAAA,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAIA,qBAAAA,eACR,yEACF;CAEF,OAAO;AACT"}
+{"version":3,"file":"fcm.cjs","names":["isRetryableStatus","PermanentError","base64url","pemToDer","Buffer"],"sources":["../src/fcm.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(Buffer.from(value, 'base64').toString()) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA6DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAIA,qBAAAA,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAIC,qBAAAA,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAIA,qBAAAA,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAKD,qBAAAA,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAIC,qBAAAA,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAASC,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAASA,YAAAA,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACAC,YAAAA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAME,YAAAA,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS,CAAC;CAC3D,SAAS,OAAO;EAEd,MAAM,IAAIH,qBAAAA,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAIA,qBAAAA,eACR,yEACF;CAEF,OAAO;AACT"}

package/dist/fcm.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.d.cts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAgBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}
+{"version":3,"file":"fcm.d.cts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAiBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}

package/dist/fcm.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.d.mts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAgBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}
+{"version":3,"file":"fcm.d.mts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAiBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}

package/dist/fcm.mjs

@@ -1,5 +1,6 @@
 import { PermanentError, isRetryableStatus } from "./engine/retry.mjs";
 import { base64url, pemToDer } from "./jwt.mjs";
+import { Buffer } from "node:buffer";
 //#region src/fcm.ts
 /**
 * How an FCM v1 answer is classified, after the API's error codes
@@ -179,7 +180,7 @@ async function signJwt(account, audience, scope, nowMs = Date.now()) {
 function serviceAccountFromBase64(value) {
 	let json;
 	try {
-		json = JSON.parse(atob(value));
+		json = JSON.parse(Buffer.from(value, "base64").toString());
 	} catch (error) {
 		throw new PermanentError("service account is not base64-encoded JSON", { cause: error });
 	}

package/dist/fcm.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.mjs","names":[],"sources":["../src/fcm.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(atob(value)) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA4DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAI,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAI,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAI,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAI,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAAS,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,KAAK,KAAK,CAAC;CAC/B,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAI,eACR,yEACF;CAEF,OAAO;AACT"}
+{"version":3,"file":"fcm.mjs","names":[],"sources":["../src/fcm.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(Buffer.from(value, 'base64').toString()) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAI,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAI,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAI,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAI,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAAS,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS,CAAC;CAC3D,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAI,eACR,yEACF;CAEF,OAAO;AACT"}

package/dist/host/channels.cjs

@@ -12,6 +12,7 @@ const require_webhooks = require("../webhooks.cjs");
 const require_webpush = require("../webpush.cjs");
 const require_host_ingest = require("./ingest.cjs");
 const require_host_senders = require("./senders.cjs");
+let node_buffer = require("node:buffer");
 //#region src/host/channels.ts
 /**
 * The outlets a `JourneyConfig` describes, assembled against the environment:
@@ -67,7 +68,7 @@ function identity(value) {
 /** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */
 async function secretDigest(secret) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-	return Array.from(new Uint8Array(digest).slice(0, 4), (b) => b.toString(16).padStart(2, "0")).join("");
+	return node_buffer.Buffer.from(digest.slice(0, 4)).toString("hex");
 }
 /**
 * A sender built on its first message, then kept for this call. `build` reads the secrets (and