@smthrs/notifications 0.0.0-stage → 1.0.0-rc.13

package/dist/cjs/AlertPolicy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/AlertPolicy.ts"],
+  "sourcesContent": ["/**\n * Alert policy: what a condition is, when a journal leaves one open, and\n * which open conditions have outlived their delay.\n *\n * Everything here is pure and a function of journal time, so the same entries\n * decide the same alerts in any process at any instant past the delay. The\n * transport that pages about them is `./layerWebhook.ts` and the journal-backed\n * tick that drives them is `./AlertRuntime.ts`; `./Alerts.ts` is the module a\n * consumer imports.\n *\n * @since 1.0.0\n */\n\nimport type { JournalEvent } from \"@smthrs/journal\"\nimport { Schema } from \"effect\"\n\n/**\n * The journal event type one delivered alert is recorded under.\n *\n * @category constants\n * @since 0.1.0\n */\nexport const deliveredEventType = \"flows.alerts.delivered\"\n\n/**\n * The journal event type one failed delivery attempt is recorded under.\n *\n * One entry is written per alert per failure code, never one per tick: a\n * webhook that stays down for an hour leaves one record, not a hundred and\n * twenty that every later tick has to read past.\n *\n * @category constants\n * @since 0.1.0\n */\nexport const failedEventType = \"flows.alerts.failed\"\n\n/**\n * How loud an alert is.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Severity = Schema.Literals([\"info\", \"warning\", \"critical\"])\n\n/**\n * How loud an alert is.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Severity = typeof Severity.Type\n\n/**\n * How a condition is recognized in the journal.\n *\n * `field` names a payload key, `value` the value that means the condition\n * holds, and `eventTypes` narrows which entries are consulted at all. An\n * `eventTypes` item ending in `.*` names a family: `control.*` consults\n * `control.run.parked` and `control.monitor.beat` alike. An entry that carries\n * the field with a different value CLOSES the condition, which is what makes a\n * resume clear an approval alert without a second vocabulary for \"cleared\".\n *\n * @category models\n * @since 0.1.0\n */\nexport const Detector = Schema.Struct({\n  field: Schema.NonEmptyString,\n  value: Schema.NonEmptyString,\n  eventTypes: Schema.optional(Schema.Array(Schema.NonEmptyString))\n})\n\n/**\n * How a condition is recognized in the journal.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Detector = typeof Detector.Type\n\n/**\n * What to do about one condition, and after how long.\n *\n * `afterMs` is a whole, non-negative number of milliseconds. The bound is the\n * schema's job because the delay is also arithmetic on journal time: a `NaN`\n * delay fires on the first tick and stamps a `firedAt` that JSON writes as\n * `null`, and a negative one fires with a `firedAt` earlier than the condition\n * it describes.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Rule = Schema.Struct({\n  afterMs: Schema.Int.pipe(Schema.check(Schema.isGreaterThanOrEqualTo(0))),\n  severity: Schema.optional(Severity),\n  owner: Schema.optional(Schema.String),\n  runbook: Schema.optional(Schema.String)\n})\n\n/**\n * What to do about one condition, and after how long.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Rule = typeof Rule.Type\n\n/**\n * The conditions a policy alerts on and the delays it alerts after.\n *\n * `defaults` fills in what a rule leaves out, so a policy states the delay per\n * condition and the ownership once.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Policy = Schema.Struct({\n  defaults: Schema.optional(Schema.Struct({\n    severity: Schema.optional(Severity),\n    owner: Schema.optional(Schema.String),\n    runbook: Schema.optional(Schema.String)\n  })),\n  rules: Schema.Record(Schema.String, Rule),\n  /** Detectors for conditions this deployment names itself. */\n  detectors: Schema.optional(Schema.Record(Schema.String, Detector))\n})\n\n/**\n * The conditions a policy alerts on and the delays it alerts after.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Policy = typeof Policy.Type\n\n/**\n * The four conditions a control plane journals out of the box.\n *\n * `status` rides on every `control.run.*` entry, and `health` on every\n * `control.monitor.beat`. A deployment whose supervisor journals a park reason\n * gets `quota-parked` from the same field the run summary reports it under.\n *\n * Each consults the `control.*` family only. A run's journal is shared with\n * flow steps, agent traces, and anything else that writes to the run, and a\n * `status` or `health` field on one of those entries would otherwise open or\n * close a condition the control plane never reported.\n *\n * @category constants\n * @since 0.1.0\n */\nexport const defaultDetectors: Readonly<Record<string, Detector>> = {\n  \"waiting-approval\": { field: \"status\", value: \"waiting-approval\", eventTypes: [\"control.*\"] },\n  failed: { field: \"status\", value: \"failed\", eventTypes: [\"control.*\"] },\n  stalled: { field: \"health\", value: \"stalled\", eventTypes: [\"control.*\"] },\n  \"quota-parked\": { field: \"waitingReason\", value: \"quota\", eventTypes: [\"control.*\"] }\n}\n\n/**\n * Whether a detector's `eventTypes` names an entry's event type, exactly or\n * through a `.*` family.\n */\nconst names = (eventTypes: ReadonlyArray<string>, eventType: string): boolean =>\n  eventTypes.some((named) => named.endsWith(\".*\") ? eventType.startsWith(named.slice(0, -1)) : named === eventType)\n\n/**\n * A condition that is open on a run, and when it opened.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Open {\n  readonly runId: string\n  readonly condition: string\n  /** The journal time of the entry that opened the condition. */\n  readonly since: number\n}\n\n/**\n * One alert a policy decided to raise.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Alert {\n  readonly runId: string\n  readonly condition: string\n  readonly since: number\n  /**\n   * The journal instant the condition outlived its delay: `since` plus the\n   * rule's `afterMs`, never the wall clock of whichever tick noticed.\n   */\n  readonly firedAt: number\n  readonly severity: Severity\n  readonly coalescingKey: string\n  readonly owner?: string | undefined\n  readonly runbook?: string | undefined\n}\n\n/**\n * The journal source the alerter writes one outcome of one alert under.\n *\n * A delivery record counts as evidence that an alert went out only under this\n * source, so another producer's `flows.alerts.delivered` record with a\n * matching `alertId` does not suppress a page. This scopes records; it does\n * not authenticate the writer, because the journal does not bind a source to\n * a writer.\n *\n * @param id the alert's {@link alertId}\n * @param outcome `delivered`, `refused`, or `failed/<code>`\n * @private\n * @since 1.0.0\n */\nexport const recordSourceId = (id: string, outcome: string): string => `/notifications/alerts/${id}/${outcome}`\n\n/**\n * The key an alert coalesces on: one open condition on one run.\n *\n * Each component is percent-encoded before it is joined, so a run id or a\n * condition name containing the separator cannot forge another pair's key and\n * suppress a page that belongs to somebody else. Both components are values a\n * deployment chooses, which is why the encoding is not optional.\n *\n * @param runId the run the condition is open on\n * @param condition the condition name the policy uses\n * @category getters\n * @since 1.0.0\n */\nexport const coalescingKey = (runId: string, condition: string): string =>\n  `${encodeURIComponent(runId)}:${encodeURIComponent(condition)}`\n\n/**\n * The identity a delivery is recorded under.\n *\n * The opening time is part of it on purpose. A condition that clears and\n * re-opens is a NEW alert, because the second approval wait is not the first\n * one, and a key without the time would suppress it forever.\n *\n * @param alert the alert\n * @category getters\n * @since 0.1.0\n */\nexport const alertId = (alert: Pick<Alert, \"coalescingKey\" | \"since\">): string =>\n  `alert:${alert.coalescingKey}:${alert.since}`\n\n/**\n * The detectors one policy decides with: the four this package ships, with\n * the deployment's own overriding them by name.\n *\n * @private\n * @since 1.0.0\n */\nexport const detectorsOf = (policy: Policy): Readonly<Record<string, Detector>> => ({\n  ...defaultDetectors,\n  ...policy.detectors\n})\n\n/**\n * One entry's payload when it is a record a detector can read a field off,\n * and `undefined` for the arrays and primitives that carry no fields at all.\n *\n * @private\n * @since 1.0.0\n */\nexport const payloadRecord = (payload: unknown): Readonly<Record<string, unknown>> | undefined =>\n  typeof payload === \"object\" && payload !== null && !Array.isArray(payload)\n    ? payload as Readonly<Record<string, unknown>>\n    : undefined\n\n/**\n * Folds one entry into the open-condition map. Shared by {@link conditions}\n * and the runtime's incremental read, so both decide a condition the same\n * way.\n *\n * The alerter's own records are never evidence about a condition. They are\n * written into the same journal they are read from, and they carry the alert's\n * own vocabulary: a refusal reports the answering HTTP `status`, which a\n * detector watching the run's `status` would read as the condition clearing.\n * A page would then close the condition it paged about and the next tick would\n * re-open it, so a webhook that answered 503 once would alert forever.\n *\n * @private\n * @since 1.0.0\n */\nexport const observe = (\n  policy: Policy,\n  detectors: Readonly<Record<string, Detector>>,\n  entry: JournalEvent.Entry,\n  payload: Readonly<Record<string, unknown>>,\n  open: Map<string, number>\n): void => {\n  if (entry.eventType === deliveredEventType || entry.eventType === failedEventType) return\n  for (const condition of Object.keys(policy.rules)) {\n    const detector = detectors[condition]\n    if (detector === undefined) continue\n    if (detector.eventTypes !== undefined && !names(detector.eventTypes, entry.eventType)) continue\n    // Own properties only. `in` walks `Object.prototype`, so a detector named\n    // `toString` or `constructor` would read every record-shaped entry in the\n    // run as evidence and close the condition on all of them.\n    if (!Object.hasOwn(payload, detector.field)) continue\n    if (payload[detector.field] === detector.value) {\n      if (!open.has(condition)) open.set(condition, entry.emittedAtMs)\n    } else {\n      open.delete(condition)\n    }\n  }\n}\n\n/**\n * Every condition a run's journal leaves open, with the time each opened.\n *\n * An entry that carries a detector's field opens the condition when the value\n * matches and closes it when it does not. Entries the detector does not name\n * are ignored entirely, so a monitor beat cannot close an approval wait and an\n * approval cannot close a stall.\n *\n * @param policy the policy whose detectors decide what counts\n * @param runId the run the entries belong to\n * @param entries the run's journal, oldest first\n * @category projections\n * @since 0.1.0\n */\nexport const conditions = (\n  policy: Policy,\n  runId: string,\n  entries: ReadonlyArray<JournalEvent.Entry>\n): ReadonlyArray<Open> => {\n  const detectors = detectorsOf(policy)\n  const open = new Map<string, number>()\n  for (const entry of entries) {\n    const payload = payloadRecord(entry.payload)\n    if (payload === undefined) continue\n    observe(policy, detectors, entry, payload, open)\n  }\n  return Array.from(open, ([condition, since]) => ({ runId, condition, since }))\n}\n\n/**\n * The alerts a policy raises for the conditions open at `now`.\n *\n * Pure, and a function of journal time: the same journal raises the same\n * alerts in any process, at any instant past the delay. `now` decides WHETHER\n * an alert is raised; it never appears in one. A condition that has been open\n * for less than its rule's delay raises nothing, which is the whole point of\n * the delay, because most stalls clear themselves.\n *\n * @param policy the policy\n * @param open the conditions the journal left open\n * @param now the instant to judge them at\n * @category projections\n * @since 0.1.0\n */\nexport const decide = (\n  policy: Policy,\n  open: ReadonlyArray<Open>,\n  now: number\n): ReadonlyArray<Alert> =>\n  open.flatMap((condition) => {\n    const rule = policy.rules[condition.condition]\n    if (rule === undefined) return []\n    if (now - condition.since < rule.afterMs) return []\n    const severity = rule.severity ?? policy.defaults?.severity ?? \"warning\"\n    const owner = rule.owner ?? policy.defaults?.owner\n    const runbook = rule.runbook ?? policy.defaults?.runbook\n    return [{\n      runId: condition.runId,\n      condition: condition.condition,\n      since: condition.since,\n      // Derived from the journal, not read off the clock. The alert id is\n      // stable across ticks, and the queue refuses a reused id whose content\n      // changed, so an alert stamped with the reading time would become\n      // permanently undeliverable the moment a tick refused and time moved on.\n      firedAt: condition.since + rule.afterMs,\n      severity,\n      coalescingKey: coalescingKey(condition.runId, condition.condition),\n      ...(owner === undefined ? {} : { owner }),\n      ...(runbook === undefined ? {} : { runbook })\n    }]\n  })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,oBAAuB;AAQhB,MAAM,qBAAqB;AAY3B,MAAM,kBAAkB;AAQxB,MAAM,WAAW,qBAAO,SAAS,CAAC,QAAQ,WAAW,UAAU,CAAC;AAuBhE,MAAM,WAAW,qBAAO,OAAO;AAAA,EACpC,OAAO,qBAAO;AAAA,EACd,OAAO,qBAAO;AAAA,EACd,YAAY,qBAAO,SAAS,qBAAO,MAAM,qBAAO,cAAc,CAAC;AACjE,CAAC;AAsBM,MAAM,OAAO,qBAAO,OAAO;AAAA,EAChC,SAAS,qBAAO,IAAI,KAAK,qBAAO,MAAM,qBAAO,uBAAuB,CAAC,CAAC,CAAC;AAAA,EACvE,UAAU,qBAAO,SAAS,QAAQ;AAAA,EAClC,OAAO,qBAAO,SAAS,qBAAO,MAAM;AAAA,EACpC,SAAS,qBAAO,SAAS,qBAAO,MAAM;AACxC,CAAC;AAmBM,MAAM,SAAS,qBAAO,OAAO;AAAA,EAClC,UAAU,qBAAO,SAAS,qBAAO,OAAO;AAAA,IACtC,UAAU,qBAAO,SAAS,QAAQ;AAAA,IAClC,OAAO,qBAAO,SAAS,qBAAO,MAAM;AAAA,IACpC,SAAS,qBAAO,SAAS,qBAAO,MAAM;AAAA,EACxC,CAAC,CAAC;AAAA,EACF,OAAO,qBAAO,OAAO,qBAAO,QAAQ,IAAI;AAAA;AAAA,EAExC,WAAW,qBAAO,SAAS,qBAAO,OAAO,qBAAO,QAAQ,QAAQ,CAAC;AACnE,CAAC;AAyBM,MAAM,mBAAuD;AAAA,EAClE,oBAAoB,EAAE,OAAO,UAAU,OAAO,oBAAoB,YAAY,CAAC,WAAW,EAAE;AAAA,EAC5F,QAAQ,EAAE,OAAO,UAAU,OAAO,UAAU,YAAY,CAAC,WAAW,EAAE;AAAA,EACtE,SAAS,EAAE,OAAO,UAAU,OAAO,WAAW,YAAY,CAAC,WAAW,EAAE;AAAA,EACxE,gBAAgB,EAAE,OAAO,iBAAiB,OAAO,SAAS,YAAY,CAAC,WAAW,EAAE;AACtF;AAMA,MAAM,QAAQ,CAAC,YAAmC,cAChD,WAAW,KAAK,CAAC,UAAU,MAAM,SAAS,IAAI,IAAI,UAAU,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,UAAU,SAAS;AAkD3G,MAAM,iBAAiB,CAAC,IAAY,YAA4B,yBAAyB,EAAE,IAAI,OAAO;AAetG,MAAM,gBAAgB,CAAC,OAAe,cAC3C,GAAG,mBAAmB,KAAK,CAAC,IAAI,mBAAmB,SAAS,CAAC;AAaxD,MAAM,UAAU,CAAC,UACtB,SAAS,MAAM,aAAa,IAAI,MAAM,KAAK;AAStC,MAAM,cAAc,CAAC,YAAwD;AAAA,EAClF,GAAG;AAAA,EACH,GAAG,OAAO;AACZ;AASO,MAAM,gBAAgB,CAAC,YAC5B,OAAO,YAAY,YAAY,YAAY,QAAQ,CAAC,MAAM,QAAQ,OAAO,IACrE,UACA;AAiBC,MAAM,UAAU,CACrB,QACA,WACA,OACA,SACA,SACS;AACT,MAAI,MAAM,cAAc,sBAAsB,MAAM,cAAc,gBAAiB;AACnF,aAAW,aAAa,OAAO,KAAK,OAAO,KAAK,GAAG;AACjD,UAAM,WAAW,UAAU,SAAS;AACpC,QAAI,aAAa,OAAW;AAC5B,QAAI,SAAS,eAAe,UAAa,CAAC,MAAM,SAAS,YAAY,MAAM,SAAS,EAAG;AAIvF,QAAI,CAAC,OAAO,OAAO,SAAS,SAAS,KAAK,EAAG;AAC7C,QAAI,QAAQ,SAAS,KAAK,MAAM,SAAS,OAAO;AAC9C,UAAI,CAAC,KAAK,IAAI,SAAS,EAAG,MAAK,IAAI,WAAW,MAAM,WAAW;AAAA,IACjE,OAAO;AACL,WAAK,OAAO,SAAS;AAAA,IACvB;AAAA,EACF;AACF;AAgBO,MAAM,aAAa,CACxB,QACA,OACA,YACwB;AACxB,QAAM,YAAY,YAAY,MAAM;AACpC,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,cAAc,MAAM,OAAO;AAC3C,QAAI,YAAY,OAAW;AAC3B,YAAQ,QAAQ,WAAW,OAAO,SAAS,IAAI;AAAA,EACjD;AACA,SAAO,MAAM,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,OAAO,EAAE,OAAO,WAAW,MAAM,EAAE;AAC/E;AAiBO,MAAM,SAAS,CACpB,QACA,MACA,QAEA,KAAK,QAAQ,CAAC,cAAc;AAC1B,QAAM,OAAO,OAAO,MAAM,UAAU,SAAS;AAC7C,MAAI,SAAS,OAAW,QAAO,CAAC;AAChC,MAAI,MAAM,UAAU,QAAQ,KAAK,QAAS,QAAO,CAAC;AAClD,QAAM,WAAW,KAAK,YAAY,OAAO,UAAU,YAAY;AAC/D,QAAM,QAAQ,KAAK,SAAS,OAAO,UAAU;AAC7C,QAAM,UAAU,KAAK,WAAW,OAAO,UAAU;AACjD,SAAO,CAAC;AAAA,IACN,OAAO,UAAU;AAAA,IACjB,WAAW,UAAU;AAAA,IACrB,OAAO,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,IAKjB,SAAS,UAAU,QAAQ,KAAK;AAAA,IAChC;AAAA,IACA,eAAe,cAAc,UAAU,OAAO,UAAU,SAAS;AAAA,IACjE,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACvC,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,EAC7C,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/cjs/AlertRuntime.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The journal-backed alert runtime: one tick per run.
+ *
+ * A tick folds the run's journal into the conditions it leaves open, decides
+ * which have outlived their delay, admits each one as a coalesced system
+ * event, pages the sink, and journals what the sink did with it. The fold is
+ * retained per run, so a tick costs the entries committed since the previous
+ * one rather than the run's whole journal.
+ *
+ * The rules it enforces are `./AlertPolicy.ts` and the channel it pages over
+ * is `./AlertSink.ts`; neither knows this module exists.
+ *
+ * @since 1.0.0
+ */
+import { Journal } from "@smthrs/journal";
+import { Context, Effect, Layer } from "effect";
+import { type Alert, Policy } from "./AlertPolicy.ts";
+import { Sink } from "./AlertSink.ts";
+import { type NotificationError, NotificationQueue } from "./NotificationQueue.ts";
+/**
+ * What one tick decided.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Tick {
+    /** Alerts raised and delivered on this tick. */
+    readonly delivered: ReadonlyArray<Alert>;
+    /** Alerts the sink refused on this tick. They are retried on the next one. */
+    readonly failed: ReadonlyArray<Alert>;
+    /**
+     * Alerts the notification queue refused because the run is at capacity. The
+     * sink was not called for them, and they are retried on the next tick.
+     */
+    readonly refused: ReadonlyArray<Alert>;
+    /** Alerts that had already been delivered, and were not delivered again. */
+    readonly suppressed: ReadonlyArray<Alert>;
+}
+/**
+ * The alert runtime: one tick per run.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export interface RuntimeService {
+    /**
+     * Reads one run's journal and pages about whatever has waited too long.
+     *
+     * The two failures stay apart because they mean different things to an
+     * operator. A `JournalError` is the alerter's own record channel failing: it
+     * read no entries, or it could not write the delivery record. A
+     * `NotificationError` is the notification queue rejecting the alert outright,
+     * which is a producer or storage fault rather than a full queue. Neither is
+     * a sink failure: a refused page is journaled as `flows.alerts.failed` and
+     * retried on the next tick, and it comes back in {@link Tick.failed}. A queue
+     * at capacity is not a failure either; it comes back in {@link Tick.refused}.
+     */
+    readonly tick: (runId: string) => Effect.Effect<Tick, Journal.JournalError | NotificationError>;
+}
+declare const AlertRuntime_base: Context.ServiceClass<AlertRuntime, "/notifications/AlertRuntime", RuntimeService>;
+/**
+ * The {@link RuntimeService} tag.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class AlertRuntime extends AlertRuntime_base {
+}
+/**
+ * The alert runtime over one policy.
+ *
+ * A tick reads the run's journal, derives the open conditions, decides which
+ * have outlived their delay, and for each one that has not already been
+ * delivered: admits a coalesced system event, sends it to the sink, and
+ * journals the delivery. The admission comes first because it is idempotent
+ * and the send is not: a crash between them costs a duplicate admission, which
+ * the queue drops, while a crash between an accepted send and the delivery
+ * record costs a duplicate PAGE, which is why {@link SinkService.deliver} is
+ * required to dedupe on {@link alertId}.
+ *
+ * The policy is decoded when the layer is built, so a rule with an impossible
+ * delay fails the composition by name instead of mis-paging at 3am.
+ *
+ * @param policy the rules to enforce
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: (policy: Policy) => Layer.Layer<AlertRuntime, never, Journal.Journal | NotificationQueue | Sink>;
+export {};
+//# sourceMappingURL=AlertRuntime.d.ts.map

package/dist/cjs/AlertRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlertRuntime.d.ts","sourceRoot":"","sources":["../../src/AlertRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAgB,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAS,OAAO,EAAE,MAAM,EAAW,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAC/E,OAAO,EACL,KAAK,KAAK,EAQV,MAAM,EAEP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAGrC,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAElF;;;;;GAKG;AACH,MAAM,WAAW,IAAI;IACnB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,iBAAiB,CAAC,CAAA;CAChG;;AAED;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,iBAEjC;CAAG;AA8CJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,KAAK,GAChB,QAAQ,MAAM,KACb,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAgI3E,CAAA"}

package/dist/cjs/AlertRuntime.js

@@ -0,0 +1,166 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var AlertRuntime_exports = {};
+__export(AlertRuntime_exports, {
+  AlertRuntime: () => AlertRuntime,
+  layer: () => layer
+});
+module.exports = __toCommonJS(AlertRuntime_exports);
+var import_journal = require("@smthrs/journal");
+var import_effect = require("effect");
+var import_AlertPolicy = require("./AlertPolicy.js");
+var import_AlertSink = require("./AlertSink.js");
+var FoldCache = __toESM(require("./internal/foldCache.js"), 1);
+var import_NotificationQueue = require("./NotificationQueue.js");
+class AlertRuntime extends import_effect.Context.Service()(
+  "/notifications/AlertRuntime"
+) {
+}
+const maximumWatchedRuns = 64;
+const alertNotification = (alert) => ({
+  _tag: "system-event",
+  id: (0, import_AlertPolicy.alertId)(alert),
+  targetLineageId: alert.runId,
+  delivery: "queue",
+  coalescingKey: alert.coalescingKey,
+  provenance: {
+    sourceRunId: alert.runId,
+    sourceLineageId: alert.runId,
+    sourceTurn: 0,
+    sourceActor: "alerts"
+  },
+  payload: {
+    condition: alert.condition,
+    severity: alert.severity,
+    since: alert.since,
+    firedAt: alert.firedAt,
+    ...alert.owner === void 0 ? {} : { owner: alert.owner },
+    ...alert.runbook === void 0 ? {} : { runbook: alert.runbook }
+  }
+});
+const layer = (policy) => import_effect.Layer.effect(
+  AlertRuntime,
+  import_effect.Effect.gen(function* () {
+    const checked = yield* import_effect.Effect.orDie(import_effect.Schema.decodeUnknownEffect(import_AlertPolicy.Policy)(policy));
+    const detectors = (0, import_AlertPolicy.detectorsOf)(checked);
+    const journal = yield* import_journal.Journal.Journal;
+    const queue = yield* import_NotificationQueue.NotificationQueue;
+    const sink = yield* import_AlertSink.Sink;
+    const watched = FoldCache.make(maximumWatchedRuns);
+    const observed = (runId) => import_effect.Effect.gen(function* () {
+      const base = watched.get(runId) ?? { open: /* @__PURE__ */ new Map(), delivered: import_effect.HashSet.empty(), cursor: void 0 };
+      const fresh = [];
+      let after = base.cursor === void 0 ? void 0 : import_journal.JournalEvent.Seq.make(base.cursor);
+      while (true) {
+        const page = yield* journal.entries({ runId, ...after === void 0 ? {} : { after }, limit: 512 });
+        fresh.push(...page.entries);
+        if (!page.hasMore || page.entries.length === 0) break;
+        after = page.entries.at(-1).seq;
+      }
+      if (fresh.length === 0) return base;
+      const open = new Map(base.open);
+      let delivered = base.delivered;
+      let cursor = base.cursor;
+      for (const entry of fresh) {
+        cursor = entry.seq;
+        const payload = (0, import_AlertPolicy.payloadRecord)(entry.payload);
+        if (payload === void 0) continue;
+        if (entry.eventType === import_AlertPolicy.deliveredEventType) {
+          const id = payload["alertId"];
+          if (typeof id === "string" && entry.sourceId === (0, import_AlertPolicy.recordSourceId)(id, "delivered")) {
+            delivered = import_effect.HashSet.add(delivered, id);
+          }
+        }
+        (0, import_AlertPolicy.observe)(checked, detectors, entry, payload, open);
+      }
+      const next = { open, delivered, cursor };
+      yield* journal.whenCommitted(import_effect.Effect.sync(() => watched.put(runId, next)));
+      return next;
+    });
+    const record = (eventType, alert, source, outcome) => journal.emitDurableUnfenced(
+      new import_journal.JournalEvent.Input({
+        runId: import_journal.JournalEvent.RunId.make(alert.runId),
+        sourceId: import_journal.JournalEvent.SourceId.make((0, import_AlertPolicy.recordSourceId)((0, import_AlertPolicy.alertId)(alert), source)),
+        sourceSeq: import_journal.JournalEvent.SourceSeq.make(0),
+        // One record per alert per outcome. Without an explicit identity
+        // the journal allocates a new sequence on every attempt, and a
+        // webhook that stays down appends a row per tick forever.
+        dedupe: "identity",
+        eventType,
+        payload: {
+          runId: alert.runId,
+          condition: alert.condition,
+          since: alert.since,
+          severity: alert.severity,
+          alertId: (0, import_AlertPolicy.alertId)(alert),
+          ...outcome.code === void 0 ? {} : { code: outcome.code },
+          ...outcome.status === void 0 ? {} : { status: outcome.status }
+        }
+      })
+    ).pipe(import_effect.Effect.asVoid);
+    return AlertRuntime.of({
+      tick: import_effect.Effect.fn("AlertRuntime.tick")(function* (runId) {
+        const journalRunId = import_journal.JournalEvent.RunId.make(runId);
+        const history = yield* observed(journalRunId);
+        const now = yield* import_effect.Clock.currentTimeMillis;
+        const open = Array.from(history.open, ([condition, since]) => ({ runId, condition, since }));
+        const raised = (0, import_AlertPolicy.decide)(checked, open, now);
+        const delivered = [];
+        const failed = [];
+        const refused = [];
+        const suppressed = [];
+        for (const alert of raised) {
+          if (import_effect.HashSet.has(history.delivered, (0, import_AlertPolicy.alertId)(alert))) {
+            suppressed.push(alert);
+            continue;
+          }
+          const receipt = yield* queue.admit(runId, alertNotification(alert));
+          if (receipt.decision === "rejected-full") {
+            yield* record(import_AlertPolicy.failedEventType, alert, "refused", { code: "notification_full" });
+            refused.push(alert);
+            continue;
+          }
+          const outcome = yield* import_effect.Effect.result(sink.deliver(alert));
+          if (import_effect.Result.isFailure(outcome)) {
+            yield* record(import_AlertPolicy.failedEventType, alert, `failed/${outcome.failure.code}`, {
+              code: outcome.failure.code,
+              status: outcome.failure.status
+            });
+            failed.push(alert);
+          } else {
+            yield* record(import_AlertPolicy.deliveredEventType, alert, "delivered", {});
+            delivered.push(alert);
+          }
+        }
+        return { delivered, failed, refused, suppressed };
+      })
+    });
+  })
+);
+//# sourceMappingURL=AlertRuntime.js.map

package/dist/cjs/AlertRuntime.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/AlertRuntime.ts"],
+  "sourcesContent": ["/**\n * The journal-backed alert runtime: one tick per run.\n *\n * A tick folds the run's journal into the conditions it leaves open, decides\n * which have outlived their delay, admits each one as a coalesced system\n * event, pages the sink, and journals what the sink did with it. The fold is\n * retained per run, so a tick costs the entries committed since the previous\n * one rather than the run's whole journal.\n *\n * The rules it enforces are `./AlertPolicy.ts` and the channel it pages over\n * is `./AlertSink.ts`; neither knows this module exists.\n *\n * @since 1.0.0\n */\n\nimport { Journal, JournalEvent } from \"@smthrs/journal\"\nimport { Clock, Context, Effect, HashSet, Layer, Result, Schema } from \"effect\"\nimport {\n  type Alert,\n  alertId,\n  decide,\n  deliveredEventType,\n  detectorsOf,\n  failedEventType,\n  observe,\n  payloadRecord,\n  Policy,\n  recordSourceId\n} from \"./AlertPolicy.ts\"\nimport { Sink } from \"./AlertSink.ts\"\nimport * as FoldCache from \"./internal/foldCache.ts\"\nimport type * as NotificationModel from \"./Notification.ts\"\nimport { type NotificationError, NotificationQueue } from \"./NotificationQueue.ts\"\n\n/**\n * What one tick decided.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Tick {\n  /** Alerts raised and delivered on this tick. */\n  readonly delivered: ReadonlyArray<Alert>\n  /** Alerts the sink refused on this tick. They are retried on the next one. */\n  readonly failed: ReadonlyArray<Alert>\n  /**\n   * Alerts the notification queue refused because the run is at capacity. The\n   * sink was not called for them, and they are retried on the next tick.\n   */\n  readonly refused: ReadonlyArray<Alert>\n  /** Alerts that had already been delivered, and were not delivered again. */\n  readonly suppressed: ReadonlyArray<Alert>\n}\n\n/**\n * The alert runtime: one tick per run.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface RuntimeService {\n  /**\n   * Reads one run's journal and pages about whatever has waited too long.\n   *\n   * The two failures stay apart because they mean different things to an\n   * operator. A `JournalError` is the alerter's own record channel failing: it\n   * read no entries, or it could not write the delivery record. A\n   * `NotificationError` is the notification queue rejecting the alert outright,\n   * which is a producer or storage fault rather than a full queue. Neither is\n   * a sink failure: a refused page is journaled as `flows.alerts.failed` and\n   * retried on the next tick, and it comes back in {@link Tick.failed}. A queue\n   * at capacity is not a failure either; it comes back in {@link Tick.refused}.\n   */\n  readonly tick: (runId: string) => Effect.Effect<Tick, Journal.JournalError | NotificationError>\n}\n\n/**\n * The {@link RuntimeService} tag.\n *\n * @category services\n * @since 0.1.0\n */\nexport class AlertRuntime extends Context.Service<AlertRuntime, RuntimeService>()(\n  \"/notifications/AlertRuntime\"\n) {}\n\n/**\n * One run's folded alert history: the conditions still open, the alerts\n * already paged, and the sequence the fold stopped at.\n */\ninterface Watched {\n  readonly open: ReadonlyMap<string, number>\n  /**\n   * The alerts already paged, as a persistent set: a tick adds a node and\n   * leaves the fold the previous tick published untouched, where copying the\n   * set would cost the run's whole delivery history on every tick.\n   */\n  readonly delivered: HashSet.HashSet<string>\n  readonly cursor: number | undefined\n}\n\n/**\n * How many runs one alert runtime keeps folded at a time. The retention policy\n * is scan-resistant, so a sweep of more runs than this reads journal tails for\n * all but a fixed handful of them.\n */\nconst maximumWatchedRuns = 64\n\nconst alertNotification = (alert: Alert): NotificationModel.Notification => ({\n  _tag: \"system-event\",\n  id: alertId(alert),\n  targetLineageId: alert.runId,\n  delivery: \"queue\",\n  coalescingKey: alert.coalescingKey,\n  provenance: {\n    sourceRunId: alert.runId,\n    sourceLineageId: alert.runId,\n    sourceTurn: 0,\n    sourceActor: \"alerts\"\n  },\n  payload: {\n    condition: alert.condition,\n    severity: alert.severity,\n    since: alert.since,\n    firedAt: alert.firedAt,\n    ...(alert.owner === undefined ? {} : { owner: alert.owner }),\n    ...(alert.runbook === undefined ? {} : { runbook: alert.runbook })\n  }\n})\n\n/**\n * The alert runtime over one policy.\n *\n * A tick reads the run's journal, derives the open conditions, decides which\n * have outlived their delay, and for each one that has not already been\n * delivered: admits a coalesced system event, sends it to the sink, and\n * journals the delivery. The admission comes first because it is idempotent\n * and the send is not: a crash between them costs a duplicate admission, which\n * the queue drops, while a crash between an accepted send and the delivery\n * record costs a duplicate PAGE, which is why {@link SinkService.deliver} is\n * required to dedupe on {@link alertId}.\n *\n * The policy is decoded when the layer is built, so a rule with an impossible\n * delay fails the composition by name instead of mis-paging at 3am.\n *\n * @param policy the rules to enforce\n * @category layers\n * @since 0.1.0\n */\nexport const layer = (\n  policy: Policy\n): Layer.Layer<AlertRuntime, never, Journal.Journal | NotificationQueue | Sink> =>\n  Layer.effect(\n    AlertRuntime,\n    Effect.gen(function*() {\n      const checked = yield* Effect.orDie(Schema.decodeUnknownEffect(Policy)(policy))\n      const detectors = detectorsOf(checked)\n      const journal = yield* Journal.Journal\n      const queue = yield* NotificationQueue\n      const sink = yield* Sink\n      // Folded history per run, so a tick costs the entries committed since\n      // the previous one rather than the run's whole journal.\n      const watched = FoldCache.make<Watched>(maximumWatchedRuns)\n\n      const observed = (runId: JournalEvent.RunId): Effect.Effect<Watched, Journal.JournalError> =>\n        Effect.gen(function*() {\n          const base: Watched = watched.get(runId) ??\n            { open: new Map(), delivered: HashSet.empty(), cursor: undefined }\n          const fresh: Array<JournalEvent.Entry> = []\n          let after = base.cursor === undefined ? undefined : JournalEvent.Seq.make(base.cursor)\n          while (true) {\n            const page = yield* journal.entries({ runId, ...(after === undefined ? {} : { after }), limit: 512 })\n            fresh.push(...page.entries)\n            if (!page.hasMore || page.entries.length === 0) break\n            after = page.entries.at(-1)!.seq\n          }\n          if (fresh.length === 0) return base\n\n          // `open` is bounded by the policy's rules, so it is copied; the\n          // delivery history is not, so it grows by one persistent node.\n          const open = new Map(base.open)\n          let delivered = base.delivered\n          let cursor = base.cursor\n          for (const entry of fresh) {\n            cursor = entry.seq\n            const payload = payloadRecord(entry.payload)\n            if (payload === undefined) continue\n            if (entry.eventType === deliveredEventType) {\n              const id = payload[\"alertId\"]\n              // Only a record under the source the alerter writes counts, so\n              // another producer's delivered record cannot suppress a page.\n              // The journal does not bind a source to a writer.\n              if (typeof id === \"string\" && entry.sourceId === recordSourceId(id, \"delivered\")) {\n                delivered = HashSet.add(delivered, id)\n              }\n            }\n            observe(checked, detectors, entry, payload, open)\n          }\n          const next: Watched = { open, delivered, cursor }\n          // Published at commit, exactly as `NotificationQueue.load` publishes\n          // its fold. A tick inside an enclosing transaction reads that\n          // transaction's uncommitted rows, and caching them would outlive the\n          // rollback that erased them: the run would page about a condition\n          // durable history never held.\n          yield* journal.whenCommitted(Effect.sync(() => watched.put(runId, next)))\n          return next\n        })\n\n      const record = (\n        eventType: string,\n        alert: Alert,\n        source: string,\n        outcome: { readonly code?: string | undefined; readonly status?: number | undefined }\n      ): Effect.Effect<void, Journal.JournalError> =>\n        journal.emitDurableUnfenced(\n          new JournalEvent.Input({\n            runId: JournalEvent.RunId.make(alert.runId),\n            sourceId: JournalEvent.SourceId.make(recordSourceId(alertId(alert), source)),\n            sourceSeq: JournalEvent.SourceSeq.make(0),\n            // One record per alert per outcome. Without an explicit identity\n            // the journal allocates a new sequence on every attempt, and a\n            // webhook that stays down appends a row per tick forever.\n            dedupe: \"identity\",\n            eventType,\n            payload: {\n              runId: alert.runId,\n              condition: alert.condition,\n              since: alert.since,\n              severity: alert.severity,\n              alertId: alertId(alert),\n              ...(outcome.code === undefined ? {} : { code: outcome.code }),\n              ...(outcome.status === undefined ? {} : { status: outcome.status })\n            }\n          })\n        ).pipe(Effect.asVoid)\n\n      return AlertRuntime.of({\n        tick: Effect.fn(\"AlertRuntime.tick\")(function*(runId: string) {\n          const journalRunId = JournalEvent.RunId.make(runId)\n          const history = yield* observed(journalRunId)\n          const now = yield* Clock.currentTimeMillis\n          const open = Array.from(history.open, ([condition, since]) => ({ runId, condition, since }))\n          const raised = decide(checked, open, now)\n          const delivered: Array<Alert> = []\n          const failed: Array<Alert> = []\n          const refused: Array<Alert> = []\n          const suppressed: Array<Alert> = []\n          for (const alert of raised) {\n            if (HashSet.has(history.delivered, alertId(alert))) {\n              suppressed.push(alert)\n              continue\n            }\n            // Raised unchanged: a queue that rejects the admission outright is\n            // not the journal failing, and calling it `sink_failed` would send\n            // an operator looking at the webhook.\n            const receipt = yield* queue.admit(runId, alertNotification(alert))\n            if (receipt.decision === \"rejected-full\") {\n              // The alert has nowhere durable to sit, so paging about it would\n              // tell an operator about something the run will never read.\n              yield* record(failedEventType, alert, \"refused\", { code: \"notification_full\" })\n              refused.push(alert)\n              continue\n            }\n            const outcome = yield* Effect.result(sink.deliver(alert))\n            if (Result.isFailure(outcome)) {\n              yield* record(failedEventType, alert, `failed/${outcome.failure.code}`, {\n                code: outcome.failure.code,\n                status: outcome.failure.status\n              })\n              failed.push(alert)\n            } else {\n              yield* record(deliveredEventType, alert, \"delivered\", {})\n              delivered.push(alert)\n            }\n          }\n          return { delivered, failed, refused, suppressed }\n        })\n      })\n    })\n  )\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,qBAAsC;AACtC,oBAAuE;AACvE,yBAWO;AACP,uBAAqB;AACrB,gBAA2B;AAE3B,+BAA0D;AAkDnD,MAAM,qBAAqB,sBAAQ,QAAsC;AAAA,EAC9E;AACF,EAAE;AAAC;AAsBH,MAAM,qBAAqB;AAE3B,MAAM,oBAAoB,CAAC,WAAkD;AAAA,EAC3E,MAAM;AAAA,EACN,QAAI,4BAAQ,KAAK;AAAA,EACjB,iBAAiB,MAAM;AAAA,EACvB,UAAU;AAAA,EACV,eAAe,MAAM;AAAA,EACrB,YAAY;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,EACf;AAAA,EACA,SAAS;AAAA,IACP,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,IAC1D,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,EAClE;AACF;AAqBO,MAAM,QAAQ,CACnB,WAEA,oBAAM;AAAA,EACJ;AAAA,EACA,qBAAO,IAAI,aAAY;AACrB,UAAM,UAAU,OAAO,qBAAO,MAAM,qBAAO,oBAAoB,yBAAM,EAAE,MAAM,CAAC;AAC9E,UAAM,gBAAY,gCAAY,OAAO;AACrC,UAAM,UAAU,OAAO,uBAAQ;AAC/B,UAAM,QAAQ,OAAO;AACrB,UAAM,OAAO,OAAO;AAGpB,UAAM,UAAU,UAAU,KAAc,kBAAkB;AAE1D,UAAM,WAAW,CAAC,UAChB,qBAAO,IAAI,aAAY;AACrB,YAAM,OAAgB,QAAQ,IAAI,KAAK,KACrC,EAAE,MAAM,oBAAI,IAAI,GAAG,WAAW,sBAAQ,MAAM,GAAG,QAAQ,OAAU;AACnE,YAAM,QAAmC,CAAC;AAC1C,UAAI,QAAQ,KAAK,WAAW,SAAY,SAAY,4BAAa,IAAI,KAAK,KAAK,MAAM;AACrF,aAAO,MAAM;AACX,cAAM,OAAO,OAAO,QAAQ,QAAQ,EAAE,OAAO,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM,GAAI,OAAO,IAAI,CAAC;AACpG,cAAM,KAAK,GAAG,KAAK,OAAO;AAC1B,YAAI,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,EAAG;AAChD,gBAAQ,KAAK,QAAQ,GAAG,EAAE,EAAG;AAAA,MAC/B;AACA,UAAI,MAAM,WAAW,EAAG,QAAO;AAI/B,YAAM,OAAO,IAAI,IAAI,KAAK,IAAI;AAC9B,UAAI,YAAY,KAAK;AACrB,UAAI,SAAS,KAAK;AAClB,iBAAW,SAAS,OAAO;AACzB,iBAAS,MAAM;AACf,cAAM,cAAU,kCAAc,MAAM,OAAO;AAC3C,YAAI,YAAY,OAAW;AAC3B,YAAI,MAAM,cAAc,uCAAoB;AAC1C,gBAAM,KAAK,QAAQ,SAAS;AAI5B,cAAI,OAAO,OAAO,YAAY,MAAM,iBAAa,mCAAe,IAAI,WAAW,GAAG;AAChF,wBAAY,sBAAQ,IAAI,WAAW,EAAE;AAAA,UACvC;AAAA,QACF;AACA,wCAAQ,SAAS,WAAW,OAAO,SAAS,IAAI;AAAA,MAClD;AACA,YAAM,OAAgB,EAAE,MAAM,WAAW,OAAO;AAMhD,aAAO,QAAQ,cAAc,qBAAO,KAAK,MAAM,QAAQ,IAAI,OAAO,IAAI,CAAC,CAAC;AACxE,aAAO;AAAA,IACT,CAAC;AAEH,UAAM,SAAS,CACb,WACA,OACA,QACA,YAEA,QAAQ;AAAA,MACN,IAAI,4BAAa,MAAM;AAAA,QACrB,OAAO,4BAAa,MAAM,KAAK,MAAM,KAAK;AAAA,QAC1C,UAAU,4BAAa,SAAS,SAAK,uCAAe,4BAAQ,KAAK,GAAG,MAAM,CAAC;AAAA,QAC3E,WAAW,4BAAa,UAAU,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA,QAIxC,QAAQ;AAAA,QACR;AAAA,QACA,SAAS;AAAA,UACP,OAAO,MAAM;AAAA,UACb,WAAW,MAAM;AAAA,UACjB,OAAO,MAAM;AAAA,UACb,UAAU,MAAM;AAAA,UAChB,aAAS,4BAAQ,KAAK;AAAA,UACtB,GAAI,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;AAAA,UAC3D,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,QACnE;AAAA,MACF,CAAC;AAAA,IACH,EAAE,KAAK,qBAAO,MAAM;AAEtB,WAAO,aAAa,GAAG;AAAA,MACrB,MAAM,qBAAO,GAAG,mBAAmB,EAAE,WAAU,OAAe;AAC5D,cAAM,eAAe,4BAAa,MAAM,KAAK,KAAK;AAClD,cAAM,UAAU,OAAO,SAAS,YAAY;AAC5C,cAAM,MAAM,OAAO,oBAAM;AACzB,cAAM,OAAO,MAAM,KAAK,QAAQ,MAAM,CAAC,CAAC,WAAW,KAAK,OAAO,EAAE,OAAO,WAAW,MAAM,EAAE;AAC3F,cAAM,aAAS,2BAAO,SAAS,MAAM,GAAG;AACxC,cAAM,YAA0B,CAAC;AACjC,cAAM,SAAuB,CAAC;AAC9B,cAAM,UAAwB,CAAC;AAC/B,cAAM,aAA2B,CAAC;AAClC,mBAAW,SAAS,QAAQ;AAC1B,cAAI,sBAAQ,IAAI,QAAQ,eAAW,4BAAQ,KAAK,CAAC,GAAG;AAClD,uBAAW,KAAK,KAAK;AACrB;AAAA,UACF;AAIA,gBAAM,UAAU,OAAO,MAAM,MAAM,OAAO,kBAAkB,KAAK,CAAC;AAClE,cAAI,QAAQ,aAAa,iBAAiB;AAGxC,mBAAO,OAAO,oCAAiB,OAAO,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC9E,oBAAQ,KAAK,KAAK;AAClB;AAAA,UACF;AACA,gBAAM,UAAU,OAAO,qBAAO,OAAO,KAAK,QAAQ,KAAK,CAAC;AACxD,cAAI,qBAAO,UAAU,OAAO,GAAG;AAC7B,mBAAO,OAAO,oCAAiB,OAAO,UAAU,QAAQ,QAAQ,IAAI,IAAI;AAAA,cACtE,MAAM,QAAQ,QAAQ;AAAA,cACtB,QAAQ,QAAQ,QAAQ;AAAA,YAC1B,CAAC;AACD,mBAAO,KAAK,KAAK;AAAA,UACnB,OAAO;AACL,mBAAO,OAAO,uCAAoB,OAAO,aAAa,CAAC,CAAC;AACxD,sBAAU,KAAK,KAAK;AAAA,UACtB;AAAA,QACF;AACA,eAAO,EAAE,WAAW,QAAQ,SAAS,WAAW;AAAA,MAClD,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;",
+  "names": []
+}

package/dist/cjs/AlertSink.d.ts

@@ -0,0 +1,101 @@
+/**
+ * The alert sink port: where a raised alert is sent, and why a send failed.
+ *
+ * The port is a tag and an error so a deployment supplies the transport and
+ * the policy needs none. `./layerWebhook.ts` is the transport this package
+ * ships, and {@link layerNoop} is the one a test composes.
+ *
+ * @since 1.0.0
+ */
+import { Context, Effect, Layer, Schema } from "effect";
+import type { Alert } from "./AlertPolicy.ts";
+/**
+ * Why a sink did not take an alert.
+ *
+ * `sink_rejected` is an answer that refused the page, `sink_unreachable` a
+ * request that never got one, and `sink_timeout` one that got no answer inside
+ * the sink's bound. `sink_misconfigured` is an endpoint the sink may not POST
+ * to at all; it is raised when the layer is built, before any alert exists,
+ * so it never reaches a journal.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export declare const FailureCode: Schema.Literals<readonly ["sink_rejected", "sink_unreachable", "sink_timeout", "sink_misconfigured"]>;
+/**
+ * Why a sink did not take an alert.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export type FailureCode = typeof FailureCode.Type;
+declare const AlertError_base: Schema.Class<AlertError, Schema.TaggedStruct<"/notifications/AlertError", {
+    readonly code: Schema.withConstructorDefault<Schema.Literals<readonly ["sink_rejected", "sink_unreachable", "sink_timeout", "sink_misconfigured"]>>;
+    readonly message: Schema.String;
+    /** The HTTP status that refused the page, when the sink speaks HTTP. */
+    readonly status: Schema.optional<Schema.Int>;
+    /** A short, credential-free description of the transport failure. */
+    readonly reason: Schema.optional<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A sink refused or could not take an alert.
+ *
+ * The error carries a code, the answering status when there was one, and a
+ * short reason. It deliberately holds no request: a webhook request carries
+ * the credential the deployment handed {@link layerWebhook}, and an error is
+ * logged, encoded, and journaled in places a credential must never reach.
+ *
+ * @category errors
+ * @since 0.1.0
+ */
+export declare class AlertError extends AlertError_base {
+}
+/**
+ * Where a raised alert is sent.
+ *
+ * Injected rather than fixed, because who gets paged is a deployment's
+ * decision and the policy is not: the same rules feed a webhook in production
+ * and nothing at all in a test.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export interface SinkService {
+    /**
+     * Sends one alert, and does so idempotently on {@link alertId}.
+     *
+     * Delivery is at-least-once: the `flows.alerts.delivered` record is written
+     * after this effect succeeds, so a process that dies in between pages again
+     * on the next tick. Every field of the alert, {@link Alert.firedAt}
+     * included, is derived from the journal, so the same alert is byte-identical
+     * on every attempt and `alertId(alert)` is the deduplication key a receiving
+     * system should key on. A sink that cannot dedupe is a sink that will
+     * occasionally page twice about one condition.
+     *
+     * A failure means the page did not go out. Succeeding on a page that was
+     * dropped is the one thing this port must never do.
+     */
+    readonly deliver: (alert: Alert) => Effect.Effect<void, AlertError>;
+}
+declare const Sink_base: Context.ServiceClass<Sink, "/notifications/AlertSink", SinkService>;
+/**
+ * The {@link SinkService} tag.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class Sink extends Sink_base {
+}
+/**
+ * A sink that accepts every alert and sends it nowhere.
+ *
+ * The admission and the delivery record still happen, so a composition without
+ * an outbound channel still has the durable evidence of what it would have
+ * paged about.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerNoop: Layer.Layer<Sink>;
+export {};
+//# sourceMappingURL=AlertSink.d.ts.map

package/dist/cjs/AlertSink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlertSink.d.ts","sourceRoot":"","sources":["../../src/AlertSink.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,uGAA+F,CAAA;AAEvH;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;;;;IAkB7C,wEAAwE;;IAExE,qEAAqE;;;AAlBzE;;;;;;;;;;GAUG;AACH,qBAAa,UAAW,SAAQ,eAU/B;CAAG;AAEJ;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;CACpE;;AAED;;;;;GAKG;AACH,qBAAa,IAAK,SAAQ,SAAgE;CAAG;AAE7F;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAuD,CAAA"}

package/dist/cjs/AlertSink.js

@@ -0,0 +1,44 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var AlertSink_exports = {};
+__export(AlertSink_exports, {
+  AlertError: () => AlertError,
+  FailureCode: () => FailureCode,
+  Sink: () => Sink,
+  layerNoop: () => layerNoop
+});
+module.exports = __toCommonJS(AlertSink_exports);
+var import_effect = require("effect");
+const FailureCode = import_effect.Schema.Literals(["sink_rejected", "sink_unreachable", "sink_timeout", "sink_misconfigured"]);
+class AlertError extends import_effect.Schema.TaggedError()(
+  "/notifications/AlertError",
+  {
+    code: FailureCode.pipe(import_effect.Schema.withConstructorDefault(import_effect.Effect.succeed("sink_rejected"))),
+    message: import_effect.Schema.String,
+    /** The HTTP status that refused the page, when the sink speaks HTTP. */
+    status: import_effect.Schema.optional(import_effect.Schema.Int),
+    /** A short, credential-free description of the transport failure. */
+    reason: import_effect.Schema.optional(import_effect.Schema.String)
+  }
+) {
+}
+class Sink extends import_effect.Context.Service()("/notifications/AlertSink") {
+}
+const layerNoop = import_effect.Layer.succeed(Sink)({ deliver: () => import_effect.Effect.void });
+//# sourceMappingURL=AlertSink.js.map

package/dist/cjs/AlertSink.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/AlertSink.ts"],
+  "sourcesContent": ["/**\n * The alert sink port: where a raised alert is sent, and why a send failed.\n *\n * The port is a tag and an error so a deployment supplies the transport and\n * the policy needs none. `./layerWebhook.ts` is the transport this package\n * ships, and {@link layerNoop} is the one a test composes.\n *\n * @since 1.0.0\n */\n\nimport { Context, Effect, Layer, Schema } from \"effect\"\nimport type { Alert } from \"./AlertPolicy.ts\"\n\n/**\n * Why a sink did not take an alert.\n *\n * `sink_rejected` is an answer that refused the page, `sink_unreachable` a\n * request that never got one, and `sink_timeout` one that got no answer inside\n * the sink's bound. `sink_misconfigured` is an endpoint the sink may not POST\n * to at all; it is raised when the layer is built, before any alert exists,\n * so it never reaches a journal.\n *\n * @category models\n * @since 1.0.0\n */\nexport const FailureCode = Schema.Literals([\"sink_rejected\", \"sink_unreachable\", \"sink_timeout\", \"sink_misconfigured\"])\n\n/**\n * Why a sink did not take an alert.\n *\n * @category models\n * @since 1.0.0\n */\nexport type FailureCode = typeof FailureCode.Type\n\n/**\n * A sink refused or could not take an alert.\n *\n * The error carries a code, the answering status when there was one, and a\n * short reason. It deliberately holds no request: a webhook request carries\n * the credential the deployment handed {@link layerWebhook}, and an error is\n * logged, encoded, and journaled in places a credential must never reach.\n *\n * @category errors\n * @since 0.1.0\n */\nexport class AlertError extends Schema.TaggedError<AlertError>()(\n  \"/notifications/AlertError\",\n  {\n    code: FailureCode.pipe(Schema.withConstructorDefault(Effect.succeed(\"sink_rejected\" as const))),\n    message: Schema.String,\n    /** The HTTP status that refused the page, when the sink speaks HTTP. */\n    status: Schema.optional(Schema.Int),\n    /** A short, credential-free description of the transport failure. */\n    reason: Schema.optional(Schema.String)\n  }\n) {}\n\n/**\n * Where a raised alert is sent.\n *\n * Injected rather than fixed, because who gets paged is a deployment's\n * decision and the policy is not: the same rules feed a webhook in production\n * and nothing at all in a test.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface SinkService {\n  /**\n   * Sends one alert, and does so idempotently on {@link alertId}.\n   *\n   * Delivery is at-least-once: the `flows.alerts.delivered` record is written\n   * after this effect succeeds, so a process that dies in between pages again\n   * on the next tick. Every field of the alert, {@link Alert.firedAt}\n   * included, is derived from the journal, so the same alert is byte-identical\n   * on every attempt and `alertId(alert)` is the deduplication key a receiving\n   * system should key on. A sink that cannot dedupe is a sink that will\n   * occasionally page twice about one condition.\n   *\n   * A failure means the page did not go out. Succeeding on a page that was\n   * dropped is the one thing this port must never do.\n   */\n  readonly deliver: (alert: Alert) => Effect.Effect<void, AlertError>\n}\n\n/**\n * The {@link SinkService} tag.\n *\n * @category services\n * @since 0.1.0\n */\nexport class Sink extends Context.Service<Sink, SinkService>()(\"/notifications/AlertSink\") {}\n\n/**\n * A sink that accepts every alert and sends it nowhere.\n *\n * The admission and the delivery record still happen, so a composition without\n * an outbound channel still has the durable evidence of what it would have\n * paged about.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoop: Layer.Layer<Sink> = Layer.succeed(Sink)({ deliver: () => Effect.void })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,oBAA+C;AAexC,MAAM,cAAc,qBAAO,SAAS,CAAC,iBAAiB,oBAAoB,gBAAgB,oBAAoB,CAAC;AAqB/G,MAAM,mBAAmB,qBAAO,YAAwB;AAAA,EAC7D;AAAA,EACA;AAAA,IACE,MAAM,YAAY,KAAK,qBAAO,uBAAuB,qBAAO,QAAQ,eAAwB,CAAC,CAAC;AAAA,IAC9F,SAAS,qBAAO;AAAA;AAAA,IAEhB,QAAQ,qBAAO,SAAS,qBAAO,GAAG;AAAA;AAAA,IAElC,QAAQ,qBAAO,SAAS,qBAAO,MAAM;AAAA,EACvC;AACF,EAAE;AAAC;AAoCI,MAAM,aAAa,sBAAQ,QAA2B,EAAE,0BAA0B,EAAE;AAAC;AAYrF,MAAM,YAA+B,oBAAM,QAAQ,IAAI,EAAE,EAAE,SAAS,MAAM,qBAAO,KAAK,CAAC;",
+  "names": []
+}

package/dist/cjs/Alerts.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Alert policy: run conditions that have lasted too long, turned into durable,
+ * coalesced, delivered-once notifications.
+ *
+ * A notification queue answers "tell this run something". An alert answers the
+ * question nobody is around to ask: a run has been waiting for an approval for
+ * an hour, and the person who could grant it does not know. The two are the
+ * same machinery, since an alert is admitted as a coalesced system event, and
+ * they differ only in who decides to write one.
+ *
+ * ## Journal time, not wall time
+ *
+ * A condition's clock starts at the journal entry that opened it, which makes
+ * the decision replayable: the same journal produces the same alerts, whatever
+ * process reads it and whenever. A restart re-derives every open condition
+ * from the entries rather than from a timer it lost.
+ *
+ * ## Delivered at least once
+ *
+ * The admission is idempotent on the notification id, so re-admitting the same
+ * alert writes nothing new, and `flows.alerts.delivered` is journaled AFTER
+ * the sink accepted the page and is checked before the sink is called again.
+ * That ordering is deliberate and it is the reason the guarantee is
+ * at-least-once rather than exactly-once: a process that dies between the
+ * accepted send and the delivery record has paged, left no evidence of it, and
+ * will page again on the next tick. Recording the delivery first turns the
+ * same crash into a page nobody ever receives, which for an alert is the worse
+ * failure.
+ *
+ * So the sink owns the last mile: {@link SinkService.deliver} MUST be
+ * idempotent on {@link alertId}, which is stable for the life of one condition
+ * and reaches the sink on every alert it is handed. A sink that fails journals
+ * `flows.alerts.failed` once per failure code and the alert is retried on the
+ * next tick, because a refused page is not a delivered page.
+ *
+ * ## What a refusal costs
+ *
+ * The queue can refuse the admission when a run already holds its capacity of
+ * pending notifications. A tick that is refused pages nobody: the alert comes
+ * back in {@link Tick.refused}, the refusal is journaled, and the next tick
+ * tries again once a boundary has drained. Calling the sink anyway would page
+ * about an alert the run will never see.
+ *
+ * ## Conditions are data
+ *
+ * A condition is a payload field with a value: `status` is `waiting-approval`,
+ * `health` is `stalled`. Those are the fields control-plane entries and monitor
+ * beats already carry, so a deployment that journals a different vocabulary
+ * supplies its own detectors instead of a fork of this module.
+ *
+ * @since 0.1.0
+ */
+export { type Alert, alertId, coalescingKey, conditions, decide, defaultDetectors, deliveredEventType, Detector, failedEventType, type Open, Policy, Rule, Severity } from "./AlertPolicy.ts";
+export { AlertRuntime, layer, type RuntimeService, type Tick } from "./AlertRuntime.ts";
+export { AlertError, FailureCode, layerNoop, Sink, type SinkService } from "./AlertSink.ts";
+export { defaultWebhookTimeout, layerWebhook } from "./layerWebhook.ts";
+//# sourceMappingURL=Alerts.d.ts.map

package/dist/cjs/Alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Alerts.d.ts","sourceRoot":"","sources":["../../src/Alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EACL,KAAK,KAAK,EACV,OAAO,EACP,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,KAAK,IAAI,EACT,MAAM,EACN,IAAI,EACJ,QAAQ,EACT,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,cAAc,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC3F,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/cjs/Alerts.js

@@ -0,0 +1,46 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Alerts_exports = {};
+__export(Alerts_exports, {
+  AlertError: () => import_AlertSink.AlertError,
+  AlertRuntime: () => import_AlertRuntime.AlertRuntime,
+  Detector: () => import_AlertPolicy.Detector,
+  FailureCode: () => import_AlertSink.FailureCode,
+  Policy: () => import_AlertPolicy.Policy,
+  Rule: () => import_AlertPolicy.Rule,
+  Severity: () => import_AlertPolicy.Severity,
+  Sink: () => import_AlertSink.Sink,
+  alertId: () => import_AlertPolicy.alertId,
+  coalescingKey: () => import_AlertPolicy.coalescingKey,
+  conditions: () => import_AlertPolicy.conditions,
+  decide: () => import_AlertPolicy.decide,
+  defaultDetectors: () => import_AlertPolicy.defaultDetectors,
+  defaultWebhookTimeout: () => import_layerWebhook.defaultWebhookTimeout,
+  deliveredEventType: () => import_AlertPolicy.deliveredEventType,
+  failedEventType: () => import_AlertPolicy.failedEventType,
+  layer: () => import_AlertRuntime.layer,
+  layerNoop: () => import_AlertSink.layerNoop,
+  layerWebhook: () => import_layerWebhook.layerWebhook
+});
+module.exports = __toCommonJS(Alerts_exports);
+var import_AlertPolicy = require("./AlertPolicy.js");
+var import_AlertRuntime = require("./AlertRuntime.js");
+var import_AlertSink = require("./AlertSink.js");
+var import_layerWebhook = require("./layerWebhook.js");
+//# sourceMappingURL=Alerts.js.map

package/dist/cjs/Alerts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Alerts.ts"],
+  "sourcesContent": ["/**\n * Alert policy: run conditions that have lasted too long, turned into durable,\n * coalesced, delivered-once notifications.\n *\n * A notification queue answers \"tell this run something\". An alert answers the\n * question nobody is around to ask: a run has been waiting for an approval for\n * an hour, and the person who could grant it does not know. The two are the\n * same machinery, since an alert is admitted as a coalesced system event, and\n * they differ only in who decides to write one.\n *\n * ## Journal time, not wall time\n *\n * A condition's clock starts at the journal entry that opened it, which makes\n * the decision replayable: the same journal produces the same alerts, whatever\n * process reads it and whenever. A restart re-derives every open condition\n * from the entries rather than from a timer it lost.\n *\n * ## Delivered at least once\n *\n * The admission is idempotent on the notification id, so re-admitting the same\n * alert writes nothing new, and `flows.alerts.delivered` is journaled AFTER\n * the sink accepted the page and is checked before the sink is called again.\n * That ordering is deliberate and it is the reason the guarantee is\n * at-least-once rather than exactly-once: a process that dies between the\n * accepted send and the delivery record has paged, left no evidence of it, and\n * will page again on the next tick. Recording the delivery first turns the\n * same crash into a page nobody ever receives, which for an alert is the worse\n * failure.\n *\n * So the sink owns the last mile: {@link SinkService.deliver} MUST be\n * idempotent on {@link alertId}, which is stable for the life of one condition\n * and reaches the sink on every alert it is handed. A sink that fails journals\n * `flows.alerts.failed` once per failure code and the alert is retried on the\n * next tick, because a refused page is not a delivered page.\n *\n * ## What a refusal costs\n *\n * The queue can refuse the admission when a run already holds its capacity of\n * pending notifications. A tick that is refused pages nobody: the alert comes\n * back in {@link Tick.refused}, the refusal is journaled, and the next tick\n * tries again once a boundary has drained. Calling the sink anyway would page\n * about an alert the run will never see.\n *\n * ## Conditions are data\n *\n * A condition is a payload field with a value: `status` is `waiting-approval`,\n * `health` is `stalled`. Those are the fields control-plane entries and monitor\n * beats already carry, so a deployment that journals a different vocabulary\n * supplies its own detectors instead of a fork of this module.\n *\n * @since 0.1.0\n */\n\nexport {\n  type Alert,\n  alertId,\n  coalescingKey,\n  conditions,\n  decide,\n  defaultDetectors,\n  deliveredEventType,\n  Detector,\n  failedEventType,\n  type Open,\n  Policy,\n  Rule,\n  Severity\n} from \"./AlertPolicy.ts\"\nexport { AlertRuntime, layer, type RuntimeService, type Tick } from \"./AlertRuntime.ts\"\nexport { AlertError, FailureCode, layerNoop, Sink, type SinkService } from \"./AlertSink.ts\"\nexport { defaultWebhookTimeout, layerWebhook } from \"./layerWebhook.ts\"\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqDA,yBAcO;AACP,0BAAoE;AACpE,uBAA2E;AAC3E,0BAAoD;",
+  "names": []
+}