@shware/workflow 4.1.0 → 5.0.0

package/dist/engine/condition.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"condition.cjs","names":["RECIPIENT_PROPERTY"],"sources":["../../src/engine/condition.ts"],"sourcesContent":["import type { ConditionIR, PropertyOperatorIR, ScalarIR } from '../ir';\nimport type { FactSource } from './ports';\nimport { RECIPIENT_PROPERTY } from './recipient';\n\n/**\n * Evaluation options.\n * - anchorMs: the earliest instant `performed` counts events from — the goal\n *   guard anchors at workflow entry (a conversion must happen *after* entry),\n *   waitUntil at the moment the wait began (a wake must not be satisfied by\n *   pre-existing history). Combined with `within` by taking the later bound.\n * - untilMs: the latest instant `performed` counts events up to — the goal's\n *   attribution window ends there, so an event after it is no conversion even\n *   when the check runs later (a resumed instance, a delayed wake).\n */\nexport interface EvaluateOptions {\n  anchorMs?: number;\n  untilMs?: number;\n}\n\n/**\n * ConditionIR evaluation: pure logic, with facts injected through FactSource,\n * so the D1 implementation and the in-memory test one share a single set of\n * semantics and cannot drift into two evaluators.\n */\nexport async function evaluateCondition(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts?: EvaluateOptions\n): Promise<boolean> {\n  return evaluate(condition, facts, nowMs, opts, []);\n}\n\n/**\n * `enclosing` is the chain of segment names currently being expanded. A\n * segment that reaches itself has no truth value to converge on, and left\n * unchecked the recursion runs until memory gives out, one D1 round trip per\n * level — inside a step, so Workflows retries it and the instance never gets\n * out. Failing immediately keeps it bounded, and the message names the cycle\n * because only a deployed bundle can fix it. Only the *path* is tracked, so a\n * diamond (two branches referencing one segment) still evaluates twice.\n */\nasync function evaluate(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts: EvaluateOptions | undefined,\n  enclosing: readonly string[]\n): Promise<boolean> {\n  switch (condition.type) {\n    case 'and': {\n      for (const child of condition.conditions) {\n        if (!(await evaluate(child, facts, nowMs, opts, enclosing))) return false;\n      }\n      return true;\n    }\n    case 'or': {\n      for (const child of condition.conditions) {\n        if (await evaluate(child, facts, nowMs, opts, enclosing)) return true;\n      }\n      return false;\n    }\n    case 'not':\n      return !(await evaluate(condition.condition, facts, nowMs, opts, enclosing));\n    case 'segment': {\n      if (enclosing.includes(condition.segment)) {\n        throw new Error(\n          `segment '${condition.segment}' references itself: ${[...enclosing, condition.segment].join(' -> ')}`\n        );\n      }\n      const def = await facts.getSegmentCondition(condition.segment);\n      if (def === undefined) {\n        throw new Error(`Unknown segment: '${condition.segment}' (bundle not deployed?)`);\n      }\n      return evaluate(def, facts, nowMs, opts, [...enclosing, condition.segment]);\n    }\n    case 'performed': {\n      const bounds: number[] = [];\n      if (condition.within !== undefined) bounds.push(nowMs - condition.within.ms);\n      if (opts?.anchorMs !== undefined) bounds.push(opts.anchorMs);\n      const sinceMs = bounds.length > 0 ? Math.max(...bounds) : undefined;\n      const count = await facts.countEvents(condition.event, {\n        ...(sinceMs !== undefined ? { sinceMs } : {}),\n        ...(opts?.untilMs !== undefined ? { untilMs: opts.untilMs } : {}),\n        ...(condition.where !== undefined ? { where: condition.where } : {}),\n      });\n      return count >= (condition.count ?? 1);\n    }\n    case 'property': {\n      const actual = await facts.getProperty(condition.path);\n      return compareProperty(condition, actual);\n    }\n    case 'reachable': {\n      if (await facts.isSuppressed?.(condition.channel)) return false;\n      if (condition.channel === 'push') return (await facts.listDevices()).length > 0;\n      const path = RECIPIENT_PROPERTY[condition.channel];\n      // in_app, slack and discord need no address: a signed-in user is reachable in the app, and\n      // the webhook channels post to a team channel, not to the user\n      return path === undefined || (await facts.getProperty(path)) !== undefined;\n    }\n    case 'payload':\n      // Placement is validated at compile; reaching here means hand-built IR\n      throw new Error(\n        'payload conditions are only valid inside performed({ where }) or a trigger where clause'\n      );\n  }\n}\n\n/**\n * Evaluate a where tree against one event's payload. Shared by performed\n * counting (FactSource implementations) and the ingest router's trigger gate.\n * Dotted paths descend nested objects; a missing or non-scalar leaf behaves\n * like a missing property (exists sees objects, comparisons do not).\n */\nexport function matchesWhere(payload: unknown, where: ConditionIR): boolean {\n  switch (where.type) {\n    case 'and':\n      return where.conditions.every((child) => matchesWhere(payload, child));\n    case 'or':\n      return where.conditions.some((child) => matchesWhere(payload, child));\n    case 'not':\n      return !matchesWhere(payload, where.condition);\n    case 'payload': {\n      const raw = valueAtPath(payload, where.path);\n      if (where.op === 'exists') return raw !== undefined && raw !== null;\n      if (where.op === 'not_exists') return raw === undefined || raw === null;\n      const actual =\n        typeof raw === 'string' || typeof raw === 'number' || typeof raw === 'boolean'\n          ? raw\n          : undefined;\n      return compareProperty(where, actual);\n    }\n    default:\n      // compileBundle rejects these; defend against hand-built IR\n      throw new Error(`where clause may not contain a '${where.type}' condition`);\n  }\n}\n\nfunction valueAtPath(payload: unknown, path: string): unknown {\n  let current: unknown = payload;\n  for (const key of path.split('.')) {\n    if (current === null || typeof current !== 'object') return undefined;\n    current = (current as Record<string, unknown>)[key];\n  }\n  return current;\n}\n\nfunction compareProperty(\n  condition: {\n    op: PropertyOperatorIR;\n    value?: ScalarIR | undefined;\n    values?: ScalarIR[] | undefined;\n  },\n  actual: ScalarIR | undefined\n): boolean {\n  const { op, value, values } = condition;\n  switch (op) {\n    case 'exists':\n      return actual !== undefined;\n    case 'not_exists':\n      return actual === undefined;\n    case 'eq':\n      return actual === value;\n    case 'ne':\n      return actual !== value;\n    case 'gt':\n      return actual !== undefined && value !== undefined && actual > value;\n    case 'gte':\n      return actual !== undefined && value !== undefined && actual >= value;\n    case 'lt':\n      return actual !== undefined && value !== undefined && actual < value;\n    case 'lte':\n      return actual !== undefined && value !== undefined && actual <= value;\n    case 'between':\n      return isBetween(actual, values);\n    case 'not_between':\n      // A missing property is outside any range, mirroring not_in_array.\n      return !isBetween(actual, values);\n    case 'in_array':\n      return actual !== undefined && (values ?? []).includes(actual);\n    case 'not_in_array':\n      return actual === undefined || !(values ?? []).includes(actual);\n    case 'contains':\n      return typeof actual === 'string' && typeof value === 'string' && actual.includes(value);\n    case 'not_contains':\n      return !(typeof actual === 'string' && typeof value === 'string' && actual.includes(value));\n  }\n}\n\nfunction isBetween(actual: ScalarIR | undefined, values: ScalarIR[] | undefined): boolean {\n  if (actual === undefined || values === undefined || values.length < 2) return false;\n  const [min, max] = values;\n  return actual >= min && actual <= max;\n}\n\n/**\n * Wake-up channel for profile changes: a property predicate has no event name\n * of its own, so subscriptions use this reserved name and the ingest router\n * fires it on every /identify. The '$' prefix marks internal names — real\n * events may never use it (the router rejects them).\n */\nexport const PROFILE_UPDATED_EVENT = '$profile_updated';\n\n/**\n * The wake-up channel for one profile property: `$profile_updated:<path>`. A property predicate\n * subscribes to its own property's channel, and `/identify` fires one per property it patched —\n * so an identify that touches `plan` does not wake a wait on `email`.\n */\nexport function profileUpdatedEvent(path: string): string {\n  return `${PROFILE_UPDATED_EVENT}:${path}`;\n}\n\n/**\n * Wake-up channel for device changes: a device registered for the user, moved to another account\n * or was unbound or removed (`POST /devices`, `/devices/unbind`, `/devices/remove`). `reachable('push')` subscribes to it.\n */\nexport const DEVICES_UPDATED_EVENT = '$devices_updated';\n\n/**\n * The set of event names a condition cares about — what wait_until subscribes\n * to for wake-ups. `performed` contributes its event; a property predicate\n * contributes its property's channel (`profileUpdatedEvent(path)`, so an\n * /identify touching that property wakes the wait and one touching another\n * does not); `reachable` contributes the recipient property's channel, or the\n * device channel for push (in_app, slack and discord have no address to wait\n * on). Segment references are expanded, which is why a FactSource is needed to\n * resolve their definitions.\n */\nexport async function relevantEvents(condition: ConditionIR, facts: FactSource): Promise<string[]> {\n  const found = new Set<string>();\n  // Names already expanded. The result is a union, so re-walking a segment can\n  // only add what is already there — and a segment that reaches itself would\n  // otherwise recurse until the stack blows, taking a D1 read per level.\n  const expanded = new Set<string>();\n  async function walk(c: ConditionIR): Promise<void> {\n    switch (c.type) {\n      case 'and':\n      case 'or':\n        for (const child of c.conditions) await walk(child);\n        break;\n      case 'not':\n        await walk(c.condition);\n        break;\n      case 'performed':\n        found.add(c.event);\n        break;\n      case 'segment': {\n        if (expanded.has(c.segment)) break;\n        expanded.add(c.segment);\n        const def = await facts.getSegmentCondition(c.segment);\n        if (def) await walk(def);\n        break;\n      }\n      case 'property':\n        found.add(profileUpdatedEvent(c.path));\n        break;\n      case 'reachable': {\n        if (c.channel === 'push') {\n          found.add(DEVICES_UPDATED_EVENT);\n          break;\n        }\n        const path = RECIPIENT_PROPERTY[c.channel];\n        if (path !== undefined) found.add(profileUpdatedEvent(path));\n        break;\n      }\n      case 'payload':\n        break; // only appears inside performed.where, which is not walked\n    }\n  }\n  await walk(condition);\n  return [...found];\n}\n"],"mappings":";;;;;;;;AAwBA,eAAsB,kBACpB,WACA,OACA,OACA,MACkB;CAClB,OAAO,SAAS,WAAW,OAAO,OAAO,MAAM,CAAC,CAAC;AACnD;;;;;;;;;;AAWA,eAAe,SACb,WACA,OACA,OACA,MACA,WACkB;CAClB,QAAQ,UAAU,MAAlB;EACE,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,CAAE,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAI,OAAO;GAEtE,OAAO;EAET,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAG,OAAO;GAEnE,OAAO;EAET,KAAK,OACH,OAAO,CAAE,MAAM,SAAS,UAAU,WAAW,OAAO,OAAO,MAAM,SAAS;EAC5E,KAAK,WAAW;GACd,IAAI,UAAU,SAAS,UAAU,OAAO,GACtC,MAAM,IAAI,MACR,YAAY,UAAU,QAAQ,uBAAuB,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC,CAAC,KAAK,MAAM,GACpG;GAEF,MAAM,MAAM,MAAM,MAAM,oBAAoB,UAAU,OAAO;GAC7D,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MAAM,qBAAqB,UAAU,QAAQ,yBAAyB;GAElF,OAAO,SAAS,KAAK,OAAO,OAAO,MAAM,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC;EAC5E;EACA,KAAK,aAAa;GAChB,MAAM,SAAmB,CAAC;GAC1B,IAAI,UAAU,WAAW,KAAA,GAAW,OAAO,KAAK,QAAQ,UAAU,OAAO,EAAE;GAC3E,IAAI,MAAM,aAAa,KAAA,GAAW,OAAO,KAAK,KAAK,QAAQ;GAC3D,MAAM,UAAU,OAAO,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,KAAA;GAM1D,OAAO,MALa,MAAM,YAAY,UAAU,OAAO;IACrD,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;IAC3C,GAAI,MAAM,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;IAC/D,GAAI,UAAU,UAAU,KAAA,IAAY,EAAE,OAAO,UAAU,MAAM,IAAI,CAAC;GACpE,CAAC,MACgB,UAAU,SAAS;EACtC;EACA,KAAK,YAEH,OAAO,gBAAgB,WAAW,MADb,MAAM,YAAY,UAAU,IAAI,CACb;EAE1C,KAAK,aAAa;GAChB,IAAI,MAAM,MAAM,eAAe,UAAU,OAAO,GAAG,OAAO;GAC1D,IAAI,UAAU,YAAY,QAAQ,QAAQ,MAAM,MAAM,YAAY,EAAA,CAAG,SAAS;GAC9E,MAAM,OAAOA,yBAAAA,mBAAmB,UAAU;GAG1C,OAAO,SAAS,KAAA,KAAc,MAAM,MAAM,YAAY,IAAI,MAAO,KAAA;EACnE;EACA,KAAK,WAEH,MAAM,IAAI,MACR,yFACF;CACJ;AACF;;;;;;;AAQA,SAAgB,aAAa,SAAkB,OAA6B;CAC1E,QAAQ,MAAM,MAAd;EACE,KAAK,OACH,OAAO,MAAM,WAAW,OAAO,UAAU,aAAa,SAAS,KAAK,CAAC;EACvE,KAAK,MACH,OAAO,MAAM,WAAW,MAAM,UAAU,aAAa,SAAS,KAAK,CAAC;EACtE,KAAK,OACH,OAAO,CAAC,aAAa,SAAS,MAAM,SAAS;EAC/C,KAAK,WAAW;GACd,MAAM,MAAM,YAAY,SAAS,MAAM,IAAI;GAC3C,IAAI,MAAM,OAAO,UAAU,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAC/D,IAAI,MAAM,OAAO,cAAc,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAKnE,OAAO,gBAAgB,OAHrB,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,YACjE,MACA,KAAA,CAC8B;EACtC;EACA,SAEE,MAAM,IAAI,MAAM,mCAAmC,MAAM,KAAK,YAAY;CAC9E;AACF;AAEA,SAAS,YAAY,SAAkB,MAAuB;CAC5D,IAAI,UAAmB;CACvB,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,GAAG;EACjC,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU,OAAO,KAAA;EAC5D,UAAW,QAAoC;CACjD;CACA,OAAO;AACT;AAEA,SAAS,gBACP,WAKA,QACS;CACT,MAAM,EAAE,IAAI,OAAO,WAAW;CAC9B,QAAQ,IAAR;EACE,KAAK,UACH,OAAO,WAAW,KAAA;EACpB,KAAK,cACH,OAAO,WAAW,KAAA;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,WACH,OAAO,UAAU,QAAQ,MAAM;EACjC,KAAK,eAEH,OAAO,CAAC,UAAU,QAAQ,MAAM;EAClC,KAAK,YACH,OAAO,WAAW,KAAA,MAAc,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAC/D,KAAK,gBACH,OAAO,WAAW,KAAA,KAAa,EAAE,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAChE,KAAK,YACH,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;EACzF,KAAK,gBACH,OAAO,EAAE,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;CAC7F;AACF;AAEA,SAAS,UAAU,QAA8B,QAAyC;CACxF,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,KAAa,OAAO,SAAS,GAAG,OAAO;CAC9E,MAAM,CAAC,KAAK,OAAO;CACnB,OAAO,UAAU,OAAO,UAAU;AACpC;;;;;;;AAQA,MAAa,wBAAwB;;;;;;AAOrC,SAAgB,oBAAoB,MAAsB;CACxD,OAAO,GAAG,sBAAsB,GAAG;AACrC;;;;;AAMA,MAAa,wBAAwB;;;;;;;;;;;AAYrC,eAAsB,eAAe,WAAwB,OAAsC;CACjG,MAAM,wBAAQ,IAAI,IAAY;CAI9B,MAAM,2BAAW,IAAI,IAAY;CACjC,eAAe,KAAK,GAA+B;EACjD,QAAQ,EAAE,MAAV;GACE,KAAK;GACL,KAAK;IACH,KAAK,MAAM,SAAS,EAAE,YAAY,MAAM,KAAK,KAAK;IAClD;GACF,KAAK;IACH,MAAM,KAAK,EAAE,SAAS;IACtB;GACF,KAAK;IACH,MAAM,IAAI,EAAE,KAAK;IACjB;GACF,KAAK,WAAW;IACd,IAAI,SAAS,IAAI,EAAE,OAAO,GAAG;IAC7B,SAAS,IAAI,EAAE,OAAO;IACtB,MAAM,MAAM,MAAM,MAAM,oBAAoB,EAAE,OAAO;IACrD,IAAI,KAAK,MAAM,KAAK,GAAG;IACvB;GACF;GACA,KAAK;IACH,MAAM,IAAI,oBAAoB,EAAE,IAAI,CAAC;IACrC;GACF,KAAK,aAAa;IAChB,IAAI,EAAE,YAAY,QAAQ;KACxB,MAAM,IAAI,qBAAqB;KAC/B;IACF;IACA,MAAM,OAAOA,yBAAAA,mBAAmB,EAAE;IAClC,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,oBAAoB,IAAI,CAAC;IAC3D;GACF;EAGF;CACF;CACA,MAAM,KAAK,SAAS;CACpB,OAAO,CAAC,GAAG,KAAK;AAClB"}
+{"version":3,"file":"condition.cjs","names":["RECIPIENT_PROPERTY"],"sources":["../../src/engine/condition.ts"],"sourcesContent":["import type { ConditionIR, PropertyOperatorIR, ScalarIR } from '../ir';\nimport type { FactSource } from './ports';\nimport { RECIPIENT_PROPERTY } from './recipient';\n\n/**\n * Evaluation options.\n * - anchorMs: the earliest instant `performed` counts events from — the goal\n *   guard anchors at workflow entry (a conversion must happen *after* entry),\n *   waitUntil at the moment the wait began (a wake must not be satisfied by\n *   pre-existing history). Combined with `within` by taking the later bound.\n * - untilMs: the latest instant `performed` counts events up to — the goal's\n *   attribution window ends there, so an event after it is no conversion even\n *   when the check runs later (a resumed instance, a delayed wake).\n */\nexport interface EvaluateOptions {\n  anchorMs?: number;\n  untilMs?: number;\n}\n\n/**\n * ConditionIR evaluation: pure logic, with facts injected through FactSource,\n * so the store-backed implementation and the in-memory test one share a single set of\n * semantics and cannot drift into two evaluators.\n */\nexport async function evaluateCondition(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts?: EvaluateOptions\n): Promise<boolean> {\n  return evaluate(condition, facts, nowMs, opts, []);\n}\n\n/**\n * `enclosing` is the chain of segment names currently being expanded. A\n * segment that reaches itself has no truth value to converge on, and left\n * unchecked the recursion runs until memory gives out, one store round trip per\n * level — inside a step, so Workflows retries it and the instance never gets\n * out. Failing immediately keeps it bounded, and the message names the cycle\n * because only a deployed bundle can fix it. Only the *path* is tracked, so a\n * diamond (two branches referencing one segment) still evaluates twice.\n */\nasync function evaluate(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts: EvaluateOptions | undefined,\n  enclosing: readonly string[]\n): Promise<boolean> {\n  switch (condition.type) {\n    case 'and': {\n      for (const child of condition.conditions) {\n        if (!(await evaluate(child, facts, nowMs, opts, enclosing))) return false;\n      }\n      return true;\n    }\n    case 'or': {\n      for (const child of condition.conditions) {\n        if (await evaluate(child, facts, nowMs, opts, enclosing)) return true;\n      }\n      return false;\n    }\n    case 'not':\n      return !(await evaluate(condition.condition, facts, nowMs, opts, enclosing));\n    case 'segment': {\n      if (enclosing.includes(condition.segment)) {\n        throw new Error(\n          `segment '${condition.segment}' references itself: ${[...enclosing, condition.segment].join(' -> ')}`\n        );\n      }\n      const def = await facts.getSegmentCondition(condition.segment);\n      if (def === undefined) {\n        throw new Error(`Unknown segment: '${condition.segment}' (bundle not deployed?)`);\n      }\n      return evaluate(def, facts, nowMs, opts, [...enclosing, condition.segment]);\n    }\n    case 'performed': {\n      const bounds: number[] = [];\n      if (condition.within !== undefined) bounds.push(nowMs - condition.within.ms);\n      if (opts?.anchorMs !== undefined) bounds.push(opts.anchorMs);\n      const sinceMs = bounds.length > 0 ? Math.max(...bounds) : undefined;\n      const count = await facts.countEvents(condition.event, {\n        ...(sinceMs !== undefined ? { sinceMs } : {}),\n        ...(opts?.untilMs !== undefined ? { untilMs: opts.untilMs } : {}),\n        ...(condition.where !== undefined ? { where: condition.where } : {}),\n      });\n      return count >= (condition.count ?? 1);\n    }\n    case 'property': {\n      const actual = await facts.getProperty(condition.path);\n      return compareProperty(condition, actual);\n    }\n    case 'reachable': {\n      if (await facts.isSuppressed?.(condition.channel)) return false;\n      if (condition.channel === 'push') return (await facts.listDevices()).length > 0;\n      const path = RECIPIENT_PROPERTY[condition.channel];\n      // in_app, slack and discord need no address: a signed-in user is reachable in the app, and\n      // the webhook channels post to a team channel, not to the user\n      return path === undefined || (await facts.getProperty(path)) !== undefined;\n    }\n    case 'payload':\n      // Placement is validated at compile; reaching here means hand-built IR\n      throw new Error(\n        'payload conditions are only valid inside performed({ where }) or a trigger where clause'\n      );\n  }\n}\n\n/**\n * Evaluate a where tree against one event's payload. Shared by performed\n * counting (FactSource implementations) and the ingest router's trigger gate.\n * Dotted paths descend nested objects; a missing or non-scalar leaf behaves\n * like a missing property (exists sees objects, comparisons do not).\n */\nexport function matchesWhere(payload: unknown, where: ConditionIR): boolean {\n  switch (where.type) {\n    case 'and':\n      return where.conditions.every((child) => matchesWhere(payload, child));\n    case 'or':\n      return where.conditions.some((child) => matchesWhere(payload, child));\n    case 'not':\n      return !matchesWhere(payload, where.condition);\n    case 'payload': {\n      const raw = valueAtPath(payload, where.path);\n      if (where.op === 'exists') return raw !== undefined && raw !== null;\n      if (where.op === 'not_exists') return raw === undefined || raw === null;\n      const actual =\n        typeof raw === 'string' || typeof raw === 'number' || typeof raw === 'boolean'\n          ? raw\n          : undefined;\n      return compareProperty(where, actual);\n    }\n    default:\n      // compileBundle rejects these; defend against hand-built IR\n      throw new Error(`where clause may not contain a '${where.type}' condition`);\n  }\n}\n\nfunction valueAtPath(payload: unknown, path: string): unknown {\n  let current: unknown = payload;\n  for (const key of path.split('.')) {\n    if (current === null || typeof current !== 'object') return undefined;\n    current = (current as Record<string, unknown>)[key];\n  }\n  return current;\n}\n\nfunction compareProperty(\n  condition: {\n    op: PropertyOperatorIR;\n    value?: ScalarIR | undefined;\n    values?: ScalarIR[] | undefined;\n  },\n  actual: ScalarIR | undefined\n): boolean {\n  const { op, value, values } = condition;\n  switch (op) {\n    case 'exists':\n      return actual !== undefined;\n    case 'not_exists':\n      return actual === undefined;\n    case 'eq':\n      return actual === value;\n    case 'ne':\n      return actual !== value;\n    case 'gt':\n      return actual !== undefined && value !== undefined && actual > value;\n    case 'gte':\n      return actual !== undefined && value !== undefined && actual >= value;\n    case 'lt':\n      return actual !== undefined && value !== undefined && actual < value;\n    case 'lte':\n      return actual !== undefined && value !== undefined && actual <= value;\n    case 'between':\n      return isBetween(actual, values);\n    case 'not_between':\n      // A missing property is outside any range, mirroring not_in_array.\n      return !isBetween(actual, values);\n    case 'in_array':\n      return actual !== undefined && (values ?? []).includes(actual);\n    case 'not_in_array':\n      return actual === undefined || !(values ?? []).includes(actual);\n    case 'contains':\n      return typeof actual === 'string' && typeof value === 'string' && actual.includes(value);\n    case 'not_contains':\n      return !(typeof actual === 'string' && typeof value === 'string' && actual.includes(value));\n  }\n}\n\nfunction isBetween(actual: ScalarIR | undefined, values: ScalarIR[] | undefined): boolean {\n  if (actual === undefined || values === undefined || values.length < 2) return false;\n  const [min, max] = values;\n  return actual >= min && actual <= max;\n}\n\n/**\n * Wake-up channel for profile changes: a property predicate has no event name\n * of its own, so subscriptions use this reserved name and the ingest router\n * fires it on every /identify. The '$' prefix marks internal names — real\n * events may never use it (the router rejects them).\n */\nexport const PROFILE_UPDATED_EVENT = '$profile_updated';\n\n/**\n * The wake-up channel for one profile property: `$profile_updated:<path>`. A property predicate\n * subscribes to its own property's channel, and `/identify` fires one per property it patched —\n * so an identify that touches `plan` does not wake a wait on `email`.\n */\nexport function profileUpdatedEvent(path: string): string {\n  return `${PROFILE_UPDATED_EVENT}:${path}`;\n}\n\n/**\n * Wake-up channel for device changes: a device registered for the user, moved to another account\n * or was unbound or removed (`POST /devices`, `/devices/unbind`, `/devices/remove`). `reachable('push')` subscribes to it.\n */\nexport const DEVICES_UPDATED_EVENT = '$devices_updated';\n\n/**\n * The set of event names a condition cares about — what wait_until subscribes\n * to for wake-ups. `performed` contributes its event; a property predicate\n * contributes its property's channel (`profileUpdatedEvent(path)`, so an\n * /identify touching that property wakes the wait and one touching another\n * does not); `reachable` contributes the recipient property's channel, or the\n * device channel for push (in_app, slack and discord have no address to wait\n * on). Segment references are expanded, which is why a FactSource is needed to\n * resolve their definitions.\n */\nexport async function relevantEvents(condition: ConditionIR, facts: FactSource): Promise<string[]> {\n  const found = new Set<string>();\n  // Names already expanded. The result is a union, so re-walking a segment can\n  // only add what is already there — and a segment that reaches itself would\n  // otherwise recurse until the stack blows, taking a store read per level.\n  const expanded = new Set<string>();\n  async function walk(c: ConditionIR): Promise<void> {\n    switch (c.type) {\n      case 'and':\n      case 'or':\n        for (const child of c.conditions) await walk(child);\n        break;\n      case 'not':\n        await walk(c.condition);\n        break;\n      case 'performed':\n        found.add(c.event);\n        break;\n      case 'segment': {\n        if (expanded.has(c.segment)) break;\n        expanded.add(c.segment);\n        const def = await facts.getSegmentCondition(c.segment);\n        if (def) await walk(def);\n        break;\n      }\n      case 'property':\n        found.add(profileUpdatedEvent(c.path));\n        break;\n      case 'reachable': {\n        if (c.channel === 'push') {\n          found.add(DEVICES_UPDATED_EVENT);\n          break;\n        }\n        const path = RECIPIENT_PROPERTY[c.channel];\n        if (path !== undefined) found.add(profileUpdatedEvent(path));\n        break;\n      }\n      case 'payload':\n        break; // only appears inside performed.where, which is not walked\n    }\n  }\n  await walk(condition);\n  return [...found];\n}\n"],"mappings":";;;;;;;;AAwBA,eAAsB,kBACpB,WACA,OACA,OACA,MACkB;CAClB,OAAO,SAAS,WAAW,OAAO,OAAO,MAAM,CAAC,CAAC;AACnD;;;;;;;;;;AAWA,eAAe,SACb,WACA,OACA,OACA,MACA,WACkB;CAClB,QAAQ,UAAU,MAAlB;EACE,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,CAAE,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAI,OAAO;GAEtE,OAAO;EAET,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAG,OAAO;GAEnE,OAAO;EAET,KAAK,OACH,OAAO,CAAE,MAAM,SAAS,UAAU,WAAW,OAAO,OAAO,MAAM,SAAS;EAC5E,KAAK,WAAW;GACd,IAAI,UAAU,SAAS,UAAU,OAAO,GACtC,MAAM,IAAI,MACR,YAAY,UAAU,QAAQ,uBAAuB,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC,CAAC,KAAK,MAAM,GACpG;GAEF,MAAM,MAAM,MAAM,MAAM,oBAAoB,UAAU,OAAO;GAC7D,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MAAM,qBAAqB,UAAU,QAAQ,yBAAyB;GAElF,OAAO,SAAS,KAAK,OAAO,OAAO,MAAM,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC;EAC5E;EACA,KAAK,aAAa;GAChB,MAAM,SAAmB,CAAC;GAC1B,IAAI,UAAU,WAAW,KAAA,GAAW,OAAO,KAAK,QAAQ,UAAU,OAAO,EAAE;GAC3E,IAAI,MAAM,aAAa,KAAA,GAAW,OAAO,KAAK,KAAK,QAAQ;GAC3D,MAAM,UAAU,OAAO,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,KAAA;GAM1D,OAAO,MALa,MAAM,YAAY,UAAU,OAAO;IACrD,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;IAC3C,GAAI,MAAM,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;IAC/D,GAAI,UAAU,UAAU,KAAA,IAAY,EAAE,OAAO,UAAU,MAAM,IAAI,CAAC;GACpE,CAAC,MACgB,UAAU,SAAS;EACtC;EACA,KAAK,YAEH,OAAO,gBAAgB,WAAW,MADb,MAAM,YAAY,UAAU,IAAI,CACb;EAE1C,KAAK,aAAa;GAChB,IAAI,MAAM,MAAM,eAAe,UAAU,OAAO,GAAG,OAAO;GAC1D,IAAI,UAAU,YAAY,QAAQ,QAAQ,MAAM,MAAM,YAAY,EAAA,CAAG,SAAS;GAC9E,MAAM,OAAOA,yBAAAA,mBAAmB,UAAU;GAG1C,OAAO,SAAS,KAAA,KAAc,MAAM,MAAM,YAAY,IAAI,MAAO,KAAA;EACnE;EACA,KAAK,WAEH,MAAM,IAAI,MACR,yFACF;CACJ;AACF;;;;;;;AAQA,SAAgB,aAAa,SAAkB,OAA6B;CAC1E,QAAQ,MAAM,MAAd;EACE,KAAK,OACH,OAAO,MAAM,WAAW,OAAO,UAAU,aAAa,SAAS,KAAK,CAAC;EACvE,KAAK,MACH,OAAO,MAAM,WAAW,MAAM,UAAU,aAAa,SAAS,KAAK,CAAC;EACtE,KAAK,OACH,OAAO,CAAC,aAAa,SAAS,MAAM,SAAS;EAC/C,KAAK,WAAW;GACd,MAAM,MAAM,YAAY,SAAS,MAAM,IAAI;GAC3C,IAAI,MAAM,OAAO,UAAU,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAC/D,IAAI,MAAM,OAAO,cAAc,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAKnE,OAAO,gBAAgB,OAHrB,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,YACjE,MACA,KAAA,CAC8B;EACtC;EACA,SAEE,MAAM,IAAI,MAAM,mCAAmC,MAAM,KAAK,YAAY;CAC9E;AACF;AAEA,SAAS,YAAY,SAAkB,MAAuB;CAC5D,IAAI,UAAmB;CACvB,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,GAAG;EACjC,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU,OAAO,KAAA;EAC5D,UAAW,QAAoC;CACjD;CACA,OAAO;AACT;AAEA,SAAS,gBACP,WAKA,QACS;CACT,MAAM,EAAE,IAAI,OAAO,WAAW;CAC9B,QAAQ,IAAR;EACE,KAAK,UACH,OAAO,WAAW,KAAA;EACpB,KAAK,cACH,OAAO,WAAW,KAAA;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,WACH,OAAO,UAAU,QAAQ,MAAM;EACjC,KAAK,eAEH,OAAO,CAAC,UAAU,QAAQ,MAAM;EAClC,KAAK,YACH,OAAO,WAAW,KAAA,MAAc,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAC/D,KAAK,gBACH,OAAO,WAAW,KAAA,KAAa,EAAE,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAChE,KAAK,YACH,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;EACzF,KAAK,gBACH,OAAO,EAAE,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;CAC7F;AACF;AAEA,SAAS,UAAU,QAA8B,QAAyC;CACxF,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,KAAa,OAAO,SAAS,GAAG,OAAO;CAC9E,MAAM,CAAC,KAAK,OAAO;CACnB,OAAO,UAAU,OAAO,UAAU;AACpC;;;;;;;AAQA,MAAa,wBAAwB;;;;;;AAOrC,SAAgB,oBAAoB,MAAsB;CACxD,OAAO,GAAG,sBAAsB,GAAG;AACrC;;;;;AAMA,MAAa,wBAAwB;;;;;;;;;;;AAYrC,eAAsB,eAAe,WAAwB,OAAsC;CACjG,MAAM,wBAAQ,IAAI,IAAY;CAI9B,MAAM,2BAAW,IAAI,IAAY;CACjC,eAAe,KAAK,GAA+B;EACjD,QAAQ,EAAE,MAAV;GACE,KAAK;GACL,KAAK;IACH,KAAK,MAAM,SAAS,EAAE,YAAY,MAAM,KAAK,KAAK;IAClD;GACF,KAAK;IACH,MAAM,KAAK,EAAE,SAAS;IACtB;GACF,KAAK;IACH,MAAM,IAAI,EAAE,KAAK;IACjB;GACF,KAAK,WAAW;IACd,IAAI,SAAS,IAAI,EAAE,OAAO,GAAG;IAC7B,SAAS,IAAI,EAAE,OAAO;IACtB,MAAM,MAAM,MAAM,MAAM,oBAAoB,EAAE,OAAO;IACrD,IAAI,KAAK,MAAM,KAAK,GAAG;IACvB;GACF;GACA,KAAK;IACH,MAAM,IAAI,oBAAoB,EAAE,IAAI,CAAC;IACrC;GACF,KAAK,aAAa;IAChB,IAAI,EAAE,YAAY,QAAQ;KACxB,MAAM,IAAI,qBAAqB;KAC/B;IACF;IACA,MAAM,OAAOA,yBAAAA,mBAAmB,EAAE;IAClC,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,oBAAoB,IAAI,CAAC;IAC3D;GACF;EAGF;CACF;CACA,MAAM,KAAK,SAAS;CACpB,OAAO,CAAC,GAAG,KAAK;AAClB"}

package/dist/engine/condition.d.cts

@@ -17,7 +17,7 @@ export interface EvaluateOptions {
 }
 /**
  * ConditionIR evaluation: pure logic, with facts injected through FactSource,
- * so the D1 implementation and the in-memory test one share a single set of
+ * so the store-backed implementation and the in-memory test one share a single set of
  * semantics and cannot drift into two evaluators.
  */
 export declare function evaluateCondition(condition: ConditionIR, facts: FactSource, nowMs: number, opts?: EvaluateOptions): Promise<boolean>;

package/dist/engine/condition.d.mts

@@ -17,7 +17,7 @@ export interface EvaluateOptions {
 }
 /**
  * ConditionIR evaluation: pure logic, with facts injected through FactSource,
- * so the D1 implementation and the in-memory test one share a single set of
+ * so the store-backed implementation and the in-memory test one share a single set of
  * semantics and cannot drift into two evaluators.
  */
 export declare function evaluateCondition(condition: ConditionIR, facts: FactSource, nowMs: number, opts?: EvaluateOptions): Promise<boolean>;

package/dist/engine/condition.mjs

@@ -2,7 +2,7 @@ import { RECIPIENT_PROPERTY } from "./recipient.mjs";
 //#region src/engine/condition.ts
 /**
 * ConditionIR evaluation: pure logic, with facts injected through FactSource,
-* so the D1 implementation and the in-memory test one share a single set of
+* so the store-backed implementation and the in-memory test one share a single set of
 * semantics and cannot drift into two evaluators.
 */
 async function evaluateCondition(condition, facts, nowMs, opts) {
@@ -11,7 +11,7 @@ async function evaluateCondition(condition, facts, nowMs, opts) {
 /**
 * `enclosing` is the chain of segment names currently being expanded. A
 * segment that reaches itself has no truth value to converge on, and left
-* unchecked the recursion runs until memory gives out, one D1 round trip per
+* unchecked the recursion runs until memory gives out, one store round trip per
 * level — inside a step, so Workflows retries it and the instance never gets
 * out. Failing immediately keeps it bounded, and the message names the cycle
 * because only a deployed bundle can fix it. Only the *path* is tracked, so a

package/dist/engine/condition.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"condition.mjs","names":[],"sources":["../../src/engine/condition.ts"],"sourcesContent":["import type { ConditionIR, PropertyOperatorIR, ScalarIR } from '../ir';\nimport type { FactSource } from './ports';\nimport { RECIPIENT_PROPERTY } from './recipient';\n\n/**\n * Evaluation options.\n * - anchorMs: the earliest instant `performed` counts events from — the goal\n *   guard anchors at workflow entry (a conversion must happen *after* entry),\n *   waitUntil at the moment the wait began (a wake must not be satisfied by\n *   pre-existing history). Combined with `within` by taking the later bound.\n * - untilMs: the latest instant `performed` counts events up to — the goal's\n *   attribution window ends there, so an event after it is no conversion even\n *   when the check runs later (a resumed instance, a delayed wake).\n */\nexport interface EvaluateOptions {\n  anchorMs?: number;\n  untilMs?: number;\n}\n\n/**\n * ConditionIR evaluation: pure logic, with facts injected through FactSource,\n * so the D1 implementation and the in-memory test one share a single set of\n * semantics and cannot drift into two evaluators.\n */\nexport async function evaluateCondition(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts?: EvaluateOptions\n): Promise<boolean> {\n  return evaluate(condition, facts, nowMs, opts, []);\n}\n\n/**\n * `enclosing` is the chain of segment names currently being expanded. A\n * segment that reaches itself has no truth value to converge on, and left\n * unchecked the recursion runs until memory gives out, one D1 round trip per\n * level — inside a step, so Workflows retries it and the instance never gets\n * out. Failing immediately keeps it bounded, and the message names the cycle\n * because only a deployed bundle can fix it. Only the *path* is tracked, so a\n * diamond (two branches referencing one segment) still evaluates twice.\n */\nasync function evaluate(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts: EvaluateOptions | undefined,\n  enclosing: readonly string[]\n): Promise<boolean> {\n  switch (condition.type) {\n    case 'and': {\n      for (const child of condition.conditions) {\n        if (!(await evaluate(child, facts, nowMs, opts, enclosing))) return false;\n      }\n      return true;\n    }\n    case 'or': {\n      for (const child of condition.conditions) {\n        if (await evaluate(child, facts, nowMs, opts, enclosing)) return true;\n      }\n      return false;\n    }\n    case 'not':\n      return !(await evaluate(condition.condition, facts, nowMs, opts, enclosing));\n    case 'segment': {\n      if (enclosing.includes(condition.segment)) {\n        throw new Error(\n          `segment '${condition.segment}' references itself: ${[...enclosing, condition.segment].join(' -> ')}`\n        );\n      }\n      const def = await facts.getSegmentCondition(condition.segment);\n      if (def === undefined) {\n        throw new Error(`Unknown segment: '${condition.segment}' (bundle not deployed?)`);\n      }\n      return evaluate(def, facts, nowMs, opts, [...enclosing, condition.segment]);\n    }\n    case 'performed': {\n      const bounds: number[] = [];\n      if (condition.within !== undefined) bounds.push(nowMs - condition.within.ms);\n      if (opts?.anchorMs !== undefined) bounds.push(opts.anchorMs);\n      const sinceMs = bounds.length > 0 ? Math.max(...bounds) : undefined;\n      const count = await facts.countEvents(condition.event, {\n        ...(sinceMs !== undefined ? { sinceMs } : {}),\n        ...(opts?.untilMs !== undefined ? { untilMs: opts.untilMs } : {}),\n        ...(condition.where !== undefined ? { where: condition.where } : {}),\n      });\n      return count >= (condition.count ?? 1);\n    }\n    case 'property': {\n      const actual = await facts.getProperty(condition.path);\n      return compareProperty(condition, actual);\n    }\n    case 'reachable': {\n      if (await facts.isSuppressed?.(condition.channel)) return false;\n      if (condition.channel === 'push') return (await facts.listDevices()).length > 0;\n      const path = RECIPIENT_PROPERTY[condition.channel];\n      // in_app, slack and discord need no address: a signed-in user is reachable in the app, and\n      // the webhook channels post to a team channel, not to the user\n      return path === undefined || (await facts.getProperty(path)) !== undefined;\n    }\n    case 'payload':\n      // Placement is validated at compile; reaching here means hand-built IR\n      throw new Error(\n        'payload conditions are only valid inside performed({ where }) or a trigger where clause'\n      );\n  }\n}\n\n/**\n * Evaluate a where tree against one event's payload. Shared by performed\n * counting (FactSource implementations) and the ingest router's trigger gate.\n * Dotted paths descend nested objects; a missing or non-scalar leaf behaves\n * like a missing property (exists sees objects, comparisons do not).\n */\nexport function matchesWhere(payload: unknown, where: ConditionIR): boolean {\n  switch (where.type) {\n    case 'and':\n      return where.conditions.every((child) => matchesWhere(payload, child));\n    case 'or':\n      return where.conditions.some((child) => matchesWhere(payload, child));\n    case 'not':\n      return !matchesWhere(payload, where.condition);\n    case 'payload': {\n      const raw = valueAtPath(payload, where.path);\n      if (where.op === 'exists') return raw !== undefined && raw !== null;\n      if (where.op === 'not_exists') return raw === undefined || raw === null;\n      const actual =\n        typeof raw === 'string' || typeof raw === 'number' || typeof raw === 'boolean'\n          ? raw\n          : undefined;\n      return compareProperty(where, actual);\n    }\n    default:\n      // compileBundle rejects these; defend against hand-built IR\n      throw new Error(`where clause may not contain a '${where.type}' condition`);\n  }\n}\n\nfunction valueAtPath(payload: unknown, path: string): unknown {\n  let current: unknown = payload;\n  for (const key of path.split('.')) {\n    if (current === null || typeof current !== 'object') return undefined;\n    current = (current as Record<string, unknown>)[key];\n  }\n  return current;\n}\n\nfunction compareProperty(\n  condition: {\n    op: PropertyOperatorIR;\n    value?: ScalarIR | undefined;\n    values?: ScalarIR[] | undefined;\n  },\n  actual: ScalarIR | undefined\n): boolean {\n  const { op, value, values } = condition;\n  switch (op) {\n    case 'exists':\n      return actual !== undefined;\n    case 'not_exists':\n      return actual === undefined;\n    case 'eq':\n      return actual === value;\n    case 'ne':\n      return actual !== value;\n    case 'gt':\n      return actual !== undefined && value !== undefined && actual > value;\n    case 'gte':\n      return actual !== undefined && value !== undefined && actual >= value;\n    case 'lt':\n      return actual !== undefined && value !== undefined && actual < value;\n    case 'lte':\n      return actual !== undefined && value !== undefined && actual <= value;\n    case 'between':\n      return isBetween(actual, values);\n    case 'not_between':\n      // A missing property is outside any range, mirroring not_in_array.\n      return !isBetween(actual, values);\n    case 'in_array':\n      return actual !== undefined && (values ?? []).includes(actual);\n    case 'not_in_array':\n      return actual === undefined || !(values ?? []).includes(actual);\n    case 'contains':\n      return typeof actual === 'string' && typeof value === 'string' && actual.includes(value);\n    case 'not_contains':\n      return !(typeof actual === 'string' && typeof value === 'string' && actual.includes(value));\n  }\n}\n\nfunction isBetween(actual: ScalarIR | undefined, values: ScalarIR[] | undefined): boolean {\n  if (actual === undefined || values === undefined || values.length < 2) return false;\n  const [min, max] = values;\n  return actual >= min && actual <= max;\n}\n\n/**\n * Wake-up channel for profile changes: a property predicate has no event name\n * of its own, so subscriptions use this reserved name and the ingest router\n * fires it on every /identify. The '$' prefix marks internal names — real\n * events may never use it (the router rejects them).\n */\nexport const PROFILE_UPDATED_EVENT = '$profile_updated';\n\n/**\n * The wake-up channel for one profile property: `$profile_updated:<path>`. A property predicate\n * subscribes to its own property's channel, and `/identify` fires one per property it patched —\n * so an identify that touches `plan` does not wake a wait on `email`.\n */\nexport function profileUpdatedEvent(path: string): string {\n  return `${PROFILE_UPDATED_EVENT}:${path}`;\n}\n\n/**\n * Wake-up channel for device changes: a device registered for the user, moved to another account\n * or was unbound or removed (`POST /devices`, `/devices/unbind`, `/devices/remove`). `reachable('push')` subscribes to it.\n */\nexport const DEVICES_UPDATED_EVENT = '$devices_updated';\n\n/**\n * The set of event names a condition cares about — what wait_until subscribes\n * to for wake-ups. `performed` contributes its event; a property predicate\n * contributes its property's channel (`profileUpdatedEvent(path)`, so an\n * /identify touching that property wakes the wait and one touching another\n * does not); `reachable` contributes the recipient property's channel, or the\n * device channel for push (in_app, slack and discord have no address to wait\n * on). Segment references are expanded, which is why a FactSource is needed to\n * resolve their definitions.\n */\nexport async function relevantEvents(condition: ConditionIR, facts: FactSource): Promise<string[]> {\n  const found = new Set<string>();\n  // Names already expanded. The result is a union, so re-walking a segment can\n  // only add what is already there — and a segment that reaches itself would\n  // otherwise recurse until the stack blows, taking a D1 read per level.\n  const expanded = new Set<string>();\n  async function walk(c: ConditionIR): Promise<void> {\n    switch (c.type) {\n      case 'and':\n      case 'or':\n        for (const child of c.conditions) await walk(child);\n        break;\n      case 'not':\n        await walk(c.condition);\n        break;\n      case 'performed':\n        found.add(c.event);\n        break;\n      case 'segment': {\n        if (expanded.has(c.segment)) break;\n        expanded.add(c.segment);\n        const def = await facts.getSegmentCondition(c.segment);\n        if (def) await walk(def);\n        break;\n      }\n      case 'property':\n        found.add(profileUpdatedEvent(c.path));\n        break;\n      case 'reachable': {\n        if (c.channel === 'push') {\n          found.add(DEVICES_UPDATED_EVENT);\n          break;\n        }\n        const path = RECIPIENT_PROPERTY[c.channel];\n        if (path !== undefined) found.add(profileUpdatedEvent(path));\n        break;\n      }\n      case 'payload':\n        break; // only appears inside performed.where, which is not walked\n    }\n  }\n  await walk(condition);\n  return [...found];\n}\n"],"mappings":";;;;;;;AAwBA,eAAsB,kBACpB,WACA,OACA,OACA,MACkB;CAClB,OAAO,SAAS,WAAW,OAAO,OAAO,MAAM,CAAC,CAAC;AACnD;;;;;;;;;;AAWA,eAAe,SACb,WACA,OACA,OACA,MACA,WACkB;CAClB,QAAQ,UAAU,MAAlB;EACE,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,CAAE,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAI,OAAO;GAEtE,OAAO;EAET,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAG,OAAO;GAEnE,OAAO;EAET,KAAK,OACH,OAAO,CAAE,MAAM,SAAS,UAAU,WAAW,OAAO,OAAO,MAAM,SAAS;EAC5E,KAAK,WAAW;GACd,IAAI,UAAU,SAAS,UAAU,OAAO,GACtC,MAAM,IAAI,MACR,YAAY,UAAU,QAAQ,uBAAuB,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC,CAAC,KAAK,MAAM,GACpG;GAEF,MAAM,MAAM,MAAM,MAAM,oBAAoB,UAAU,OAAO;GAC7D,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MAAM,qBAAqB,UAAU,QAAQ,yBAAyB;GAElF,OAAO,SAAS,KAAK,OAAO,OAAO,MAAM,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC;EAC5E;EACA,KAAK,aAAa;GAChB,MAAM,SAAmB,CAAC;GAC1B,IAAI,UAAU,WAAW,KAAA,GAAW,OAAO,KAAK,QAAQ,UAAU,OAAO,EAAE;GAC3E,IAAI,MAAM,aAAa,KAAA,GAAW,OAAO,KAAK,KAAK,QAAQ;GAC3D,MAAM,UAAU,OAAO,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,KAAA;GAM1D,OAAO,MALa,MAAM,YAAY,UAAU,OAAO;IACrD,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;IAC3C,GAAI,MAAM,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;IAC/D,GAAI,UAAU,UAAU,KAAA,IAAY,EAAE,OAAO,UAAU,MAAM,IAAI,CAAC;GACpE,CAAC,MACgB,UAAU,SAAS;EACtC;EACA,KAAK,YAEH,OAAO,gBAAgB,WAAW,MADb,MAAM,YAAY,UAAU,IAAI,CACb;EAE1C,KAAK,aAAa;GAChB,IAAI,MAAM,MAAM,eAAe,UAAU,OAAO,GAAG,OAAO;GAC1D,IAAI,UAAU,YAAY,QAAQ,QAAQ,MAAM,MAAM,YAAY,EAAA,CAAG,SAAS;GAC9E,MAAM,OAAO,mBAAmB,UAAU;GAG1C,OAAO,SAAS,KAAA,KAAc,MAAM,MAAM,YAAY,IAAI,MAAO,KAAA;EACnE;EACA,KAAK,WAEH,MAAM,IAAI,MACR,yFACF;CACJ;AACF;;;;;;;AAQA,SAAgB,aAAa,SAAkB,OAA6B;CAC1E,QAAQ,MAAM,MAAd;EACE,KAAK,OACH,OAAO,MAAM,WAAW,OAAO,UAAU,aAAa,SAAS,KAAK,CAAC;EACvE,KAAK,MACH,OAAO,MAAM,WAAW,MAAM,UAAU,aAAa,SAAS,KAAK,CAAC;EACtE,KAAK,OACH,OAAO,CAAC,aAAa,SAAS,MAAM,SAAS;EAC/C,KAAK,WAAW;GACd,MAAM,MAAM,YAAY,SAAS,MAAM,IAAI;GAC3C,IAAI,MAAM,OAAO,UAAU,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAC/D,IAAI,MAAM,OAAO,cAAc,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAKnE,OAAO,gBAAgB,OAHrB,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,YACjE,MACA,KAAA,CAC8B;EACtC;EACA,SAEE,MAAM,IAAI,MAAM,mCAAmC,MAAM,KAAK,YAAY;CAC9E;AACF;AAEA,SAAS,YAAY,SAAkB,MAAuB;CAC5D,IAAI,UAAmB;CACvB,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,GAAG;EACjC,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU,OAAO,KAAA;EAC5D,UAAW,QAAoC;CACjD;CACA,OAAO;AACT;AAEA,SAAS,gBACP,WAKA,QACS;CACT,MAAM,EAAE,IAAI,OAAO,WAAW;CAC9B,QAAQ,IAAR;EACE,KAAK,UACH,OAAO,WAAW,KAAA;EACpB,KAAK,cACH,OAAO,WAAW,KAAA;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,WACH,OAAO,UAAU,QAAQ,MAAM;EACjC,KAAK,eAEH,OAAO,CAAC,UAAU,QAAQ,MAAM;EAClC,KAAK,YACH,OAAO,WAAW,KAAA,MAAc,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAC/D,KAAK,gBACH,OAAO,WAAW,KAAA,KAAa,EAAE,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAChE,KAAK,YACH,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;EACzF,KAAK,gBACH,OAAO,EAAE,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;CAC7F;AACF;AAEA,SAAS,UAAU,QAA8B,QAAyC;CACxF,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,KAAa,OAAO,SAAS,GAAG,OAAO;CAC9E,MAAM,CAAC,KAAK,OAAO;CACnB,OAAO,UAAU,OAAO,UAAU;AACpC;;;;;;;AAQA,MAAa,wBAAwB;;;;;;AAOrC,SAAgB,oBAAoB,MAAsB;CACxD,OAAO,GAAG,sBAAsB,GAAG;AACrC;;;;;AAMA,MAAa,wBAAwB;;;;;;;;;;;AAYrC,eAAsB,eAAe,WAAwB,OAAsC;CACjG,MAAM,wBAAQ,IAAI,IAAY;CAI9B,MAAM,2BAAW,IAAI,IAAY;CACjC,eAAe,KAAK,GAA+B;EACjD,QAAQ,EAAE,MAAV;GACE,KAAK;GACL,KAAK;IACH,KAAK,MAAM,SAAS,EAAE,YAAY,MAAM,KAAK,KAAK;IAClD;GACF,KAAK;IACH,MAAM,KAAK,EAAE,SAAS;IACtB;GACF,KAAK;IACH,MAAM,IAAI,EAAE,KAAK;IACjB;GACF,KAAK,WAAW;IACd,IAAI,SAAS,IAAI,EAAE,OAAO,GAAG;IAC7B,SAAS,IAAI,EAAE,OAAO;IACtB,MAAM,MAAM,MAAM,MAAM,oBAAoB,EAAE,OAAO;IACrD,IAAI,KAAK,MAAM,KAAK,GAAG;IACvB;GACF;GACA,KAAK;IACH,MAAM,IAAI,oBAAoB,EAAE,IAAI,CAAC;IACrC;GACF,KAAK,aAAa;IAChB,IAAI,EAAE,YAAY,QAAQ;KACxB,MAAM,IAAI,qBAAqB;KAC/B;IACF;IACA,MAAM,OAAO,mBAAmB,EAAE;IAClC,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,oBAAoB,IAAI,CAAC;IAC3D;GACF;EAGF;CACF;CACA,MAAM,KAAK,SAAS;CACpB,OAAO,CAAC,GAAG,KAAK;AAClB"}
+{"version":3,"file":"condition.mjs","names":[],"sources":["../../src/engine/condition.ts"],"sourcesContent":["import type { ConditionIR, PropertyOperatorIR, ScalarIR } from '../ir';\nimport type { FactSource } from './ports';\nimport { RECIPIENT_PROPERTY } from './recipient';\n\n/**\n * Evaluation options.\n * - anchorMs: the earliest instant `performed` counts events from — the goal\n *   guard anchors at workflow entry (a conversion must happen *after* entry),\n *   waitUntil at the moment the wait began (a wake must not be satisfied by\n *   pre-existing history). Combined with `within` by taking the later bound.\n * - untilMs: the latest instant `performed` counts events up to — the goal's\n *   attribution window ends there, so an event after it is no conversion even\n *   when the check runs later (a resumed instance, a delayed wake).\n */\nexport interface EvaluateOptions {\n  anchorMs?: number;\n  untilMs?: number;\n}\n\n/**\n * ConditionIR evaluation: pure logic, with facts injected through FactSource,\n * so the store-backed implementation and the in-memory test one share a single set of\n * semantics and cannot drift into two evaluators.\n */\nexport async function evaluateCondition(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts?: EvaluateOptions\n): Promise<boolean> {\n  return evaluate(condition, facts, nowMs, opts, []);\n}\n\n/**\n * `enclosing` is the chain of segment names currently being expanded. A\n * segment that reaches itself has no truth value to converge on, and left\n * unchecked the recursion runs until memory gives out, one store round trip per\n * level — inside a step, so Workflows retries it and the instance never gets\n * out. Failing immediately keeps it bounded, and the message names the cycle\n * because only a deployed bundle can fix it. Only the *path* is tracked, so a\n * diamond (two branches referencing one segment) still evaluates twice.\n */\nasync function evaluate(\n  condition: ConditionIR,\n  facts: FactSource,\n  nowMs: number,\n  opts: EvaluateOptions | undefined,\n  enclosing: readonly string[]\n): Promise<boolean> {\n  switch (condition.type) {\n    case 'and': {\n      for (const child of condition.conditions) {\n        if (!(await evaluate(child, facts, nowMs, opts, enclosing))) return false;\n      }\n      return true;\n    }\n    case 'or': {\n      for (const child of condition.conditions) {\n        if (await evaluate(child, facts, nowMs, opts, enclosing)) return true;\n      }\n      return false;\n    }\n    case 'not':\n      return !(await evaluate(condition.condition, facts, nowMs, opts, enclosing));\n    case 'segment': {\n      if (enclosing.includes(condition.segment)) {\n        throw new Error(\n          `segment '${condition.segment}' references itself: ${[...enclosing, condition.segment].join(' -> ')}`\n        );\n      }\n      const def = await facts.getSegmentCondition(condition.segment);\n      if (def === undefined) {\n        throw new Error(`Unknown segment: '${condition.segment}' (bundle not deployed?)`);\n      }\n      return evaluate(def, facts, nowMs, opts, [...enclosing, condition.segment]);\n    }\n    case 'performed': {\n      const bounds: number[] = [];\n      if (condition.within !== undefined) bounds.push(nowMs - condition.within.ms);\n      if (opts?.anchorMs !== undefined) bounds.push(opts.anchorMs);\n      const sinceMs = bounds.length > 0 ? Math.max(...bounds) : undefined;\n      const count = await facts.countEvents(condition.event, {\n        ...(sinceMs !== undefined ? { sinceMs } : {}),\n        ...(opts?.untilMs !== undefined ? { untilMs: opts.untilMs } : {}),\n        ...(condition.where !== undefined ? { where: condition.where } : {}),\n      });\n      return count >= (condition.count ?? 1);\n    }\n    case 'property': {\n      const actual = await facts.getProperty(condition.path);\n      return compareProperty(condition, actual);\n    }\n    case 'reachable': {\n      if (await facts.isSuppressed?.(condition.channel)) return false;\n      if (condition.channel === 'push') return (await facts.listDevices()).length > 0;\n      const path = RECIPIENT_PROPERTY[condition.channel];\n      // in_app, slack and discord need no address: a signed-in user is reachable in the app, and\n      // the webhook channels post to a team channel, not to the user\n      return path === undefined || (await facts.getProperty(path)) !== undefined;\n    }\n    case 'payload':\n      // Placement is validated at compile; reaching here means hand-built IR\n      throw new Error(\n        'payload conditions are only valid inside performed({ where }) or a trigger where clause'\n      );\n  }\n}\n\n/**\n * Evaluate a where tree against one event's payload. Shared by performed\n * counting (FactSource implementations) and the ingest router's trigger gate.\n * Dotted paths descend nested objects; a missing or non-scalar leaf behaves\n * like a missing property (exists sees objects, comparisons do not).\n */\nexport function matchesWhere(payload: unknown, where: ConditionIR): boolean {\n  switch (where.type) {\n    case 'and':\n      return where.conditions.every((child) => matchesWhere(payload, child));\n    case 'or':\n      return where.conditions.some((child) => matchesWhere(payload, child));\n    case 'not':\n      return !matchesWhere(payload, where.condition);\n    case 'payload': {\n      const raw = valueAtPath(payload, where.path);\n      if (where.op === 'exists') return raw !== undefined && raw !== null;\n      if (where.op === 'not_exists') return raw === undefined || raw === null;\n      const actual =\n        typeof raw === 'string' || typeof raw === 'number' || typeof raw === 'boolean'\n          ? raw\n          : undefined;\n      return compareProperty(where, actual);\n    }\n    default:\n      // compileBundle rejects these; defend against hand-built IR\n      throw new Error(`where clause may not contain a '${where.type}' condition`);\n  }\n}\n\nfunction valueAtPath(payload: unknown, path: string): unknown {\n  let current: unknown = payload;\n  for (const key of path.split('.')) {\n    if (current === null || typeof current !== 'object') return undefined;\n    current = (current as Record<string, unknown>)[key];\n  }\n  return current;\n}\n\nfunction compareProperty(\n  condition: {\n    op: PropertyOperatorIR;\n    value?: ScalarIR | undefined;\n    values?: ScalarIR[] | undefined;\n  },\n  actual: ScalarIR | undefined\n): boolean {\n  const { op, value, values } = condition;\n  switch (op) {\n    case 'exists':\n      return actual !== undefined;\n    case 'not_exists':\n      return actual === undefined;\n    case 'eq':\n      return actual === value;\n    case 'ne':\n      return actual !== value;\n    case 'gt':\n      return actual !== undefined && value !== undefined && actual > value;\n    case 'gte':\n      return actual !== undefined && value !== undefined && actual >= value;\n    case 'lt':\n      return actual !== undefined && value !== undefined && actual < value;\n    case 'lte':\n      return actual !== undefined && value !== undefined && actual <= value;\n    case 'between':\n      return isBetween(actual, values);\n    case 'not_between':\n      // A missing property is outside any range, mirroring not_in_array.\n      return !isBetween(actual, values);\n    case 'in_array':\n      return actual !== undefined && (values ?? []).includes(actual);\n    case 'not_in_array':\n      return actual === undefined || !(values ?? []).includes(actual);\n    case 'contains':\n      return typeof actual === 'string' && typeof value === 'string' && actual.includes(value);\n    case 'not_contains':\n      return !(typeof actual === 'string' && typeof value === 'string' && actual.includes(value));\n  }\n}\n\nfunction isBetween(actual: ScalarIR | undefined, values: ScalarIR[] | undefined): boolean {\n  if (actual === undefined || values === undefined || values.length < 2) return false;\n  const [min, max] = values;\n  return actual >= min && actual <= max;\n}\n\n/**\n * Wake-up channel for profile changes: a property predicate has no event name\n * of its own, so subscriptions use this reserved name and the ingest router\n * fires it on every /identify. The '$' prefix marks internal names — real\n * events may never use it (the router rejects them).\n */\nexport const PROFILE_UPDATED_EVENT = '$profile_updated';\n\n/**\n * The wake-up channel for one profile property: `$profile_updated:<path>`. A property predicate\n * subscribes to its own property's channel, and `/identify` fires one per property it patched —\n * so an identify that touches `plan` does not wake a wait on `email`.\n */\nexport function profileUpdatedEvent(path: string): string {\n  return `${PROFILE_UPDATED_EVENT}:${path}`;\n}\n\n/**\n * Wake-up channel for device changes: a device registered for the user, moved to another account\n * or was unbound or removed (`POST /devices`, `/devices/unbind`, `/devices/remove`). `reachable('push')` subscribes to it.\n */\nexport const DEVICES_UPDATED_EVENT = '$devices_updated';\n\n/**\n * The set of event names a condition cares about — what wait_until subscribes\n * to for wake-ups. `performed` contributes its event; a property predicate\n * contributes its property's channel (`profileUpdatedEvent(path)`, so an\n * /identify touching that property wakes the wait and one touching another\n * does not); `reachable` contributes the recipient property's channel, or the\n * device channel for push (in_app, slack and discord have no address to wait\n * on). Segment references are expanded, which is why a FactSource is needed to\n * resolve their definitions.\n */\nexport async function relevantEvents(condition: ConditionIR, facts: FactSource): Promise<string[]> {\n  const found = new Set<string>();\n  // Names already expanded. The result is a union, so re-walking a segment can\n  // only add what is already there — and a segment that reaches itself would\n  // otherwise recurse until the stack blows, taking a store read per level.\n  const expanded = new Set<string>();\n  async function walk(c: ConditionIR): Promise<void> {\n    switch (c.type) {\n      case 'and':\n      case 'or':\n        for (const child of c.conditions) await walk(child);\n        break;\n      case 'not':\n        await walk(c.condition);\n        break;\n      case 'performed':\n        found.add(c.event);\n        break;\n      case 'segment': {\n        if (expanded.has(c.segment)) break;\n        expanded.add(c.segment);\n        const def = await facts.getSegmentCondition(c.segment);\n        if (def) await walk(def);\n        break;\n      }\n      case 'property':\n        found.add(profileUpdatedEvent(c.path));\n        break;\n      case 'reachable': {\n        if (c.channel === 'push') {\n          found.add(DEVICES_UPDATED_EVENT);\n          break;\n        }\n        const path = RECIPIENT_PROPERTY[c.channel];\n        if (path !== undefined) found.add(profileUpdatedEvent(path));\n        break;\n      }\n      case 'payload':\n        break; // only appears inside performed.where, which is not walked\n    }\n  }\n  await walk(condition);\n  return [...found];\n}\n"],"mappings":";;;;;;;AAwBA,eAAsB,kBACpB,WACA,OACA,OACA,MACkB;CAClB,OAAO,SAAS,WAAW,OAAO,OAAO,MAAM,CAAC,CAAC;AACnD;;;;;;;;;;AAWA,eAAe,SACb,WACA,OACA,OACA,MACA,WACkB;CAClB,QAAQ,UAAU,MAAlB;EACE,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,CAAE,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAI,OAAO;GAEtE,OAAO;EAET,KAAK;GACH,KAAK,MAAM,SAAS,UAAU,YAC5B,IAAI,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,SAAS,GAAG,OAAO;GAEnE,OAAO;EAET,KAAK,OACH,OAAO,CAAE,MAAM,SAAS,UAAU,WAAW,OAAO,OAAO,MAAM,SAAS;EAC5E,KAAK,WAAW;GACd,IAAI,UAAU,SAAS,UAAU,OAAO,GACtC,MAAM,IAAI,MACR,YAAY,UAAU,QAAQ,uBAAuB,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC,CAAC,KAAK,MAAM,GACpG;GAEF,MAAM,MAAM,MAAM,MAAM,oBAAoB,UAAU,OAAO;GAC7D,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,MAAM,qBAAqB,UAAU,QAAQ,yBAAyB;GAElF,OAAO,SAAS,KAAK,OAAO,OAAO,MAAM,CAAC,GAAG,WAAW,UAAU,OAAO,CAAC;EAC5E;EACA,KAAK,aAAa;GAChB,MAAM,SAAmB,CAAC;GAC1B,IAAI,UAAU,WAAW,KAAA,GAAW,OAAO,KAAK,QAAQ,UAAU,OAAO,EAAE;GAC3E,IAAI,MAAM,aAAa,KAAA,GAAW,OAAO,KAAK,KAAK,QAAQ;GAC3D,MAAM,UAAU,OAAO,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,KAAA;GAM1D,OAAO,MALa,MAAM,YAAY,UAAU,OAAO;IACrD,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;IAC3C,GAAI,MAAM,YAAY,KAAA,IAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;IAC/D,GAAI,UAAU,UAAU,KAAA,IAAY,EAAE,OAAO,UAAU,MAAM,IAAI,CAAC;GACpE,CAAC,MACgB,UAAU,SAAS;EACtC;EACA,KAAK,YAEH,OAAO,gBAAgB,WAAW,MADb,MAAM,YAAY,UAAU,IAAI,CACb;EAE1C,KAAK,aAAa;GAChB,IAAI,MAAM,MAAM,eAAe,UAAU,OAAO,GAAG,OAAO;GAC1D,IAAI,UAAU,YAAY,QAAQ,QAAQ,MAAM,MAAM,YAAY,EAAA,CAAG,SAAS;GAC9E,MAAM,OAAO,mBAAmB,UAAU;GAG1C,OAAO,SAAS,KAAA,KAAc,MAAM,MAAM,YAAY,IAAI,MAAO,KAAA;EACnE;EACA,KAAK,WAEH,MAAM,IAAI,MACR,yFACF;CACJ;AACF;;;;;;;AAQA,SAAgB,aAAa,SAAkB,OAA6B;CAC1E,QAAQ,MAAM,MAAd;EACE,KAAK,OACH,OAAO,MAAM,WAAW,OAAO,UAAU,aAAa,SAAS,KAAK,CAAC;EACvE,KAAK,MACH,OAAO,MAAM,WAAW,MAAM,UAAU,aAAa,SAAS,KAAK,CAAC;EACtE,KAAK,OACH,OAAO,CAAC,aAAa,SAAS,MAAM,SAAS;EAC/C,KAAK,WAAW;GACd,MAAM,MAAM,YAAY,SAAS,MAAM,IAAI;GAC3C,IAAI,MAAM,OAAO,UAAU,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAC/D,IAAI,MAAM,OAAO,cAAc,OAAO,QAAQ,KAAA,KAAa,QAAQ;GAKnE,OAAO,gBAAgB,OAHrB,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,QAAQ,YACjE,MACA,KAAA,CAC8B;EACtC;EACA,SAEE,MAAM,IAAI,MAAM,mCAAmC,MAAM,KAAK,YAAY;CAC9E;AACF;AAEA,SAAS,YAAY,SAAkB,MAAuB;CAC5D,IAAI,UAAmB;CACvB,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,GAAG;EACjC,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU,OAAO,KAAA;EAC5D,UAAW,QAAoC;CACjD;CACA,OAAO;AACT;AAEA,SAAS,gBACP,WAKA,QACS;CACT,MAAM,EAAE,IAAI,OAAO,WAAW;CAC9B,QAAQ,IAAR;EACE,KAAK,UACH,OAAO,WAAW,KAAA;EACpB,KAAK,cACH,OAAO,WAAW,KAAA;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW;EACpB,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,MACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,SAAS;EACjE,KAAK,OACH,OAAO,WAAW,KAAA,KAAa,UAAU,KAAA,KAAa,UAAU;EAClE,KAAK,WACH,OAAO,UAAU,QAAQ,MAAM;EACjC,KAAK,eAEH,OAAO,CAAC,UAAU,QAAQ,MAAM;EAClC,KAAK,YACH,OAAO,WAAW,KAAA,MAAc,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAC/D,KAAK,gBACH,OAAO,WAAW,KAAA,KAAa,EAAE,UAAU,CAAC,EAAA,CAAG,SAAS,MAAM;EAChE,KAAK,YACH,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;EACzF,KAAK,gBACH,OAAO,EAAE,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;CAC7F;AACF;AAEA,SAAS,UAAU,QAA8B,QAAyC;CACxF,IAAI,WAAW,KAAA,KAAa,WAAW,KAAA,KAAa,OAAO,SAAS,GAAG,OAAO;CAC9E,MAAM,CAAC,KAAK,OAAO;CACnB,OAAO,UAAU,OAAO,UAAU;AACpC;;;;;;;AAQA,MAAa,wBAAwB;;;;;;AAOrC,SAAgB,oBAAoB,MAAsB;CACxD,OAAO,GAAG,sBAAsB,GAAG;AACrC;;;;;AAMA,MAAa,wBAAwB;;;;;;;;;;;AAYrC,eAAsB,eAAe,WAAwB,OAAsC;CACjG,MAAM,wBAAQ,IAAI,IAAY;CAI9B,MAAM,2BAAW,IAAI,IAAY;CACjC,eAAe,KAAK,GAA+B;EACjD,QAAQ,EAAE,MAAV;GACE,KAAK;GACL,KAAK;IACH,KAAK,MAAM,SAAS,EAAE,YAAY,MAAM,KAAK,KAAK;IAClD;GACF,KAAK;IACH,MAAM,KAAK,EAAE,SAAS;IACtB;GACF,KAAK;IACH,MAAM,IAAI,EAAE,KAAK;IACjB;GACF,KAAK,WAAW;IACd,IAAI,SAAS,IAAI,EAAE,OAAO,GAAG;IAC7B,SAAS,IAAI,EAAE,OAAO;IACtB,MAAM,MAAM,MAAM,MAAM,oBAAoB,EAAE,OAAO;IACrD,IAAI,KAAK,MAAM,KAAK,GAAG;IACvB;GACF;GACA,KAAK;IACH,MAAM,IAAI,oBAAoB,EAAE,IAAI,CAAC;IACrC;GACF,KAAK,aAAa;IAChB,IAAI,EAAE,YAAY,QAAQ;KACxB,MAAM,IAAI,qBAAqB;KAC/B;IACF;IACA,MAAM,OAAO,mBAAmB,EAAE;IAClC,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,oBAAoB,IAAI,CAAC;IAC3D;GACF;EAGF;CACF;CACA,MAAM,KAAK,SAAS;CACpB,OAAO,CAAC,GAAG,KAAK;AAClB"}

package/dist/engine/ports.d.cts

@@ -62,7 +62,7 @@ export interface PushDevice {
   token: string;
   platform: string;
 }
-/** Facts from a single user's point of view: the read interface condition evaluation uses (D1 and in-memory share one evaluator). */
+/** Facts from a single user's point of view: the read interface condition evaluation uses (the store-backed and in-memory sources share one evaluator). */
 export interface FactSource {
   /**
    * How many times an event occurred. `sinceMs` bounds the window (within /

package/dist/engine/ports.d.mts

@@ -62,7 +62,7 @@ export interface PushDevice {
   token: string;
   platform: string;
 }
-/** Facts from a single user's point of view: the read interface condition evaluation uses (D1 and in-memory share one evaluator). */
+/** Facts from a single user's point of view: the read interface condition evaluation uses (the store-backed and in-memory sources share one evaluator). */
 export interface FactSource {
   /**
    * How many times an event occurred. `sinceMs` bounds the window (within /

package/dist/fcm.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_engine_retry = require("./engine/retry.cjs");
 const require_jwt = require("./jwt.cjs");
+let node_buffer = require("node:buffer");
 //#region src/fcm.ts
 /**
 * How an FCM v1 answer is classified, after the API's error codes
@@ -180,7 +181,7 @@ async function signJwt(account, audience, scope, nowMs = Date.now()) {
 function serviceAccountFromBase64(value) {
 	let json;
 	try {
-		json = JSON.parse(atob(value));
+		json = JSON.parse(node_buffer.Buffer.from(value, "base64").toString());
 	} catch (error) {
 		throw new require_engine_retry.PermanentError("service account is not base64-encoded JSON", { cause: error });
 	}

package/dist/fcm.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.cjs","names":["isRetryableStatus","PermanentError","base64url","pemToDer"],"sources":["../src/fcm.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(atob(value)) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAIA,qBAAAA,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAIC,qBAAAA,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAIA,qBAAAA,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAKD,qBAAAA,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAIC,qBAAAA,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAASC,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAASA,YAAAA,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACAC,YAAAA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,KAAK,KAAK,CAAC;CAC/B,SAAS,OAAO;EAEd,MAAM,IAAID,qBAAAA,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAIA,qBAAAA,eACR,yEACF;CAEF,OAAO;AACT"}
+{"version":3,"file":"fcm.cjs","names":["isRetryableStatus","PermanentError","base64url","pemToDer","Buffer"],"sources":["../src/fcm.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(Buffer.from(value, 'base64').toString()) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA6DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAIA,qBAAAA,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAIC,qBAAAA,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAIA,qBAAAA,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAKD,qBAAAA,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAIC,qBAAAA,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAASC,YAAAA,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAASA,YAAAA,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACAC,YAAAA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAGD,YAAAA,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAME,YAAAA,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS,CAAC;CAC3D,SAAS,OAAO;EAEd,MAAM,IAAIH,qBAAAA,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAIA,qBAAAA,eACR,yEACF;CAEF,OAAO;AACT"}

package/dist/fcm.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.d.cts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAgBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}
+{"version":3,"file":"fcm.d.cts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAiBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}

package/dist/fcm.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.d.mts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAgBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}
+{"version":3,"file":"fcm.d.mts","names":[],"sources":["../src/fcm.ts"],"mappings":";;;;;;;;;;;;;;iBAiBiB;EACf;EACA;;EAEA;EACA;;iBAGe;EACf,gBAAgB;;EAEhB,eAAe;;iBAGA;;EAEf,aAAa;EACb,QAAQ;;EAER,UAAU;;EAEV,OAAO;;EAEP,eAAe;;;;;;;;;;;;;;;;;;;;qBAqBJ,oBAAoB;;;;;;;qBAgBpB;mBAMkB;;WAJpB;UACD;UACA;EAER,YAA6B,SAAS;;EAKhC,MAAM,eAAmB;;EAgB/B;UAIc;;qBA6BH,yBAAyB;mBACP;EAA7B,YAA6B,SAAS;EAEhC,KAAK,SAAS,kBAAkB,eAAe;;;wBAyEvC,aAAa;;wBAaP,QACpB,SAAS,mBACT,kBACA,eACA,iBACC;;wBAsBa,yBAAyB,gBAAgB"}

package/dist/fcm.mjs

@@ -1,5 +1,6 @@
 import { PermanentError, isRetryableStatus } from "./engine/retry.mjs";
 import { base64url, pemToDer } from "./jwt.mjs";
+import { Buffer } from "node:buffer";
 //#region src/fcm.ts
 /**
 * How an FCM v1 answer is classified, after the API's error codes
@@ -179,7 +180,7 @@ async function signJwt(account, audience, scope, nowMs = Date.now()) {
 function serviceAccountFromBase64(value) {
 	let json;
 	try {
-		json = JSON.parse(atob(value));
+		json = JSON.parse(Buffer.from(value, "base64").toString());
 	} catch (error) {
 		throw new PermanentError("service account is not base64-encoded JSON", { cause: error });
 	}

package/dist/fcm.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fcm.mjs","names":[],"sources":["../src/fcm.ts"],"sourcesContent":["import type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(atob(value)) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA4DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAI,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAI,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAI,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAI,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAAS,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,KAAK,KAAK,CAAC;CAC/B,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAI,eACR,yEACF;CAEF,OAAO;AACT"}
+{"version":3,"file":"fcm.mjs","names":[],"sources":["../src/fcm.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport type { MessageSender, OutboundMessage, SendResult } from './engine';\nimport { PermanentError, isRetryableStatus } from './engine/retry';\nimport { base64url, pemToDer } from './jwt';\nimport type { PushRenderer } from './push';\n\n/**\n * `@shware/workflow/fcm` — push delivery through Firebase Cloud Messaging's\n * HTTP v1 API, from a service account. No dependencies: the OAuth2 access\n * token is minted by signing a JWT with WebCrypto (Workers, Node 20+, Deno,\n * Bun), so this runs wherever the engine runs.\n *\n * The recipient is an FCM registration token the app registered for the user\n * (`registerDevice`); the engine sends one message per device.\n */\n\n/** The fields of a Google service-account JSON this sender needs. */\nexport interface FcmServiceAccount {\n  project_id: string;\n  client_email: string;\n  /** PEM, `-----BEGIN PRIVATE KEY-----` (PKCS #8). */\n  private_key: string;\n  token_uri?: string;\n}\n\nexport interface FcmAccessTokenOptions {\n  serviceAccount: FcmServiceAccount;\n  /** Fetch implementation for the token exchange (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\nexport interface FcmPushOptions {\n  /** The access token the requests carry — shared by every sender on the same service account. */\n  credentials: FcmAccessToken;\n  render: PushRenderer;\n  /** Android-specific delivery options, e.g. `{ channel_id: 'default' }` (FCM v1 `android.notification`). */\n  android?: Record<string, unknown>;\n  /** APNs-specific payload options merged into `aps`, e.g. `{ sound: 'default' }`. */\n  apns?: Record<string, unknown>;\n  /** Fetch implementation (defaults to the global one). */\n  fetch?: typeof fetch;\n}\n\n/**\n * How an FCM v1 answer is classified, after the API's error codes\n * (https://firebase.google.com/docs/reference/fcm/rest/v1/ErrorCode):\n *\n * - dead token: 404 `UNREGISTERED` (the app was uninstalled, or the token expired) — also a 404\n *   whose only code is the gRPC status `NOT_FOUND`. The copy settles undelivered and the host\n *   forgets the token.\n * - undelivered, device kept: 400 `INVALID_ARGUMENT`. FCM gives it for a malformed token but\n *   just as well for a payload problem (a message too big, a bad data key, a bad TTL), which\n *   would hit every device of the template at once; the copy settles with the reason, so the\n *   report shows it, and nothing is deleted on a guess.\n * - configuration: 403 `SENDER_ID_MISMATCH` (the token belongs to another Firebase project) and\n *   401 `THIRD_PARTY_AUTH_ERROR` (the APNs or web push credentials in the Firebase project):\n *   `PermanentError`, devices kept.\n * - transient: 401 `UNAUTHENTICATED` (the cached access token is dropped first), 429\n *   `QUOTA_EXCEEDED`, 503 `UNAVAILABLE`, 500 `INTERNAL` and any other 429 / 5xx.\n * - everything else (another 4xx) is this request itself: a `PermanentError`.\n */\nexport const DEAD_TOKEN_REASONS: ReadonlySet<string> = new Set(['UNREGISTERED', 'NOT_FOUND']);\n\nconst CONFIGURATION_CODES: ReadonlySet<string> = new Set([\n  'SENDER_ID_MISMATCH',\n  'THIRD_PARTY_AUTH_ERROR',\n]);\nconst TRANSIENT_CODES: ReadonlySet<string> = new Set(['QUOTA_EXCEEDED', 'UNAVAILABLE', 'INTERNAL']);\n\nconst SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';\n\n/**\n * The OAuth2 access token for one service account, exchanged once and reused until a minute\n * before it expires. Concurrent callers without a usable token share the one exchange in flight,\n * and an exchange that failed is not kept, so the next call tries again. One instance serves every\n * sender built on the account — a host keeps it across runs, and builds the senders per run.\n */\nexport class FcmAccessToken {\n  /** The Firebase project the account belongs to — the `messages:send` URL names it. */\n  readonly projectId: string;\n  private minted: { value: string; expiresAt: number } | undefined;\n  private minting: Promise<string> | undefined;\n\n  constructor(private readonly options: FcmAccessTokenOptions) {\n    this.projectId = options.serviceAccount.project_id;\n  }\n\n  /** The current token, exchanged now if there is none or it is about to expire. */\n  async token(now = Date.now()): Promise<string> {\n    if (this.minted !== undefined && this.minted.expiresAt - 60_000 > now) {\n      return this.minted.value;\n    }\n    this.minting ??= this.exchange(now)\n      .then((minted) => {\n        this.minted = minted;\n        return minted.value;\n      })\n      .finally(() => {\n        this.minting = undefined;\n      });\n    return this.minting;\n  }\n\n  /** Forget the token: FCM refused it (401), so the next call exchanges a new one. */\n  invalidate(): void {\n    this.minted = undefined;\n  }\n\n  private async exchange(now: number): Promise<{ value: string; expiresAt: number }> {\n    const { serviceAccount } = this.options;\n    const tokenUri = serviceAccount.token_uri ?? 'https://oauth2.googleapis.com/token';\n    const assertion = await signJwt(serviceAccount, tokenUri, SCOPE, now);\n    const doFetch = this.options.fetch ?? fetch;\n    const response = await doFetch(tokenUri, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion,\n      }),\n    });\n    if (!response.ok) {\n      const detail = `${response.status} ${await response.text()}`;\n      // A 4xx from the token endpoint (`invalid_grant`: the key was revoked, `invalid_client`)\n      // is the service account itself; only a throttled or failing endpoint is worth a retry\n      if (isRetryableStatus(response.status)) {\n        throw new Error(`FCM token exchange failed: ${detail}`);\n      }\n      throw new PermanentError(\n        `FCM token exchange refused for '${serviceAccount.client_email}': ${detail}`\n      );\n    }\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    return { value: json.access_token, expiresAt: now + json.expires_in * 1000 };\n  }\n}\n\nexport class FcmPushSender implements MessageSender {\n  constructor(private readonly options: FcmPushOptions) {}\n\n  async send(message: OutboundMessage): Promise<void | SendResult> {\n    if (message.channel !== 'push') {\n      throw new Error(`FcmPushSender: unsupported channel '${message.channel}'`);\n    }\n    if (message.recipient === undefined) {\n      throw new Error(`FcmPushSender: no push token for user '${message.userId}'`);\n    }\n    const { title, body, image, url } = await this.options.render(message.template, message.props);\n    const { credentials, android, apns } = this.options;\n    const doFetch = this.options.fetch ?? fetch;\n\n    const response = await doFetch(\n      `https://fcm.googleapis.com/v1/projects/${credentials.projectId}/messages:send`,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${await credentials.token()}`,\n          'content-type': 'application/json',\n        },\n        body: JSON.stringify({\n          message: {\n            token: message.recipient,\n            notification: { title, body, ...(image === undefined ? {} : { image }) },\n            // The template key travels as data so the app can route a tap; the\n            // idempotency key lets the app de-duplicate a redelivered push.\n            data: {\n              template: message.template,\n              idempotencyKey: message.idempotencyKey,\n              ...(url === undefined ? {} : { url }),\n              ...message.tracking?.data,\n            },\n            ...(android === undefined ? {} : { android: { notification: android } }),\n            apns: { payload: { aps: { sound: 'default', ...apns } } },\n          },\n        }),\n      }\n    );\n    if (response.ok) return;\n\n    const text = await response.text();\n    const { status } = response;\n    const code = fcmErrorCode(text);\n    if (code === 'UNREGISTERED' || (status === 404 && DEAD_TOKEN_REASONS.has(code))) {\n      // A dead token is a fact about the recipient, not a transient failure:\n      // report it and move on, so the step does not retry into the same wall.\n      console.warn(`[fcm] token gone for user ${message.userId}: ${code}`);\n      return { delivered: false, reason: code };\n    }\n    if (code === 'INVALID_ARGUMENT') {\n      // The token or our payload: settled so the report says which device, nothing deleted\n      console.warn(`[fcm] refused for user ${message.userId}: ${status} ${text}`);\n      return { delivered: false, reason: code };\n    }\n    if (CONFIGURATION_CODES.has(code)) {\n      throw new PermanentError(\n        `FCM refused the request for project '${credentials.projectId}': ${status} ${code}`\n      );\n    }\n    if (status === 401 || code === 'UNAUTHENTICATED') {\n      // The access token was revoked before it expired: mint a new one on the retry\n      credentials.invalidate();\n      throw new Error(\n        `FCM send failed: ${status} ${code || text} (access token renewed for the retry)`\n      );\n    }\n    if (TRANSIENT_CODES.has(code) || isRetryableStatus(status)) {\n      throw new Error(`FCM send failed: ${status} ${code || text}`);\n    }\n    throw new PermanentError(`FCM refused the request: ${status} ${code || text}`);\n  }\n}\n\n/** FCM v1 error bodies carry the code at `error.status` and, for messaging, in `error.details[].errorCode`. */\nexport function fcmErrorCode(body: string): string {\n  try {\n    const parsed = JSON.parse(body) as {\n      error?: { status?: string; details?: { errorCode?: string }[] };\n    };\n    const detail = parsed.error?.details?.find((d) => d.errorCode !== undefined)?.errorCode;\n    return detail ?? parsed.error?.status ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/** RS256-sign the OAuth2 JWT assertion for a service account. */\nexport async function signJwt(\n  account: FcmServiceAccount,\n  audience: string,\n  scope: string,\n  nowMs = Date.now()\n): Promise<string> {\n  const iat = Math.floor(nowMs / 1000);\n  const header = base64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = base64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: audience, iat, exp: iat + 3600 })\n  );\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`)\n  );\n  return `${header}.${claims}.${base64url(new Uint8Array(signature))}`;\n}\n\n/** Parse the service-account JSON as it is usually shipped: base64 of the file, in one secret. */\nexport function serviceAccountFromBase64(value: string): FcmServiceAccount {\n  let json: Partial<FcmServiceAccount>;\n  try {\n    json = JSON.parse(Buffer.from(value, 'base64').toString()) as Partial<FcmServiceAccount>;\n  } catch (error) {\n    // A secret that is not base64 JSON is the same on every attempt: not worth a retry\n    throw new PermanentError('service account is not base64-encoded JSON', { cause: error });\n  }\n  if (!json.project_id || !json.client_email || !json.private_key) {\n    throw new PermanentError(\n      'service account JSON is missing project_id, client_email or private_key'\n    );\n  }\n  return json as FcmServiceAccount;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6DA,MAAa,qCAA0C,IAAI,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAE5F,MAAM,sCAA2C,IAAI,IAAI,CACvD,sBACA,wBACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CAAC;CAAkB;CAAe;AAAU,CAAC;AAElG,MAAM,QAAQ;;;;;;;AAQd,IAAa,iBAAb,MAA4B;CAMG;;CAJ7B;CACA;CACA;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,YAAY,QAAQ,eAAe;CAC1C;;CAGA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAoB;EAC7C,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,YAAY,MAAS,KAChE,OAAO,KAAK,OAAO;EAErB,KAAK,YAAY,KAAK,SAAS,GAAG,CAAC,CAChC,MAAM,WAAW;GAChB,KAAK,SAAS;GACd,OAAO,OAAO;EAChB,CAAC,CAAC,CACD,cAAc;GACb,KAAK,UAAU,KAAA;EACjB,CAAC;EACH,OAAO,KAAK;CACd;;CAGA,aAAmB;EACjB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAc,SAAS,KAA4D;EACjF,MAAM,EAAE,mBAAmB,KAAK;EAChC,MAAM,WAAW,eAAe,aAAa;EAC7C,MAAM,YAAY,MAAM,QAAQ,gBAAgB,UAAU,OAAO,GAAG;EAEpE,MAAM,WAAW,OADD,KAAK,QAAQ,SAAS,MAAA,CACP,UAAU;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ;GACF,CAAC;EACH,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,GAAG,SAAS,OAAO,GAAG,MAAM,SAAS,KAAK;GAGzD,IAAI,kBAAkB,SAAS,MAAM,GACnC,MAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,IAAI,eACR,mCAAmC,eAAe,aAAa,KAAK,QACtE;EACF;EACA,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,OAAO;GAAE,OAAO,KAAK;GAAc,WAAW,MAAM,KAAK,aAAa;EAAK;CAC7E;AACF;AAEA,IAAa,gBAAb,MAAoD;CACrB;CAA7B,YAAY,SAA0C;EAAzB,KAAA,UAAA;CAA0B;CAEvD,MAAM,KAAK,SAAsD;EAC/D,IAAI,QAAQ,YAAY,QACtB,MAAM,IAAI,MAAM,uCAAuC,QAAQ,QAAQ,EAAE;EAE3E,IAAI,QAAQ,cAAc,KAAA,GACxB,MAAM,IAAI,MAAM,0CAA0C,QAAQ,OAAO,EAAE;EAE7E,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;EAC7F,MAAM,EAAE,aAAa,SAAS,SAAS,KAAK;EAG5C,MAAM,WAAW,OAFD,KAAK,QAAQ,SAAS,MAAA,CAGpC,0CAA0C,YAAY,UAAU,iBAChE;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,MAAM,YAAY,MAAM;IACjD,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,EACnB,SAAS;IACP,OAAO,QAAQ;IACf,cAAc;KAAE;KAAO;KAAM,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IAAG;IAGvE,MAAM;KACJ,UAAU,QAAQ;KAClB,gBAAgB,QAAQ;KACxB,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;KACnC,GAAG,QAAQ,UAAU;IACvB;IACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,QAAQ,EAAE;IACtE,MAAM,EAAE,SAAS,EAAE,KAAK;KAAE,OAAO;KAAW,GAAG;IAAK,EAAE,EAAE;GAC1D,EACF,CAAC;EACH,CACF;EACA,IAAI,SAAS,IAAI;EAEjB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,MAAM,EAAE,WAAW;EACnB,MAAM,OAAO,aAAa,IAAI;EAC9B,IAAI,SAAS,kBAAmB,WAAW,OAAO,mBAAmB,IAAI,IAAI,GAAI;GAG/E,QAAQ,KAAK,6BAA6B,QAAQ,OAAO,IAAI,MAAM;GACnE,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,SAAS,oBAAoB;GAE/B,QAAQ,KAAK,0BAA0B,QAAQ,OAAO,IAAI,OAAO,GAAG,MAAM;GAC1E,OAAO;IAAE,WAAW;IAAO,QAAQ;GAAK;EAC1C;EACA,IAAI,oBAAoB,IAAI,IAAI,GAC9B,MAAM,IAAI,eACR,wCAAwC,YAAY,UAAU,KAAK,OAAO,GAAG,MAC/E;EAEF,IAAI,WAAW,OAAO,SAAS,mBAAmB;GAEhD,YAAY,WAAW;GACvB,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,QAAQ,KAAK,sCAC7C;EACF;EACA,IAAI,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,MAAM,GACvD,MAAM,IAAI,MAAM,oBAAoB,OAAO,GAAG,QAAQ,MAAM;EAE9D,MAAM,IAAI,eAAe,4BAA4B,OAAO,GAAG,QAAQ,MAAM;CAC/E;AACF;;AAGA,SAAgB,aAAa,MAAsB;CACjD,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAI9B,OADe,OAAO,OAAO,SAAS,MAAM,MAAM,EAAE,cAAc,KAAA,CAAS,CAAC,EAAE,aAC7D,OAAO,OAAO,UAAU;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,QACpB,SACA,UACA,OACA,QAAQ,KAAK,IAAI,GACA;CACjB,MAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;CACnC,MAAM,SAAS,UAAU,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CACrE,MAAM,SAAS,UACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAU;EAAK,KAAK,MAAM;CAAK,CAAC,CAC1F;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,IAAI,WAAW,SAAS,CAAC;AACnE;;AAGA,SAAgB,yBAAyB,OAAkC;CACzE,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,SAAS,CAAC;CAC3D,SAAS,OAAO;EAEd,MAAM,IAAI,eAAe,8CAA8C,EAAE,OAAO,MAAM,CAAC;CACzF;CACA,IAAI,CAAC,KAAK,cAAc,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAClD,MAAM,IAAI,eACR,yEACF;CAEF,OAAO;AACT"}

package/dist/host/channels.cjs

@@ -12,6 +12,7 @@ const require_webhooks = require("../webhooks.cjs");
 const require_webpush = require("../webpush.cjs");
 const require_host_ingest = require("./ingest.cjs");
 const require_host_senders = require("./senders.cjs");
+let node_buffer = require("node:buffer");
 //#region src/host/channels.ts
 /**
 * The outlets a `JourneyConfig` describes, assembled against the environment:
@@ -67,7 +68,7 @@ function identity(value) {
 /** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */
 async function secretDigest(secret) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-	return Array.from(new Uint8Array(digest).slice(0, 4), (b) => b.toString(16).padStart(2, "0")).join("");
+	return node_buffer.Buffer.from(digest.slice(0, 4)).toString("hex");
 }
 /**
 * A sender built on its first message, then kept for this call. `build` reads the secrets (and

package/dist/host/channels.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"channels.cjs","names":["resolveRuntime","PermanentError","EmailSender","registryRenderer","registryPushRenderer","removeDevice","apnsEnvironment","ApnsProviderToken","apnsKeyFromBase64","ApnsPushSender","APNS_DEAD_TOKEN_REASONS","serviceAccountFromBase64","FcmAccessToken","FcmPushSender","FCM_DEAD_TOKEN_REASONS","VapidSigner","WebPushSender","WEB_PUSH_DEAD_TOKEN_REASONS","routeByPlatform","indexTemplates","DiscordWebhookSender","lookupTemplate","renderDiscordContent","SlackWebhookSender","renderSlackContent","routeByChannel"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import {\n  DEAD_TOKEN_REASONS as APNS_DEAD_TOKEN_REASONS,\n  ApnsProviderToken,\n  ApnsPushSender,\n  apnsKeyFromBase64,\n} from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender } from '../engine/ports';\nimport { PermanentError } from '../engine/retry';\nimport {\n  DEAD_TOKEN_REASONS as FCM_DEAD_TOKEN_REASONS,\n  FcmAccessToken,\n  FcmPushSender,\n  serviceAccountFromBase64,\n} from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport {\n  VapidSigner,\n  DEAD_TOKEN_REASONS as WEB_PUSH_DEAD_TOKEN_REASONS,\n  WebPushSender,\n} from '../webpush';\nimport { removeDevice } from './ingest';\nimport type { JourneyEnv } from './platform';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/**\n * A sender that fails every message with the reason the channel cannot deliver — for good: the\n * configuration is the same on every attempt, so the step does not retry into it.\n */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new PermanentError(\n        `cannot send '${message.template}' on ${message.channel}: ${reason}`\n      );\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    // Missing on this attempt, missing on the next: the deployment has to change, not the step\n    throw new PermanentError(\n      `${name} is not set: the environment must hold it for the configured channel`\n    );\n  }\n  return value;\n}\n\n/**\n * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long\n * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every\n * instance) and builds the senders anew each time; what must outlive the run is the credential\n * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a\n * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access\n * token is good for an hour, the VAPID key import is wasted work twice.\n *\n * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the\n * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is\n * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,\n * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded\n * host mints a new credential instead of reusing the old, and the secret itself is in no key and\n * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:\n * the sender is built per call around the shared credential.\n */\nexport interface ProviderCache {\n  /** The credential under `key`, built on the first call and returned as is after that. */\n  get<T>(key: string, build: () => T): T;\n}\n\nexport function createProviderCache(): ProviderCache {\n  const credentials = new Map<string, unknown>();\n  return {\n    get<T>(key: string, build: () => T): T {\n      if (!credentials.has(key)) credentials.set(key, build());\n      return credentials.get(key) as T;\n    },\n  };\n}\n\n/** A number for each fetch implementation, so a credential minted through one is not reused with another. */\nconst identities = new WeakMap<object, number>();\nlet nextIdentity = 1;\nfunction identity(value: object | undefined): string {\n  if (value === undefined) return 'global';\n  let id = identities.get(value);\n  if (id === undefined) {\n    id = nextIdentity++;\n    identities.set(value, id);\n  }\n  return String(id);\n}\n\n/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */\nasync function secretDigest(secret: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return Array.from(new Uint8Array(digest).slice(0, 4), (b) =>\n    b.toString(16).padStart(2, '0')\n  ).join('');\n}\n\n/**\n * A sender built on its first message, then kept for this call. `build` reads the secrets (and\n * so may throw a `PermanentError` naming the missing variable): a platform's secret is only\n * required when something is actually sent there, so a journey that only emails must not fail\n * because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.\n */\nfunction lazy(build: () => Promise<MessageSender>): MessageSender {\n  let sender: Promise<MessageSender> | undefined;\n  return {\n    async send(message) {\n      sender ??= build().catch((error: unknown) => {\n        sender = undefined;\n        throw error;\n      });\n      return (await sender).send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n    /**\n     * Where the provider credentials live across runs (`createProviderCache`): the host's, made\n     * once with it. Without one, this call's credentials are its own — nothing is reused.\n     */\n    providers?: ProviderCache | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n  const providers = options.providers ?? createProviderCache();\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    /**\n     * A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n     * waits that read devices, as a removal through the API does. Done here, per run, on the\n     * settled result, so the credential cached across runs (see `ProviderCache`) never holds a\n     * run's store.\n     */\n    const dropDeadTokens = (\n      provider: MessageSender,\n      deadTokenReasons: ReadonlySet<string>\n    ): MessageSender => ({\n      async send(message) {\n        const result = await provider.send(message);\n        if (\n          result !== undefined &&\n          deadTokenReasons.has(result.reason) &&\n          message.device !== undefined &&\n          options.store !== undefined\n        ) {\n          await removeDevice(env, message.device.token, options.store);\n        }\n        return result;\n      },\n    });\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      const apnsFetch = options.apnsFetch ?? options.fetch;\n      const environment = apnsEnvironment(apns, mode);\n      platforms.ios = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'APNS_PRIVATE_KEY_BASE64');\n          const credentials = providers.get(\n            JSON.stringify(['apns', apns.keyId, apns.teamId, await secretDigest(secret)]),\n            () =>\n              new ApnsProviderToken({\n                keyId: apns.keyId,\n                teamId: apns.teamId,\n                privateKey: apnsKeyFromBase64(secret),\n              })\n          );\n          return new ApnsPushSender({\n            credentials,\n            topic: apns.topic,\n            environment,\n            render,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...(apnsFetch === undefined ? {} : { fetch: apnsFetch }),\n          });\n        }),\n        APNS_DEAD_TOKEN_REASONS\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64');\n          const serviceAccount = serviceAccountFromBase64(secret);\n          // The token endpoint is called through the fetch: another fetch is another credential\n          const credentials = providers.get(\n            JSON.stringify([\n              'fcm',\n              serviceAccount.client_email,\n              serviceAccount.project_id,\n              identity(options.fetch),\n              await secretDigest(secret),\n            ]),\n            () =>\n              new FcmAccessToken({\n                serviceAccount,\n                ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n              })\n          );\n          return new FcmPushSender({\n            credentials,\n            render,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        FCM_DEAD_TOKEN_REASONS\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = dropDeadTokens(\n        lazy(async () => {\n          const publicKey = requireSecret(env, 'VAPID_PUBLIC_KEY');\n          const privateKey = requireSecret(env, 'VAPID_PRIVATE_KEY');\n          const credentials = providers.get(\n            JSON.stringify(['vapid', webPush.subject, publicKey, await secretDigest(privateKey)]),\n            () => new VapidSigner({ subject: webPush.subject, publicKey, privateKey })\n          );\n          return new WebPushSender({\n            credentials,\n            render,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        WEB_PUSH_DEAD_TOKEN_REASONS\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new PermanentError(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAOA,gBAAAA,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;;;;AAMA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAIC,qBAAAA,eACR,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAC9D;CACF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAEhD,MAAM,IAAIA,qBAAAA,eACR,GAAG,KAAK,qEACV;CAEF,OAAO;AACT;AAuBA,SAAgB,sBAAqC;CACnD,MAAM,8BAAc,IAAI,IAAqB;CAC7C,OAAO,EACL,IAAO,KAAa,OAAmB;EACrC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,MAAM,CAAC;EACvD,OAAO,YAAY,IAAI,GAAG;CAC5B,EACF;AACF;;AAGA,MAAM,6BAAa,IAAI,QAAwB;AAC/C,IAAI,eAAe;AACnB,SAAS,SAAS,OAAmC;CACnD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,KAAK,WAAW,IAAI,KAAK;CAC7B,IAAI,OAAO,KAAA,GAAW;EACpB,KAAK;EACL,WAAW,IAAI,OAAO,EAAE;CAC1B;CACA,OAAO,OAAO,EAAE;AAClB;;AAGA,eAAe,aAAa,QAAiC;CAC3D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC;CACrF,OAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MACrD,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAChC,CAAC,CAAC,KAAK,EAAE;AACX;;;;;;;AAQA,SAAS,KAAK,OAAoD;CAChE,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC3C,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,QAAQ,MAAM,OAAA,CAAQ,KAAK,OAAO;CACpC,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAaI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,YAAY,QAAQ,aAAa,oBAAoB;CAE3D,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAIC,qBAAAA,YAAY;GAAE;GAAW,QAAQC,oBAAAA,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAASC,aAAAA,qBAAqB,QAAQ;;;;;;;EAO5C,MAAM,kBACJ,UACA,sBACmB,EACnB,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;GAC1C,IACE,WAAW,KAAA,KACX,iBAAiB,IAAI,OAAO,MAAM,KAClC,QAAQ,WAAW,KAAA,KACnB,QAAQ,UAAU,KAAA,GAElB,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;GAE7D,OAAO;EACT,EACF;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;GAC/C,MAAM,cAAcC,eAAAA,gBAAgB,MAAM,IAAI;GAC9C,UAAU,MAAM,eACd,KAAK,YAAY;IACf,MAAM,SAAS,cAAc,KAAK,yBAAyB;IAC3D,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;KAAC;KAAQ,KAAK;KAAO,KAAK;KAAQ,MAAM,aAAa,MAAM;IAAC,CAAC,SAE1E,IAAIC,aAAAA,kBAAkB;KACpB,OAAO,KAAK;KACZ,QAAQ,KAAK;KACb,YAAYC,aAAAA,kBAAkB,MAAM;IACtC,CAAC,CACL;IACA,OAAO,IAAIC,aAAAA,eAAe;KACxB;KACA,OAAO,KAAK;KACZ;KACA;KACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;KAC/E,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU;IACxD,CAAC;GACH,CAAC,GACDC,aAAAA,kBACF;EACF;EACA,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,eAClB,KAAK,YAAY;GACf,MAAM,SAAS,cAAc,KAAK,uCAAuC;GACzE,MAAM,iBAAiBC,YAAAA,yBAAyB,MAAM;GAEtD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IACb;IACA,eAAe;IACf,eAAe;IACf,SAAS,QAAQ,KAAK;IACtB,MAAM,aAAa,MAAM;GAC3B,CAAC,SAEC,IAAIC,YAAAA,eAAe;IACjB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC,CACL;GACA,OAAO,IAAIC,YAAAA,cAAc;IACvB;IACA;IACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;IACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,YAAAA,kBACF;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,eACd,KAAK,YAAY;GACf,MAAM,YAAY,cAAc,KAAK,kBAAkB;GACvD,MAAM,aAAa,cAAc,KAAK,mBAAmB;GACzD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IAAC;IAAS,QAAQ;IAAS;IAAW,MAAM,aAAa,UAAU;GAAC,CAAC,SAC9E,IAAIC,gBAAAA,YAAY;IAAE,SAAS,QAAQ;IAAS;IAAW;GAAW,CAAC,CAC3E;GACA,OAAO,IAAIC,gBAAAA,cAAc;IACvB;IACA;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,gBAAAA,kBACF;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAOC,qBAAAA,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAIjB,qBAAAA,eACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQkB,kBAAAA,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAIC,iBAAAA,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWC,kBAAAA,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAASC,kBAAAA,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQH,kBAAAA,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAII,iBAAAA,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWF,kBAAAA,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAASG,kBAAAA,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAOC,qBAAAA,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}
+{"version":3,"file":"channels.cjs","names":["resolveRuntime","PermanentError","Buffer","EmailSender","registryRenderer","registryPushRenderer","removeDevice","apnsEnvironment","ApnsProviderToken","apnsKeyFromBase64","ApnsPushSender","APNS_DEAD_TOKEN_REASONS","serviceAccountFromBase64","FcmAccessToken","FcmPushSender","FCM_DEAD_TOKEN_REASONS","VapidSigner","WebPushSender","WEB_PUSH_DEAD_TOKEN_REASONS","routeByPlatform","indexTemplates","DiscordWebhookSender","lookupTemplate","renderDiscordContent","SlackWebhookSender","renderSlackContent","routeByChannel"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport {\n  DEAD_TOKEN_REASONS as APNS_DEAD_TOKEN_REASONS,\n  ApnsProviderToken,\n  ApnsPushSender,\n  apnsKeyFromBase64,\n} from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender } from '../engine/ports';\nimport { PermanentError } from '../engine/retry';\nimport {\n  DEAD_TOKEN_REASONS as FCM_DEAD_TOKEN_REASONS,\n  FcmAccessToken,\n  FcmPushSender,\n  serviceAccountFromBase64,\n} from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport {\n  VapidSigner,\n  DEAD_TOKEN_REASONS as WEB_PUSH_DEAD_TOKEN_REASONS,\n  WebPushSender,\n} from '../webpush';\nimport { removeDevice } from './ingest';\nimport type { JourneyEnv } from './platform';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/**\n * A sender that fails every message with the reason the channel cannot deliver — for good: the\n * configuration is the same on every attempt, so the step does not retry into it.\n */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new PermanentError(\n        `cannot send '${message.template}' on ${message.channel}: ${reason}`\n      );\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    // Missing on this attempt, missing on the next: the deployment has to change, not the step\n    throw new PermanentError(\n      `${name} is not set: the environment must hold it for the configured channel`\n    );\n  }\n  return value;\n}\n\n/**\n * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long\n * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every\n * instance) and builds the senders anew each time; what must outlive the run is the credential\n * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a\n * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access\n * token is good for an hour, the VAPID key import is wasted work twice.\n *\n * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the\n * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is\n * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,\n * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded\n * host mints a new credential instead of reusing the old, and the secret itself is in no key and\n * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:\n * the sender is built per call around the shared credential.\n */\nexport interface ProviderCache {\n  /** The credential under `key`, built on the first call and returned as is after that. */\n  get<T>(key: string, build: () => T): T;\n}\n\nexport function createProviderCache(): ProviderCache {\n  const credentials = new Map<string, unknown>();\n  return {\n    get<T>(key: string, build: () => T): T {\n      if (!credentials.has(key)) credentials.set(key, build());\n      return credentials.get(key) as T;\n    },\n  };\n}\n\n/** A number for each fetch implementation, so a credential minted through one is not reused with another. */\nconst identities = new WeakMap<object, number>();\nlet nextIdentity = 1;\nfunction identity(value: object | undefined): string {\n  if (value === undefined) return 'global';\n  let id = identities.get(value);\n  if (id === undefined) {\n    id = nextIdentity++;\n    identities.set(value, id);\n  }\n  return String(id);\n}\n\n/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */\nasync function secretDigest(secret: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return Buffer.from(digest.slice(0, 4)).toString('hex');\n}\n\n/**\n * A sender built on its first message, then kept for this call. `build` reads the secrets (and\n * so may throw a `PermanentError` naming the missing variable): a platform's secret is only\n * required when something is actually sent there, so a journey that only emails must not fail\n * because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.\n */\nfunction lazy(build: () => Promise<MessageSender>): MessageSender {\n  let sender: Promise<MessageSender> | undefined;\n  return {\n    async send(message) {\n      sender ??= build().catch((error: unknown) => {\n        sender = undefined;\n        throw error;\n      });\n      return (await sender).send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n    /**\n     * Where the provider credentials live across runs (`createProviderCache`): the host's, made\n     * once with it. Without one, this call's credentials are its own — nothing is reused.\n     */\n    providers?: ProviderCache | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n  const providers = options.providers ?? createProviderCache();\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    /**\n     * A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n     * waits that read devices, as a removal through the API does. Done here, per run, on the\n     * settled result, so the credential cached across runs (see `ProviderCache`) never holds a\n     * run's store.\n     */\n    const dropDeadTokens = (\n      provider: MessageSender,\n      deadTokenReasons: ReadonlySet<string>\n    ): MessageSender => ({\n      async send(message) {\n        const result = await provider.send(message);\n        if (\n          result !== undefined &&\n          deadTokenReasons.has(result.reason) &&\n          message.device !== undefined &&\n          options.store !== undefined\n        ) {\n          await removeDevice(env, message.device.token, options.store);\n        }\n        return result;\n      },\n    });\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      const apnsFetch = options.apnsFetch ?? options.fetch;\n      const environment = apnsEnvironment(apns, mode);\n      platforms.ios = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'APNS_PRIVATE_KEY_BASE64');\n          const credentials = providers.get(\n            JSON.stringify(['apns', apns.keyId, apns.teamId, await secretDigest(secret)]),\n            () =>\n              new ApnsProviderToken({\n                keyId: apns.keyId,\n                teamId: apns.teamId,\n                privateKey: apnsKeyFromBase64(secret),\n              })\n          );\n          return new ApnsPushSender({\n            credentials,\n            topic: apns.topic,\n            environment,\n            render,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...(apnsFetch === undefined ? {} : { fetch: apnsFetch }),\n          });\n        }),\n        APNS_DEAD_TOKEN_REASONS\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64');\n          const serviceAccount = serviceAccountFromBase64(secret);\n          // The token endpoint is called through the fetch: another fetch is another credential\n          const credentials = providers.get(\n            JSON.stringify([\n              'fcm',\n              serviceAccount.client_email,\n              serviceAccount.project_id,\n              identity(options.fetch),\n              await secretDigest(secret),\n            ]),\n            () =>\n              new FcmAccessToken({\n                serviceAccount,\n                ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n              })\n          );\n          return new FcmPushSender({\n            credentials,\n            render,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        FCM_DEAD_TOKEN_REASONS\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = dropDeadTokens(\n        lazy(async () => {\n          const publicKey = requireSecret(env, 'VAPID_PUBLIC_KEY');\n          const privateKey = requireSecret(env, 'VAPID_PRIVATE_KEY');\n          const credentials = providers.get(\n            JSON.stringify(['vapid', webPush.subject, publicKey, await secretDigest(privateKey)]),\n            () => new VapidSigner({ subject: webPush.subject, publicKey, privateKey })\n          );\n          return new WebPushSender({\n            credentials,\n            render,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        WEB_PUSH_DEAD_TOKEN_REASONS\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new PermanentError(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAOA,gBAAAA,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;;;;AAMA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAIC,qBAAAA,eACR,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAC9D;CACF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAEhD,MAAM,IAAIA,qBAAAA,eACR,GAAG,KAAK,qEACV;CAEF,OAAO;AACT;AAuBA,SAAgB,sBAAqC;CACnD,MAAM,8BAAc,IAAI,IAAqB;CAC7C,OAAO,EACL,IAAO,KAAa,OAAmB;EACrC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,MAAM,CAAC;EACvD,OAAO,YAAY,IAAI,GAAG;CAC5B,EACF;AACF;;AAGA,MAAM,6BAAa,IAAI,QAAwB;AAC/C,IAAI,eAAe;AACnB,SAAS,SAAS,OAAmC;CACnD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,KAAK,WAAW,IAAI,KAAK;CAC7B,IAAI,OAAO,KAAA,GAAW;EACpB,KAAK;EACL,WAAW,IAAI,OAAO,EAAE;CAC1B;CACA,OAAO,OAAO,EAAE;AAClB;;AAGA,eAAe,aAAa,QAAiC;CAC3D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC;CACrF,OAAOC,YAAAA,OAAO,KAAK,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK;AACvD;;;;;;;AAQA,SAAS,KAAK,OAAoD;CAChE,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC3C,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,QAAQ,MAAM,OAAA,CAAQ,KAAK,OAAO;CACpC,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAaI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,YAAY,QAAQ,aAAa,oBAAoB;CAE3D,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAIC,qBAAAA,YAAY;GAAE;GAAW,QAAQC,oBAAAA,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAASC,aAAAA,qBAAqB,QAAQ;;;;;;;EAO5C,MAAM,kBACJ,UACA,sBACmB,EACnB,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;GAC1C,IACE,WAAW,KAAA,KACX,iBAAiB,IAAI,OAAO,MAAM,KAClC,QAAQ,WAAW,KAAA,KACnB,QAAQ,UAAU,KAAA,GAElB,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;GAE7D,OAAO;EACT,EACF;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;GAC/C,MAAM,cAAcC,eAAAA,gBAAgB,MAAM,IAAI;GAC9C,UAAU,MAAM,eACd,KAAK,YAAY;IACf,MAAM,SAAS,cAAc,KAAK,yBAAyB;IAC3D,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;KAAC;KAAQ,KAAK;KAAO,KAAK;KAAQ,MAAM,aAAa,MAAM;IAAC,CAAC,SAE1E,IAAIC,aAAAA,kBAAkB;KACpB,OAAO,KAAK;KACZ,QAAQ,KAAK;KACb,YAAYC,aAAAA,kBAAkB,MAAM;IACtC,CAAC,CACL;IACA,OAAO,IAAIC,aAAAA,eAAe;KACxB;KACA,OAAO,KAAK;KACZ;KACA;KACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;KAC/E,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU;IACxD,CAAC;GACH,CAAC,GACDC,aAAAA,kBACF;EACF;EACA,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,eAClB,KAAK,YAAY;GACf,MAAM,SAAS,cAAc,KAAK,uCAAuC;GACzE,MAAM,iBAAiBC,YAAAA,yBAAyB,MAAM;GAEtD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IACb;IACA,eAAe;IACf,eAAe;IACf,SAAS,QAAQ,KAAK;IACtB,MAAM,aAAa,MAAM;GAC3B,CAAC,SAEC,IAAIC,YAAAA,eAAe;IACjB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC,CACL;GACA,OAAO,IAAIC,YAAAA,cAAc;IACvB;IACA;IACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;IACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,YAAAA,kBACF;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,eACd,KAAK,YAAY;GACf,MAAM,YAAY,cAAc,KAAK,kBAAkB;GACvD,MAAM,aAAa,cAAc,KAAK,mBAAmB;GACzD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IAAC;IAAS,QAAQ;IAAS;IAAW,MAAM,aAAa,UAAU;GAAC,CAAC,SAC9E,IAAIC,gBAAAA,YAAY;IAAE,SAAS,QAAQ;IAAS;IAAW;GAAW,CAAC,CAC3E;GACA,OAAO,IAAIC,gBAAAA,cAAc;IACvB;IACA;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,gBAAAA,kBACF;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAOC,qBAAAA,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAIlB,qBAAAA,eACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQmB,kBAAAA,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAIC,iBAAAA,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWC,kBAAAA,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAASC,kBAAAA,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQH,kBAAAA,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAII,iBAAAA,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWF,kBAAAA,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAASG,kBAAAA,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAOC,qBAAAA,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}

package/dist/host/channels.d.cts

@@ -1,9 +1,9 @@
 import { MessageSender } from "../engine/ports.cjs";
-import { JourneyEnv } from "./platform.cjs";
 import { JourneyStore } from "../store/index.cjs";
 import { JourneyMode, JourneyRuntimeOptions } from "../runtime.cjs";
 import { JourneyConfig } from "../config.cjs";
 import { EmailTransport } from "../email-sender.cjs";
+import { JourneyEnv } from "./platform.cjs";
 //#region src/host/channels.d.ts
 /**
  * The outlets a `JourneyConfig` describes, assembled against the environment:

package/dist/host/channels.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.cts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAkDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAmD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}
+{"version":3,"file":"channels.d.cts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAmDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAiD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}

package/dist/host/channels.d.mts

@@ -1,9 +1,9 @@
 import { MessageSender } from "../engine/ports.mjs";
-import { JourneyEnv } from "./platform.mjs";
 import { JourneyStore } from "../store/index.mjs";
 import { JourneyMode, JourneyRuntimeOptions } from "../runtime.mjs";
 import { JourneyConfig } from "../config.mjs";
 import { EmailTransport } from "../email-sender.mjs";
+import { JourneyEnv } from "./platform.mjs";
 //#region src/host/channels.d.ts
 /**
  * The outlets a `JourneyConfig` describes, assembled against the environment:

package/dist/host/channels.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.mts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAkDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAmD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}
+{"version":3,"file":"channels.d.mts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAmDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAiD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}

package/dist/host/channels.mjs

@@ -11,6 +11,7 @@ import { DiscordWebhookSender, SlackWebhookSender } from "../webhooks.mjs";
 import { DEAD_TOKEN_REASONS as DEAD_TOKEN_REASONS$2, VapidSigner, WebPushSender } from "../webpush.mjs";
 import { removeDevice } from "./ingest.mjs";
 import { routeByChannel, routeByPlatform } from "./senders.mjs";
+import { Buffer } from "node:buffer";
 //#region src/host/channels.ts
 /**
 * The outlets a `JourneyConfig` describes, assembled against the environment:
@@ -66,7 +67,7 @@ function identity(value) {
 /** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */
 async function secretDigest(secret) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-	return Array.from(new Uint8Array(digest).slice(0, 4), (b) => b.toString(16).padStart(2, "0")).join("");
+	return Buffer.from(digest.slice(0, 4)).toString("hex");
 }
 /**
 * A sender built on its first message, then kept for this call. `build` reads the secrets (and