@siglo/notifications 0.0.0-stage → 1.0.1

package/dist/steps.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertTransportPolicy = assertTransportPolicy;
+exports.registerNotificationCompensationHandlers = registerNotificationCompensationHandlers;
+exports.sendNotificationStep = sendNotificationStep;
+exports.sendInteractiveApprovalStep = sendInteractiveApprovalStep;
+const dispatch_1 = require("./dispatch");
+const node_crypto_1 = require("node:crypto");
+const core_1 = require("@siglo/core");
+const http_1 = require("@siglo/http");
+const registry_1 = require("./registry");
+const approvals_1 = require("./approvals");
+const tokens_1 = require("./tokens");
+const resolve = (v, ctx) => typeof v === 'function' ? v(ctx) : v;
+function assertTransportPolicy(name, transport) {
+    for (const host of transport.allowedHosts)
+        (0, http_1.assertNetworkPolicy)(name, `https://${host}`, host);
+}
+async function cancelNotification(output, transport) {
+    if (output.correlationKey)
+        await (0, approvals_1.getApprovalRevocationStore)().revoke(output.correlationKey);
+    if (!transport.cancel && output.correlationKey)
+        return;
+    assertTransportPolicy('cancelNotification', transport);
+    if (!transport.cancel)
+        throw new Error('Transport does not support cancellation');
+    await transport.cancel(output.notificationId, 'Workflow cancelled');
+}
+function registerNotificationCompensationHandlers() {
+    if ((0, core_1.hasCompensationHandler)('cancelNotification'))
+        return;
+    (0, core_1.registerCompensationHandler)('cancelNotification', output => cancelNotification(output, (0, registry_1.getNotificationTransport)(output.$notificationMetadata.channel)));
+}
+registerNotificationCompensationHandlers();
+function sendNotificationStep(name, options) {
+    return createNotificationStep(name, options);
+}
+function createNotificationStep(name, options, enrich) {
+    registerNotificationCompensationHandlers();
+    const transportFor = (ctx) => options.transport ?? (0, registry_1.getNotificationTransport)(resolve(options.channel, ctx));
+    // Schema and before hooks run outside the observed action. Report their failures
+    // without resolving caller callbacks again or copying exception content.
+    const inspectPreAction = async (action) => {
+        const started = Date.now();
+        try {
+            return await action();
+        }
+        catch (error) {
+            (0, core_1.recordInspection)({ version: 1, kind: 'notification', outcome: 'failure',
+                approval: !!enrich, tokenStatus: 'unavailable', durationMs: Date.now() - started,
+                channel: typeof options.channel === 'string' ? options.channel : undefined });
+            throw error;
+        }
+    };
+    const dispatchKey = (ctx) => `${typeof ctx?.$stackId === 'function' ? ctx.$stackId() : ctx?.$stackId || ctx?.stackId || 'standalone'}:${name}:${(0, node_crypto_1.createHash)('sha256').update(JSON.stringify(resolve(options.recipient, ctx))).digest('hex')}`;
+    const action = async (ctx, inspection) => {
+        const channel = resolve(options.channel, ctx), to = resolve(options.recipient, ctx), transport = transportFor(ctx);
+        if (transport.channel !== channel)
+            throw new Error('Notification transport channel mismatch');
+        assertTransportPolicy(name, transport);
+        const target = typeof to === 'string' ? to : channel === 'email' ? to.email : channel === 'sms' ? to.phone : channel === 'slack' ? to.slackChannelId || to.slackUserId : channel === 'push' ? to.pushToken : to.discordWebhookUrl;
+        const idempotencyKey = (0, node_crypto_1.createHash)('sha256').update(dispatchKey(ctx)).digest('hex');
+        const intent = await (options.dispatchStore ?? (0, dispatch_1.getNotificationDispatchStore)()).prepare(idempotencyKey, async () => {
+            const enriched = await enrich?.(ctx);
+            return { message: { to, idempotencyKey, subject: options.subject === undefined ? undefined : resolve(options.subject, ctx), content: resolve(options.template, ctx), interactiveActions: enriched?.actions }, extra: enriched?.extra };
+        });
+        inspection.content = (0, core_1.captureInspection)(options.capture, 'preview', intent.message.content);
+        const result = await transport.send({ ...intent.message, signal: typeof ctx?.$signal === 'function' ? ctx.$signal() : ctx?.$signal });
+        const metadata = { notificationId: result.id, channel, dispatchedAt: result.timestamp, recipientMasked: `${target.slice(0, 1)}***` };
+        const stackId = typeof ctx?.$stackId === 'function' ? ctx.$stackId() : ctx?.$stackId || ctx?.stackId || 'standalone';
+        metadata.stackId = stackId;
+        if (enrich && typeof intent.extra?.approvalExpiresAt === 'number') {
+            metadata.approvalExpiresAt = intent.extra.approvalExpiresAt;
+        }
+        return { ...intent.extra, notificationId: result.id, sentAt: result.timestamp, $notificationMetadata: metadata, notificationMetadata: metadata };
+    };
+    const step = new core_1.Step(name, ctx => {
+        const inspection = {
+            version: 1, kind: 'notification', outcome: 'failure', approval: !!enrich,
+            channel: typeof options.channel === 'string' ? options.channel : undefined
+        };
+        return (0, core_1.observeEcosystem)(inspection, () => action(ctx, inspection), result => ({ channel: result.$notificationMetadata.channel,
+            notificationId: result.notificationId, approvalState: enrich ? 'requested' : undefined, approvalExpiresAt: result.$notificationMetadata.approvalExpiresAt, tokenStatus: enrich ? 'issued' : 'unavailable' }));
+    });
+    step.schema({ '~standard': { version: 1, vendor: 'siglo-notifications', validate: async (ctx) => inspectPreAction(async () => {
+                const channel = resolve(options.channel, ctx), to = resolve(options.recipient, ctx);
+                const target = typeof to === 'string' ? to : channel === 'email' ? to.email : channel === 'sms' ? to.phone : channel === 'slack' ? to.slackChannelId || to.slackUserId : channel === 'push' ? to.pushToken : to.discordWebhookUrl;
+                const valid = target && (channel === 'email' ? /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(target) : channel === 'sms' ? /^\+[1-9]\d{6,14}$/.test(target) : channel === 'slack' ? /^[A-Z][A-Z0-9]+$/.test(target) : channel === 'push' ? target.length > 0 : /^https:\/\/discord.com\/api\/webhooks\//.test(target));
+                if (!valid)
+                    throw new core_1.ValidationException([{ field: 'recipient', message: 'Invalid notification recipient' }], { phase: 'validation', retryable: false });
+                if (options.dataSchema)
+                    await (0, http_1.validatePayload)(options.dataSchema, options.data?.(ctx) ?? ctx, 'validation', name);
+                return { value: ctx };
+            }) } });
+    step.onAfter(async (output) => {
+        const metadata = output.$notificationMetadata;
+        const stackId = metadata.stackId;
+        for (const type of (enrich ? ['notification:dispatched', 'approval:requested'] : ['notification:dispatched'])) {
+            (0, core_1.emitMonitoringEvent)({ monitor: core_1.defaultStorageManager.getStack(stackId)?.monitor }, (0, core_1.redactEvent)({ type, stackId, stepId: name, timestamp: output.sentAt, ...metadata }));
+        }
+        return output;
+    });
+    step.onBefore(async (ctx) => inspectPreAction(() => { assertTransportPolicy(name, transportFor(ctx)); return true; }));
+    if (options.transport)
+        step.allowNetwork(options.transport.allowedHosts);
+    step.idempotent(dispatchKey, { ttlMs: (options.deduplicationTtl ?? 86400) * 1000, store: options.idempotencyStore });
+    if (options.compensateOnFailure) {
+        if (options.transport)
+            step.compensate((out) => cancelNotification(out, options.transport));
+        else
+            step.compensate('cancelNotification');
+    }
+    return step;
+}
+function sendInteractiveApprovalStep(name, options) {
+    const ttl = (0, core_1.parseDuration)(options.timeout);
+    if (!ttl || !Number.isFinite(ttl) || ttl <= 0)
+        throw new Error('Approval timeout must be positive');
+    return createNotificationStep(name, { capture: options.capture, channel: options.channel, recipient: options.recipient, template: options.title, transport: options.transport, idempotencyStore: options.idempotencyStore, dispatchStore: options.dispatchStore, compensateOnFailure: options.autoCompensate }, async (ctx) => {
+        const correlationKey = resolve(options.correlationKey, ctx);
+        const stackId = typeof ctx?.$stackId === 'function' ? ctx.$stackId() : ctx?.$stackId || ctx?.stackId || correlationKey;
+        const expiresAt = Date.now() + ttl;
+        const scope = core_1.stepInspectionStorage.getStore();
+        const inspection = scope ? { stepId: scope.stepId, stepName: scope.stepName, attempt: scope.attempt, namespace: scope.namespace } : undefined;
+        const url = async (approved) => { const u = new URL(options.callbackBaseUrl); if (u.protocol !== 'https:' && u.hostname !== 'localhost')
+            throw new Error('Callback URL must use HTTPS'); u.searchParams.set('token', await (0, tokens_1.signActionToken)({ stackId, correlationKey, expectedEvent: approved ? options.onApproveEvent : options.onRejectEvent, approved, expiresAt, inspection }, options.signingSecret)); return u.toString(); };
+        const approvalTokens = { approveUrl: await url(true), rejectUrl: await url(false) };
+        return { actions: { ...approvalTokens, title: resolve(options.title, ctx), description: options.description === undefined ? undefined : resolve(options.description, ctx) }, extra: { correlationKey, approvalTokens, approvalExpiresAt: expiresAt } };
+    });
+}
+//# sourceMappingURL=steps.js.map

package/dist/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../src/steps.ts"],"names":[],"mappings":";;AASA,sDAEC;AASD,4FAIC;AAGD,oDAEC;AAyED,kEAaC;AAnHD,yCAA0D;AAC1D,6CAAyC;AACzC,sCAAwR;AACxR,sCAAmE;AACnE,yCAAsD;AACtD,2CAAyD;AACzD,qCAA2C;AAE3C,MAAM,OAAO,GAAG,CAAI,CAAwB,EAAE,GAAQ,EAAK,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAE,CAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxH,SAAgB,qBAAqB,CAAC,IAAY,EAAE,SAAgC;IAClF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY;QAAE,IAAA,0BAAmB,EAAC,IAAI,EAAE,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;AAChG,CAAC;AACD,KAAK,UAAU,kBAAkB,CAAC,MAAwD,EAAE,SAAgC;IAC1H,IAAI,MAAM,CAAC,cAAc;QAAE,MAAM,IAAA,sCAA0B,GAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO;IACvD,qBAAqB,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAClF,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,wCAAwC;IACtD,IAAI,IAAA,6BAAsB,EAAC,oBAAoB,CAAC;QAAE,OAAO;IACzD,IAAA,kCAA2B,EAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,CACzD,kBAAkB,CAAC,MAAM,EAAE,IAAA,mCAAwB,EAAC,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AACD,wCAAwC,EAAE,CAAC;AAE3C,SAAgB,oBAAoB,CAAkC,IAAO,EAAE,OAAmC;IAChH,OAAO,sBAAsB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAO,EACP,OAAmC,EACnC,MAA4H;IAE5H,wCAAwC,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,GAAM,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,IAAA,mCAAwB,EAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9G,iFAAiF;IACjF,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,KAAK,EAAK,MAA4B,EAAc,EAAE;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,MAAM,MAAM,EAAE,CAAC;QAAC,CAAC;QAC9B,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,uBAAgB,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS;gBACrE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChF,OAAO,EAAE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,IAAI,GAAG,EAAE,OAAO,IAAI,YAAY,IAAI,IAAI,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAClP,MAAM,MAAM,GAAG,KAAK,EAAE,GAAM,EAAE,UAA+B,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnH,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC9F,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC;QAClO,MAAM,cAAc,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,IAAA,uCAA4B,GAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YAChH,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACzO,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,OAAO,GAAG,IAAA,wBAAiB,EAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAQ,GAAW,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,GAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAE,GAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACjK,MAAM,QAAQ,GAAyB,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,MAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5J,MAAM,OAAO,GAAG,OAAQ,GAAW,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,GAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAE,GAAW,EAAE,QAAQ,IAAK,GAAW,EAAE,OAAO,IAAI,YAAY,CAAC;QACzJ,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,EAAE,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAClE,QAAQ,CAAC,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;IACnJ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,WAAI,CAA2B,IAAI,EAAE,GAAG,CAAC,EAAE;QAAG,MAAM,UAAU,GAAwB;YACrG,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM;YACxE,OAAO,EAAE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;QAAC,OAAO,IAAA,uBAAgB,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,qBAAqB,CAAC,OAAO;YAC9H,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,WAAoB,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,aAAsB,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC,CAAC,CAAC;IAC/O,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE;gBAC9H,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACpF,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC;gBAClO,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3S,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,0BAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1J,IAAI,OAAO,CAAC,UAAU;oBAAE,MAAM,IAAA,sBAAe,EAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;gBAClH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,IAAI,CAAC,OAAO,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAQ,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAyD,EAAE,CAAC;YACtK,IAAA,0BAAmB,EAAC,EAAE,OAAO,EAAE,4BAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAA,kBAAW,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1K,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErH,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrH,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,UAAU,CAAC,CAAC,GAAqD,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAU,CAAC,CAAC,CAAC;;YAC1I,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAgB,2BAA2B,CAAkC,IAAO,EAAE,OAAsC;IAC1H,MAAM,GAAG,GAAG,IAAA,oBAAa,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpG,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;QAC1T,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAQ,GAAW,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,GAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAE,GAAW,EAAE,QAAQ,IAAK,GAAW,EAAE,OAAO,IAAI,cAAc,CAAC;QAC3J,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;QACnC,MAAM,KAAK,GAAG,4BAAqB,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9I,MAAM,GAAG,GAAG,KAAK,EAAE,QAAiB,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5a,MAAM,cAAc,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,CAAC;IACzP,CAAC,CAA0C,CAAC;AAC9C,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,18 @@
+import { NotificationChannel, NotificationTransport, ResolvedNotificationMessage } from '../types';
+export declare class MockNotificationTransport implements NotificationTransport {
+    readonly channel: NotificationChannel;
+    readonly allowedHosts: string[];
+    private now;
+    readonly messages: ResolvedNotificationMessage[];
+    readonly cancellations: {
+        id: string;
+        reason: string;
+    }[];
+    constructor(channel?: NotificationChannel, allowedHosts?: string[], now?: () => number);
+    send(message: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+    cancel(id: string, reason: string): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACnG,qBAAa,yBAA0B,YAAW,qBAAqB;IAGzD,QAAQ,CAAC,OAAO,EAAE,mBAAmB;IAAY,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE;IAAO,OAAO,CAAC,GAAG;IAF9G,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IACtD,QAAQ,CAAC,aAAa,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAM;gBACzC,OAAO,GAAE,mBAA6B,EAAW,YAAY,GAAE,MAAM,EAAO,EAAU,GAAG,eAAW;IACnH,IAAI,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CACxD"}

package/dist/testing/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MockNotificationTransport = void 0;
+class MockNotificationTransport {
+    channel;
+    allowedHosts;
+    now;
+    messages = [];
+    cancellations = [];
+    constructor(channel = 'email', allowedHosts = [], now = Date.now) {
+        this.channel = channel;
+        this.allowedHosts = allowedHosts;
+        this.now = now;
+    }
+    async send(message) { this.messages.push(message); return { id: `mock-${this.messages.length}`, timestamp: this.now() }; }
+    async cancel(id, reason) { this.cancellations.push({ id, reason }); }
+}
+exports.MockNotificationTransport = MockNotificationTransport;
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":";;;AACA,MAAa,yBAAyB;IAGf;IAAiD;IAAqC;IAFlG,QAAQ,GAAkC,EAAE,CAAC;IAC7C,aAAa,GAAqC,EAAE,CAAC;IAC9D,YAAqB,UAA+B,OAAO,EAAW,eAAyB,EAAE,EAAU,MAAM,IAAI,CAAC,GAAG;QAApG,YAAO,GAAP,OAAO,CAA+B;QAAW,iBAAY,GAAZ,YAAY,CAAe;QAAU,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAC7H,KAAK,CAAC,IAAI,CAAC,OAAoC,IAAgD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACnM,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc,IAAmB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CACrG;AAND,8DAMC"}

package/dist/testing.d.ts

@@ -0,0 +1,18 @@
+import { NotificationChannel, NotificationTransport, ResolvedNotificationMessage } from './index';
+export declare class MockNotificationTransport implements NotificationTransport {
+    readonly channel: NotificationChannel;
+    readonly allowedHosts: string[];
+    private readonly now;
+    readonly messages: ResolvedNotificationMessage[];
+    readonly cancellations: {
+        id: string;
+        reason: string;
+    }[];
+    constructor(channel?: NotificationChannel, allowedHosts?: string[], now?: () => number);
+    send(message: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+    cancel(id: string, reason: string): Promise<void>;
+}
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAClG,qBAAa,yBAA0B,YAAW,qBAAqB;IAGzD,QAAQ,CAAC,OAAO,EAAE,mBAAmB;IAAY,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE;IAAO,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFvH,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IACtD,QAAQ,CAAC,aAAa,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAM;gBACzC,OAAO,GAAE,mBAA6B,EAAW,YAAY,GAAE,MAAM,EAAO,EAAmB,GAAG,eAAW;IAC5H,IAAI,CAAC,OAAO,EAAE,2BAA2B;;;;IACzC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CACxD"}

package/dist/testing.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MockNotificationTransport = void 0;
+class MockNotificationTransport {
+    channel;
+    allowedHosts;
+    now;
+    messages = [];
+    cancellations = [];
+    constructor(channel = 'email', allowedHosts = [], now = Date.now) {
+        this.channel = channel;
+        this.allowedHosts = allowedHosts;
+        this.now = now;
+    }
+    async send(message) { this.messages.push(structuredClone(message)); return { id: String(this.messages.length), timestamp: this.now() }; }
+    async cancel(id, reason) { this.cancellations.push({ id, reason }); }
+}
+exports.MockNotificationTransport = MockNotificationTransport;
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":";;;AACA,MAAa,yBAAyB;IAGf;IAAiD;IAA8C;IAF3G,QAAQ,GAAkC,EAAE,CAAC;IAC7C,aAAa,GAAqC,EAAE,CAAC;IAC9D,YAAqB,UAA+B,OAAO,EAAW,eAAyB,EAAE,EAAmB,MAAM,IAAI,CAAC,GAAG;QAA7G,YAAO,GAAP,OAAO,CAA+B;QAAW,iBAAY,GAAZ,YAAY,CAAe;QAAmB,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IACtI,KAAK,CAAC,IAAI,CAAC,OAAoC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACtK,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc,IAAmB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CACrG;AAND,8DAMC"}

package/dist/tokens.d.ts

@@ -0,0 +1,24 @@
+import { KeyRing } from '@siglo/crypto';
+export interface ActionTokenPayload {
+    stackId: string;
+    correlationKey: string;
+    expectedEvent: string;
+    approved: boolean;
+    expiresAt: number;
+    issuedAt: number;
+    nonce: string;
+    kid?: string;
+    inspection?: {
+        stepId: string;
+        stepName: string;
+        attempt: number;
+        namespace?: string;
+    };
+}
+export declare function invalidToken(message?: string): never;
+export declare function signActionToken(payload: Omit<ActionTokenPayload, 'nonce' | 'issuedAt' | 'kid'>, secret: string | KeyRing, now?: number): Promise<string>;
+export declare function verifyActionToken(token: string, secret: string | KeyRing, options?: {
+    now?: number;
+    toleranceSeconds?: number;
+}): Promise<ActionTokenPayload>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,OAAO,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE;AACnR,wBAAgB,YAAY,CAAC,OAAO,SAA2B,GAAG,KAAK,CAEtE;AACD,wBAAsB,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,UAAU,GAAG,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlK;AACD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiBvK"}

package/dist/tokens.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invalidToken = invalidToken;
+exports.signActionToken = signActionToken;
+exports.verifyActionToken = verifyActionToken;
+const node_crypto_1 = require("node:crypto");
+const crypto_1 = require("@siglo/crypto");
+const core_1 = require("@siglo/core");
+function invalidToken(message = 'Invalid approval token') {
+    throw new core_1.ValidationException([{ field: 'token', message }], { phase: 'validation', retryable: false });
+}
+async function signActionToken(payload, secret, now = Date.now()) {
+    const active = typeof secret === 'string' ? { key: secret, kid: undefined } : await secret.getActiveKey();
+    if (!active.key.length)
+        invalidToken('Empty signing key');
+    const body = Buffer.from(JSON.stringify({ ...payload, issuedAt: now, nonce: (0, node_crypto_1.randomUUID)(), kid: active.kid })).toString('base64url');
+    return `${body}.${(0, node_crypto_1.createHmac)('sha256', active.key).update(body).digest('base64url')}`;
+}
+async function verifyActionToken(token, secret, options = {}) {
+    try {
+        if (token.length > 16384)
+            invalidToken();
+        if (!/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{43}$/.test(token))
+            invalidToken();
+        const parts = token.split('.');
+        const p = JSON.parse(Buffer.from(parts[0], 'base64url').toString());
+        const key = typeof secret === 'string' ? secret : await secret.getKey(p.kid);
+        if (!key || !(0, crypto_1.timingSafeCompare)((0, node_crypto_1.createHmac)('sha256', key).update(parts[0]).digest('base64url'), parts[1], 'base64url'))
+            invalidToken();
+        const now = options.now ?? Date.now();
+        if (![p.stackId, p.correlationKey, p.expectedEvent, p.nonce].every(v => typeof v === 'string' && v.length > 0) || typeof p.approved !== 'boolean' || !Number.isFinite(p.expiresAt) || !Number.isFinite(p.issuedAt) || p.issuedAt > now + (options.toleranceSeconds ?? 0) * 1000)
+            invalidToken();
+        if (p.inspection && (typeof p.inspection.stepId !== 'string' || !p.inspection.stepId ||
+            typeof p.inspection.stepName !== 'string' || !p.inspection.stepName ||
+            !Number.isSafeInteger(p.inspection.attempt) || p.inspection.attempt < 1 ||
+            (p.inspection.namespace !== undefined && typeof p.inspection.namespace !== 'string')))
+            invalidToken();
+        if (p.expiresAt <= now)
+            invalidToken('Approval token expired');
+        return p;
+    }
+    catch (e) {
+        if (e instanceof core_1.ValidationException)
+            throw e;
+        return invalidToken();
+    }
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;AAIA,oCAEC;AACD,0CAKC;AACD,8CAiBC;AA9BD,6CAAqD;AACrD,0CAA2D;AAC3D,sCAAkD;AAElD,SAAgB,YAAY,CAAC,OAAO,GAAG,wBAAwB;IAC7D,MAAM,IAAI,0BAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1G,CAAC;AACM,KAAK,UAAU,eAAe,CAAC,OAA+D,EAAE,MAAwB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/I,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC1G,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM;QAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAA,wBAAU,GAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpI,OAAO,GAAG,IAAI,IAAI,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AACxF,CAAC;AACM,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAwB,EAAE,UAAuD,EAAE;IACxI,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;YAAE,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,YAAY,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAuB,CAAC;QAC1F,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,IAAI,CAAC,IAAA,0BAAiB,EAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;YAAE,YAAY,EAAE,CAAC;QACtI,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI;YAAE,YAAY,EAAE,CAAC;QAChS,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;YAClF,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ;YACnE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC;YACvE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;YAAE,YAAY,EAAE,CAAC;QACxG,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;YAAE,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,YAAY,0BAAmB;YAAE,MAAM,CAAC,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;IAAC,CAAC;AACvF,CAAC"}

package/dist/transports.d.ts

@@ -0,0 +1,120 @@
+import { NotificationTransport, ResolvedNotificationMessage } from './types';
+export declare const escapeHtml: (s: string) => string;
+export declare function renderNotificationHtml(m: ResolvedNotificationMessage): string;
+interface HttpTransportOptions {
+    apiKey: string;
+    from?: string;
+    fetch?: typeof fetch;
+}
+export declare class SlackTransport implements NotificationTransport {
+    private options;
+    readonly channel = "slack";
+    readonly allowedHosts: string[];
+    constructor(options: HttpTransportOptions);
+    private call;
+    send(m: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+    openModal(triggerId: string, view: {
+        title: string;
+        blocks: unknown[];
+        callbackId?: string;
+    }, signal?: AbortSignal): Promise<string>;
+    cancel(id: string, reason: string): Promise<void>;
+}
+export declare class ResendTransport implements NotificationTransport {
+    private options;
+    readonly channel = "email";
+    readonly allowedHosts: string[];
+    constructor(options: HttpTransportOptions);
+    send(m: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+}
+export declare class SendGridTransport implements NotificationTransport {
+    private options;
+    readonly channel = "email";
+    readonly allowedHosts: string[];
+    constructor(options: HttpTransportOptions);
+    send(m: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+}
+export declare class DiscordTransport implements NotificationTransport {
+    private request;
+    readonly channel = "discord";
+    readonly allowedHosts: string[];
+    constructor(request?: typeof fetch);
+    send(m: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+}
+export declare class TwilioTransport implements NotificationTransport {
+    private options;
+    readonly channel = "sms";
+    readonly allowedHosts: string[];
+    constructor(options: {
+        accountSid: string;
+        authToken: string;
+        from: string;
+        fetch?: typeof fetch;
+    });
+    send(m: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+}
+/** Inject an SMTP client (e.g. Nodemailer) without imposing an SMTP dependency. */
+export declare class SmtpTransport implements NotificationTransport {
+    private options;
+    readonly channel = "email";
+    readonly allowedHosts: string[];
+    constructor(options: {
+        host: string;
+        from: string;
+        sendMail: (mail: {
+            from: string;
+            to: string;
+            subject: string;
+            html: string;
+            signal?: AbortSignal;
+        }) => Promise<{
+            messageId: string;
+        }>;
+    });
+    send(m: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+}
+export declare class PostmarkTransport implements NotificationTransport {
+    private options;
+    readonly channel = "email";
+    readonly allowedHosts: string[];
+    constructor(options: HttpTransportOptions);
+    send(message: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+}
+/** Sends a provider-neutral JSON push payload to a configured HTTPS webhook. */
+export declare class PushWebhookTransport implements NotificationTransport {
+    private options;
+    readonly channel = "push";
+    readonly allowedHosts: string[];
+    constructor(options: {
+        url: string;
+        headers?: Record<string, string>;
+        fetch?: typeof fetch;
+    });
+    send(message: ResolvedNotificationMessage): Promise<{
+        id: string;
+        timestamp: number;
+    }>;
+}
+export {};
+//# sourceMappingURL=transports.d.ts.map

package/dist/transports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transports.d.ts","sourceRoot":"","sources":["../src/transports.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAuB,MAAM,SAAS,CAAC;AAClG,eAAO,MAAM,UAAU,MAAO,MAAM,KAAG,MAAmH,CAAC;AAC3J,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,2BAA2B,GAAG,MAAM,CAG7E;AACD,UAAU,oBAAoB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE;AAWtF,qBAAa,cAAe,YAAW,qBAAqB;IAE9C,OAAO,CAAC,OAAO;IAD3B,QAAQ,CAAC,OAAO,WAAW;IAAC,QAAQ,CAAC,YAAY,WAAiB;gBAC9C,OAAO,EAAE,oBAAoB;YACnC,IAAI;IAIZ,IAAI,CAAC,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAKhF,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpI,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CACxD;AACD,qBAAa,eAAgB,YAAW,qBAAqB;IAE/C,OAAO,CAAC,OAAO;IAD3B,QAAQ,CAAC,OAAO,WAAW;IAAC,QAAQ,CAAC,YAAY,WAAsB;gBACnD,OAAO,EAAE,oBAAoB;IAC3C,IAAI,CAAC,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAIvF;AACD,qBAAa,iBAAkB,YAAW,qBAAqB;IAEjD,OAAO,CAAC,OAAO;IAD3B,QAAQ,CAAC,OAAO,WAAW;IAAC,QAAQ,CAAC,YAAY,WAAwB;gBACrD,OAAO,EAAE,oBAAoB;IAC3C,IAAI,CAAC,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAMvF;AACD,qBAAa,gBAAiB,YAAW,qBAAqB;IAEhD,OAAO,CAAC,OAAO;IAD3B,QAAQ,CAAC,OAAO,aAAa;IAAC,QAAQ,CAAC,YAAY,WAAmB;gBAClD,OAAO,eAA0B;IAC/C,IAAI,CAAC,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAKvF;AACD,qBAAa,eAAgB,YAAW,qBAAqB;IAE/C,OAAO,CAAC,OAAO;IAD3B,QAAQ,CAAC,OAAO,SAAS;IAAC,QAAQ,CAAC,YAAY,WAAsB;gBACjD,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;KAAE;IACpG,IAAI,CAAC,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAKvF;AACD,mFAAmF;AACnF,qBAAa,aAAc,YAAW,qBAAqB;IAE7C,OAAO,CAAC,OAAO;IAD3B,QAAQ,CAAC,OAAO,WAAW;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;gBACxC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,WAAW,CAAA;SAAE,KAAK,OAAO,CAAC;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE;IAC5L,IAAI,CAAC,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAIvF;AAED,qBAAa,iBAAkB,YAAW,qBAAqB;IAGjD,OAAO,CAAC,OAAO;IAF3B,QAAQ,CAAC,OAAO,WAAW;IAC3B,QAAQ,CAAC,YAAY,WAA2B;gBAC5B,OAAO,EAAE,oBAAoB;IAC3C,IAAI,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAQ7F;AAED,gFAAgF;AAChF,qBAAa,oBAAqB,YAAW,qBAAqB;IAGpD,OAAO,CAAC,OAAO;IAF3B,QAAQ,CAAC,OAAO,UAAU;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;KAAE;IAK9F,IAAI,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAQ7F"}

package/dist/transports.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PushWebhookTransport = exports.PostmarkTransport = exports.SmtpTransport = exports.TwilioTransport = exports.DiscordTransport = exports.SendGridTransport = exports.ResendTransport = exports.SlackTransport = exports.escapeHtml = void 0;
+exports.renderNotificationHtml = renderNotificationHtml;
+const egress_1 = require("./egress");
+const http_1 = require("@siglo/http");
+const escapeHtml = (s) => s.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+exports.escapeHtml = escapeHtml;
+function renderNotificationHtml(m) {
+    const a = m.interactiveActions;
+    return `<!doctype html><html><head><meta name="viewport" content="width=device-width, initial-scale=1"></head><body style="margin:0;padding:24px;font-family:Arial,sans-serif"><main style="max-width:600px;margin:auto"><p>${(0, exports.escapeHtml)(m.content)}</p>${a ? `<p>${(0, exports.escapeHtml)(a.description ?? '')}</p><a href="${(0, exports.escapeHtml)(a.approveUrl)}">Approve</a> <a href="${(0, exports.escapeHtml)(a.rejectUrl)}">Reject</a>` : ''}</main></body></html>`;
+}
+function recipient(m, channel) {
+    if (typeof m.to === 'string')
+        return m.to;
+    return (channel === 'email' ? m.to.email : channel === 'sms' ? m.to.phone : channel === 'slack' ? m.to.slackChannelId || m.to.slackUserId : m.to.discordWebhookUrl);
+}
+async function post(url, headers, body, signal, request = egress_1.publicNotificationFetch) {
+    const u = new URL(url);
+    (0, http_1.assertNetworkPolicy)('notificationTransport', url, u.hostname, u.port);
+    const r = await request(url, { method: 'POST', headers, body: typeof body === 'string' ? body : JSON.stringify(body), signal, redirect: 'error' });
+    if (!r.ok)
+        throw new Error(`Notification provider failed (${r.status})`);
+    return r.status === 204 ? {} : r.json();
+}
+class SlackTransport {
+    options;
+    channel = 'slack';
+    allowedHosts = ['slack.com'];
+    constructor(options) {
+        this.options = options;
+    }
+    async call(method, body, signal) {
+        const r = await post(`https://slack.com/api/${method}`, { Authorization: `Bearer ${this.options.apiKey}`, 'Content-Type': 'application/json' }, body, signal, this.options.fetch);
+        if (!r.ok)
+            throw new Error('Slack notification request failed');
+        return r;
+    }
+    async send(m) {
+        const a = m.interactiveActions;
+        const r = await this.call('chat.postMessage', { channel: recipient(m, this.channel), text: m.content, blocks: [{ type: 'section', text: { type: 'plain_text', text: m.content } }, ...(a ? [{ type: 'actions', elements: [{ type: 'button', text: { type: 'plain_text', text: 'Approve' }, url: a.approveUrl }, { type: 'button', text: { type: 'plain_text', text: 'Reject' }, url: a.rejectUrl }] }] : [])] }, m.signal);
+        return { id: `${r.channel}:${r.ts}`, timestamp: Date.now() };
+    }
+    async openModal(triggerId, view, signal) {
+        if (!triggerId || !view.title || view.title.length > 24)
+            throw new Error('A trigger ID and modal title of at most 24 characters are required');
+        const result = await this.call('views.open', { trigger_id: triggerId, view: { type: 'modal', title: { type: 'plain_text', text: view.title }, blocks: view.blocks, callback_id: view.callbackId } }, signal);
+        return result.view.id;
+    }
+    async cancel(id, reason) { const [channel, ts] = id.split(':'); await this.call('chat.update', { channel, ts, text: reason, blocks: [] }); }
+}
+exports.SlackTransport = SlackTransport;
+class ResendTransport {
+    options;
+    channel = 'email';
+    allowedHosts = ['api.resend.com'];
+    constructor(options) {
+        this.options = options;
+    }
+    async send(m) {
+        const r = await post('https://api.resend.com/emails', { Authorization: `Bearer ${this.options.apiKey}`, 'Content-Type': 'application/json', ...(m.idempotencyKey ? { 'Idempotency-Key': m.idempotencyKey } : {}) }, { from: this.options.from, to: recipient(m, this.channel), subject: m.subject ?? m.content, html: renderNotificationHtml(m) }, m.signal, this.options.fetch);
+        return { id: r.id, timestamp: Date.now() };
+    }
+}
+exports.ResendTransport = ResendTransport;
+class SendGridTransport {
+    options;
+    channel = 'email';
+    allowedHosts = ['api.sendgrid.com'];
+    constructor(options) {
+        this.options = options;
+    }
+    async send(m) {
+        const url = 'https://api.sendgrid.com/v3/mail/send';
+        (0, http_1.assertNetworkPolicy)('sendgrid', url, 'api.sendgrid.com');
+        const r = await (this.options.fetch ?? egress_1.publicNotificationFetch)(url, { method: 'POST', redirect: 'error', signal: m.signal, headers: { Authorization: `Bearer ${this.options.apiKey}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ personalizations: [{ to: [{ email: recipient(m, this.channel) }] }], from: { email: this.options.from }, subject: m.subject ?? m.content, content: [{ type: 'text/html', value: renderNotificationHtml(m) }] }) });
+        if (!r.ok)
+            throw new Error(`SendGrid notification failed (${r.status})`);
+        return { id: r.headers.get('x-message-id') ?? '', timestamp: Date.now() };
+    }
+}
+exports.SendGridTransport = SendGridTransport;
+class DiscordTransport {
+    request;
+    channel = 'discord';
+    allowedHosts = ['discord.com'];
+    constructor(request = egress_1.publicNotificationFetch) {
+        this.request = request;
+    }
+    async send(m) {
+        const u = new URL(recipient(m, this.channel));
+        if (u.protocol !== 'https:' || u.hostname !== 'discord.com' || !u.pathname.startsWith('/api/webhooks/'))
+            throw new Error('Invalid Discord webhook');
+        u.searchParams.set('wait', 'true');
+        const r = await post(u.toString(), { 'Content-Type': 'application/json' }, { content: m.content, allowed_mentions: { parse: [] }, embeds: m.interactiveActions ? [{ title: m.interactiveActions.title, description: `${m.interactiveActions.description ?? ''}\n[Approve](${m.interactiveActions.approveUrl}) · [Reject](${m.interactiveActions.rejectUrl})` }] : undefined }, m.signal, this.request);
+        return { id: r.id, timestamp: Date.now() };
+    }
+}
+exports.DiscordTransport = DiscordTransport;
+class TwilioTransport {
+    options;
+    channel = 'sms';
+    allowedHosts = ['api.twilio.com'];
+    constructor(options) {
+        this.options = options;
+    }
+    async send(m) {
+        if (!/^AC[a-zA-Z0-9]+$/.test(this.options.accountSid))
+            throw new Error('Invalid Twilio account SID');
+        const r = await post(`https://api.twilio.com/2010-04-01/Accounts/${this.options.accountSid}/Messages.json`, { Authorization: `Basic ${Buffer.from(`${this.options.accountSid}:${this.options.authToken}`).toString('base64')}`, 'Content-Type': 'application/x-www-form-urlencoded' }, new URLSearchParams({ To: recipient(m, this.channel), From: this.options.from, Body: m.content }).toString(), m.signal, this.options.fetch);
+        return { id: r.sid, timestamp: Date.now() };
+    }
+}
+exports.TwilioTransport = TwilioTransport;
+/** Inject an SMTP client (e.g. Nodemailer) without imposing an SMTP dependency. */
+class SmtpTransport {
+    options;
+    channel = 'email';
+    allowedHosts;
+    constructor(options) {
+        this.options = options;
+        this.allowedHosts = [options.host];
+    }
+    async send(m) {
+        (0, http_1.assertNetworkPolicy)('smtp', `smtp://${this.options.host}`, this.options.host);
+        const r = await this.options.sendMail({ from: this.options.from, to: recipient(m, this.channel), subject: m.subject ?? m.content, html: renderNotificationHtml(m), signal: m.signal });
+        return { id: r.messageId, timestamp: Date.now() };
+    }
+}
+exports.SmtpTransport = SmtpTransport;
+class PostmarkTransport {
+    options;
+    channel = 'email';
+    allowedHosts = ['api.postmarkapp.com'];
+    constructor(options) {
+        this.options = options;
+    }
+    async send(message) {
+        const result = await post('https://api.postmarkapp.com/email', { 'X-Postmark-Server-Token': this.options.apiKey, 'Content-Type': 'application/json' }, {
+            From: this.options.from, To: recipient(message, 'email'), Subject: message.subject ?? message.content,
+            HtmlBody: renderNotificationHtml(message), TextBody: message.content
+        }, message.signal, this.options.fetch);
+        if (result.ErrorCode)
+            throw new Error('Postmark notification request failed');
+        return { id: result.MessageID, timestamp: Date.now() };
+    }
+}
+exports.PostmarkTransport = PostmarkTransport;
+/** Sends a provider-neutral JSON push payload to a configured HTTPS webhook. */
+class PushWebhookTransport {
+    options;
+    channel = 'push';
+    allowedHosts;
+    constructor(options) {
+        this.options = options;
+        const url = new URL(options.url);
+        if (url.protocol !== 'https:' || url.username || url.password)
+            throw new Error('Push webhook must use HTTPS without URL credentials');
+        this.allowedHosts = [url.hostname];
+    }
+    async send(message) {
+        const result = await post(this.options.url, { ...this.options.headers, 'Content-Type': 'application/json', ...(message.idempotencyKey ? { 'Idempotency-Key': message.idempotencyKey } : {}) }, {
+            to: typeof message.to === 'string' ? message.to : message.to.pushToken,
+            title: message.subject, body: message.content, actions: message.interactiveActions, metadata: message.metadata
+        }, message.signal, this.options.fetch);
+        if (typeof result.id !== 'string' || !result.id)
+            throw new Error('Push webhook response must contain a message id');
+        return { id: result.id, timestamp: Date.now() };
+    }
+}
+exports.PushWebhookTransport = PushWebhookTransport;
+//# sourceMappingURL=transports.js.map