@shware/workflow 6.0.0 → 6.1.1

package/dist/email.mjs

@@ -25,18 +25,33 @@ function mimeAddress(address) {
 	return `${name} <${email}>`;
 }
 /**
-* The template's metadata, its `unsubscribeUrl` falling back to the config's — for a topic
-* email; a transactional one resolves to no unsubscribe link at all. Leaves both untouched.
+* The message id a preview renders with: the preferences link shows in the studio and
+* `GET /preview`, pointing at a copy that does not exist.
 */
-function resolveEmail(template, config) {
-	const unsubscribeUrl = template.topic === null ? void 0 : template.unsubscribeUrl ?? config?.unsubscribeUrl;
+const PREVIEW_MESSAGE_ID = "00000000-0000-0000-0000-000000000000";
+/**
+* The template's metadata, its `unsubscribeUrl` falling back to the config's, and the
+* preferences link built from the config's page and the copy's message id — for a topic email; a
+* transactional one resolves to neither link. Leaves the inputs untouched.
+*/
+function resolveEmail(template, config, options = {}) {
+	const topical = template.topic !== null;
+	const unsubscribeUrl = topical ? template.unsubscribeUrl ?? config?.unsubscribeUrl : void 0;
+	const preferencesUrl = topical && config?.preferencesUrl !== void 0 && options.messageId !== void 0 ? preferencesLink(config.preferencesUrl, options.messageId) : void 0;
 	return {
 		from: template.from,
 		topic: template.topic,
 		...template.replyTo === void 0 ? {} : { replyTo: template.replyTo },
-		...unsubscribeUrl === void 0 ? {} : { unsubscribeUrl }
+		...unsubscribeUrl === void 0 ? {} : { unsubscribeUrl },
+		...preferencesUrl === void 0 ? {} : { preferencesUrl }
 	};
 }
+/** The preference page's URL for one copy: `m=<message id>` set on its query, the rest of it kept. */
+function preferencesLink(preferencesUrl, messageId) {
+	const url = new URL(preferencesUrl);
+	url.searchParams.set("m", messageId);
+	return url.toString();
+}
 const ADDRESS = /^[^\s@<>]+@[^\s@<>]+$/;
 /** Throws naming `where` when `address` is neither `user@host` nor `{ email: 'user@host', name? }`. */
 function assertEmailAddress(address, where) {
@@ -46,7 +61,7 @@ function assertEmailAddress(address, where) {
 	if (name !== void 0 && typeof name !== "string") throw new TypeError(`${where}.name must be a string`);
 }
 /** Throws naming `where` unless `url` is an absolute http(s) URL; '' and null are not a way to leave it out. */
-function assertUnsubscribeUrl(url, where) {
+function assertHttpUrl(url, where) {
 	let parsed;
 	try {
 		parsed = typeof url === "string" ? new URL(url) : void 0;
@@ -55,16 +70,26 @@ function assertUnsubscribeUrl(url, where) {
 	}
 	if (parsed === void 0 || parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new TypeError(`${where} must be an http(s) URL (leave it out for none)`);
 }
+/** `assertHttpUrl`, under its earlier name. */
+const assertUnsubscribeUrl = assertHttpUrl;
 /** The config's `email` and every registered template's metadata; throws on the first invalid value. */
 function assertEmailConfig(config, templates) {
-	if (Object.hasOwn(config, "emails")) throw new TypeError("the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, and the rest moved to `email: { unsubscribeUrl, tracking }`");
+	if (Object.hasOwn(config, "emails")) throw new TypeError("the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, and the rest moved to `email: { unsubscribeUrl, preferencesUrl, tracking }`");
 	const email = config.email;
 	if (email !== void 0) {
-		if (email.unsubscribeUrl !== void 0) assertUnsubscribeUrl(email.unsubscribeUrl, "email.unsubscribeUrl");
+		if (email.unsubscribeUrl !== void 0) assertHttpUrl(email.unsubscribeUrl, "email.unsubscribeUrl");
+		if (email.preferencesUrl !== void 0) {
+			assertHttpUrl(email.preferencesUrl, "email.preferencesUrl");
+			if (isUnsubscribeLink(email.preferencesUrl, email.unsubscribeUrl)) throw new TypeError("email.preferencesUrl must not share its origin and path with email.unsubscribeUrl: the sender would track the preferences link as the unsubscribe link");
+		}
 		const quick = email.tracking?.quickClickMs;
 		if (quick !== void 0 && !(typeof quick === "number" && Number.isFinite(quick) && quick >= 0)) throw new TypeError("email.tracking.quickClickMs must be a non-negative number");
 	}
-	for (const template of templates) assertEmailMetadata(template, `email template '${template.id}'`, true);
+	for (const template of templates) {
+		const where = `email template '${template.id}'`;
+		assertEmailMetadata(template, where, true);
+		if (email?.preferencesUrl !== void 0 && isUnsubscribeLink(email.preferencesUrl, template.unsubscribeUrl)) throw new TypeError(`${where}: its unsubscribeUrl shares its origin and path with email.preferencesUrl, so the sender would track the preferences link as the unsubscribe link`);
+	}
 }
 /**
 * A template's own `from` / `replyTo` / `unsubscribeUrl` and what it is (`topic` or
@@ -75,7 +100,7 @@ function assertEmailConfig(config, templates) {
 function assertEmailMetadata(template, where, declared = false) {
 	assertEmailAddress(template.from, `${where}: from`);
 	if (template.replyTo !== void 0) assertEmailAddress(template.replyTo, `${where}: replyTo`);
-	if (template.unsubscribeUrl !== void 0) assertUnsubscribeUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);
+	if (template.unsubscribeUrl !== void 0) assertHttpUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);
 	if (assertTemplateTopic(template, where, "email", declared) && template.unsubscribeUrl !== void 0) throw new TypeError(`${where}: a transactional email has no unsubscribe link, so it takes no 'unsubscribeUrl'`);
 }
 /**
@@ -105,6 +130,6 @@ function isUnsubscribeLink(url, unsubscribeUrl) {
 		return false;
 	}
 }
-export { assertEmailAddress, assertEmailConfig, assertEmailMetadata, assertTemplateTopic, assertUnsubscribeUrl, formatEmailAddress, isUnsubscribeLink, mimeAddress, resolveEmail };
+export { PREVIEW_MESSAGE_ID, assertEmailAddress, assertEmailConfig, assertEmailMetadata, assertHttpUrl, assertTemplateTopic, assertUnsubscribeUrl, formatEmailAddress, isUnsubscribeLink, mimeAddress, preferencesLink, resolveEmail };
 
 //# sourceMappingURL=email.mjs.map

package/dist/email.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email.mjs","names":[],"sources":["../src/email.ts"],"sourcesContent":["import type { EmailTemplate } from './templates';\n\n/**\n * Email metadata: who a template's email comes from, where replies go, and the unsubscribe link\n * its layout carries. Each `emailTemplate` declares its own `from` (and `replyTo`, if replies should\n * go elsewhere) and says what it is: a `topic` the recipient may unsubscribe from, or\n * `transactional: true`. A topic email's unsubscribe link is the template's `unsubscribeUrl`,\n * else the config's `email.unsubscribeUrl`, else none; a transactional email never has one,\n * whatever the config says. `resolveEmail` is that rule, and the sender, the renderer, the\n * Worker's preview and the studio all go through it. No React and no I/O here, so a browser can\n * import it.\n */\n\n/** An address as the transports take it: bare, or with a display name. */\nexport type EmailAddress = string | { email: string; name?: string };\n\n/** `Name <email>`, or the bare address. */\nexport function formatEmailAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  return address.name === undefined ? address.email : `${address.name} <${address.email}>`;\n}\n\nconst ASCII = /^[\\x20-\\x7e]*$/;\nconst SPECIALS = /[()<>[\\]:;@\\\\,.\"]/;\n\n/**\n * An address as a mail API reads it (RFC 5322): a display name with specials is quoted, one\n * outside ASCII is a MIME encoded-word — raw non-ASCII names are refused (SES), and an unquoted\n * comma splits the address in two.\n */\nexport function mimeAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  const { email, name } = address;\n  if (name === undefined || name === '') return email;\n  if (!ASCII.test(name)) {\n    const bytes = new TextEncoder().encode(name);\n    let binary = '';\n    for (const byte of bytes) binary += String.fromCharCode(byte);\n    return `=?UTF-8?B?${btoa(binary)}?= <${email}>`;\n  }\n  if (SPECIALS.test(name)) return `\"${name.replace(/([\"\\\\])/g, '\\\\$1')}\" <${email}>`;\n  return `${name} <${email}>`;\n}\n\n/** The config's `email`: what every email template shares. */\nexport interface EmailConfig {\n  /**\n   * The unsubscribe link of every email template that names none of its own. The layout reads it\n   * with `useEmailContext()`; sent, it is tracked like every link, but following it shows a\n   * confirmation page, and only the confirmation (a POST no link scanner sends) unsubscribes.\n   */\n  unsubscribeUrl?: string;\n  /** How the Worker tells a person's opens and clicks from a machine's (see the reporting classifier). */\n  tracking?: {\n    /**\n     * An open or click this many milliseconds after delivery is a weak machine signal — machine\n     * only together with another (a second link within seconds); 1000 by default. A person\n     * tapping a mail notification can click within a few seconds, so keep it short.\n     */\n    quickClickMs?: number;\n  };\n}\n\n/** One template's email metadata, resolved against the config. */\nexport interface ResolvedEmail {\n  from: EmailAddress;\n  /** The template's subscription topic; null for a transactional email. */\n  topic: string | null;\n  /** Absent when the template names none: the email goes out without a Reply-To. */\n  replyTo?: EmailAddress;\n  /**\n   * Absent when the email is transactional, or neither the template nor the config names one:\n   * the email has no unsubscribe link.\n   */\n  unsubscribeUrl?: string;\n}\n\n/**\n * The template's metadata, its `unsubscribeUrl` falling back to the config's — for a topic\n * email; a transactional one resolves to no unsubscribe link at all. Leaves both untouched.\n */\nexport function resolveEmail(\n  template: Pick<EmailTemplate, 'from' | 'replyTo' | 'unsubscribeUrl' | 'topic'>,\n  config?: EmailConfig\n): ResolvedEmail {\n  const unsubscribeUrl =\n    template.topic === null ? undefined : (template.unsubscribeUrl ?? config?.unsubscribeUrl);\n  return {\n    from: template.from,\n    topic: template.topic,\n    ...(template.replyTo === undefined ? {} : { replyTo: template.replyTo }),\n    ...(unsubscribeUrl === undefined ? {} : { unsubscribeUrl }),\n  };\n}\n\nconst ADDRESS = /^[^\\s@<>]+@[^\\s@<>]+$/;\n\n/** Throws naming `where` when `address` is neither `user@host` nor `{ email: 'user@host', name? }`. */\nexport function assertEmailAddress(address: unknown, where: string): void {\n  const email =\n    typeof address === 'object' && address !== null\n      ? (address as { email?: unknown }).email\n      : address;\n  const name =\n    typeof address === 'object' && address !== null\n      ? (address as { name?: unknown }).name\n      : undefined;\n  if (typeof email !== 'string' || !ADDRESS.test(email)) {\n    throw new TypeError(`${where} must be an email address or { email, name? }`);\n  }\n  if (name !== undefined && typeof name !== 'string') {\n    throw new TypeError(`${where}.name must be a string`);\n  }\n}\n\n/** Throws naming `where` unless `url` is an absolute http(s) URL; '' and null are not a way to leave it out. */\nexport function assertUnsubscribeUrl(url: unknown, where: string): void {\n  let parsed: URL | undefined;\n  try {\n    parsed = typeof url === 'string' ? new URL(url) : undefined;\n  } catch {\n    parsed = undefined;\n  }\n  if (parsed === undefined || (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')) {\n    throw new TypeError(`${where} must be an http(s) URL (leave it out for none)`);\n  }\n}\n\n/** The config's `email` and every registered template's metadata; throws on the first invalid value. */\nexport function assertEmailConfig(\n  config: { email?: EmailConfig },\n  templates: Iterable<EmailTemplate>\n): void {\n  if (Object.hasOwn(config, 'emails')) {\n    throw new TypeError(\n      \"the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, \" +\n        'and the rest moved to `email: { unsubscribeUrl, tracking }`'\n    );\n  }\n  const email = config.email;\n  if (email !== undefined) {\n    if (email.unsubscribeUrl !== undefined) {\n      assertUnsubscribeUrl(email.unsubscribeUrl, 'email.unsubscribeUrl');\n    }\n    const quick = email.tracking?.quickClickMs;\n    if (\n      quick !== undefined &&\n      !(typeof quick === 'number' && Number.isFinite(quick) && quick >= 0)\n    ) {\n      throw new TypeError('email.tracking.quickClickMs must be a non-negative number');\n    }\n  }\n  for (const template of templates)\n    assertEmailMetadata(template, `email template '${template.id}'`, true);\n}\n\n/**\n * A template's own `from` / `replyTo` / `unsubscribeUrl` and what it is (`topic` or\n * `transactional: true`), as `emailTemplate` checks them — and `compileConfig` again, for a\n * definition that did not come through `emailTemplate`. A declared template carries `topic`\n * (a string, or null for transactional); a definition carries one of the two options.\n */\nexport function assertEmailMetadata(\n  template: {\n    from?: unknown;\n    replyTo?: unknown;\n    unsubscribeUrl?: unknown;\n    topic?: unknown;\n    transactional?: unknown;\n  },\n  where: string,\n  /** True for a declared template (`topic: string | null`), false for `emailTemplate`'s argument. */\n  declared = false\n): void {\n  assertEmailAddress(template.from, `${where}: from`);\n  if (template.replyTo !== undefined) assertEmailAddress(template.replyTo, `${where}: replyTo`);\n  if (template.unsubscribeUrl !== undefined) {\n    assertUnsubscribeUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);\n  }\n  const transactional = assertTemplateTopic(template, where, 'email', declared);\n  if (transactional && template.unsubscribeUrl !== undefined) {\n    throw new TypeError(\n      `${where}: a transactional email has no unsubscribe link, so it takes no 'unsubscribeUrl'`\n    );\n  }\n}\n\n/**\n * What a template is — `topic: <id>` or `transactional: true`, one of the two — as `emailTemplate`\n * and `pushTemplate` check their argument and `compileConfig` checks a declared template (where\n * `topic: null` is transactional). Answers whether the template is transactional. Whether the\n * topic is one the contract declares is `compileConfig`'s check, where the contract is at hand.\n */\nexport function assertTemplateTopic(\n  template: { topic?: unknown; transactional?: unknown },\n  where: string,\n  channel: 'email' | 'push',\n  declared = false\n): boolean {\n  const { topic } = template;\n  // A declared template says `topic: null` for transactional; a definition says `transactional: true`\n  const transactional = template.transactional === true || (declared && topic === null);\n  if (template.transactional !== undefined && template.transactional !== true) {\n    throw new TypeError(\n      `${where}: 'transactional' must be the literal true (leave it out for a topic ${channel})`\n    );\n  }\n  const hasTopic = topic !== undefined && topic !== null;\n  if (hasTopic && (typeof topic !== 'string' || topic.trim() === '')) {\n    throw new TypeError(`${where}: 'topic' must be a topic id the contract declares`);\n  }\n  if (hasTopic && transactional) {\n    throw new TypeError(`${where}: give either 'topic' or 'transactional: true', not both`);\n  }\n  if (!hasTopic && !transactional) {\n    throw new TypeError(\n      `${where}: every ${channel} template says what it is — 'topic: <id>' (one the contract's subscriptions.topics declares) or 'transactional: true'`\n    );\n  }\n  return transactional;\n}\n\n/** The unsubscribe link may carry its own query (a token, a list): the path names it. */\nexport function isUnsubscribeLink(url: string, unsubscribeUrl: string | undefined): boolean {\n  if (unsubscribeUrl === undefined) return false;\n  try {\n    const a = new URL(url);\n    const b = new URL(unsubscribeUrl);\n    return a.origin === b.origin && a.pathname === b.pathname;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;AAiBA,SAAgB,mBAAmB,SAA+B;CAChE,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,OAAO,QAAQ,SAAS,KAAA,IAAY,QAAQ,QAAQ,GAAG,QAAQ,KAAK,IAAI,QAAQ,MAAM;AACxF;AAEA,MAAM,QAAQ;AACd,MAAM,WAAW;;;;;;AAOjB,SAAgB,YAAY,SAA+B;CACzD,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,MAAM,EAAE,OAAO,SAAS;CACxB,IAAI,SAAS,KAAA,KAAa,SAAS,IAAI,OAAO;CAC9C,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG;EACrB,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;EAC3C,IAAI,SAAS;EACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;EAC5D,OAAO,aAAa,KAAK,MAAM,EAAE,MAAM,MAAM;CAC/C;CACA,IAAI,SAAS,KAAK,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,YAAY,MAAM,EAAE,KAAK,MAAM;CAChF,OAAO,GAAG,KAAK,IAAI,MAAM;AAC3B;;;;;AAuCA,SAAgB,aACd,UACA,QACe;CACf,MAAM,iBACJ,SAAS,UAAU,OAAO,KAAA,IAAa,SAAS,kBAAkB,QAAQ;CAC5E,OAAO;EACL,MAAM,SAAS;EACf,OAAO,SAAS;EAChB,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACtE,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe;CAC3D;AACF;AAEA,MAAM,UAAU;;AAGhB,SAAgB,mBAAmB,SAAkB,OAAqB;CACxE,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAAgC,QACjC;CACN,MAAM,OACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAA+B,OAChC,KAAA;CACN,IAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,KAAK,GAClD,MAAM,IAAI,UAAU,GAAG,MAAM,8CAA8C;CAE7E,IAAI,SAAS,KAAA,KAAa,OAAO,SAAS,UACxC,MAAM,IAAI,UAAU,GAAG,MAAM,uBAAuB;AAExD;;AAGA,SAAgB,qBAAqB,KAAc,OAAqB;CACtE,IAAI;CACJ,IAAI;EACF,SAAS,OAAO,QAAQ,WAAW,IAAI,IAAI,GAAG,IAAI,KAAA;CACpD,QAAQ;EACN,SAAS,KAAA;CACX;CACA,IAAI,WAAW,KAAA,KAAc,OAAO,aAAa,YAAY,OAAO,aAAa,SAC/E,MAAM,IAAI,UAAU,GAAG,MAAM,gDAAgD;AAEjF;;AAGA,SAAgB,kBACd,QACA,WACM;CACN,IAAI,OAAO,OAAO,QAAQ,QAAQ,GAChC,MAAM,IAAI,UACR,qJAEF;CAEF,MAAM,QAAQ,OAAO;CACrB,IAAI,UAAU,KAAA,GAAW;EACvB,IAAI,MAAM,mBAAmB,KAAA,GAC3B,qBAAqB,MAAM,gBAAgB,sBAAsB;EAEnE,MAAM,QAAQ,MAAM,UAAU;EAC9B,IACE,UAAU,KAAA,KACV,EAAE,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,SAAS,IAElE,MAAM,IAAI,UAAU,2DAA2D;CAEnF;CACA,KAAK,MAAM,YAAY,WACrB,oBAAoB,UAAU,mBAAmB,SAAS,GAAG,IAAI,IAAI;AACzE;;;;;;;AAQA,SAAgB,oBACd,UAOA,OAEA,WAAW,OACL;CACN,mBAAmB,SAAS,MAAM,GAAG,MAAM,OAAO;CAClD,IAAI,SAAS,YAAY,KAAA,GAAW,mBAAmB,SAAS,SAAS,GAAG,MAAM,UAAU;CAC5F,IAAI,SAAS,mBAAmB,KAAA,GAC9B,qBAAqB,SAAS,gBAAgB,GAAG,MAAM,iBAAiB;CAG1E,IADsB,oBAAoB,UAAU,OAAO,SAAS,QACpD,KAAK,SAAS,mBAAmB,KAAA,GAC/C,MAAM,IAAI,UACR,GAAG,MAAM,iFACX;AAEJ;;;;;;;AAQA,SAAgB,oBACd,UACA,OACA,SACA,WAAW,OACF;CACT,MAAM,EAAE,UAAU;CAElB,MAAM,gBAAgB,SAAS,kBAAkB,QAAS,YAAY,UAAU;CAChF,IAAI,SAAS,kBAAkB,KAAA,KAAa,SAAS,kBAAkB,MACrE,MAAM,IAAI,UACR,GAAG,MAAM,uEAAuE,QAAQ,EAC1F;CAEF,MAAM,WAAW,UAAU,KAAA,KAAa,UAAU;CAClD,IAAI,aAAa,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAC7D,MAAM,IAAI,UAAU,GAAG,MAAM,mDAAmD;CAElF,IAAI,YAAY,eACd,MAAM,IAAI,UAAU,GAAG,MAAM,yDAAyD;CAExF,IAAI,CAAC,YAAY,CAAC,eAChB,MAAM,IAAI,UACR,GAAG,MAAM,UAAU,QAAQ,sHAC7B;CAEF,OAAO;AACT;;AAGA,SAAgB,kBAAkB,KAAa,gBAA6C;CAC1F,IAAI,mBAAmB,KAAA,GAAW,OAAO;CACzC,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,GAAG;EACrB,MAAM,IAAI,IAAI,IAAI,cAAc;EAChC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE;CACnD,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"email.mjs","names":[],"sources":["../src/email.ts"],"sourcesContent":["import type { EmailTemplate } from './templates';\n\n/**\n * Email metadata: who a template's email comes from, where replies go, and the unsubscribe and\n * preference links its layout carries. Each `emailTemplate` declares its own `from` (and\n * `replyTo`, if replies should go elsewhere) and says what it is: a `topic` the recipient may\n * unsubscribe from, or `transactional: true`. A topic email's unsubscribe link is the template's\n * `unsubscribeUrl`, else the config's `email.unsubscribeUrl`, else none; its preferences link is\n * the config's `email.preferencesUrl` with the copy's message id, when the copy has one (reporting\n * on); a transactional email never has either, whatever the config says. `resolveEmail` is that\n * rule, and the sender, the renderer, the Worker's preview and the studio all go through it. No\n * React and no I/O here, so a browser can import it.\n */\n\n/** An address as the transports take it: bare, or with a display name. */\nexport type EmailAddress = string | { email: string; name?: string };\n\n/** `Name <email>`, or the bare address. */\nexport function formatEmailAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  return address.name === undefined ? address.email : `${address.name} <${address.email}>`;\n}\n\nconst ASCII = /^[\\x20-\\x7e]*$/;\nconst SPECIALS = /[()<>[\\]:;@\\\\,.\"]/;\n\n/**\n * An address as a mail API reads it (RFC 5322): a display name with specials is quoted, one\n * outside ASCII is a MIME encoded-word — raw non-ASCII names are refused (SES), and an unquoted\n * comma splits the address in two.\n */\nexport function mimeAddress(address: EmailAddress): string {\n  if (typeof address === 'string') return address;\n  const { email, name } = address;\n  if (name === undefined || name === '') return email;\n  if (!ASCII.test(name)) {\n    const bytes = new TextEncoder().encode(name);\n    let binary = '';\n    for (const byte of bytes) binary += String.fromCharCode(byte);\n    return `=?UTF-8?B?${btoa(binary)}?= <${email}>`;\n  }\n  if (SPECIALS.test(name)) return `\"${name.replace(/([\"\\\\])/g, '\\\\$1')}\" <${email}>`;\n  return `${name} <${email}>`;\n}\n\n/** The config's `email`: what every email template shares. */\nexport interface EmailConfig {\n  /**\n   * The unsubscribe link of every email template that names none of its own. The layout reads it\n   * with `useEmailContext()`; sent, it is tracked like every link, but following it shows a\n   * confirmation page, and only the confirmation (a POST no link scanner sends) unsubscribes.\n   */\n  unsubscribeUrl?: string;\n  /**\n   * The app's email preference page. A topic email sent with reporting on links to it with the\n   * copy's message id as the `m` query parameter (`useEmailContext().preferencesUrl`), and the\n   * page reads and sets the recipient's subscriptions by that id — no sign-in — through\n   * `GET` / `PUT /subscriptions/by-message/:messageId` (`JourneyClient.getSubscriptionsByMessage`\n   * / `setSubscriptionsByMessage`). Tracked as an ordinary link; it must not share its origin and\n   * path with `unsubscribeUrl`, which would make it the unsubscribe link instead.\n   */\n  preferencesUrl?: string;\n  /** How the Worker tells a person's opens and clicks from a machine's (see the reporting classifier). */\n  tracking?: {\n    /**\n     * An open or click this many milliseconds after delivery is a weak machine signal — machine\n     * only together with another (a second link within seconds); 1000 by default. A person\n     * tapping a mail notification can click within a few seconds, so keep it short.\n     */\n    quickClickMs?: number;\n  };\n}\n\n/** One template's email metadata, resolved against the config. */\nexport interface ResolvedEmail {\n  from: EmailAddress;\n  /** The template's subscription topic; null for a transactional email. */\n  topic: string | null;\n  /** Absent when the template names none: the email goes out without a Reply-To. */\n  replyTo?: EmailAddress;\n  /**\n   * Absent when the email is transactional, or neither the template nor the config names one:\n   * the email has no unsubscribe link.\n   */\n  unsubscribeUrl?: string;\n  /**\n   * The config's `preferencesUrl` with this copy's message id as `m`. Absent when the email is\n   * transactional, the config names no page, or the copy has no message id (reporting off): the\n   * email has no preferences link, and a layout renders none.\n   */\n  preferencesUrl?: string;\n}\n\n/** What a render knows of the copy beyond the template: its message id, when reporting records one. */\nexport interface EmailRenderOptions {\n  /** The copy's id in the reporting tables — what `/t/...` and `/subscriptions/by-message` key on. */\n  messageId?: string | undefined;\n}\n\n/**\n * The message id a preview renders with: the preferences link shows in the studio and\n * `GET /preview`, pointing at a copy that does not exist.\n */\nexport const PREVIEW_MESSAGE_ID = '00000000-0000-0000-0000-000000000000';\n\n/**\n * The template's metadata, its `unsubscribeUrl` falling back to the config's, and the\n * preferences link built from the config's page and the copy's message id — for a topic email; a\n * transactional one resolves to neither link. Leaves the inputs untouched.\n */\nexport function resolveEmail(\n  template: Pick<EmailTemplate, 'from' | 'replyTo' | 'unsubscribeUrl' | 'topic'>,\n  config?: EmailConfig,\n  options: EmailRenderOptions = {}\n): ResolvedEmail {\n  const topical = template.topic !== null;\n  const unsubscribeUrl = topical ? (template.unsubscribeUrl ?? config?.unsubscribeUrl) : undefined;\n  const preferencesUrl =\n    topical && config?.preferencesUrl !== undefined && options.messageId !== undefined\n      ? preferencesLink(config.preferencesUrl, options.messageId)\n      : undefined;\n  return {\n    from: template.from,\n    topic: template.topic,\n    ...(template.replyTo === undefined ? {} : { replyTo: template.replyTo }),\n    ...(unsubscribeUrl === undefined ? {} : { unsubscribeUrl }),\n    ...(preferencesUrl === undefined ? {} : { preferencesUrl }),\n  };\n}\n\n/** The preference page's URL for one copy: `m=<message id>` set on its query, the rest of it kept. */\nexport function preferencesLink(preferencesUrl: string, messageId: string): string {\n  const url = new URL(preferencesUrl);\n  url.searchParams.set('m', messageId);\n  return url.toString();\n}\n\nconst ADDRESS = /^[^\\s@<>]+@[^\\s@<>]+$/;\n\n/** Throws naming `where` when `address` is neither `user@host` nor `{ email: 'user@host', name? }`. */\nexport function assertEmailAddress(address: unknown, where: string): void {\n  const email =\n    typeof address === 'object' && address !== null\n      ? (address as { email?: unknown }).email\n      : address;\n  const name =\n    typeof address === 'object' && address !== null\n      ? (address as { name?: unknown }).name\n      : undefined;\n  if (typeof email !== 'string' || !ADDRESS.test(email)) {\n    throw new TypeError(`${where} must be an email address or { email, name? }`);\n  }\n  if (name !== undefined && typeof name !== 'string') {\n    throw new TypeError(`${where}.name must be a string`);\n  }\n}\n\n/** Throws naming `where` unless `url` is an absolute http(s) URL; '' and null are not a way to leave it out. */\nexport function assertHttpUrl(url: unknown, where: string): void {\n  let parsed: URL | undefined;\n  try {\n    parsed = typeof url === 'string' ? new URL(url) : undefined;\n  } catch {\n    parsed = undefined;\n  }\n  if (parsed === undefined || (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')) {\n    throw new TypeError(`${where} must be an http(s) URL (leave it out for none)`);\n  }\n}\n\n/** `assertHttpUrl`, under its earlier name. */\nexport const assertUnsubscribeUrl: typeof assertHttpUrl = assertHttpUrl;\n\n/** The config's `email` and every registered template's metadata; throws on the first invalid value. */\nexport function assertEmailConfig(\n  config: { email?: EmailConfig },\n  templates: Iterable<EmailTemplate>\n): void {\n  if (Object.hasOwn(config, 'emails')) {\n    throw new TypeError(\n      \"the config's `emails` is gone: `from` and `replyTo` are declared on each emailTemplate, \" +\n        'and the rest moved to `email: { unsubscribeUrl, preferencesUrl, tracking }`'\n    );\n  }\n  const email = config.email;\n  if (email !== undefined) {\n    if (email.unsubscribeUrl !== undefined) {\n      assertHttpUrl(email.unsubscribeUrl, 'email.unsubscribeUrl');\n    }\n    if (email.preferencesUrl !== undefined) {\n      assertHttpUrl(email.preferencesUrl, 'email.preferencesUrl');\n      // The sender tells the unsubscribe link from the others by origin and path: a preference\n      // page at the same address would be tracked as the unsubscribe link and land on `/t/u`\n      if (isUnsubscribeLink(email.preferencesUrl, email.unsubscribeUrl)) {\n        throw new TypeError(\n          'email.preferencesUrl must not share its origin and path with email.unsubscribeUrl: ' +\n            'the sender would track the preferences link as the unsubscribe link'\n        );\n      }\n    }\n    const quick = email.tracking?.quickClickMs;\n    if (\n      quick !== undefined &&\n      !(typeof quick === 'number' && Number.isFinite(quick) && quick >= 0)\n    ) {\n      throw new TypeError('email.tracking.quickClickMs must be a non-negative number');\n    }\n  }\n  for (const template of templates) {\n    const where = `email template '${template.id}'`;\n    assertEmailMetadata(template, where, true);\n    if (\n      email?.preferencesUrl !== undefined &&\n      isUnsubscribeLink(email.preferencesUrl, template.unsubscribeUrl)\n    ) {\n      throw new TypeError(\n        `${where}: its unsubscribeUrl shares its origin and path with email.preferencesUrl, so ` +\n          'the sender would track the preferences link as the unsubscribe link'\n      );\n    }\n  }\n}\n\n/**\n * A template's own `from` / `replyTo` / `unsubscribeUrl` and what it is (`topic` or\n * `transactional: true`), as `emailTemplate` checks them — and `compileConfig` again, for a\n * definition that did not come through `emailTemplate`. A declared template carries `topic`\n * (a string, or null for transactional); a definition carries one of the two options.\n */\nexport function assertEmailMetadata(\n  template: {\n    from?: unknown;\n    replyTo?: unknown;\n    unsubscribeUrl?: unknown;\n    topic?: unknown;\n    transactional?: unknown;\n  },\n  where: string,\n  /** True for a declared template (`topic: string | null`), false for `emailTemplate`'s argument. */\n  declared = false\n): void {\n  assertEmailAddress(template.from, `${where}: from`);\n  if (template.replyTo !== undefined) assertEmailAddress(template.replyTo, `${where}: replyTo`);\n  if (template.unsubscribeUrl !== undefined) {\n    assertHttpUrl(template.unsubscribeUrl, `${where}: unsubscribeUrl`);\n  }\n  const transactional = assertTemplateTopic(template, where, 'email', declared);\n  if (transactional && template.unsubscribeUrl !== undefined) {\n    throw new TypeError(\n      `${where}: a transactional email has no unsubscribe link, so it takes no 'unsubscribeUrl'`\n    );\n  }\n}\n\n/**\n * What a template is — `topic: <id>` or `transactional: true`, one of the two — as `emailTemplate`\n * and `pushTemplate` check their argument and `compileConfig` checks a declared template (where\n * `topic: null` is transactional). Answers whether the template is transactional. Whether the\n * topic is one the contract declares is `compileConfig`'s check, where the contract is at hand.\n */\nexport function assertTemplateTopic(\n  template: { topic?: unknown; transactional?: unknown },\n  where: string,\n  channel: 'email' | 'push',\n  declared = false\n): boolean {\n  const { topic } = template;\n  // A declared template says `topic: null` for transactional; a definition says `transactional: true`\n  const transactional = template.transactional === true || (declared && topic === null);\n  if (template.transactional !== undefined && template.transactional !== true) {\n    throw new TypeError(\n      `${where}: 'transactional' must be the literal true (leave it out for a topic ${channel})`\n    );\n  }\n  const hasTopic = topic !== undefined && topic !== null;\n  if (hasTopic && (typeof topic !== 'string' || topic.trim() === '')) {\n    throw new TypeError(`${where}: 'topic' must be a topic id the contract declares`);\n  }\n  if (hasTopic && transactional) {\n    throw new TypeError(`${where}: give either 'topic' or 'transactional: true', not both`);\n  }\n  if (!hasTopic && !transactional) {\n    throw new TypeError(\n      `${where}: every ${channel} template says what it is — 'topic: <id>' (one the contract's subscriptions.topics declares) or 'transactional: true'`\n    );\n  }\n  return transactional;\n}\n\n/** The unsubscribe link may carry its own query (a token, a list): the path names it. */\nexport function isUnsubscribeLink(url: string, unsubscribeUrl: string | undefined): boolean {\n  if (unsubscribeUrl === undefined) return false;\n  try {\n    const a = new URL(url);\n    const b = new URL(unsubscribeUrl);\n    return a.origin === b.origin && a.pathname === b.pathname;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;AAkBA,SAAgB,mBAAmB,SAA+B;CAChE,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,OAAO,QAAQ,SAAS,KAAA,IAAY,QAAQ,QAAQ,GAAG,QAAQ,KAAK,IAAI,QAAQ,MAAM;AACxF;AAEA,MAAM,QAAQ;AACd,MAAM,WAAW;;;;;;AAOjB,SAAgB,YAAY,SAA+B;CACzD,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,MAAM,EAAE,OAAO,SAAS;CACxB,IAAI,SAAS,KAAA,KAAa,SAAS,IAAI,OAAO;CAC9C,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG;EACrB,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;EAC3C,IAAI,SAAS;EACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;EAC5D,OAAO,aAAa,KAAK,MAAM,EAAE,MAAM,MAAM;CAC/C;CACA,IAAI,SAAS,KAAK,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,YAAY,MAAM,EAAE,KAAK,MAAM;CAChF,OAAO,GAAG,KAAK,IAAI,MAAM;AAC3B;;;;;AA4DA,MAAa,qBAAqB;;;;;;AAOlC,SAAgB,aACd,UACA,QACA,UAA8B,CAAC,GAChB;CACf,MAAM,UAAU,SAAS,UAAU;CACnC,MAAM,iBAAiB,UAAW,SAAS,kBAAkB,QAAQ,iBAAkB,KAAA;CACvF,MAAM,iBACJ,WAAW,QAAQ,mBAAmB,KAAA,KAAa,QAAQ,cAAc,KAAA,IACrE,gBAAgB,OAAO,gBAAgB,QAAQ,SAAS,IACxD,KAAA;CACN,OAAO;EACL,MAAM,SAAS;EACf,OAAO,SAAS;EAChB,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACtE,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe;EACzD,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe;CAC3D;AACF;;AAGA,SAAgB,gBAAgB,gBAAwB,WAA2B;CACjF,MAAM,MAAM,IAAI,IAAI,cAAc;CAClC,IAAI,aAAa,IAAI,KAAK,SAAS;CACnC,OAAO,IAAI,SAAS;AACtB;AAEA,MAAM,UAAU;;AAGhB,SAAgB,mBAAmB,SAAkB,OAAqB;CACxE,MAAM,QACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAAgC,QACjC;CACN,MAAM,OACJ,OAAO,YAAY,YAAY,YAAY,OACtC,QAA+B,OAChC,KAAA;CACN,IAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,KAAK,GAClD,MAAM,IAAI,UAAU,GAAG,MAAM,8CAA8C;CAE7E,IAAI,SAAS,KAAA,KAAa,OAAO,SAAS,UACxC,MAAM,IAAI,UAAU,GAAG,MAAM,uBAAuB;AAExD;;AAGA,SAAgB,cAAc,KAAc,OAAqB;CAC/D,IAAI;CACJ,IAAI;EACF,SAAS,OAAO,QAAQ,WAAW,IAAI,IAAI,GAAG,IAAI,KAAA;CACpD,QAAQ;EACN,SAAS,KAAA;CACX;CACA,IAAI,WAAW,KAAA,KAAc,OAAO,aAAa,YAAY,OAAO,aAAa,SAC/E,MAAM,IAAI,UAAU,GAAG,MAAM,gDAAgD;AAEjF;;AAGA,MAAa,uBAA6C;;AAG1D,SAAgB,kBACd,QACA,WACM;CACN,IAAI,OAAO,OAAO,QAAQ,QAAQ,GAChC,MAAM,IAAI,UACR,qKAEF;CAEF,MAAM,QAAQ,OAAO;CACrB,IAAI,UAAU,KAAA,GAAW;EACvB,IAAI,MAAM,mBAAmB,KAAA,GAC3B,cAAc,MAAM,gBAAgB,sBAAsB;EAE5D,IAAI,MAAM,mBAAmB,KAAA,GAAW;GACtC,cAAc,MAAM,gBAAgB,sBAAsB;GAG1D,IAAI,kBAAkB,MAAM,gBAAgB,MAAM,cAAc,GAC9D,MAAM,IAAI,UACR,wJAEF;EAEJ;EACA,MAAM,QAAQ,MAAM,UAAU;EAC9B,IACE,UAAU,KAAA,KACV,EAAE,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,SAAS,IAElE,MAAM,IAAI,UAAU,2DAA2D;CAEnF;CACA,KAAK,MAAM,YAAY,WAAW;EAChC,MAAM,QAAQ,mBAAmB,SAAS,GAAG;EAC7C,oBAAoB,UAAU,OAAO,IAAI;EACzC,IACE,OAAO,mBAAmB,KAAA,KAC1B,kBAAkB,MAAM,gBAAgB,SAAS,cAAc,GAE/D,MAAM,IAAI,UACR,GAAG,MAAM,kJAEX;CAEJ;AACF;;;;;;;AAQA,SAAgB,oBACd,UAOA,OAEA,WAAW,OACL;CACN,mBAAmB,SAAS,MAAM,GAAG,MAAM,OAAO;CAClD,IAAI,SAAS,YAAY,KAAA,GAAW,mBAAmB,SAAS,SAAS,GAAG,MAAM,UAAU;CAC5F,IAAI,SAAS,mBAAmB,KAAA,GAC9B,cAAc,SAAS,gBAAgB,GAAG,MAAM,iBAAiB;CAGnE,IADsB,oBAAoB,UAAU,OAAO,SAAS,QACpD,KAAK,SAAS,mBAAmB,KAAA,GAC/C,MAAM,IAAI,UACR,GAAG,MAAM,iFACX;AAEJ;;;;;;;AAQA,SAAgB,oBACd,UACA,OACA,SACA,WAAW,OACF;CACT,MAAM,EAAE,UAAU;CAElB,MAAM,gBAAgB,SAAS,kBAAkB,QAAS,YAAY,UAAU;CAChF,IAAI,SAAS,kBAAkB,KAAA,KAAa,SAAS,kBAAkB,MACrE,MAAM,IAAI,UACR,GAAG,MAAM,uEAAuE,QAAQ,EAC1F;CAEF,MAAM,WAAW,UAAU,KAAA,KAAa,UAAU;CAClD,IAAI,aAAa,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAC7D,MAAM,IAAI,UAAU,GAAG,MAAM,mDAAmD;CAElF,IAAI,YAAY,eACd,MAAM,IAAI,UAAU,GAAG,MAAM,yDAAyD;CAExF,IAAI,CAAC,YAAY,CAAC,eAChB,MAAM,IAAI,UACR,GAAG,MAAM,UAAU,QAAQ,sHAC7B;CAEF,OAAO;AACT;;AAGA,SAAgB,kBAAkB,KAAa,gBAA6C;CAC1F,IAAI,mBAAmB,KAAA,GAAW,OAAO;CACzC,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,GAAG;EACrB,MAAM,IAAI,IAAI,IAAI,cAAc;EAChC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE;CACnD,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/engine/ports.d.cts

@@ -122,6 +122,12 @@ export type LinkPurpose = 'link' | 'unsubscribe';
  * Each is optional, and a sender ignores what its channel has no use for.
  */
 export interface MessageTracking {
+  /**
+   * The copy's id in the reporting tables: what its tracking URLs name, and what an email's
+   * preferences link carries (`email.preferencesUrl`), so the app's page can read the recipient's
+   * subscriptions by it. The email sender hands it to the renderer.
+   */
+  messageId?: string;
   /**
    * The original `http(s)` URL in, the URL that records the click and redirects out — or, for the
    * email's unsubscribe link, asks the recipient to confirm.

package/dist/engine/ports.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.cts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;;EAMf;;;;;EAKA,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/engine/ports.d.mts

@@ -122,6 +122,12 @@ export type LinkPurpose = 'link' | 'unsubscribe';
  * Each is optional, and a sender ignores what its channel has no use for.
  */
 export interface MessageTracking {
+  /**
+   * The copy's id in the reporting tables: what its tracking URLs name, and what an email's
+   * preferences link carries (`email.preferencesUrl`), so the app's page can read the recipient's
+   * subscriptions by it. The email sender hands it to the renderer.
+   */
+  messageId?: string;
   /**
    * The original `http(s)` URL in, the URL that records the click and redirects out — or, for the
    * email's unsubscribe link, asks the recipient to confirm.

package/dist/engine/ports.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;EAKf,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}
+{"version":3,"file":"ports.d.mts","names":[],"sources":["../../src/engine/ports.ts"],"mappings":";;;;;;;;;;;;;;;iBAiBiB;;EAEf,GAAG,GAAG,cAAc,UAAU,QAAQ,KAAK,QAAQ;;;;;EAMnD,MAAM,cAAc,aAAa;;;;;;;;;;;;;;;EAgBjC,UACE,cACA,2BACA;IAAY;MACX;;EAGH,YAAY,eAAe;;;;;;;;;;;;EAa3B,YACE,cACA;IAAQ;IAAmB;MAC1B;;;iBAIY;EACf;EACA;;;iBAIe;;;;;;EAMf,YACE,eACA;IAAS;IAAkB;IAAkB,QAAQ;MACpD;EACH,YAAY,eAAe,QAAQ;;EAEnC,oBAAoB,eAAe,QAAQ;;EAE3C,eAAe,QAAQ;;;;;;EAMvB,cAAc,SAAS,WAAW,iBAAiB;;iBAGpC;;EAEf;EACA;EACA;EACA,SAAS;EACT;;EAEA,OAAO,eAAe;EACtB;;;;;;EAMA;;EAEA,SAAS;;EAET;;;;;;EAMA;;EAEA,WAAW;;;YAID;;;;;;iBAOK;;;;;;EAMf;;;;;EAKA,QAAQ,aAAa,SAAS;;EAE9B;;;;;;EAMA;;EAEA,OAAO;;;;;;EAMP,eAAe;;;;;;;iBAQA;EACf;EACA;;iBAGe;EACf,KAAK,SAAS,kBAAkB,eAAe;;;;;;;;;iBAUhC;;EAEf,SAAS;IACP;IACA;IACA;IACA;MACE;;EAEJ,aAAa;IACX;IACA;IACA;IACA;IACA;MACE;;EAEJ,iBAAiB,SAAS,kBAAkB,QAAQ;;EAEpD,aAAa,SAAS,iBAAiB;IAAU;MAAoB,aAAa;;EAElF,UAAU;IACR;IACA;IACA;IACA,QAAQ;IACR;;IAEA;MACE;;;;;;;;;iBAUW;EACf,SAAS;IACP,SAAS;IACT;IACA,OAAO,eAAe;MACpB,eAAe;;;iBAIJ;;;;;;;;EAQf,KAAK,eAAe,SAAS,eAAe,uBAAuB,aAAa;;;iBAIjE;;EAEf;;EAEA,MAAM,eAAe;EACrB;;EAEA;;;;;;;iBAQe;EACf,OAAO,YAAY,mBAAmB;;iBAGvB;EACf;;EAEA;;;;;;;EAOA;EACA,MAAM;EACN,OAAO;EACP,UAAU;EACV,QAAQ;;EAER,UAAU;;EAEV,YAAY;;EAEZ,WAAW;;;;;;;YAQD;EACN;;EACA;EAAkB;;EAClB;;EACA;;EACA"}

package/dist/host/channels.cjs

@@ -28,6 +28,21 @@ let node_buffer = require("node:buffer");
 function journeyMode(env) {
 	return env.ENVIRONMENT ?? "production";
 }
+let relayIgnoredLogged = false;
+/**
+* Where APNs requests go: the dev relay `APNS_RELAY_ORIGIN` names, except in production. The relay
+* sees the provider JWT, so a production deploy that inherited the variable (a copied `.dev.vars`,
+* a leftover `vars` entry) goes straight to APNs rather than hand the credential to whatever
+* answers there, and says so once.
+*/
+function apnsRelayOrigin(env, mode) {
+	const origin = env.APNS_RELAY_ORIGIN;
+	if (origin === void 0 || mode !== "production") return origin;
+	if (!relayIgnoredLogged) {
+		relayIgnoredLogged = true;
+		console.error(`[workflow] APNS_RELAY_ORIGIN (${origin}) is ignored in production: APNs is called directly. The relay is for wrangler dev only; unset it in this environment.`);
+	}
+}
 /** The runtime options for this environment's mode. */
 function runtimeFromConfig(config, env) {
 	return require_runtime.resolveRuntime(config?.runtime, journeyMode(env));
@@ -131,12 +146,13 @@ function channelsFromConfig(config, env, options = {}) {
 					teamId: apns.teamId,
 					privateKey: require_apns.apnsKeyFromBase64(secret)
 				}));
+				const origin = apnsRelayOrigin(env, mode);
 				return new require_apns.ApnsPushSender({
 					credentials,
 					topic: apns.topic,
 					environment,
 					render,
-					...env.APNS_RELAY_ORIGIN === void 0 ? {} : { origin: env.APNS_RELAY_ORIGIN },
+					...origin === void 0 ? {} : { origin },
 					...apnsFetch === void 0 ? {} : { fetch: apnsFetch }
 				});
 			}), require_apns.DEAD_TOKEN_REASONS);

package/dist/host/channels.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"channels.cjs","names":["resolveRuntime","PermanentError","Buffer","EmailSender","registryRenderer","registryPushRenderer","removeDevice","apnsEnvironment","ApnsProviderToken","apnsKeyFromBase64","ApnsPushSender","APNS_DEAD_TOKEN_REASONS","serviceAccountFromBase64","FcmAccessToken","FcmPushSender","FCM_DEAD_TOKEN_REASONS","VapidSigner","WebPushSender","WEB_PUSH_DEAD_TOKEN_REASONS","routeByPlatform","indexTemplates","DiscordWebhookSender","lookupTemplate","renderDiscordContent","SlackWebhookSender","renderSlackContent","routeByChannel"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport {\n  DEAD_TOKEN_REASONS as APNS_DEAD_TOKEN_REASONS,\n  ApnsProviderToken,\n  ApnsPushSender,\n  apnsKeyFromBase64,\n} from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender } from '../engine/ports';\nimport { PermanentError } from '../engine/retry';\nimport {\n  DEAD_TOKEN_REASONS as FCM_DEAD_TOKEN_REASONS,\n  FcmAccessToken,\n  FcmPushSender,\n  serviceAccountFromBase64,\n} from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport {\n  VapidSigner,\n  DEAD_TOKEN_REASONS as WEB_PUSH_DEAD_TOKEN_REASONS,\n  WebPushSender,\n} from '../webpush';\nimport { removeDevice } from './ingest';\nimport type { JourneyEnv } from './platform';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/**\n * A sender that fails every message with the reason the channel cannot deliver — for good: the\n * configuration is the same on every attempt, so the step does not retry into it.\n */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new PermanentError(\n        `cannot send '${message.template}' on ${message.channel}: ${reason}`\n      );\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    // Missing on this attempt, missing on the next: the deployment has to change, not the step\n    throw new PermanentError(\n      `${name} is not set: the environment must hold it for the configured channel`\n    );\n  }\n  return value;\n}\n\n/**\n * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long\n * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every\n * instance) and builds the senders anew each time; what must outlive the run is the credential\n * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a\n * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access\n * token is good for an hour, the VAPID key import is wasted work twice.\n *\n * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the\n * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is\n * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,\n * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded\n * host mints a new credential instead of reusing the old, and the secret itself is in no key and\n * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:\n * the sender is built per call around the shared credential.\n */\nexport interface ProviderCache {\n  /** The credential under `key`, built on the first call and returned as is after that. */\n  get<T>(key: string, build: () => T): T;\n}\n\nexport function createProviderCache(): ProviderCache {\n  const credentials = new Map<string, unknown>();\n  return {\n    get<T>(key: string, build: () => T): T {\n      if (!credentials.has(key)) credentials.set(key, build());\n      return credentials.get(key) as T;\n    },\n  };\n}\n\n/** A number for each fetch implementation, so a credential minted through one is not reused with another. */\nconst identities = new WeakMap<object, number>();\nlet nextIdentity = 1;\nfunction identity(value: object | undefined): string {\n  if (value === undefined) return 'global';\n  let id = identities.get(value);\n  if (id === undefined) {\n    id = nextIdentity++;\n    identities.set(value, id);\n  }\n  return String(id);\n}\n\n/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */\nasync function secretDigest(secret: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return Buffer.from(digest.slice(0, 4)).toString('hex');\n}\n\n/**\n * A sender built on its first message, then kept for this call. `build` reads the secrets (and\n * so may throw a `PermanentError` naming the missing variable): a platform's secret is only\n * required when something is actually sent there, so a journey that only emails must not fail\n * because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.\n */\nfunction lazy(build: () => Promise<MessageSender>): MessageSender {\n  let sender: Promise<MessageSender> | undefined;\n  return {\n    async send(message) {\n      sender ??= build().catch((error: unknown) => {\n        sender = undefined;\n        throw error;\n      });\n      return (await sender).send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n    /**\n     * Where the provider credentials live across runs (`createProviderCache`): the host's, made\n     * once with it. Without one, this call's credentials are its own — nothing is reused.\n     */\n    providers?: ProviderCache | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n  const providers = options.providers ?? createProviderCache();\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    /**\n     * A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n     * waits that read devices, as a removal through the API does. Done here, per run, on the\n     * settled result, so the credential cached across runs (see `ProviderCache`) never holds a\n     * run's store.\n     */\n    const dropDeadTokens = (\n      provider: MessageSender,\n      deadTokenReasons: ReadonlySet<string>\n    ): MessageSender => ({\n      async send(message) {\n        const result = await provider.send(message);\n        if (\n          result !== undefined &&\n          deadTokenReasons.has(result.reason) &&\n          message.device !== undefined &&\n          options.store !== undefined\n        ) {\n          await removeDevice(env, message.device.token, options.store);\n        }\n        return result;\n      },\n    });\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      const apnsFetch = options.apnsFetch ?? options.fetch;\n      const environment = apnsEnvironment(apns, mode);\n      platforms.ios = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'APNS_PRIVATE_KEY_BASE64');\n          const credentials = providers.get(\n            JSON.stringify(['apns', apns.keyId, apns.teamId, await secretDigest(secret)]),\n            () =>\n              new ApnsProviderToken({\n                keyId: apns.keyId,\n                teamId: apns.teamId,\n                privateKey: apnsKeyFromBase64(secret),\n              })\n          );\n          return new ApnsPushSender({\n            credentials,\n            topic: apns.topic,\n            environment,\n            render,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...(apnsFetch === undefined ? {} : { fetch: apnsFetch }),\n          });\n        }),\n        APNS_DEAD_TOKEN_REASONS\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64');\n          const serviceAccount = serviceAccountFromBase64(secret);\n          // The token endpoint is called through the fetch: another fetch is another credential\n          const credentials = providers.get(\n            JSON.stringify([\n              'fcm',\n              serviceAccount.client_email,\n              serviceAccount.project_id,\n              identity(options.fetch),\n              await secretDigest(secret),\n            ]),\n            () =>\n              new FcmAccessToken({\n                serviceAccount,\n                ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n              })\n          );\n          return new FcmPushSender({\n            credentials,\n            render,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        FCM_DEAD_TOKEN_REASONS\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = dropDeadTokens(\n        lazy(async () => {\n          const publicKey = requireSecret(env, 'VAPID_PUBLIC_KEY');\n          const privateKey = requireSecret(env, 'VAPID_PRIVATE_KEY');\n          const credentials = providers.get(\n            JSON.stringify(['vapid', webPush.subject, publicKey, await secretDigest(privateKey)]),\n            () => new VapidSigner({ subject: webPush.subject, publicKey, privateKey })\n          );\n          return new WebPushSender({\n            credentials,\n            render,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        WEB_PUSH_DEAD_TOKEN_REASONS\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new PermanentError(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAOA,gBAAAA,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;;;;AAMA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAIC,qBAAAA,eACR,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAC9D;CACF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAEhD,MAAM,IAAIA,qBAAAA,eACR,GAAG,KAAK,qEACV;CAEF,OAAO;AACT;AAuBA,SAAgB,sBAAqC;CACnD,MAAM,8BAAc,IAAI,IAAqB;CAC7C,OAAO,EACL,IAAO,KAAa,OAAmB;EACrC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,MAAM,CAAC;EACvD,OAAO,YAAY,IAAI,GAAG;CAC5B,EACF;AACF;;AAGA,MAAM,6BAAa,IAAI,QAAwB;AAC/C,IAAI,eAAe;AACnB,SAAS,SAAS,OAAmC;CACnD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,KAAK,WAAW,IAAI,KAAK;CAC7B,IAAI,OAAO,KAAA,GAAW;EACpB,KAAK;EACL,WAAW,IAAI,OAAO,EAAE;CAC1B;CACA,OAAO,OAAO,EAAE;AAClB;;AAGA,eAAe,aAAa,QAAiC;CAC3D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC;CACrF,OAAOC,YAAAA,OAAO,KAAK,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK;AACvD;;;;;;;AAQA,SAAS,KAAK,OAAoD;CAChE,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC3C,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,QAAQ,MAAM,OAAA,CAAQ,KAAK,OAAO;CACpC,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAaI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,YAAY,QAAQ,aAAa,oBAAoB;CAE3D,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAIC,qBAAAA,YAAY;GAAE;GAAW,QAAQC,oBAAAA,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAASC,aAAAA,qBAAqB,QAAQ;;;;;;;EAO5C,MAAM,kBACJ,UACA,sBACmB,EACnB,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;GAC1C,IACE,WAAW,KAAA,KACX,iBAAiB,IAAI,OAAO,MAAM,KAClC,QAAQ,WAAW,KAAA,KACnB,QAAQ,UAAU,KAAA,GAElB,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;GAE7D,OAAO;EACT,EACF;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;GAC/C,MAAM,cAAcC,eAAAA,gBAAgB,MAAM,IAAI;GAC9C,UAAU,MAAM,eACd,KAAK,YAAY;IACf,MAAM,SAAS,cAAc,KAAK,yBAAyB;IAC3D,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;KAAC;KAAQ,KAAK;KAAO,KAAK;KAAQ,MAAM,aAAa,MAAM;IAAC,CAAC,SAE1E,IAAIC,aAAAA,kBAAkB;KACpB,OAAO,KAAK;KACZ,QAAQ,KAAK;KACb,YAAYC,aAAAA,kBAAkB,MAAM;IACtC,CAAC,CACL;IACA,OAAO,IAAIC,aAAAA,eAAe;KACxB;KACA,OAAO,KAAK;KACZ;KACA;KACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;KAC/E,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU;IACxD,CAAC;GACH,CAAC,GACDC,aAAAA,kBACF;EACF;EACA,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,eAClB,KAAK,YAAY;GACf,MAAM,SAAS,cAAc,KAAK,uCAAuC;GACzE,MAAM,iBAAiBC,YAAAA,yBAAyB,MAAM;GAEtD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IACb;IACA,eAAe;IACf,eAAe;IACf,SAAS,QAAQ,KAAK;IACtB,MAAM,aAAa,MAAM;GAC3B,CAAC,SAEC,IAAIC,YAAAA,eAAe;IACjB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC,CACL;GACA,OAAO,IAAIC,YAAAA,cAAc;IACvB;IACA;IACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;IACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,YAAAA,kBACF;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,eACd,KAAK,YAAY;GACf,MAAM,YAAY,cAAc,KAAK,kBAAkB;GACvD,MAAM,aAAa,cAAc,KAAK,mBAAmB;GACzD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IAAC;IAAS,QAAQ;IAAS;IAAW,MAAM,aAAa,UAAU;GAAC,CAAC,SAC9E,IAAIC,gBAAAA,YAAY;IAAE,SAAS,QAAQ;IAAS;IAAW;GAAW,CAAC,CAC3E;GACA,OAAO,IAAIC,gBAAAA,cAAc;IACvB;IACA;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,gBAAAA,kBACF;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAOC,qBAAAA,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAIlB,qBAAAA,eACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQmB,kBAAAA,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAIC,iBAAAA,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWC,kBAAAA,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAASC,kBAAAA,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQH,kBAAAA,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAII,iBAAAA,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWF,kBAAAA,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAASG,kBAAAA,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAOC,qBAAAA,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}
+{"version":3,"file":"channels.cjs","names":["resolveRuntime","PermanentError","Buffer","EmailSender","registryRenderer","registryPushRenderer","removeDevice","apnsEnvironment","ApnsProviderToken","apnsKeyFromBase64","ApnsPushSender","APNS_DEAD_TOKEN_REASONS","serviceAccountFromBase64","FcmAccessToken","FcmPushSender","FCM_DEAD_TOKEN_REASONS","VapidSigner","WebPushSender","WEB_PUSH_DEAD_TOKEN_REASONS","routeByPlatform","indexTemplates","DiscordWebhookSender","lookupTemplate","renderDiscordContent","SlackWebhookSender","renderSlackContent","routeByChannel"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport {\n  DEAD_TOKEN_REASONS as APNS_DEAD_TOKEN_REASONS,\n  ApnsProviderToken,\n  ApnsPushSender,\n  apnsKeyFromBase64,\n} from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender } from '../engine/ports';\nimport { PermanentError } from '../engine/retry';\nimport {\n  DEAD_TOKEN_REASONS as FCM_DEAD_TOKEN_REASONS,\n  FcmAccessToken,\n  FcmPushSender,\n  serviceAccountFromBase64,\n} from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport {\n  VapidSigner,\n  DEAD_TOKEN_REASONS as WEB_PUSH_DEAD_TOKEN_REASONS,\n  WebPushSender,\n} from '../webpush';\nimport { removeDevice } from './ingest';\nimport type { JourneyEnv } from './platform';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\nlet relayIgnoredLogged = false;\n\n/**\n * Where APNs requests go: the dev relay `APNS_RELAY_ORIGIN` names, except in production. The relay\n * sees the provider JWT, so a production deploy that inherited the variable (a copied `.dev.vars`,\n * a leftover `vars` entry) goes straight to APNs rather than hand the credential to whatever\n * answers there, and says so once.\n */\nfunction apnsRelayOrigin(env: JourneyEnv, mode: JourneyMode): string | undefined {\n  const origin = env.APNS_RELAY_ORIGIN;\n  if (origin === undefined || mode !== 'production') return origin;\n  if (!relayIgnoredLogged) {\n    relayIgnoredLogged = true;\n    console.error(\n      `[workflow] APNS_RELAY_ORIGIN (${origin}) is ignored in production: APNs is called directly. The relay is for wrangler dev only; unset it in this environment.`\n    );\n  }\n  return undefined;\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/**\n * A sender that fails every message with the reason the channel cannot deliver — for good: the\n * configuration is the same on every attempt, so the step does not retry into it.\n */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new PermanentError(\n        `cannot send '${message.template}' on ${message.channel}: ${reason}`\n      );\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    // Missing on this attempt, missing on the next: the deployment has to change, not the step\n    throw new PermanentError(\n      `${name} is not set: the environment must hold it for the configured channel`\n    );\n  }\n  return value;\n}\n\n/**\n * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long\n * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every\n * instance) and builds the senders anew each time; what must outlive the run is the credential\n * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a\n * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access\n * token is good for an hour, the VAPID key import is wasted work twice.\n *\n * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the\n * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is\n * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,\n * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded\n * host mints a new credential instead of reusing the old, and the secret itself is in no key and\n * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:\n * the sender is built per call around the shared credential.\n */\nexport interface ProviderCache {\n  /** The credential under `key`, built on the first call and returned as is after that. */\n  get<T>(key: string, build: () => T): T;\n}\n\nexport function createProviderCache(): ProviderCache {\n  const credentials = new Map<string, unknown>();\n  return {\n    get<T>(key: string, build: () => T): T {\n      if (!credentials.has(key)) credentials.set(key, build());\n      return credentials.get(key) as T;\n    },\n  };\n}\n\n/** A number for each fetch implementation, so a credential minted through one is not reused with another. */\nconst identities = new WeakMap<object, number>();\nlet nextIdentity = 1;\nfunction identity(value: object | undefined): string {\n  if (value === undefined) return 'global';\n  let id = identities.get(value);\n  if (id === undefined) {\n    id = nextIdentity++;\n    identities.set(value, id);\n  }\n  return String(id);\n}\n\n/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */\nasync function secretDigest(secret: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return Buffer.from(digest.slice(0, 4)).toString('hex');\n}\n\n/**\n * A sender built on its first message, then kept for this call. `build` reads the secrets (and\n * so may throw a `PermanentError` naming the missing variable): a platform's secret is only\n * required when something is actually sent there, so a journey that only emails must not fail\n * because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.\n */\nfunction lazy(build: () => Promise<MessageSender>): MessageSender {\n  let sender: Promise<MessageSender> | undefined;\n  return {\n    async send(message) {\n      sender ??= build().catch((error: unknown) => {\n        sender = undefined;\n        throw error;\n      });\n      return (await sender).send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n    /**\n     * Where the provider credentials live across runs (`createProviderCache`): the host's, made\n     * once with it. Without one, this call's credentials are its own — nothing is reused.\n     */\n    providers?: ProviderCache | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n  const providers = options.providers ?? createProviderCache();\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    /**\n     * A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n     * waits that read devices, as a removal through the API does. Done here, per run, on the\n     * settled result, so the credential cached across runs (see `ProviderCache`) never holds a\n     * run's store.\n     */\n    const dropDeadTokens = (\n      provider: MessageSender,\n      deadTokenReasons: ReadonlySet<string>\n    ): MessageSender => ({\n      async send(message) {\n        const result = await provider.send(message);\n        if (\n          result !== undefined &&\n          deadTokenReasons.has(result.reason) &&\n          message.device !== undefined &&\n          options.store !== undefined\n        ) {\n          await removeDevice(env, message.device.token, options.store);\n        }\n        return result;\n      },\n    });\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      const apnsFetch = options.apnsFetch ?? options.fetch;\n      const environment = apnsEnvironment(apns, mode);\n      platforms.ios = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'APNS_PRIVATE_KEY_BASE64');\n          const credentials = providers.get(\n            JSON.stringify(['apns', apns.keyId, apns.teamId, await secretDigest(secret)]),\n            () =>\n              new ApnsProviderToken({\n                keyId: apns.keyId,\n                teamId: apns.teamId,\n                privateKey: apnsKeyFromBase64(secret),\n              })\n          );\n          const origin = apnsRelayOrigin(env, mode);\n          return new ApnsPushSender({\n            credentials,\n            topic: apns.topic,\n            environment,\n            render,\n            ...(origin === undefined ? {} : { origin }),\n            ...(apnsFetch === undefined ? {} : { fetch: apnsFetch }),\n          });\n        }),\n        APNS_DEAD_TOKEN_REASONS\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64');\n          const serviceAccount = serviceAccountFromBase64(secret);\n          // The token endpoint is called through the fetch: another fetch is another credential\n          const credentials = providers.get(\n            JSON.stringify([\n              'fcm',\n              serviceAccount.client_email,\n              serviceAccount.project_id,\n              identity(options.fetch),\n              await secretDigest(secret),\n            ]),\n            () =>\n              new FcmAccessToken({\n                serviceAccount,\n                ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n              })\n          );\n          return new FcmPushSender({\n            credentials,\n            render,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        FCM_DEAD_TOKEN_REASONS\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = dropDeadTokens(\n        lazy(async () => {\n          const publicKey = requireSecret(env, 'VAPID_PUBLIC_KEY');\n          const privateKey = requireSecret(env, 'VAPID_PRIVATE_KEY');\n          const credentials = providers.get(\n            JSON.stringify(['vapid', webPush.subject, publicKey, await secretDigest(privateKey)]),\n            () => new VapidSigner({ subject: webPush.subject, publicKey, privateKey })\n          );\n          return new WebPushSender({\n            credentials,\n            render,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        WEB_PUSH_DEAD_TOKEN_REASONS\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new PermanentError(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;AAEA,IAAI,qBAAqB;;;;;;;AAQzB,SAAS,gBAAgB,KAAiB,MAAuC;CAC/E,MAAM,SAAS,IAAI;CACnB,IAAI,WAAW,KAAA,KAAa,SAAS,cAAc,OAAO;CAC1D,IAAI,CAAC,oBAAoB;EACvB,qBAAqB;EACrB,QAAQ,MACN,iCAAiC,OAAO,uHAC1C;CACF;AAEF;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAOA,gBAAAA,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;;;;AAMA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAIC,qBAAAA,eACR,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAC9D;CACF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAEhD,MAAM,IAAIA,qBAAAA,eACR,GAAG,KAAK,qEACV;CAEF,OAAO;AACT;AAuBA,SAAgB,sBAAqC;CACnD,MAAM,8BAAc,IAAI,IAAqB;CAC7C,OAAO,EACL,IAAO,KAAa,OAAmB;EACrC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,MAAM,CAAC;EACvD,OAAO,YAAY,IAAI,GAAG;CAC5B,EACF;AACF;;AAGA,MAAM,6BAAa,IAAI,QAAwB;AAC/C,IAAI,eAAe;AACnB,SAAS,SAAS,OAAmC;CACnD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,KAAK,WAAW,IAAI,KAAK;CAC7B,IAAI,OAAO,KAAA,GAAW;EACpB,KAAK;EACL,WAAW,IAAI,OAAO,EAAE;CAC1B;CACA,OAAO,OAAO,EAAE;AAClB;;AAGA,eAAe,aAAa,QAAiC;CAC3D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC;CACrF,OAAOC,YAAAA,OAAO,KAAK,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK;AACvD;;;;;;;AAQA,SAAS,KAAK,OAAoD;CAChE,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC3C,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,QAAQ,MAAM,OAAA,CAAQ,KAAK,OAAO;CACpC,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAaI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,YAAY,QAAQ,aAAa,oBAAoB;CAE3D,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAIC,qBAAAA,YAAY;GAAE;GAAW,QAAQC,oBAAAA,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAASC,aAAAA,qBAAqB,QAAQ;;;;;;;EAO5C,MAAM,kBACJ,UACA,sBACmB,EACnB,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;GAC1C,IACE,WAAW,KAAA,KACX,iBAAiB,IAAI,OAAO,MAAM,KAClC,QAAQ,WAAW,KAAA,KACnB,QAAQ,UAAU,KAAA,GAElB,MAAMC,oBAAAA,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;GAE7D,OAAO;EACT,EACF;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;GAC/C,MAAM,cAAcC,eAAAA,gBAAgB,MAAM,IAAI;GAC9C,UAAU,MAAM,eACd,KAAK,YAAY;IACf,MAAM,SAAS,cAAc,KAAK,yBAAyB;IAC3D,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;KAAC;KAAQ,KAAK;KAAO,KAAK;KAAQ,MAAM,aAAa,MAAM;IAAC,CAAC,SAE1E,IAAIC,aAAAA,kBAAkB;KACpB,OAAO,KAAK;KACZ,QAAQ,KAAK;KACb,YAAYC,aAAAA,kBAAkB,MAAM;IACtC,CAAC,CACL;IACA,MAAM,SAAS,gBAAgB,KAAK,IAAI;IACxC,OAAO,IAAIC,aAAAA,eAAe;KACxB;KACA,OAAO,KAAK;KACZ;KACA;KACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;KACzC,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU;IACxD,CAAC;GACH,CAAC,GACDC,aAAAA,kBACF;EACF;EACA,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,eAClB,KAAK,YAAY;GACf,MAAM,SAAS,cAAc,KAAK,uCAAuC;GACzE,MAAM,iBAAiBC,YAAAA,yBAAyB,MAAM;GAEtD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IACb;IACA,eAAe;IACf,eAAe;IACf,SAAS,QAAQ,KAAK;IACtB,MAAM,aAAa,MAAM;GAC3B,CAAC,SAEC,IAAIC,YAAAA,eAAe;IACjB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC,CACL;GACA,OAAO,IAAIC,YAAAA,cAAc;IACvB;IACA;IACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;IACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,YAAAA,kBACF;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,eACd,KAAK,YAAY;GACf,MAAM,YAAY,cAAc,KAAK,kBAAkB;GACvD,MAAM,aAAa,cAAc,KAAK,mBAAmB;GACzD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IAAC;IAAS,QAAQ;IAAS;IAAW,MAAM,aAAa,UAAU;GAAC,CAAC,SAC9E,IAAIC,gBAAAA,YAAY;IAAE,SAAS,QAAQ;IAAS;IAAW;GAAW,CAAC,CAC3E;GACA,OAAO,IAAIC,gBAAAA,cAAc;IACvB;IACA;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,gBAAAA,kBACF;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAOC,qBAAAA,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAIlB,qBAAAA,eACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQmB,kBAAAA,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAIC,iBAAAA,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWC,kBAAAA,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAASC,kBAAAA,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQH,kBAAAA,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAII,iBAAAA,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAWF,kBAAAA,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAASG,kBAAAA,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAOC,qBAAAA,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}

package/dist/host/channels.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.cts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;wBAmDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAiD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}
+{"version":3,"file":"channels.d.cts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;wBAmDgB,YAAY,KAAK,aAAa;;wBAyB9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAiD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}

package/dist/host/channels.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.mts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;wBAmDgB,YAAY,KAAK,aAAa;;wBAK9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAiD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}
+{"version":3,"file":"channels.d.mts","names":[],"sources":["../../src/host/channels.ts"],"mappings":";;;;;;;;;;;;;;;;;wBAmDgB,YAAY,KAAK,aAAa;;wBAyB9B,kBACd,QAAQ,KAAK,uCACb,KAAK,aACJ,SAAS;;;;;;;;;;;;;;;;;iBAoDK;;EAEf,IAAI,GAAG,aAAa,aAAa,IAAI;;wBAGvB,uBAAuB;;YAiD3B,iBAAiB,KAC3B;wBAIc,mBACd,QAAQ,gBACR,KAAK,YACL;;EAEE,QAAQ;;EAER,QAAQ;EACR,eAAe;;EAEf,mBAAmB;;;;;EAKnB,YAAY;IAEb"}

package/dist/host/channels.mjs

@@ -27,6 +27,21 @@ import { Buffer } from "node:buffer";
 function journeyMode(env) {
 	return env.ENVIRONMENT ?? "production";
 }
+let relayIgnoredLogged = false;
+/**
+* Where APNs requests go: the dev relay `APNS_RELAY_ORIGIN` names, except in production. The relay
+* sees the provider JWT, so a production deploy that inherited the variable (a copied `.dev.vars`,
+* a leftover `vars` entry) goes straight to APNs rather than hand the credential to whatever
+* answers there, and says so once.
+*/
+function apnsRelayOrigin(env, mode) {
+	const origin = env.APNS_RELAY_ORIGIN;
+	if (origin === void 0 || mode !== "production") return origin;
+	if (!relayIgnoredLogged) {
+		relayIgnoredLogged = true;
+		console.error(`[workflow] APNS_RELAY_ORIGIN (${origin}) is ignored in production: APNs is called directly. The relay is for wrangler dev only; unset it in this environment.`);
+	}
+}
 /** The runtime options for this environment's mode. */
 function runtimeFromConfig(config, env) {
 	return resolveRuntime(config?.runtime, journeyMode(env));
@@ -130,12 +145,13 @@ function channelsFromConfig(config, env, options = {}) {
 					teamId: apns.teamId,
 					privateKey: apnsKeyFromBase64(secret)
 				}));
+				const origin = apnsRelayOrigin(env, mode);
 				return new ApnsPushSender({
 					credentials,
 					topic: apns.topic,
 					environment,
 					render,
-					...env.APNS_RELAY_ORIGIN === void 0 ? {} : { origin: env.APNS_RELAY_ORIGIN },
+					...origin === void 0 ? {} : { origin },
 					...apnsFetch === void 0 ? {} : { fetch: apnsFetch }
 				});
 			}), DEAD_TOKEN_REASONS);

package/dist/host/channels.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"channels.mjs","names":["APNS_DEAD_TOKEN_REASONS","FCM_DEAD_TOKEN_REASONS","WEB_PUSH_DEAD_TOKEN_REASONS"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport {\n  DEAD_TOKEN_REASONS as APNS_DEAD_TOKEN_REASONS,\n  ApnsProviderToken,\n  ApnsPushSender,\n  apnsKeyFromBase64,\n} from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender } from '../engine/ports';\nimport { PermanentError } from '../engine/retry';\nimport {\n  DEAD_TOKEN_REASONS as FCM_DEAD_TOKEN_REASONS,\n  FcmAccessToken,\n  FcmPushSender,\n  serviceAccountFromBase64,\n} from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport {\n  VapidSigner,\n  DEAD_TOKEN_REASONS as WEB_PUSH_DEAD_TOKEN_REASONS,\n  WebPushSender,\n} from '../webpush';\nimport { removeDevice } from './ingest';\nimport type { JourneyEnv } from './platform';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/**\n * A sender that fails every message with the reason the channel cannot deliver — for good: the\n * configuration is the same on every attempt, so the step does not retry into it.\n */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new PermanentError(\n        `cannot send '${message.template}' on ${message.channel}: ${reason}`\n      );\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    // Missing on this attempt, missing on the next: the deployment has to change, not the step\n    throw new PermanentError(\n      `${name} is not set: the environment must hold it for the configured channel`\n    );\n  }\n  return value;\n}\n\n/**\n * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long\n * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every\n * instance) and builds the senders anew each time; what must outlive the run is the credential\n * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a\n * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access\n * token is good for an hour, the VAPID key import is wasted work twice.\n *\n * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the\n * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is\n * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,\n * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded\n * host mints a new credential instead of reusing the old, and the secret itself is in no key and\n * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:\n * the sender is built per call around the shared credential.\n */\nexport interface ProviderCache {\n  /** The credential under `key`, built on the first call and returned as is after that. */\n  get<T>(key: string, build: () => T): T;\n}\n\nexport function createProviderCache(): ProviderCache {\n  const credentials = new Map<string, unknown>();\n  return {\n    get<T>(key: string, build: () => T): T {\n      if (!credentials.has(key)) credentials.set(key, build());\n      return credentials.get(key) as T;\n    },\n  };\n}\n\n/** A number for each fetch implementation, so a credential minted through one is not reused with another. */\nconst identities = new WeakMap<object, number>();\nlet nextIdentity = 1;\nfunction identity(value: object | undefined): string {\n  if (value === undefined) return 'global';\n  let id = identities.get(value);\n  if (id === undefined) {\n    id = nextIdentity++;\n    identities.set(value, id);\n  }\n  return String(id);\n}\n\n/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */\nasync function secretDigest(secret: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return Buffer.from(digest.slice(0, 4)).toString('hex');\n}\n\n/**\n * A sender built on its first message, then kept for this call. `build` reads the secrets (and\n * so may throw a `PermanentError` naming the missing variable): a platform's secret is only\n * required when something is actually sent there, so a journey that only emails must not fail\n * because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.\n */\nfunction lazy(build: () => Promise<MessageSender>): MessageSender {\n  let sender: Promise<MessageSender> | undefined;\n  return {\n    async send(message) {\n      sender ??= build().catch((error: unknown) => {\n        sender = undefined;\n        throw error;\n      });\n      return (await sender).send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n    /**\n     * Where the provider credentials live across runs (`createProviderCache`): the host's, made\n     * once with it. Without one, this call's credentials are its own — nothing is reused.\n     */\n    providers?: ProviderCache | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n  const providers = options.providers ?? createProviderCache();\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    /**\n     * A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n     * waits that read devices, as a removal through the API does. Done here, per run, on the\n     * settled result, so the credential cached across runs (see `ProviderCache`) never holds a\n     * run's store.\n     */\n    const dropDeadTokens = (\n      provider: MessageSender,\n      deadTokenReasons: ReadonlySet<string>\n    ): MessageSender => ({\n      async send(message) {\n        const result = await provider.send(message);\n        if (\n          result !== undefined &&\n          deadTokenReasons.has(result.reason) &&\n          message.device !== undefined &&\n          options.store !== undefined\n        ) {\n          await removeDevice(env, message.device.token, options.store);\n        }\n        return result;\n      },\n    });\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      const apnsFetch = options.apnsFetch ?? options.fetch;\n      const environment = apnsEnvironment(apns, mode);\n      platforms.ios = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'APNS_PRIVATE_KEY_BASE64');\n          const credentials = providers.get(\n            JSON.stringify(['apns', apns.keyId, apns.teamId, await secretDigest(secret)]),\n            () =>\n              new ApnsProviderToken({\n                keyId: apns.keyId,\n                teamId: apns.teamId,\n                privateKey: apnsKeyFromBase64(secret),\n              })\n          );\n          return new ApnsPushSender({\n            credentials,\n            topic: apns.topic,\n            environment,\n            render,\n            ...(env.APNS_RELAY_ORIGIN === undefined ? {} : { origin: env.APNS_RELAY_ORIGIN }),\n            ...(apnsFetch === undefined ? {} : { fetch: apnsFetch }),\n          });\n        }),\n        APNS_DEAD_TOKEN_REASONS\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64');\n          const serviceAccount = serviceAccountFromBase64(secret);\n          // The token endpoint is called through the fetch: another fetch is another credential\n          const credentials = providers.get(\n            JSON.stringify([\n              'fcm',\n              serviceAccount.client_email,\n              serviceAccount.project_id,\n              identity(options.fetch),\n              await secretDigest(secret),\n            ]),\n            () =>\n              new FcmAccessToken({\n                serviceAccount,\n                ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n              })\n          );\n          return new FcmPushSender({\n            credentials,\n            render,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        FCM_DEAD_TOKEN_REASONS\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = dropDeadTokens(\n        lazy(async () => {\n          const publicKey = requireSecret(env, 'VAPID_PUBLIC_KEY');\n          const privateKey = requireSecret(env, 'VAPID_PRIVATE_KEY');\n          const credentials = providers.get(\n            JSON.stringify(['vapid', webPush.subject, publicKey, await secretDigest(privateKey)]),\n            () => new VapidSigner({ subject: webPush.subject, publicKey, privateKey })\n          );\n          return new WebPushSender({\n            credentials,\n            render,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        WEB_PUSH_DEAD_TOKEN_REASONS\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new PermanentError(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAO,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;;;;AAMA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAI,eACR,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAC9D;CACF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAEhD,MAAM,IAAI,eACR,GAAG,KAAK,qEACV;CAEF,OAAO;AACT;AAuBA,SAAgB,sBAAqC;CACnD,MAAM,8BAAc,IAAI,IAAqB;CAC7C,OAAO,EACL,IAAO,KAAa,OAAmB;EACrC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,MAAM,CAAC;EACvD,OAAO,YAAY,IAAI,GAAG;CAC5B,EACF;AACF;;AAGA,MAAM,6BAAa,IAAI,QAAwB;AAC/C,IAAI,eAAe;AACnB,SAAS,SAAS,OAAmC;CACnD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,KAAK,WAAW,IAAI,KAAK;CAC7B,IAAI,OAAO,KAAA,GAAW;EACpB,KAAK;EACL,WAAW,IAAI,OAAO,EAAE;CAC1B;CACA,OAAO,OAAO,EAAE;AAClB;;AAGA,eAAe,aAAa,QAAiC;CAC3D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK;AACvD;;;;;;;AAQA,SAAS,KAAK,OAAoD;CAChE,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC3C,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,QAAQ,MAAM,OAAA,CAAQ,KAAK,OAAO;CACpC,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAaI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,YAAY,QAAQ,aAAa,oBAAoB;CAE3D,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAI,YAAY;GAAE;GAAW,QAAQ,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAAS,qBAAqB,QAAQ;;;;;;;EAO5C,MAAM,kBACJ,UACA,sBACmB,EACnB,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;GAC1C,IACE,WAAW,KAAA,KACX,iBAAiB,IAAI,OAAO,MAAM,KAClC,QAAQ,WAAW,KAAA,KACnB,QAAQ,UAAU,KAAA,GAElB,MAAM,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;GAE7D,OAAO;EACT,EACF;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;GAC/C,MAAM,cAAc,gBAAgB,MAAM,IAAI;GAC9C,UAAU,MAAM,eACd,KAAK,YAAY;IACf,MAAM,SAAS,cAAc,KAAK,yBAAyB;IAC3D,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;KAAC;KAAQ,KAAK;KAAO,KAAK;KAAQ,MAAM,aAAa,MAAM;IAAC,CAAC,SAE1E,IAAI,kBAAkB;KACpB,OAAO,KAAK;KACZ,QAAQ,KAAK;KACb,YAAY,kBAAkB,MAAM;IACtC,CAAC,CACL;IACA,OAAO,IAAI,eAAe;KACxB;KACA,OAAO,KAAK;KACZ;KACA;KACA,GAAI,IAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,kBAAkB;KAC/E,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU;IACxD,CAAC;GACH,CAAC,GACDA,kBACF;EACF;EACA,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,eAClB,KAAK,YAAY;GACf,MAAM,SAAS,cAAc,KAAK,uCAAuC;GACzE,MAAM,iBAAiB,yBAAyB,MAAM;GAEtD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IACb;IACA,eAAe;IACf,eAAe;IACf,SAAS,QAAQ,KAAK;IACtB,MAAM,aAAa,MAAM;GAC3B,CAAC,SAEC,IAAI,eAAe;IACjB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC,CACL;GACA,OAAO,IAAI,cAAc;IACvB;IACA;IACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;IACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,oBACF;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,eACd,KAAK,YAAY;GACf,MAAM,YAAY,cAAc,KAAK,kBAAkB;GACvD,MAAM,aAAa,cAAc,KAAK,mBAAmB;GACzD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IAAC;IAAS,QAAQ;IAAS;IAAW,MAAM,aAAa,UAAU;GAAC,CAAC,SAC9E,IAAI,YAAY;IAAE,SAAS,QAAQ;IAAS;IAAW;GAAW,CAAC,CAC3E;GACA,OAAO,IAAI,cAAc;IACvB;IACA;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,oBACF;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAO,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAI,eACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQ,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAI,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAW,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAAS,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQ,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAI,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAW,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAAS,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAO,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}
+{"version":3,"file":"channels.mjs","names":["APNS_DEAD_TOKEN_REASONS","FCM_DEAD_TOKEN_REASONS","WEB_PUSH_DEAD_TOKEN_REASONS"],"sources":["../../src/host/channels.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport {\n  DEAD_TOKEN_REASONS as APNS_DEAD_TOKEN_REASONS,\n  ApnsProviderToken,\n  ApnsPushSender,\n  apnsKeyFromBase64,\n} from '../apns';\nimport { type JourneyConfig, apnsEnvironment } from '../config';\nimport { EmailSender, type EmailTransport } from '../email-sender';\nimport type { MessageSender } from '../engine/ports';\nimport { PermanentError } from '../engine/retry';\nimport {\n  DEAD_TOKEN_REASONS as FCM_DEAD_TOKEN_REASONS,\n  FcmAccessToken,\n  FcmPushSender,\n  serviceAccountFromBase64,\n} from '../fcm';\nimport { registryPushRenderer } from '../push';\nimport { registryRenderer } from '../react-email';\nimport { type JourneyMode, type JourneyRuntimeOptions, resolveRuntime } from '../runtime';\nimport type { JourneyStore } from '../store/index';\nimport {\n  type DiscordTemplate,\n  type SlackTemplate,\n  indexTemplates,\n  lookupTemplate,\n  renderDiscordContent,\n  renderSlackContent,\n} from '../templates';\nimport { DiscordWebhookSender, SlackWebhookSender } from '../webhooks';\nimport {\n  VapidSigner,\n  DEAD_TOKEN_REASONS as WEB_PUSH_DEAD_TOKEN_REASONS,\n  WebPushSender,\n} from '../webpush';\nimport { removeDevice } from './ingest';\nimport type { JourneyEnv } from './platform';\nimport { routeByChannel, routeByPlatform } from './senders';\n\n/**\n * The outlets a `JourneyConfig` describes, assembled against the environment:\n * email through the host's transport (SES, Cloudflare Email, ...) with each template's addresses, iOS pushes\n * straight to APNs with the configured key (the `.p8` from\n * `APNS_PRIVATE_KEY_BASE64`), Android pushes through FCM with the service\n * account from `GOOGLE_APPLICATION_CREDENTIALS_BASE64`. A channel the config\n * leaves out is simply absent, and a journey that sends on it fails that step\n * with a message saying so — rather than the host having to spell out every\n * sender by hand.\n */\n\n/** Which config entry applies: wrangler's `ENVIRONMENT` var, production when unset. */\nexport function journeyMode(env: JourneyEnv): JourneyMode {\n  return env.ENVIRONMENT ?? 'production';\n}\n\nlet relayIgnoredLogged = false;\n\n/**\n * Where APNs requests go: the dev relay `APNS_RELAY_ORIGIN` names, except in production. The relay\n * sees the provider JWT, so a production deploy that inherited the variable (a copied `.dev.vars`,\n * a leftover `vars` entry) goes straight to APNs rather than hand the credential to whatever\n * answers there, and says so once.\n */\nfunction apnsRelayOrigin(env: JourneyEnv, mode: JourneyMode): string | undefined {\n  const origin = env.APNS_RELAY_ORIGIN;\n  if (origin === undefined || mode !== 'production') return origin;\n  if (!relayIgnoredLogged) {\n    relayIgnoredLogged = true;\n    console.error(\n      `[workflow] APNS_RELAY_ORIGIN (${origin}) is ignored in production: APNs is called directly. The relay is for wrangler dev only; unset it in this environment.`\n    );\n  }\n  return undefined;\n}\n\n/** The runtime options for this environment's mode. */\nexport function runtimeFromConfig(\n  config: Pick<JourneyConfig, 'runtime'> | undefined,\n  env: JourneyEnv\n): Required<JourneyRuntimeOptions> {\n  return resolveRuntime(config?.runtime, journeyMode(env));\n}\n\n/**\n * A sender that fails every message with the reason the channel cannot deliver — for good: the\n * configuration is the same on every attempt, so the step does not retry into it.\n */\nfunction unavailable(reason: string): MessageSender {\n  return {\n    async send(message) {\n      throw new PermanentError(\n        `cannot send '${message.template}' on ${message.channel}: ${reason}`\n      );\n    },\n  };\n}\n\nfunction requireSecret(\n  env: JourneyEnv,\n  name:\n    | 'APNS_PRIVATE_KEY_BASE64'\n    | 'GOOGLE_APPLICATION_CREDENTIALS_BASE64'\n    | 'VAPID_PUBLIC_KEY'\n    | 'VAPID_PRIVATE_KEY'\n): string {\n  const value = env[name];\n  if (typeof value !== 'string' || value.length === 0) {\n    // Missing on this attempt, missing on the next: the deployment has to change, not the step\n    throw new PermanentError(\n      `${name} is not set: the environment must hold it for the configured channel`\n    );\n  }\n  return value;\n}\n\n/**\n * The provider credentials — `ApnsProviderToken`, `FcmAccessToken`, `VapidSigner` — for as long\n * as the host lives. `channelsFromConfig` runs once per workflow run (every wake of every\n * instance) and builds the senders anew each time; what must outlive the run is the credential\n * state they hold: the APNs provider JWT must be reused for at least 20 minutes (Apple answers a\n * sender that re-signs on every push with 429 `TooManyProviderTokenUpdates`), the FCM access\n * token is good for an hour, the VAPID key import is wasted work twice.\n *\n * The cache is the host's (`createJourneyHost` makes one and hands it to every run), not the\n * run's `env`: a Lambda invocation builds a fresh env object for each run (its instance port is\n * in it), so a cache keyed on env would miss on every wake. Inside, the key names the provider,\n * the ids that identify the key and a digest of the secret — so a rotated secret or a reloaded\n * host mints a new credential instead of reusing the old, and the secret itself is in no key and\n * no log. Nothing that shapes the sender (topic, environment, relay, registry, store) is in it:\n * the sender is built per call around the shared credential.\n */\nexport interface ProviderCache {\n  /** The credential under `key`, built on the first call and returned as is after that. */\n  get<T>(key: string, build: () => T): T;\n}\n\nexport function createProviderCache(): ProviderCache {\n  const credentials = new Map<string, unknown>();\n  return {\n    get<T>(key: string, build: () => T): T {\n      if (!credentials.has(key)) credentials.set(key, build());\n      return credentials.get(key) as T;\n    },\n  };\n}\n\n/** A number for each fetch implementation, so a credential minted through one is not reused with another. */\nconst identities = new WeakMap<object, number>();\nlet nextIdentity = 1;\nfunction identity(value: object | undefined): string {\n  if (value === undefined) return 'global';\n  let id = identities.get(value);\n  if (id === undefined) {\n    id = nextIdentity++;\n    identities.set(value, id);\n  }\n  return String(id);\n}\n\n/** The first 8 hex of the secret's SHA-256: enough to tell a rotation apart, nothing of the secret. */\nasync function secretDigest(secret: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return Buffer.from(digest.slice(0, 4)).toString('hex');\n}\n\n/**\n * A sender built on its first message, then kept for this call. `build` reads the secrets (and\n * so may throw a `PermanentError` naming the missing variable): a platform's secret is only\n * required when something is actually sent there, so a journey that only emails must not fail\n * because the APNs key is missing from a local `.dev.vars`. A build that failed is not kept.\n */\nfunction lazy(build: () => Promise<MessageSender>): MessageSender {\n  let sender: Promise<MessageSender> | undefined;\n  return {\n    async send(message) {\n      sender ??= build().catch((error: unknown) => {\n        sender = undefined;\n        throw error;\n      });\n      return (await sender).send(message);\n    },\n  };\n}\n\n/** The channels slice of the config — what `channelsFromConfig` reads. */\nexport type ChannelsConfig = Pick<\n  JourneyConfig,\n  'templates' | 'email' | 'apns' | 'fcm' | 'webPush' | 'runtime'\n>;\n\nexport function channelsFromConfig(\n  config: ChannelsConfig,\n  env: JourneyEnv,\n  options: {\n    /** The store a token APNs / FCM / a push service reports as gone is removed from. */\n    store?: JourneyStore | undefined;\n    /** Where finished emails go — the host's choice, independent of where the workflow runs. */\n    email?: EmailTransport | undefined;\n    fetch?: typeof fetch;\n    /** APNs is HTTP/2 only: a Node host passes an HTTP/2 fetch here (its own fetch cannot). */\n    apnsFetch?: typeof fetch | undefined;\n    /**\n     * Where the provider credentials live across runs (`createProviderCache`): the host's, made\n     * once with it. Without one, this call's credentials are its own — nothing is reused.\n     */\n    providers?: ProviderCache | undefined;\n  } = {}\n): MessageSender {\n  const mode = journeyMode(env);\n  const providers = options.providers ?? createProviderCache();\n\n  const email = (): MessageSender => {\n    const registry = config.templates?.email;\n    if (registry === undefined) return unavailable('no email templates are registered');\n    const transport = options.email;\n    if (transport === undefined) {\n      return unavailable(\"no email transport is configured (the host's `email` option)\");\n    }\n    // Each template names its own sender: there is no global one to require\n    return new EmailSender({ transport, render: registryRenderer(registry, config.email) });\n  };\n\n  const push = (): MessageSender => {\n    const registry = config.templates?.push;\n    if (registry === undefined) return unavailable('no push templates are registered');\n    const render = registryPushRenderer(registry);\n    /**\n     * A token the provider reports as gone is forgotten (nothing left to deliver to), waking the\n     * waits that read devices, as a removal through the API does. Done here, per run, on the\n     * settled result, so the credential cached across runs (see `ProviderCache`) never holds a\n     * run's store.\n     */\n    const dropDeadTokens = (\n      provider: MessageSender,\n      deadTokenReasons: ReadonlySet<string>\n    ): MessageSender => ({\n      async send(message) {\n        const result = await provider.send(message);\n        if (\n          result !== undefined &&\n          deadTokenReasons.has(result.reason) &&\n          message.device !== undefined &&\n          options.store !== undefined\n        ) {\n          await removeDevice(env, message.device.token, options.store);\n        }\n        return result;\n      },\n    });\n    const platforms: Record<string, MessageSender> = {};\n    const apns = config.apns;\n    if (apns !== undefined) {\n      const apnsFetch = options.apnsFetch ?? options.fetch;\n      const environment = apnsEnvironment(apns, mode);\n      platforms.ios = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'APNS_PRIVATE_KEY_BASE64');\n          const credentials = providers.get(\n            JSON.stringify(['apns', apns.keyId, apns.teamId, await secretDigest(secret)]),\n            () =>\n              new ApnsProviderToken({\n                keyId: apns.keyId,\n                teamId: apns.teamId,\n                privateKey: apnsKeyFromBase64(secret),\n              })\n          );\n          const origin = apnsRelayOrigin(env, mode);\n          return new ApnsPushSender({\n            credentials,\n            topic: apns.topic,\n            environment,\n            render,\n            ...(origin === undefined ? {} : { origin }),\n            ...(apnsFetch === undefined ? {} : { fetch: apnsFetch }),\n          });\n        }),\n        APNS_DEAD_TOKEN_REASONS\n      );\n    }\n    const fcm = config.fcm;\n    if (fcm !== undefined) {\n      platforms.android = dropDeadTokens(\n        lazy(async () => {\n          const secret = requireSecret(env, 'GOOGLE_APPLICATION_CREDENTIALS_BASE64');\n          const serviceAccount = serviceAccountFromBase64(secret);\n          // The token endpoint is called through the fetch: another fetch is another credential\n          const credentials = providers.get(\n            JSON.stringify([\n              'fcm',\n              serviceAccount.client_email,\n              serviceAccount.project_id,\n              identity(options.fetch),\n              await secretDigest(secret),\n            ]),\n            () =>\n              new FcmAccessToken({\n                serviceAccount,\n                ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n              })\n          );\n          return new FcmPushSender({\n            credentials,\n            render,\n            ...(fcm.androidChannelId === undefined\n              ? {}\n              : { android: { channel_id: fcm.androidChannelId } }),\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        FCM_DEAD_TOKEN_REASONS\n      );\n    }\n    const webPush = config.webPush;\n    if (webPush !== undefined) {\n      platforms.web = dropDeadTokens(\n        lazy(async () => {\n          const publicKey = requireSecret(env, 'VAPID_PUBLIC_KEY');\n          const privateKey = requireSecret(env, 'VAPID_PRIVATE_KEY');\n          const credentials = providers.get(\n            JSON.stringify(['vapid', webPush.subject, publicKey, await secretDigest(privateKey)]),\n            () => new VapidSigner({ subject: webPush.subject, publicKey, privateKey })\n          );\n          return new WebPushSender({\n            credentials,\n            render,\n            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          });\n        }),\n        WEB_PUSH_DEAD_TOKEN_REASONS\n      );\n    }\n    if (Object.keys(platforms).length === 0)\n      return unavailable('none of apns, fcm or webPush is configured');\n    return routeByPlatform(platforms);\n  };\n\n  /**\n   * A webhook template's URL, read from the environment the Worker validated at startup (its\n   * `env` schema): a template whose variable is unset fails the step, naming the template.\n   */\n  const webhookUrl = (channel: 'discord' | 'slack', template: DiscordTemplate | SlackTemplate) => {\n    const url = template.webhook(env as unknown as Record<string, unknown>);\n    if (typeof url !== 'string' || url === '') {\n      throw new PermanentError(\n        `${channel} template '${template.id}': its webhook URL is not set in the environment`\n      );\n    }\n    return url;\n  };\n\n  const discord = (): MessageSender => {\n    const registry = config.templates?.discord;\n    if (registry === undefined) return unavailable('no discord templates are registered');\n    const index = indexTemplates('discord', registry);\n    return new DiscordWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'discord', id);\n        return {\n          url: webhookUrl('discord', template),\n          content: renderDiscordContent(template, props),\n        };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  const slack = (): MessageSender => {\n    const registry = config.templates?.slack;\n    if (registry === undefined) return unavailable('no slack templates are registered');\n    const index = indexTemplates('slack', registry);\n    return new SlackWebhookSender({\n      render: (id, props) => {\n        const template = lookupTemplate(index, 'slack', id);\n        return { url: webhookUrl('slack', template), content: renderSlackContent(template, props) };\n      },\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n    });\n  };\n\n  return routeByChannel({ email: email(), push: push(), discord: discord(), slack: slack() });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,YAAY,KAA8B;CACxD,OAAO,IAAI,eAAe;AAC5B;AAEA,IAAI,qBAAqB;;;;;;;AAQzB,SAAS,gBAAgB,KAAiB,MAAuC;CAC/E,MAAM,SAAS,IAAI;CACnB,IAAI,WAAW,KAAA,KAAa,SAAS,cAAc,OAAO;CAC1D,IAAI,CAAC,oBAAoB;EACvB,qBAAqB;EACrB,QAAQ,MACN,iCAAiC,OAAO,uHAC1C;CACF;AAEF;;AAGA,SAAgB,kBACd,QACA,KACiC;CACjC,OAAO,eAAe,QAAQ,SAAS,YAAY,GAAG,CAAC;AACzD;;;;;AAMA,SAAS,YAAY,QAA+B;CAClD,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,MAAM,IAAI,eACR,gBAAgB,QAAQ,SAAS,OAAO,QAAQ,QAAQ,IAAI,QAC9D;CACF,EACF;AACF;AAEA,SAAS,cACP,KACA,MAKQ;CACR,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAEhD,MAAM,IAAI,eACR,GAAG,KAAK,qEACV;CAEF,OAAO;AACT;AAuBA,SAAgB,sBAAqC;CACnD,MAAM,8BAAc,IAAI,IAAqB;CAC7C,OAAO,EACL,IAAO,KAAa,OAAmB;EACrC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,MAAM,CAAC;EACvD,OAAO,YAAY,IAAI,GAAG;CAC5B,EACF;AACF;;AAGA,MAAM,6BAAa,IAAI,QAAwB;AAC/C,IAAI,eAAe;AACnB,SAAS,SAAS,OAAmC;CACnD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,KAAK,WAAW,IAAI,KAAK;CAC7B,IAAI,OAAO,KAAA,GAAW;EACpB,KAAK;EACL,WAAW,IAAI,OAAO,EAAE;CAC1B;CACA,OAAO,OAAO,EAAE;AAClB;;AAGA,eAAe,aAAa,QAAiC;CAC3D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK;AACvD;;;;;;;AAQA,SAAS,KAAK,OAAoD;CAChE,IAAI;CACJ,OAAO,EACL,MAAM,KAAK,SAAS;EAClB,WAAW,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC3C,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,QAAQ,MAAM,OAAA,CAAQ,KAAK,OAAO;CACpC,EACF;AACF;AAQA,SAAgB,mBACd,QACA,KACA,UAaI,CAAC,GACU;CACf,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,YAAY,QAAQ,aAAa,oBAAoB;CAE3D,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,YAAY,QAAQ;EAC1B,IAAI,cAAc,KAAA,GAChB,OAAO,YAAY,8DAA8D;EAGnF,OAAO,IAAI,YAAY;GAAE;GAAW,QAAQ,iBAAiB,UAAU,OAAO,KAAK;EAAE,CAAC;CACxF;CAEA,MAAM,aAA4B;EAChC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,kCAAkC;EACjF,MAAM,SAAS,qBAAqB,QAAQ;;;;;;;EAO5C,MAAM,kBACJ,UACA,sBACmB,EACnB,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;GAC1C,IACE,WAAW,KAAA,KACX,iBAAiB,IAAI,OAAO,MAAM,KAClC,QAAQ,WAAW,KAAA,KACnB,QAAQ,UAAU,KAAA,GAElB,MAAM,aAAa,KAAK,QAAQ,OAAO,OAAO,QAAQ,KAAK;GAE7D,OAAO;EACT,EACF;EACA,MAAM,YAA2C,CAAC;EAClD,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;GAC/C,MAAM,cAAc,gBAAgB,MAAM,IAAI;GAC9C,UAAU,MAAM,eACd,KAAK,YAAY;IACf,MAAM,SAAS,cAAc,KAAK,yBAAyB;IAC3D,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;KAAC;KAAQ,KAAK;KAAO,KAAK;KAAQ,MAAM,aAAa,MAAM;IAAC,CAAC,SAE1E,IAAI,kBAAkB;KACpB,OAAO,KAAK;KACZ,QAAQ,KAAK;KACb,YAAY,kBAAkB,MAAM;IACtC,CAAC,CACL;IACA,MAAM,SAAS,gBAAgB,KAAK,IAAI;IACxC,OAAO,IAAI,eAAe;KACxB;KACA,OAAO,KAAK;KACZ;KACA;KACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;KACzC,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU;IACxD,CAAC;GACH,CAAC,GACDA,kBACF;EACF;EACA,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,GACV,UAAU,UAAU,eAClB,KAAK,YAAY;GACf,MAAM,SAAS,cAAc,KAAK,uCAAuC;GACzE,MAAM,iBAAiB,yBAAyB,MAAM;GAEtD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IACb;IACA,eAAe;IACf,eAAe;IACf,SAAS,QAAQ,KAAK;IACtB,MAAM,aAAa,MAAM;GAC3B,CAAC,SAEC,IAAI,eAAe;IACjB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC,CACL;GACA,OAAO,IAAI,cAAc;IACvB;IACA;IACA,GAAI,IAAI,qBAAqB,KAAA,IACzB,CAAC,IACD,EAAE,SAAS,EAAE,YAAY,IAAI,iBAAiB,EAAE;IACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,oBACF;EAEF,MAAM,UAAU,OAAO;EACvB,IAAI,YAAY,KAAA,GACd,UAAU,MAAM,eACd,KAAK,YAAY;GACf,MAAM,YAAY,cAAc,KAAK,kBAAkB;GACvD,MAAM,aAAa,cAAc,KAAK,mBAAmB;GACzD,MAAM,cAAc,UAAU,IAC5B,KAAK,UAAU;IAAC;IAAS,QAAQ;IAAS;IAAW,MAAM,aAAa,UAAU;GAAC,CAAC,SAC9E,IAAI,YAAY;IAAE,SAAS,QAAQ;IAAS;IAAW;GAAW,CAAC,CAC3E;GACA,OAAO,IAAI,cAAc;IACvB;IACA;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAChE,CAAC;EACH,CAAC,GACDC,oBACF;EAEF,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,GACpC,OAAO,YAAY,4CAA4C;EACjE,OAAO,gBAAgB,SAAS;CAClC;;;;;CAMA,MAAM,cAAc,SAA8B,aAA8C;EAC9F,MAAM,MAAM,SAAS,QAAQ,GAAyC;EACtE,IAAI,OAAO,QAAQ,YAAY,QAAQ,IACrC,MAAM,IAAI,eACR,GAAG,QAAQ,aAAa,SAAS,GAAG,iDACtC;EAEF,OAAO;CACT;CAEA,MAAM,gBAA+B;EACnC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,qCAAqC;EACpF,MAAM,QAAQ,eAAe,WAAW,QAAQ;EAChD,OAAO,IAAI,qBAAqB;GAC9B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAW,eAAe,OAAO,WAAW,EAAE;IACpD,OAAO;KACL,KAAK,WAAW,WAAW,QAAQ;KACnC,SAAS,qBAAqB,UAAU,KAAK;IAC/C;GACF;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,MAAM,cAA6B;EACjC,MAAM,WAAW,OAAO,WAAW;EACnC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY,mCAAmC;EAClF,MAAM,QAAQ,eAAe,SAAS,QAAQ;EAC9C,OAAO,IAAI,mBAAmB;GAC5B,SAAS,IAAI,UAAU;IACrB,MAAM,WAAW,eAAe,OAAO,SAAS,EAAE;IAClD,OAAO;KAAE,KAAK,WAAW,SAAS,QAAQ;KAAG,SAAS,mBAAmB,UAAU,KAAK;IAAE;GAC5F;GACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAChE,CAAC;CACH;CAEA,OAAO,eAAe;EAAE,OAAO,MAAM;EAAG,MAAM,KAAK;EAAG,SAAS,QAAQ;EAAG,OAAO,MAAM;CAAE,CAAC;AAC5F"}

package/dist/host/http.cjs

@@ -1,12 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_store_erasure = require("../store/erasure.cjs");
 const require_store_index = require("../store/index.cjs");
 const require_host_ingest = require("./ingest.cjs");
+const require_email = require("../email.cjs");
 const require_templates = require("../templates.cjs");
 const require_contract = require("../contract.cjs");
 const require_host_channels = require("./channels.cjs");
-const require_reporting_tracking = require("../reporting/tracking.cjs");
 const require_host_auth = require("./auth.cjs");
 let zod_mini = require("zod/mini");
 zod_mini = require_runtime.__toESM(zod_mini, 1);
@@ -79,6 +80,14 @@ function declaredTopics(ctx) {
 }
 const SUBSCRIPTIONS = /^\/subscriptions\/[^/]+$/;
 const subscriptionsUser = (url) => decodeURIComponent(url.pathname.slice(15));
+/**
+* The same record, reached by one of the user's copies instead of their id: for the app's
+* preference page opened from an email's `preferencesUrl?m=<message>` without a sign-in. The
+* message id is the capability (an unguessable UUID, as `/t/u` trusts it); the bearer still
+* guards the route, so the page's own API proxies it, and rate-limits it as it sees fit.
+*/
+const SUBSCRIPTIONS_BY_MESSAGE = /^\/subscriptions\/by-message\/[^/]+$/;
+const subscriptionsMessage = (url) => decodeURIComponent(url.pathname.slice(26));
 const routes = [
 	{
 		method: "GET",
@@ -219,6 +228,32 @@ const routes = [
 			return json(await require_host_ingest.setSubscriptions(ctx.env, ctx.store, userId, parsed.patch, topics));
 		}
 	},
+	{
+		method: "GET",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const found = await require_host_ingest.getSubscriptionsByMessage(ctx.store, messageId, declaredTopics(ctx));
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
+	{
+		method: "PUT",
+		path: SUBSCRIPTIONS_BY_MESSAGE,
+		auth: "api",
+		async handle(ctx) {
+			const messageId = subscriptionsMessage(ctx.url);
+			const topics = declaredTopics(ctx);
+			const parsed = require_host_ingest.parseSubscriptionsPatch(await readJson(ctx.request), topics);
+			if (!parsed.ok) return json({
+				error: "subscriptions refused",
+				issues: parsed.issues
+			}, 400);
+			const found = await require_host_ingest.setSubscriptionsByMessage(ctx.env, ctx.store, messageId, parsed.patch, topics);
+			return found === void 0 ? json({ error: "unknown message" }, 404) : json(found);
+		}
+	},
 	{
 		method: "POST",
 		path: "/users/forget",
@@ -278,7 +313,7 @@ const routes = [
 				return json({ error: "props must be a JSON object" }, 400);
 			}
 			if (!isPlainObject(props)) return json({ error: "props must be a JSON object" }, 400);
-			const { subject, html } = await preview.render(key, props);
+			const { subject, html } = await preview.render(key, props, { messageId: require_email.PREVIEW_MESSAGE_ID });
 			return new Response(html, { headers: {
 				"content-type": "text/html; charset=utf-8",
 				"x-subject": encodeURIComponent(subject)
@@ -331,7 +366,7 @@ function failure(error) {
 /** One request through the table: the production gate, the bearer, the route, the error mapping. */
 async function serve(request, ctx) {
 	const url = new URL(request.url);
-	if (ctx.host !== void 0 && refusesOpen(request, ctx, url.pathname)) return json({ error: "API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)" }, 503);
+	if (refusesOpen(request, ctx, url.pathname)) return json({ error: "API_TOKEN is not set: production refuses to serve without it (set ENVIRONMENT=development to run open)" }, 503);
 	const candidates = routes.filter((route) => matches(route.path, url.pathname));
 	if (candidates.length === 0) return notFound();
 	if (candidates.some((route) => route.auth === "api")) {
@@ -359,7 +394,7 @@ async function serve(request, ctx) {
 		return failure(error);
 	}
 }
-/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/users/forget`, `/deploy`. */
+/** The bare ingest API over one store: `/health`, `/events`, `/identify`, `/devices*`, `/messages/opened`, `/subscriptions/:userId`, `/subscriptions/by-message/:messageId`, `/users/forget`, `/deploy`. */
 function handleRequest(request, env, store, validation = {}) {
 	return serve(request, {
 		env,