@smthrs/notifications 0.0.0-stage → 1.0.0-rc.13

package/dist/esm/AlertPolicy.js

@@ -0,0 +1,284 @@
+/**
+ * Alert policy: what a condition is, when a journal leaves one open, and
+ * which open conditions have outlived their delay.
+ *
+ * Everything here is pure and a function of journal time, so the same entries
+ * decide the same alerts in any process at any instant past the delay. The
+ * transport that pages about them is `./layerWebhook.ts` and the journal-backed
+ * tick that drives them is `./AlertRuntime.ts`; `./Alerts.ts` is the module a
+ * consumer imports.
+ *
+ * @since 1.0.0
+ */
+import { Schema } from "effect";
+/**
+ * The journal event type one delivered alert is recorded under.
+ *
+ * @category constants
+ * @since 0.1.0
+ */
+export const deliveredEventType = "flows.alerts.delivered";
+/**
+ * The journal event type one failed delivery attempt is recorded under.
+ *
+ * One entry is written per alert per failure code, never one per tick: a
+ * webhook that stays down for an hour leaves one record, not a hundred and
+ * twenty that every later tick has to read past.
+ *
+ * @category constants
+ * @since 0.1.0
+ */
+export const failedEventType = "flows.alerts.failed";
+/**
+ * How loud an alert is.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const Severity = Schema.Literals(["info", "warning", "critical"]);
+/**
+ * How a condition is recognized in the journal.
+ *
+ * `field` names a payload key, `value` the value that means the condition
+ * holds, and `eventTypes` narrows which entries are consulted at all. An
+ * `eventTypes` item ending in `.*` names a family: `control.*` consults
+ * `control.run.parked` and `control.monitor.beat` alike. An entry that carries
+ * the field with a different value CLOSES the condition, which is what makes a
+ * resume clear an approval alert without a second vocabulary for "cleared".
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const Detector = Schema.Struct({
+    field: Schema.NonEmptyString,
+    value: Schema.NonEmptyString,
+    eventTypes: Schema.optional(Schema.Array(Schema.NonEmptyString))
+});
+/**
+ * What to do about one condition, and after how long.
+ *
+ * `afterMs` is a whole, non-negative number of milliseconds. The bound is the
+ * schema's job because the delay is also arithmetic on journal time: a `NaN`
+ * delay fires on the first tick and stamps a `firedAt` that JSON writes as
+ * `null`, and a negative one fires with a `firedAt` earlier than the condition
+ * it describes.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const Rule = Schema.Struct({
+    afterMs: Schema.Int.pipe(Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+    severity: Schema.optional(Severity),
+    owner: Schema.optional(Schema.String),
+    runbook: Schema.optional(Schema.String)
+});
+/**
+ * The conditions a policy alerts on and the delays it alerts after.
+ *
+ * `defaults` fills in what a rule leaves out, so a policy states the delay per
+ * condition and the ownership once.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const Policy = Schema.Struct({
+    defaults: Schema.optional(Schema.Struct({
+        severity: Schema.optional(Severity),
+        owner: Schema.optional(Schema.String),
+        runbook: Schema.optional(Schema.String)
+    })),
+    rules: Schema.Record(Schema.String, Rule),
+    /** Detectors for conditions this deployment names itself. */
+    detectors: Schema.optional(Schema.Record(Schema.String, Detector))
+});
+/**
+ * The four conditions a control plane journals out of the box.
+ *
+ * `status` rides on every `control.run.*` entry, and `health` on every
+ * `control.monitor.beat`. A deployment whose supervisor journals a park reason
+ * gets `quota-parked` from the same field the run summary reports it under.
+ *
+ * Each consults the `control.*` family only. A run's journal is shared with
+ * flow steps, agent traces, and anything else that writes to the run, and a
+ * `status` or `health` field on one of those entries would otherwise open or
+ * close a condition the control plane never reported.
+ *
+ * @category constants
+ * @since 0.1.0
+ */
+export const defaultDetectors = {
+    "waiting-approval": { field: "status", value: "waiting-approval", eventTypes: ["control.*"] },
+    failed: { field: "status", value: "failed", eventTypes: ["control.*"] },
+    stalled: { field: "health", value: "stalled", eventTypes: ["control.*"] },
+    "quota-parked": { field: "waitingReason", value: "quota", eventTypes: ["control.*"] }
+};
+/**
+ * Whether a detector's `eventTypes` names an entry's event type, exactly or
+ * through a `.*` family.
+ */
+const names = (eventTypes, eventType) => eventTypes.some((named) => named.endsWith(".*") ? eventType.startsWith(named.slice(0, -1)) : named === eventType);
+/**
+ * The journal source the alerter writes one outcome of one alert under.
+ *
+ * A delivery record counts as evidence that an alert went out only under this
+ * source, so another producer's `flows.alerts.delivered` record with a
+ * matching `alertId` does not suppress a page. This scopes records; it does
+ * not authenticate the writer, because the journal does not bind a source to
+ * a writer.
+ *
+ * @param id the alert's {@link alertId}
+ * @param outcome `delivered`, `refused`, or `failed/<code>`
+ * @private
+ * @since 1.0.0
+ */
+export const recordSourceId = (id, outcome) => `/notifications/alerts/${id}/${outcome}`;
+/**
+ * The key an alert coalesces on: one open condition on one run.
+ *
+ * Each component is percent-encoded before it is joined, so a run id or a
+ * condition name containing the separator cannot forge another pair's key and
+ * suppress a page that belongs to somebody else. Both components are values a
+ * deployment chooses, which is why the encoding is not optional.
+ *
+ * @param runId the run the condition is open on
+ * @param condition the condition name the policy uses
+ * @category getters
+ * @since 1.0.0
+ */
+export const coalescingKey = (runId, condition) => `${encodeURIComponent(runId)}:${encodeURIComponent(condition)}`;
+/**
+ * The identity a delivery is recorded under.
+ *
+ * The opening time is part of it on purpose. A condition that clears and
+ * re-opens is a NEW alert, because the second approval wait is not the first
+ * one, and a key without the time would suppress it forever.
+ *
+ * @param alert the alert
+ * @category getters
+ * @since 0.1.0
+ */
+export const alertId = (alert) => `alert:${alert.coalescingKey}:${alert.since}`;
+/**
+ * The detectors one policy decides with: the four this package ships, with
+ * the deployment's own overriding them by name.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export const detectorsOf = (policy) => ({
+    ...defaultDetectors,
+    ...policy.detectors
+});
+/**
+ * One entry's payload when it is a record a detector can read a field off,
+ * and `undefined` for the arrays and primitives that carry no fields at all.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export const payloadRecord = (payload) => typeof payload === "object" && payload !== null && !Array.isArray(payload)
+    ? payload
+    : undefined;
+/**
+ * Folds one entry into the open-condition map. Shared by {@link conditions}
+ * and the runtime's incremental read, so both decide a condition the same
+ * way.
+ *
+ * The alerter's own records are never evidence about a condition. They are
+ * written into the same journal they are read from, and they carry the alert's
+ * own vocabulary: a refusal reports the answering HTTP `status`, which a
+ * detector watching the run's `status` would read as the condition clearing.
+ * A page would then close the condition it paged about and the next tick would
+ * re-open it, so a webhook that answered 503 once would alert forever.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export const observe = (policy, detectors, entry, payload, open) => {
+    if (entry.eventType === deliveredEventType || entry.eventType === failedEventType)
+        return;
+    for (const condition of Object.keys(policy.rules)) {
+        const detector = detectors[condition];
+        if (detector === undefined)
+            continue;
+        if (detector.eventTypes !== undefined && !names(detector.eventTypes, entry.eventType))
+            continue;
+        // Own properties only. `in` walks `Object.prototype`, so a detector named
+        // `toString` or `constructor` would read every record-shaped entry in the
+        // run as evidence and close the condition on all of them.
+        if (!Object.hasOwn(payload, detector.field))
+            continue;
+        if (payload[detector.field] === detector.value) {
+            if (!open.has(condition))
+                open.set(condition, entry.emittedAtMs);
+        }
+        else {
+            open.delete(condition);
+        }
+    }
+};
+/**
+ * Every condition a run's journal leaves open, with the time each opened.
+ *
+ * An entry that carries a detector's field opens the condition when the value
+ * matches and closes it when it does not. Entries the detector does not name
+ * are ignored entirely, so a monitor beat cannot close an approval wait and an
+ * approval cannot close a stall.
+ *
+ * @param policy the policy whose detectors decide what counts
+ * @param runId the run the entries belong to
+ * @param entries the run's journal, oldest first
+ * @category projections
+ * @since 0.1.0
+ */
+export const conditions = (policy, runId, entries) => {
+    const detectors = detectorsOf(policy);
+    const open = new Map();
+    for (const entry of entries) {
+        const payload = payloadRecord(entry.payload);
+        if (payload === undefined)
+            continue;
+        observe(policy, detectors, entry, payload, open);
+    }
+    return Array.from(open, ([condition, since]) => ({ runId, condition, since }));
+};
+/**
+ * The alerts a policy raises for the conditions open at `now`.
+ *
+ * Pure, and a function of journal time: the same journal raises the same
+ * alerts in any process, at any instant past the delay. `now` decides WHETHER
+ * an alert is raised; it never appears in one. A condition that has been open
+ * for less than its rule's delay raises nothing, which is the whole point of
+ * the delay, because most stalls clear themselves.
+ *
+ * @param policy the policy
+ * @param open the conditions the journal left open
+ * @param now the instant to judge them at
+ * @category projections
+ * @since 0.1.0
+ */
+export const decide = (policy, open, now) => open.flatMap((condition) => {
+    const rule = policy.rules[condition.condition];
+    if (rule === undefined)
+        return [];
+    if (now - condition.since < rule.afterMs)
+        return [];
+    const severity = rule.severity ?? policy.defaults?.severity ?? "warning";
+    const owner = rule.owner ?? policy.defaults?.owner;
+    const runbook = rule.runbook ?? policy.defaults?.runbook;
+    return [{
+            runId: condition.runId,
+            condition: condition.condition,
+            since: condition.since,
+            // Derived from the journal, not read off the clock. The alert id is
+            // stable across ticks, and the queue refuses a reused id whose content
+            // changed, so an alert stamped with the reading time would become
+            // permanently undeliverable the moment a tick refused and time moved on.
+            firedAt: condition.since + rule.afterMs,
+            severity,
+            coalescingKey: coalescingKey(condition.runId, condition.condition),
+            ...(owner === undefined ? {} : { owner }),
+            ...(runbook === undefined ? {} : { runbook })
+        }];
+});
+//# sourceMappingURL=AlertPolicy.js.map

package/dist/esm/AlertPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlertPolicy.js","sourceRoot":"","sources":["../../src/AlertPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAA;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;AAUxE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC,cAAc;IAC5B,KAAK,EAAE,MAAM,CAAC,cAAc;IAC5B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;CACjE,CAAC,CAAA;AAUF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACxC,CAAC,CAAA;AAUF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;KACxC,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IACzC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACnE,CAAC,CAAA;AAUF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAuC;IAClE,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;IAC7F,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;IACvE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;IACzE,cAAc,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;CACtF,CAAA;AAED;;;GAGG;AACH,MAAM,KAAK,GAAG,CAAC,UAAiC,EAAE,SAAiB,EAAW,EAAE,CAC9E,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;AAoCnH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,OAAe,EAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,OAAO,EAAE,CAAA;AAE/G;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE,CACxE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAA;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAA6C,EAAU,EAAE,CAC/E,SAAS,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,EAAE,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAsC,EAAE,CAAC,CAAC;IAClF,GAAG,gBAAgB;IACnB,GAAG,MAAM,CAAC,SAAS;CACpB,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAiD,EAAE,CAC/F,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;IACxE,CAAC,CAAC,OAA4C;IAC9C,CAAC,CAAC,SAAS,CAAA;AAEf;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAAc,EACd,SAA6C,EAC7C,KAAyB,EACzB,OAA0C,EAC1C,IAAyB,EACnB,EAAE;IACR,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe;QAAE,OAAM;IACzF,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;QACrC,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ;QACpC,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC;YAAE,SAAQ;QAC/F,0EAA0E;QAC1E,0EAA0E;QAC1E,0DAA0D;QAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAQ;QACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAc,EACd,KAAa,EACb,OAA0C,EACrB,EAAE;IACvB,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,OAAO,KAAK,SAAS;YAAE,SAAQ;QACnC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AAChF,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,MAAc,EACd,IAAyB,EACzB,GAAW,EACW,EAAE,CACxB,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,IAAI,GAAG,GAAG,SAAS,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAA;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAA;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAA;IACxD,OAAO,CAAC;YACN,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,yEAAyE;YACzE,OAAO,EAAE,SAAS,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO;YACvC,QAAQ;YACR,aAAa,EAAE,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC;YAClE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Alert policy: what a condition is, when a journal leaves one open, and\n * which open conditions have outlived their delay.\n *\n * Everything here is pure and a function of journal time, so the same entries\n * decide the same alerts in any process at any instant past the delay. The\n * transport that pages about them is `./layerWebhook.ts` and the journal-backed\n * tick that drives them is `./AlertRuntime.ts`; `./Alerts.ts` is the module a\n * consumer imports.\n *\n * @since 1.0.0\n */\n\nimport type { JournalEvent } from \"@smthrs/journal\"\nimport { Schema } from \"effect\"\n\n/**\n * The journal event type one delivered alert is recorded under.\n *\n * @category constants\n * @since 0.1.0\n */\nexport const deliveredEventType = \"flows.alerts.delivered\"\n\n/**\n * The journal event type one failed delivery attempt is recorded under.\n *\n * One entry is written per alert per failure code, never one per tick: a\n * webhook that stays down for an hour leaves one record, not a hundred and\n * twenty that every later tick has to read past.\n *\n * @category constants\n * @since 0.1.0\n */\nexport const failedEventType = \"flows.alerts.failed\"\n\n/**\n * How loud an alert is.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Severity = Schema.Literals([\"info\", \"warning\", \"critical\"])\n\n/**\n * How loud an alert is.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Severity = typeof Severity.Type\n\n/**\n * How a condition is recognized in the journal.\n *\n * `field` names a payload key, `value` the value that means the condition\n * holds, and `eventTypes` narrows which entries are consulted at all. An\n * `eventTypes` item ending in `.*` names a family: `control.*` consults\n * `control.run.parked` and `control.monitor.beat` alike. An entry that carries\n * the field with a different value CLOSES the condition, which is what makes a\n * resume clear an approval alert without a second vocabulary for \"cleared\".\n *\n * @category models\n * @since 0.1.0\n */\nexport const Detector = Schema.Struct({\n  field: Schema.NonEmptyString,\n  value: Schema.NonEmptyString,\n  eventTypes: Schema.optional(Schema.Array(Schema.NonEmptyString))\n})\n\n/**\n * How a condition is recognized in the journal.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Detector = typeof Detector.Type\n\n/**\n * What to do about one condition, and after how long.\n *\n * `afterMs` is a whole, non-negative number of milliseconds. The bound is the\n * schema's job because the delay is also arithmetic on journal time: a `NaN`\n * delay fires on the first tick and stamps a `firedAt` that JSON writes as\n * `null`, and a negative one fires with a `firedAt` earlier than the condition\n * it describes.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Rule = Schema.Struct({\n  afterMs: Schema.Int.pipe(Schema.check(Schema.isGreaterThanOrEqualTo(0))),\n  severity: Schema.optional(Severity),\n  owner: Schema.optional(Schema.String),\n  runbook: Schema.optional(Schema.String)\n})\n\n/**\n * What to do about one condition, and after how long.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Rule = typeof Rule.Type\n\n/**\n * The conditions a policy alerts on and the delays it alerts after.\n *\n * `defaults` fills in what a rule leaves out, so a policy states the delay per\n * condition and the ownership once.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Policy = Schema.Struct({\n  defaults: Schema.optional(Schema.Struct({\n    severity: Schema.optional(Severity),\n    owner: Schema.optional(Schema.String),\n    runbook: Schema.optional(Schema.String)\n  })),\n  rules: Schema.Record(Schema.String, Rule),\n  /** Detectors for conditions this deployment names itself. */\n  detectors: Schema.optional(Schema.Record(Schema.String, Detector))\n})\n\n/**\n * The conditions a policy alerts on and the delays it alerts after.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Policy = typeof Policy.Type\n\n/**\n * The four conditions a control plane journals out of the box.\n *\n * `status` rides on every `control.run.*` entry, and `health` on every\n * `control.monitor.beat`. A deployment whose supervisor journals a park reason\n * gets `quota-parked` from the same field the run summary reports it under.\n *\n * Each consults the `control.*` family only. A run's journal is shared with\n * flow steps, agent traces, and anything else that writes to the run, and a\n * `status` or `health` field on one of those entries would otherwise open or\n * close a condition the control plane never reported.\n *\n * @category constants\n * @since 0.1.0\n */\nexport const defaultDetectors: Readonly<Record<string, Detector>> = {\n  \"waiting-approval\": { field: \"status\", value: \"waiting-approval\", eventTypes: [\"control.*\"] },\n  failed: { field: \"status\", value: \"failed\", eventTypes: [\"control.*\"] },\n  stalled: { field: \"health\", value: \"stalled\", eventTypes: [\"control.*\"] },\n  \"quota-parked\": { field: \"waitingReason\", value: \"quota\", eventTypes: [\"control.*\"] }\n}\n\n/**\n * Whether a detector's `eventTypes` names an entry's event type, exactly or\n * through a `.*` family.\n */\nconst names = (eventTypes: ReadonlyArray<string>, eventType: string): boolean =>\n  eventTypes.some((named) => named.endsWith(\".*\") ? eventType.startsWith(named.slice(0, -1)) : named === eventType)\n\n/**\n * A condition that is open on a run, and when it opened.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Open {\n  readonly runId: string\n  readonly condition: string\n  /** The journal time of the entry that opened the condition. */\n  readonly since: number\n}\n\n/**\n * One alert a policy decided to raise.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Alert {\n  readonly runId: string\n  readonly condition: string\n  readonly since: number\n  /**\n   * The journal instant the condition outlived its delay: `since` plus the\n   * rule's `afterMs`, never the wall clock of whichever tick noticed.\n   */\n  readonly firedAt: number\n  readonly severity: Severity\n  readonly coalescingKey: string\n  readonly owner?: string | undefined\n  readonly runbook?: string | undefined\n}\n\n/**\n * The journal source the alerter writes one outcome of one alert under.\n *\n * A delivery record counts as evidence that an alert went out only under this\n * source, so another producer's `flows.alerts.delivered` record with a\n * matching `alertId` does not suppress a page. This scopes records; it does\n * not authenticate the writer, because the journal does not bind a source to\n * a writer.\n *\n * @param id the alert's {@link alertId}\n * @param outcome `delivered`, `refused`, or `failed/<code>`\n * @private\n * @since 1.0.0\n */\nexport const recordSourceId = (id: string, outcome: string): string => `/notifications/alerts/${id}/${outcome}`\n\n/**\n * The key an alert coalesces on: one open condition on one run.\n *\n * Each component is percent-encoded before it is joined, so a run id or a\n * condition name containing the separator cannot forge another pair's key and\n * suppress a page that belongs to somebody else. Both components are values a\n * deployment chooses, which is why the encoding is not optional.\n *\n * @param runId the run the condition is open on\n * @param condition the condition name the policy uses\n * @category getters\n * @since 1.0.0\n */\nexport const coalescingKey = (runId: string, condition: string): string =>\n  `${encodeURIComponent(runId)}:${encodeURIComponent(condition)}`\n\n/**\n * The identity a delivery is recorded under.\n *\n * The opening time is part of it on purpose. A condition that clears and\n * re-opens is a NEW alert, because the second approval wait is not the first\n * one, and a key without the time would suppress it forever.\n *\n * @param alert the alert\n * @category getters\n * @since 0.1.0\n */\nexport const alertId = (alert: Pick<Alert, \"coalescingKey\" | \"since\">): string =>\n  `alert:${alert.coalescingKey}:${alert.since}`\n\n/**\n * The detectors one policy decides with: the four this package ships, with\n * the deployment's own overriding them by name.\n *\n * @private\n * @since 1.0.0\n */\nexport const detectorsOf = (policy: Policy): Readonly<Record<string, Detector>> => ({\n  ...defaultDetectors,\n  ...policy.detectors\n})\n\n/**\n * One entry's payload when it is a record a detector can read a field off,\n * and `undefined` for the arrays and primitives that carry no fields at all.\n *\n * @private\n * @since 1.0.0\n */\nexport const payloadRecord = (payload: unknown): Readonly<Record<string, unknown>> | undefined =>\n  typeof payload === \"object\" && payload !== null && !Array.isArray(payload)\n    ? payload as Readonly<Record<string, unknown>>\n    : undefined\n\n/**\n * Folds one entry into the open-condition map. Shared by {@link conditions}\n * and the runtime's incremental read, so both decide a condition the same\n * way.\n *\n * The alerter's own records are never evidence about a condition. They are\n * written into the same journal they are read from, and they carry the alert's\n * own vocabulary: a refusal reports the answering HTTP `status`, which a\n * detector watching the run's `status` would read as the condition clearing.\n * A page would then close the condition it paged about and the next tick would\n * re-open it, so a webhook that answered 503 once would alert forever.\n *\n * @private\n * @since 1.0.0\n */\nexport const observe = (\n  policy: Policy,\n  detectors: Readonly<Record<string, Detector>>,\n  entry: JournalEvent.Entry,\n  payload: Readonly<Record<string, unknown>>,\n  open: Map<string, number>\n): void => {\n  if (entry.eventType === deliveredEventType || entry.eventType === failedEventType) return\n  for (const condition of Object.keys(policy.rules)) {\n    const detector = detectors[condition]\n    if (detector === undefined) continue\n    if (detector.eventTypes !== undefined && !names(detector.eventTypes, entry.eventType)) continue\n    // Own properties only. `in` walks `Object.prototype`, so a detector named\n    // `toString` or `constructor` would read every record-shaped entry in the\n    // run as evidence and close the condition on all of them.\n    if (!Object.hasOwn(payload, detector.field)) continue\n    if (payload[detector.field] === detector.value) {\n      if (!open.has(condition)) open.set(condition, entry.emittedAtMs)\n    } else {\n      open.delete(condition)\n    }\n  }\n}\n\n/**\n * Every condition a run's journal leaves open, with the time each opened.\n *\n * An entry that carries a detector's field opens the condition when the value\n * matches and closes it when it does not. Entries the detector does not name\n * are ignored entirely, so a monitor beat cannot close an approval wait and an\n * approval cannot close a stall.\n *\n * @param policy the policy whose detectors decide what counts\n * @param runId the run the entries belong to\n * @param entries the run's journal, oldest first\n * @category projections\n * @since 0.1.0\n */\nexport const conditions = (\n  policy: Policy,\n  runId: string,\n  entries: ReadonlyArray<JournalEvent.Entry>\n): ReadonlyArray<Open> => {\n  const detectors = detectorsOf(policy)\n  const open = new Map<string, number>()\n  for (const entry of entries) {\n    const payload = payloadRecord(entry.payload)\n    if (payload === undefined) continue\n    observe(policy, detectors, entry, payload, open)\n  }\n  return Array.from(open, ([condition, since]) => ({ runId, condition, since }))\n}\n\n/**\n * The alerts a policy raises for the conditions open at `now`.\n *\n * Pure, and a function of journal time: the same journal raises the same\n * alerts in any process, at any instant past the delay. `now` decides WHETHER\n * an alert is raised; it never appears in one. A condition that has been open\n * for less than its rule's delay raises nothing, which is the whole point of\n * the delay, because most stalls clear themselves.\n *\n * @param policy the policy\n * @param open the conditions the journal left open\n * @param now the instant to judge them at\n * @category projections\n * @since 0.1.0\n */\nexport const decide = (\n  policy: Policy,\n  open: ReadonlyArray<Open>,\n  now: number\n): ReadonlyArray<Alert> =>\n  open.flatMap((condition) => {\n    const rule = policy.rules[condition.condition]\n    if (rule === undefined) return []\n    if (now - condition.since < rule.afterMs) return []\n    const severity = rule.severity ?? policy.defaults?.severity ?? \"warning\"\n    const owner = rule.owner ?? policy.defaults?.owner\n    const runbook = rule.runbook ?? policy.defaults?.runbook\n    return [{\n      runId: condition.runId,\n      condition: condition.condition,\n      since: condition.since,\n      // Derived from the journal, not read off the clock. The alert id is\n      // stable across ticks, and the queue refuses a reused id whose content\n      // changed, so an alert stamped with the reading time would become\n      // permanently undeliverable the moment a tick refused and time moved on.\n      firedAt: condition.since + rule.afterMs,\n      severity,\n      coalescingKey: coalescingKey(condition.runId, condition.condition),\n      ...(owner === undefined ? {} : { owner }),\n      ...(runbook === undefined ? {} : { runbook })\n    }]\n  })\n"]}

package/dist/esm/AlertRuntime.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The journal-backed alert runtime: one tick per run.
+ *
+ * A tick folds the run's journal into the conditions it leaves open, decides
+ * which have outlived their delay, admits each one as a coalesced system
+ * event, pages the sink, and journals what the sink did with it. The fold is
+ * retained per run, so a tick costs the entries committed since the previous
+ * one rather than the run's whole journal.
+ *
+ * The rules it enforces are `./AlertPolicy.ts` and the channel it pages over
+ * is `./AlertSink.ts`; neither knows this module exists.
+ *
+ * @since 1.0.0
+ */
+import { Journal } from "@smthrs/journal";
+import { Context, Effect, Layer } from "effect";
+import { type Alert, Policy } from "./AlertPolicy.ts";
+import { Sink } from "./AlertSink.ts";
+import { type NotificationError, NotificationQueue } from "./NotificationQueue.ts";
+/**
+ * What one tick decided.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Tick {
+    /** Alerts raised and delivered on this tick. */
+    readonly delivered: ReadonlyArray<Alert>;
+    /** Alerts the sink refused on this tick. They are retried on the next one. */
+    readonly failed: ReadonlyArray<Alert>;
+    /**
+     * Alerts the notification queue refused because the run is at capacity. The
+     * sink was not called for them, and they are retried on the next tick.
+     */
+    readonly refused: ReadonlyArray<Alert>;
+    /** Alerts that had already been delivered, and were not delivered again. */
+    readonly suppressed: ReadonlyArray<Alert>;
+}
+/**
+ * The alert runtime: one tick per run.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export interface RuntimeService {
+    /**
+     * Reads one run's journal and pages about whatever has waited too long.
+     *
+     * The two failures stay apart because they mean different things to an
+     * operator. A `JournalError` is the alerter's own record channel failing: it
+     * read no entries, or it could not write the delivery record. A
+     * `NotificationError` is the notification queue rejecting the alert outright,
+     * which is a producer or storage fault rather than a full queue. Neither is
+     * a sink failure: a refused page is journaled as `flows.alerts.failed` and
+     * retried on the next tick, and it comes back in {@link Tick.failed}. A queue
+     * at capacity is not a failure either; it comes back in {@link Tick.refused}.
+     */
+    readonly tick: (runId: string) => Effect.Effect<Tick, Journal.JournalError | NotificationError>;
+}
+declare const AlertRuntime_base: Context.ServiceClass<AlertRuntime, "/notifications/AlertRuntime", RuntimeService>;
+/**
+ * The {@link RuntimeService} tag.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class AlertRuntime extends AlertRuntime_base {
+}
+/**
+ * The alert runtime over one policy.
+ *
+ * A tick reads the run's journal, derives the open conditions, decides which
+ * have outlived their delay, and for each one that has not already been
+ * delivered: admits a coalesced system event, sends it to the sink, and
+ * journals the delivery. The admission comes first because it is idempotent
+ * and the send is not: a crash between them costs a duplicate admission, which
+ * the queue drops, while a crash between an accepted send and the delivery
+ * record costs a duplicate PAGE, which is why {@link SinkService.deliver} is
+ * required to dedupe on {@link alertId}.
+ *
+ * The policy is decoded when the layer is built, so a rule with an impossible
+ * delay fails the composition by name instead of mis-paging at 3am.
+ *
+ * @param policy the rules to enforce
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: (policy: Policy) => Layer.Layer<AlertRuntime, never, Journal.Journal | NotificationQueue | Sink>;
+export {};
+//# sourceMappingURL=AlertRuntime.d.ts.map

package/dist/esm/AlertRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlertRuntime.d.ts","sourceRoot":"","sources":["../../src/AlertRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAgB,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAS,OAAO,EAAE,MAAM,EAAW,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAC/E,OAAO,EACL,KAAK,KAAK,EAQV,MAAM,EAEP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAGrC,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAElF;;;;;GAKG;AACH,MAAM,WAAW,IAAI;IACnB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,iBAAiB,CAAC,CAAA;CAChG;;AAED;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,iBAEjC;CAAG;AA8CJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,KAAK,GAChB,QAAQ,MAAM,KACb,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAgI3E,CAAA"}

package/dist/esm/AlertRuntime.js

@@ -0,0 +1,191 @@
+/**
+ * The journal-backed alert runtime: one tick per run.
+ *
+ * A tick folds the run's journal into the conditions it leaves open, decides
+ * which have outlived their delay, admits each one as a coalesced system
+ * event, pages the sink, and journals what the sink did with it. The fold is
+ * retained per run, so a tick costs the entries committed since the previous
+ * one rather than the run's whole journal.
+ *
+ * The rules it enforces are `./AlertPolicy.ts` and the channel it pages over
+ * is `./AlertSink.ts`; neither knows this module exists.
+ *
+ * @since 1.0.0
+ */
+import { Journal, JournalEvent } from "@smthrs/journal";
+import { Clock, Context, Effect, HashSet, Layer, Result, Schema } from "effect";
+import { alertId, decide, deliveredEventType, detectorsOf, failedEventType, observe, payloadRecord, Policy, recordSourceId } from "./AlertPolicy.js";
+import { Sink } from "./AlertSink.js";
+import * as FoldCache from "./internal/foldCache.js";
+import { NotificationQueue } from "./NotificationQueue.js";
+/**
+ * The {@link RuntimeService} tag.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export class AlertRuntime extends Context.Service()("/notifications/AlertRuntime") {
+}
+/**
+ * How many runs one alert runtime keeps folded at a time. The retention policy
+ * is scan-resistant, so a sweep of more runs than this reads journal tails for
+ * all but a fixed handful of them.
+ */
+const maximumWatchedRuns = 64;
+const alertNotification = (alert) => ({
+    _tag: "system-event",
+    id: alertId(alert),
+    targetLineageId: alert.runId,
+    delivery: "queue",
+    coalescingKey: alert.coalescingKey,
+    provenance: {
+        sourceRunId: alert.runId,
+        sourceLineageId: alert.runId,
+        sourceTurn: 0,
+        sourceActor: "alerts"
+    },
+    payload: {
+        condition: alert.condition,
+        severity: alert.severity,
+        since: alert.since,
+        firedAt: alert.firedAt,
+        ...(alert.owner === undefined ? {} : { owner: alert.owner }),
+        ...(alert.runbook === undefined ? {} : { runbook: alert.runbook })
+    }
+});
+/**
+ * The alert runtime over one policy.
+ *
+ * A tick reads the run's journal, derives the open conditions, decides which
+ * have outlived their delay, and for each one that has not already been
+ * delivered: admits a coalesced system event, sends it to the sink, and
+ * journals the delivery. The admission comes first because it is idempotent
+ * and the send is not: a crash between them costs a duplicate admission, which
+ * the queue drops, while a crash between an accepted send and the delivery
+ * record costs a duplicate PAGE, which is why {@link SinkService.deliver} is
+ * required to dedupe on {@link alertId}.
+ *
+ * The policy is decoded when the layer is built, so a rule with an impossible
+ * delay fails the composition by name instead of mis-paging at 3am.
+ *
+ * @param policy the rules to enforce
+ * @category layers
+ * @since 0.1.0
+ */
+export const layer = (policy) => Layer.effect(AlertRuntime, Effect.gen(function* () {
+    const checked = yield* Effect.orDie(Schema.decodeUnknownEffect(Policy)(policy));
+    const detectors = detectorsOf(checked);
+    const journal = yield* Journal.Journal;
+    const queue = yield* NotificationQueue;
+    const sink = yield* Sink;
+    // Folded history per run, so a tick costs the entries committed since
+    // the previous one rather than the run's whole journal.
+    const watched = FoldCache.make(maximumWatchedRuns);
+    const observed = (runId) => Effect.gen(function* () {
+        const base = watched.get(runId) ??
+            { open: new Map(), delivered: HashSet.empty(), cursor: undefined };
+        const fresh = [];
+        let after = base.cursor === undefined ? undefined : JournalEvent.Seq.make(base.cursor);
+        while (true) {
+            const page = yield* journal.entries({ runId, ...(after === undefined ? {} : { after }), limit: 512 });
+            fresh.push(...page.entries);
+            if (!page.hasMore || page.entries.length === 0)
+                break;
+            after = page.entries.at(-1).seq;
+        }
+        if (fresh.length === 0)
+            return base;
+        // `open` is bounded by the policy's rules, so it is copied; the
+        // delivery history is not, so it grows by one persistent node.
+        const open = new Map(base.open);
+        let delivered = base.delivered;
+        let cursor = base.cursor;
+        for (const entry of fresh) {
+            cursor = entry.seq;
+            const payload = payloadRecord(entry.payload);
+            if (payload === undefined)
+                continue;
+            if (entry.eventType === deliveredEventType) {
+                const id = payload["alertId"];
+                // Only a record under the source the alerter writes counts, so
+                // another producer's delivered record cannot suppress a page.
+                // The journal does not bind a source to a writer.
+                if (typeof id === "string" && entry.sourceId === recordSourceId(id, "delivered")) {
+                    delivered = HashSet.add(delivered, id);
+                }
+            }
+            observe(checked, detectors, entry, payload, open);
+        }
+        const next = { open, delivered, cursor };
+        // Published at commit, exactly as `NotificationQueue.load` publishes
+        // its fold. A tick inside an enclosing transaction reads that
+        // transaction's uncommitted rows, and caching them would outlive the
+        // rollback that erased them: the run would page about a condition
+        // durable history never held.
+        yield* journal.whenCommitted(Effect.sync(() => watched.put(runId, next)));
+        return next;
+    });
+    const record = (eventType, alert, source, outcome) => journal.emitDurableUnfenced(new JournalEvent.Input({
+        runId: JournalEvent.RunId.make(alert.runId),
+        sourceId: JournalEvent.SourceId.make(recordSourceId(alertId(alert), source)),
+        sourceSeq: JournalEvent.SourceSeq.make(0),
+        // One record per alert per outcome. Without an explicit identity
+        // the journal allocates a new sequence on every attempt, and a
+        // webhook that stays down appends a row per tick forever.
+        dedupe: "identity",
+        eventType,
+        payload: {
+            runId: alert.runId,
+            condition: alert.condition,
+            since: alert.since,
+            severity: alert.severity,
+            alertId: alertId(alert),
+            ...(outcome.code === undefined ? {} : { code: outcome.code }),
+            ...(outcome.status === undefined ? {} : { status: outcome.status })
+        }
+    })).pipe(Effect.asVoid);
+    return AlertRuntime.of({
+        tick: Effect.fn("AlertRuntime.tick")(function* (runId) {
+            const journalRunId = JournalEvent.RunId.make(runId);
+            const history = yield* observed(journalRunId);
+            const now = yield* Clock.currentTimeMillis;
+            const open = Array.from(history.open, ([condition, since]) => ({ runId, condition, since }));
+            const raised = decide(checked, open, now);
+            const delivered = [];
+            const failed = [];
+            const refused = [];
+            const suppressed = [];
+            for (const alert of raised) {
+                if (HashSet.has(history.delivered, alertId(alert))) {
+                    suppressed.push(alert);
+                    continue;
+                }
+                // Raised unchanged: a queue that rejects the admission outright is
+                // not the journal failing, and calling it `sink_failed` would send
+                // an operator looking at the webhook.
+                const receipt = yield* queue.admit(runId, alertNotification(alert));
+                if (receipt.decision === "rejected-full") {
+                    // The alert has nowhere durable to sit, so paging about it would
+                    // tell an operator about something the run will never read.
+                    yield* record(failedEventType, alert, "refused", { code: "notification_full" });
+                    refused.push(alert);
+                    continue;
+                }
+                const outcome = yield* Effect.result(sink.deliver(alert));
+                if (Result.isFailure(outcome)) {
+                    yield* record(failedEventType, alert, `failed/${outcome.failure.code}`, {
+                        code: outcome.failure.code,
+                        status: outcome.failure.status
+                    });
+                    failed.push(alert);
+                }
+                else {
+                    yield* record(deliveredEventType, alert, "delivered", {});
+                    delivered.push(alert);
+                }
+            }
+            return { delivered, failed, refused, suppressed };
+        })
+    });
+}));
+//# sourceMappingURL=AlertRuntime.js.map

package/dist/esm/AlertRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlertRuntime.js","sourceRoot":"","sources":["../../src/AlertRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/E,OAAO,EAEL,OAAO,EACP,MAAM,EACN,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,OAAO,EACP,aAAa,EACb,MAAM,EACN,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AACrC,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AAEpD,OAAO,EAA0B,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AA4ClF;;;;;GAKG;AACH,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAAgC,CAC/E,6BAA6B,CAC9B;CAAG;AAiBJ;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,MAAM,iBAAiB,GAAG,CAAC,KAAY,EAAkC,EAAE,CAAC,CAAC;IAC3E,IAAI,EAAE,cAAc;IACpB,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;IAClB,eAAe,EAAE,KAAK,CAAC,KAAK;IAC5B,QAAQ,EAAE,OAAO;IACjB,aAAa,EAAE,KAAK,CAAC,aAAa;IAClC,UAAU,EAAE;QACV,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,eAAe,EAAE,KAAK,CAAC,KAAK;QAC5B,UAAU,EAAE,CAAC;QACb,WAAW,EAAE,QAAQ;KACtB;IACD,OAAO,EAAE;QACP,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE;CACF,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAc,EACgE,EAAE,CAChF,KAAK,CAAC,MAAM,CACV,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/E,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAA;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAA;IACxB,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAU,kBAAkB,CAAC,CAAA;IAE3D,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAgD,EAAE,CAC3F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YACtC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACpE,MAAM,KAAK,GAA8B,EAAE,CAAA;QAC3C,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtF,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YACrG,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;YAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YACrD,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAA;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAEnC,gEAAgE;QAChE,+DAA+D;QAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC9B,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACxB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,KAAK,CAAC,GAAG,CAAA;YAClB,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5C,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAQ;YACnC,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;gBAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;gBAC7B,+DAA+D;gBAC/D,8DAA8D;gBAC9D,kDAAkD;gBAClD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;oBACjF,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;gBACxC,CAAC;YACH,CAAC;YACD,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACnD,CAAC;QACD,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QACjD,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,kEAAkE;QAClE,8BAA8B;QAC9B,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,MAAM,MAAM,GAAG,CACb,SAAiB,EACjB,KAAY,EACZ,MAAc,EACd,OAAqF,EAC1C,EAAE,CAC7C,OAAO,CAAC,mBAAmB,CACzB,IAAI,YAAY,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,iEAAiE;QACjE,+DAA+D;QAC/D,0DAA0D;QAC1D,MAAM,EAAE,UAAU;QAClB,SAAS;QACT,OAAO,EAAE;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACpE;KACF,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEvB,OAAO,YAAY,CAAC,EAAE,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAC,KAAa;YAC1D,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;YAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;YACzC,MAAM,SAAS,GAAiB,EAAE,CAAA;YAClC,MAAM,MAAM,GAAiB,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAiB,EAAE,CAAA;YAChC,MAAM,UAAU,GAAiB,EAAE,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBACnD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACtB,SAAQ;gBACV,CAAC;gBACD,mEAAmE;gBACnE,mEAAmE;gBACnE,sCAAsC;gBACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;gBACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACzC,iEAAiE;oBACjE,4DAA4D;oBAC5D,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAA;oBAC/E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACnB,SAAQ;gBACV,CAAC;gBACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;gBACzD,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;wBACtE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;wBAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;qBAC/B,CAAC,CAAA;oBACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpB,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;oBACzD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACvB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;QACnD,CAAC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA","sourcesContent":["/**\n * The journal-backed alert runtime: one tick per run.\n *\n * A tick folds the run's journal into the conditions it leaves open, decides\n * which have outlived their delay, admits each one as a coalesced system\n * event, pages the sink, and journals what the sink did with it. The fold is\n * retained per run, so a tick costs the entries committed since the previous\n * one rather than the run's whole journal.\n *\n * The rules it enforces are `./AlertPolicy.ts` and the channel it pages over\n * is `./AlertSink.ts`; neither knows this module exists.\n *\n * @since 1.0.0\n */\n\nimport { Journal, JournalEvent } from \"@smthrs/journal\"\nimport { Clock, Context, Effect, HashSet, Layer, Result, Schema } from \"effect\"\nimport {\n  type Alert,\n  alertId,\n  decide,\n  deliveredEventType,\n  detectorsOf,\n  failedEventType,\n  observe,\n  payloadRecord,\n  Policy,\n  recordSourceId\n} from \"./AlertPolicy.ts\"\nimport { Sink } from \"./AlertSink.ts\"\nimport * as FoldCache from \"./internal/foldCache.ts\"\nimport type * as NotificationModel from \"./Notification.ts\"\nimport { type NotificationError, NotificationQueue } from \"./NotificationQueue.ts\"\n\n/**\n * What one tick decided.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Tick {\n  /** Alerts raised and delivered on this tick. */\n  readonly delivered: ReadonlyArray<Alert>\n  /** Alerts the sink refused on this tick. They are retried on the next one. */\n  readonly failed: ReadonlyArray<Alert>\n  /**\n   * Alerts the notification queue refused because the run is at capacity. The\n   * sink was not called for them, and they are retried on the next tick.\n   */\n  readonly refused: ReadonlyArray<Alert>\n  /** Alerts that had already been delivered, and were not delivered again. */\n  readonly suppressed: ReadonlyArray<Alert>\n}\n\n/**\n * The alert runtime: one tick per run.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface RuntimeService {\n  /**\n   * Reads one run's journal and pages about whatever has waited too long.\n   *\n   * The two failures stay apart because they mean different things to an\n   * operator. A `JournalError` is the alerter's own record channel failing: it\n   * read no entries, or it could not write the delivery record. A\n   * `NotificationError` is the notification queue rejecting the alert outright,\n   * which is a producer or storage fault rather than a full queue. Neither is\n   * a sink failure: a refused page is journaled as `flows.alerts.failed` and\n   * retried on the next tick, and it comes back in {@link Tick.failed}. A queue\n   * at capacity is not a failure either; it comes back in {@link Tick.refused}.\n   */\n  readonly tick: (runId: string) => Effect.Effect<Tick, Journal.JournalError | NotificationError>\n}\n\n/**\n * The {@link RuntimeService} tag.\n *\n * @category services\n * @since 0.1.0\n */\nexport class AlertRuntime extends Context.Service<AlertRuntime, RuntimeService>()(\n  \"/notifications/AlertRuntime\"\n) {}\n\n/**\n * One run's folded alert history: the conditions still open, the alerts\n * already paged, and the sequence the fold stopped at.\n */\ninterface Watched {\n  readonly open: ReadonlyMap<string, number>\n  /**\n   * The alerts already paged, as a persistent set: a tick adds a node and\n   * leaves the fold the previous tick published untouched, where copying the\n   * set would cost the run's whole delivery history on every tick.\n   */\n  readonly delivered: HashSet.HashSet<string>\n  readonly cursor: number | undefined\n}\n\n/**\n * How many runs one alert runtime keeps folded at a time. The retention policy\n * is scan-resistant, so a sweep of more runs than this reads journal tails for\n * all but a fixed handful of them.\n */\nconst maximumWatchedRuns = 64\n\nconst alertNotification = (alert: Alert): NotificationModel.Notification => ({\n  _tag: \"system-event\",\n  id: alertId(alert),\n  targetLineageId: alert.runId,\n  delivery: \"queue\",\n  coalescingKey: alert.coalescingKey,\n  provenance: {\n    sourceRunId: alert.runId,\n    sourceLineageId: alert.runId,\n    sourceTurn: 0,\n    sourceActor: \"alerts\"\n  },\n  payload: {\n    condition: alert.condition,\n    severity: alert.severity,\n    since: alert.since,\n    firedAt: alert.firedAt,\n    ...(alert.owner === undefined ? {} : { owner: alert.owner }),\n    ...(alert.runbook === undefined ? {} : { runbook: alert.runbook })\n  }\n})\n\n/**\n * The alert runtime over one policy.\n *\n * A tick reads the run's journal, derives the open conditions, decides which\n * have outlived their delay, and for each one that has not already been\n * delivered: admits a coalesced system event, sends it to the sink, and\n * journals the delivery. The admission comes first because it is idempotent\n * and the send is not: a crash between them costs a duplicate admission, which\n * the queue drops, while a crash between an accepted send and the delivery\n * record costs a duplicate PAGE, which is why {@link SinkService.deliver} is\n * required to dedupe on {@link alertId}.\n *\n * The policy is decoded when the layer is built, so a rule with an impossible\n * delay fails the composition by name instead of mis-paging at 3am.\n *\n * @param policy the rules to enforce\n * @category layers\n * @since 0.1.0\n */\nexport const layer = (\n  policy: Policy\n): Layer.Layer<AlertRuntime, never, Journal.Journal | NotificationQueue | Sink> =>\n  Layer.effect(\n    AlertRuntime,\n    Effect.gen(function*() {\n      const checked = yield* Effect.orDie(Schema.decodeUnknownEffect(Policy)(policy))\n      const detectors = detectorsOf(checked)\n      const journal = yield* Journal.Journal\n      const queue = yield* NotificationQueue\n      const sink = yield* Sink\n      // Folded history per run, so a tick costs the entries committed since\n      // the previous one rather than the run's whole journal.\n      const watched = FoldCache.make<Watched>(maximumWatchedRuns)\n\n      const observed = (runId: JournalEvent.RunId): Effect.Effect<Watched, Journal.JournalError> =>\n        Effect.gen(function*() {\n          const base: Watched = watched.get(runId) ??\n            { open: new Map(), delivered: HashSet.empty(), cursor: undefined }\n          const fresh: Array<JournalEvent.Entry> = []\n          let after = base.cursor === undefined ? undefined : JournalEvent.Seq.make(base.cursor)\n          while (true) {\n            const page = yield* journal.entries({ runId, ...(after === undefined ? {} : { after }), limit: 512 })\n            fresh.push(...page.entries)\n            if (!page.hasMore || page.entries.length === 0) break\n            after = page.entries.at(-1)!.seq\n          }\n          if (fresh.length === 0) return base\n\n          // `open` is bounded by the policy's rules, so it is copied; the\n          // delivery history is not, so it grows by one persistent node.\n          const open = new Map(base.open)\n          let delivered = base.delivered\n          let cursor = base.cursor\n          for (const entry of fresh) {\n            cursor = entry.seq\n            const payload = payloadRecord(entry.payload)\n            if (payload === undefined) continue\n            if (entry.eventType === deliveredEventType) {\n              const id = payload[\"alertId\"]\n              // Only a record under the source the alerter writes counts, so\n              // another producer's delivered record cannot suppress a page.\n              // The journal does not bind a source to a writer.\n              if (typeof id === \"string\" && entry.sourceId === recordSourceId(id, \"delivered\")) {\n                delivered = HashSet.add(delivered, id)\n              }\n            }\n            observe(checked, detectors, entry, payload, open)\n          }\n          const next: Watched = { open, delivered, cursor }\n          // Published at commit, exactly as `NotificationQueue.load` publishes\n          // its fold. A tick inside an enclosing transaction reads that\n          // transaction's uncommitted rows, and caching them would outlive the\n          // rollback that erased them: the run would page about a condition\n          // durable history never held.\n          yield* journal.whenCommitted(Effect.sync(() => watched.put(runId, next)))\n          return next\n        })\n\n      const record = (\n        eventType: string,\n        alert: Alert,\n        source: string,\n        outcome: { readonly code?: string | undefined; readonly status?: number | undefined }\n      ): Effect.Effect<void, Journal.JournalError> =>\n        journal.emitDurableUnfenced(\n          new JournalEvent.Input({\n            runId: JournalEvent.RunId.make(alert.runId),\n            sourceId: JournalEvent.SourceId.make(recordSourceId(alertId(alert), source)),\n            sourceSeq: JournalEvent.SourceSeq.make(0),\n            // One record per alert per outcome. Without an explicit identity\n            // the journal allocates a new sequence on every attempt, and a\n            // webhook that stays down appends a row per tick forever.\n            dedupe: \"identity\",\n            eventType,\n            payload: {\n              runId: alert.runId,\n              condition: alert.condition,\n              since: alert.since,\n              severity: alert.severity,\n              alertId: alertId(alert),\n              ...(outcome.code === undefined ? {} : { code: outcome.code }),\n              ...(outcome.status === undefined ? {} : { status: outcome.status })\n            }\n          })\n        ).pipe(Effect.asVoid)\n\n      return AlertRuntime.of({\n        tick: Effect.fn(\"AlertRuntime.tick\")(function*(runId: string) {\n          const journalRunId = JournalEvent.RunId.make(runId)\n          const history = yield* observed(journalRunId)\n          const now = yield* Clock.currentTimeMillis\n          const open = Array.from(history.open, ([condition, since]) => ({ runId, condition, since }))\n          const raised = decide(checked, open, now)\n          const delivered: Array<Alert> = []\n          const failed: Array<Alert> = []\n          const refused: Array<Alert> = []\n          const suppressed: Array<Alert> = []\n          for (const alert of raised) {\n            if (HashSet.has(history.delivered, alertId(alert))) {\n              suppressed.push(alert)\n              continue\n            }\n            // Raised unchanged: a queue that rejects the admission outright is\n            // not the journal failing, and calling it `sink_failed` would send\n            // an operator looking at the webhook.\n            const receipt = yield* queue.admit(runId, alertNotification(alert))\n            if (receipt.decision === \"rejected-full\") {\n              // The alert has nowhere durable to sit, so paging about it would\n              // tell an operator about something the run will never read.\n              yield* record(failedEventType, alert, \"refused\", { code: \"notification_full\" })\n              refused.push(alert)\n              continue\n            }\n            const outcome = yield* Effect.result(sink.deliver(alert))\n            if (Result.isFailure(outcome)) {\n              yield* record(failedEventType, alert, `failed/${outcome.failure.code}`, {\n                code: outcome.failure.code,\n                status: outcome.failure.status\n              })\n              failed.push(alert)\n            } else {\n              yield* record(deliveredEventType, alert, \"delivered\", {})\n              delivered.push(alert)\n            }\n          }\n          return { delivered, failed, refused, suppressed }\n        })\n      })\n    })\n  )\n"]}