easy-ping 0.3.0 → 0.4.0

package/dist/{plugin-f5KaFWSN.d.cts → plugin-CiMsGlQe.d.cts}

@@ -24,6 +24,33 @@ type Logger = {
 };
 declare const consoleLogger: Logger;
 
+type TokenClaims = {
+    /** Subject — the user the token acts for. */
+    uid: string;
+    /** What the token is allowed to do. Verification requires an exact match. */
+    purpose: string;
+    /** Expiry, epoch seconds. */
+    exp: number;
+    /** Issued at, epoch seconds. Set by signToken; lets a route refuse a token older than a later change. */
+    iat?: number;
+    /** Free-form, purpose-specific. */
+    data?: Record<string, string>;
+};
+declare function signToken(secret: string, claims: TokenClaims, now?: Date): Promise<string>;
+/** null for every failure mode. Distinguishing them tells an attacker which part to fix. */
+declare function verifyToken(secret: string, token: string, purpose: string, now?: Date): Promise<TokenClaims | null>;
+declare const DEFAULT_TOKEN_TTL_SECONDS: number;
+/** Ninety days. A link that must outlive this should be re-issued, not made immortal. */
+declare const MAX_TOKEN_TTL_SECONDS: number;
+declare const expiresIn: (seconds: number, now?: Date) => number;
+type SignRequest = {
+    uid: string;
+    purpose: string;
+    data?: Record<string, string>;
+    /** Defaults to 30 days, capped at 90. */
+    ttlSeconds?: number;
+};
+
 type Promisable<T> = T | Promise<T>;
 type PrepareContext = {
     type: string;
@@ -150,12 +177,7 @@ type RouteContext = {
     /** Resolved for user-scoped routes, so a handler cannot forget to scope. */
     userId: string | null;
     /** Verified before dispatch, so a handler cannot forget to check. */
-    claims: {
-        uid: string;
-        purpose: string;
-        exp: number;
-        data?: Record<string, string>;
-    } | null;
+    claims: TokenClaims | null;
     params: Record<string, string>;
 };
 type RouteDefinition = {
@@ -168,9 +190,15 @@ type RouteDefinition = {
 type PluginInitContext = {
     /** Scoped to the tables this plugin declares in schema(). */
     store: PluginStore;
-    /** The top-level signing secret, for plugins issuing signed links. */
-    secret: string;
+    /**
+     * Mints tokens for this plugin's own `signed` routes and nothing else. The
+     * master secret itself is never handed out: a plugin cannot forge another
+     * plugin's links, or anything a future signed flow relies on.
+     */
+    sign: (request: SignRequest) => Promise<string>;
     logger: Logger;
+    /** Configured notification names, so a route can refuse to store rows for types that do not exist. */
+    notificationTypes: readonly string[];
     /** The app's resolver, for plugins that need timezones or addresses. */
     getRecipients: (userIds: readonly string[]) => Promise<readonly Recipient[]>;
     /**
@@ -214,4 +242,4 @@ type ExtractActions<TPlugin> = TPlugin extends {
 /** Indexes the tuple rather than recursing: a fold blows the instantiation depth limit. */
 type ActionsOf<TPlugins extends readonly AnyClientPlugin[]> = UnionToIntersection<ExtractActions<TPlugins[number]>>;
 
-export { type AnyPlugin as A, type BeforeSendContext as B, type ChannelDecision as C, EasyPingError as E, type FieldDeclaration as F, type Logger as L, type PluginHooks as P, type ResolveChannelsContext as R, type SchemaDeclaration as S, type TableDeclaration as T, type UnionToIntersection as U, ValidationError as V, type ActionsOf as a, type AfterDeliverContext as b, type AnyClientPlugin as c, type BeforeSendResult as d, type ClientFetch as e, type ClientPlugin as f, ConfigError as g, type EasyPingPlugin as h, type FieldType as i, type PrepareContext as j, type Promisable as k, type RouteContext as l, type RouteDefinition as m, type RouteScope as n, consoleLogger as o, defineClientPlugin as p, definePlugin as q };
+export { type AnyPlugin as A, type BeforeSendContext as B, type ChannelDecision as C, DEFAULT_TOKEN_TTL_SECONDS as D, EasyPingError as E, type FieldDeclaration as F, type Logger as L, MAX_TOKEN_TTL_SECONDS as M, type Promisable as P, type RouteScope as R, type SchemaDeclaration as S, type TableDeclaration as T, type UnionToIntersection as U, ValidationError as V, type ActionsOf as a, type AfterDeliverContext as b, type AnyClientPlugin as c, type BeforeSendResult as d, type ClientFetch as e, type ClientPlugin as f, ConfigError as g, type EasyPingPlugin as h, type FieldType as i, type PluginHooks as j, type PrepareContext as k, type ResolveChannelsContext as l, type RouteContext as m, type RouteDefinition as n, type SignRequest as o, type TokenClaims as p, consoleLogger as q, defineClientPlugin as r, definePlugin as s, expiresIn as t, signToken as u, verifyToken as v };

package/dist/plugins/digests.d.cts

@@ -1,4 +1,4 @@
-import { h as EasyPingPlugin } from '../plugin-f5KaFWSN.cjs';
+import { h as EasyPingPlugin } from '../plugin-CiMsGlQe.cjs';
 import '../adapter-BfLe2J0t.cjs';
 
 type DigestWindow = "daily" | "weekly";

package/dist/plugins/digests.d.ts

@@ -1,4 +1,4 @@
-import { h as EasyPingPlugin } from '../plugin-CmPOFVmn.js';
+import { h as EasyPingPlugin } from '../plugin-C9Hoxus2.js';
 import '../adapter-BfLe2J0t.js';
 
 type DigestWindow = "daily" | "weekly";

package/dist/plugins/preferences-client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/plugin.ts","../../src/plugins/preferences/client.ts"],"names":[],"mappings":";;;AAoMO,SAAS,mBACd,MAAA,EAC6B;AAC7B,EAAA,OAAO,MAAA;AACT;;;ACpLO,IAAM,iBAAA,GAAoB,MAC/B,kBAAA,CAAmB;AAAA,EACjB,EAAA,EAAI,aAAA;AAAA,EACJ,oBAAoB,EAAC;AAAA,EAErB,OAAA,EAAS,CAAC,KAAA,MAAW;AAAA,IACnB,eAAA,EAAiB,YAId,MAAM,KAAA,CAAM,cAAc,CAAA;AAAA,IAK7B,gBAAA,EAAkB,OAAO,KAAA,KACtB,MAAM,MAAM,cAAA,EAAgB;AAAA,MAC3B,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,KAC3B;AAAA,GACL;AACF,CAAC","file":"preferences-client.cjs","sourcesContent":["import type { DeliveryOutcome } from \"./adapter\";\nimport type { Logger } from \"./errors\";\nimport type { PluginStore } from \"./store\";\nimport type { Channel, Recipient } from \"./types\";\n\nexport type Promisable<T> = T | Promise<T>;\n\nexport type PrepareContext = {\n  type: string;\n  recipients: readonly Recipient[];\n};\n\nexport type BeforeSendContext = {\n  type: string;\n  recipient: Recipient;\n  payload: unknown;\n  actorId: string | null;\n  dedupeKey: string | null;\n  /** Whatever this plugin's own prepare() returned for this send. */\n  prepared: unknown;\n};\n\nexport type BeforeSendResult =\n  | { action: \"continue\"; payload?: unknown; dedupeKey?: string }\n  | { action: \"cancel\"; reason: string };\n\nexport type ChannelDecision = {\n  channel: Channel;\n  action: \"send\" | \"skip\" | \"defer\";\n  /** defer only. Written to notification_delivery.not_before. */\n  notBefore?: Date | undefined;\n};\n\nexport type ResolveChannelsContext = {\n  type: string;\n  recipient: Recipient;\n  payload: unknown;\n  decisions: readonly ChannelDecision[];\n  /** Whatever this plugin's own prepare() returned for this send. */\n  prepared: unknown;\n};\n\nexport type DeliverContext = {\n  channel: Channel;\n  deliveryId: string;\n  attempt: number;\n  recipient: Recipient;\n  notification: { id: string; userId: string; type: string; payload: unknown };\n  /** Aborted on the runner's timeout. */\n  signal: AbortSignal;\n};\n\nexport type AfterSendContext = {\n  type: string;\n  payload: unknown;\n  /** Committed rows. Ids exist only at this point. */\n  notifications: readonly { id: string; userId: string }[];\n  /** Whatever this plugin's own prepare() returned for this send. */\n  prepared: unknown;\n};\n\nexport type AfterDeliverContext = {\n  deliveryId: string;\n  notificationId: string;\n  userId: string;\n  channel: Channel;\n  outcome: DeliveryOutcome;\n  attempt: number;\n  isTerminal: boolean;\n};\n\n/** beforeSend and resolveChannels fail closed; afterDeliver fails open. */\nexport type PluginHooks = {\n  /** Once per send, for bulk loading — the per-recipient hooks would be an N+1. */\n  prepare?: (ctx: PrepareContext) => Promisable<unknown>;\n  beforeSend?: (ctx: BeforeSendContext) => Promisable<BeforeSendResult>;\n  resolveChannels?: (ctx: ResolveChannelsContext) => Promisable<readonly ChannelDecision[]>;\n  /**\n   * Once per send, after the rows are committed. The only hook that sees\n   * notification ids, which digests needs to bucket an entry against one.\n   * Fails open: the notification is already written.\n   */\n  afterSend?: (ctx: AfterSendContext) => Promisable<void>;\n  /**\n   * Delivers one of the plugin's declared `channels`. Core carries inApp and\n   * email; everything else arrives here, which is how push, sms and slack are\n   * added without core learning about them.\n   */\n  deliver?: (ctx: DeliverContext) => Promisable<DeliveryOutcome>;\n  afterDeliver?: (ctx: AfterDeliverContext) => Promisable<void>;\n};\n\nexport type FieldType = \"string\" | \"number\" | \"boolean\" | \"date\" | \"json\";\n\nexport type FieldDeclaration = {\n  type: FieldType;\n  required?: boolean;\n  default?: string | number | boolean;\n  /** date fields only. Renders as defaultNow() / CURRENT_TIMESTAMP. */\n  defaultNow?: boolean;\n};\n\nexport type IndexDeclaration = {\n  on: readonly string[];\n  unique?: boolean;\n  name?: string;\n};\n\nexport type TableDeclaration = {\n  tableName: string;\n  fields: Record<string, FieldDeclaration>;\n  primaryKey?: readonly string[];\n  indexes?: readonly IndexDeclaration[];\n};\n\nexport type SchemaDeclaration = Record<string, TableDeclaration>;\n\nexport type RouteScope =\n  | { type: \"user\" }\n  | { type: \"machine\" }\n  | { type: \"signed\"; purpose: string }\n  | { type: \"custom\"; justification: string };\n\nexport type RouteContext = {\n  request: Request;\n  /** Resolved for user-scoped routes, so a handler cannot forget to scope. */\n  userId: string | null;\n  /** Verified before dispatch, so a handler cannot forget to check. */\n  claims: { uid: string; purpose: string; exp: number; data?: Record<string, string> } | null;\n  params: Record<string, string>;\n};\n\nexport type RouteDefinition = {\n  path: string;\n  method: \"GET\" | \"POST\";\n  scope: RouteScope;\n  handler: (ctx: RouteContext) => Promise<Response>;\n};\n\n/** Handed to a plugin at startup so it need not be given the database twice. */\nexport type PluginInitContext = {\n  /** Scoped to the tables this plugin declares in schema(). */\n  store: PluginStore;\n  /** The top-level signing secret, for plugins issuing signed links. */\n  secret: string;\n  logger: Logger;\n  /** The app's resolver, for plugins that need timezones or addresses. */\n  getRecipients: (userIds: readonly string[]) => Promise<readonly Recipient[]>;\n  /**\n   * The instance's own send(). A plugin composing a message (a digest, say)\n   * routes it back through the pipeline rather than reaching for a provider,\n   * so it inherits retry, backoff and idempotency for free.\n   */\n  send: (\n    type: string,\n    args: { to: string | readonly string[]; payload: unknown; dedupeKey?: string },\n  ) => Promise<unknown>;\n};\n\nexport type EasyPingPlugin<\n  TId extends string = string,\n  TSchema extends SchemaDeclaration = SchemaDeclaration,\n> = {\n  id: TId;\n  dependsOn?: readonly string[];\n  schema?: TSchema;\n  routes?: readonly RouteDefinition[];\n  hooks?: PluginHooks;\n  /** Channels this plugin delivers. Makes them usable in a notification. */\n  channels?: readonly Channel[];\n  /** Called once by easyPing() before any hook or route can run. */\n  init?: (ctx: PluginInitContext) => void;\n};\n\nexport type AnyPlugin = EasyPingPlugin<string, SchemaDeclaration>;\n\nexport function definePlugin<TId extends string, TSchema extends SchemaDeclaration>(\n  plugin: EasyPingPlugin<TId, TSchema>,\n): EasyPingPlugin<TId, TSchema> {\n  return plugin;\n}\n\nexport type ClientFetch = (path: string, init?: RequestInit) => Promise<unknown>;\n\nexport type ClientPlugin<\n  TId extends string = string,\n  TActions extends Record<string, unknown> = Record<string, unknown>,\n> = {\n  id: TId;\n  /** Phantom. Links client types to the server plugin so a mismatch is a type error. */\n  $InferServerPlugin?: AnyPlugin;\n  actions: (fetch: ClientFetch) => TActions;\n};\n\nexport type AnyClientPlugin = ClientPlugin<string, Record<string, unknown>>;\n\nexport function defineClientPlugin<TId extends string, TActions extends Record<string, unknown>>(\n  plugin: ClientPlugin<TId, TActions>,\n): ClientPlugin<TId, TActions> {\n  return plugin;\n}\n\nexport type UnionToIntersection<U> = (U extends unknown ? (k: U) => void : never) extends (\n  k: infer I,\n) => void\n  ? I\n  : never;\n\n/** Naked type parameter, so the conditional distributes over the union. */\ntype ExtractActions<TPlugin> = TPlugin extends { actions: (fetch: never) => infer TActions }\n  ? TActions\n  : never;\n\n/** Indexes the tuple rather than recursing: a fold blows the instantiation depth limit. */\nexport type ActionsOf<TPlugins extends readonly AnyClientPlugin[]> = UnionToIntersection<\n  ExtractActions<TPlugins[number]>\n>;\n","import { defineClientPlugin } from \"../../core/plugin\";\nimport type { Channel, Frequency } from \"../../core/types\";\nimport type { preferences } from \"./index\";\n\nexport type PreferenceView = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n};\n\nexport type UpdatePreferenceInput = {\n  type: string;\n  channel: Channel;\n  enabled?: boolean;\n  frequency?: Frequency;\n};\n\n/** Paired by phantom type: importing the server plugin's value would bundle the DB. */\nexport const preferencesClient = () =>\n  defineClientPlugin({\n    id: \"preferences\",\n    $InferServerPlugin: {} as ReturnType<typeof preferences>,\n\n    actions: (fetch) => ({\n      listPreferences: async (): Promise<{\n        preferences: PreferenceView[];\n        defaultEnabled: boolean;\n      }> =>\n        (await fetch(\"/preferences\")) as {\n          preferences: PreferenceView[];\n          defaultEnabled: boolean;\n        },\n\n      updatePreference: async (input: UpdatePreferenceInput): Promise<{ ok: boolean }> =>\n        (await fetch(\"/preferences\", {\n          method: \"POST\",\n          body: JSON.stringify(input),\n        })) as { ok: boolean },\n    }),\n  });\n\nexport type PreferencesClient = ReturnType<typeof preferencesClient>;\n"]}
+{"version":3,"sources":["../../src/core/plugin.ts","../../src/plugins/preferences/client.ts"],"names":[],"mappings":";;;AA2MO,SAAS,mBACd,MAAA,EAC6B;AAC7B,EAAA,OAAO,MAAA;AACT;;;AC3LO,IAAM,iBAAA,GAAoB,MAC/B,kBAAA,CAAmB;AAAA,EACjB,EAAA,EAAI,aAAA;AAAA,EACJ,oBAAoB,EAAC;AAAA,EAErB,OAAA,EAAS,CAAC,KAAA,MAAW;AAAA,IACnB,eAAA,EAAiB,YAId,MAAM,KAAA,CAAM,cAAc,CAAA;AAAA,IAK7B,gBAAA,EAAkB,OAAO,KAAA,KACtB,MAAM,MAAM,cAAA,EAAgB;AAAA,MAC3B,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,KAC3B;AAAA,GACL;AACF,CAAC","file":"preferences-client.cjs","sourcesContent":["import type { DeliveryOutcome } from \"./adapter\";\nimport type { Logger } from \"./errors\";\nimport type { PluginStore } from \"./store\";\nimport type { SignRequest, TokenClaims } from \"./tokens\";\nimport type { Channel, Recipient } from \"./types\";\n\nexport type Promisable<T> = T | Promise<T>;\n\nexport type PrepareContext = {\n  type: string;\n  recipients: readonly Recipient[];\n};\n\nexport type BeforeSendContext = {\n  type: string;\n  recipient: Recipient;\n  payload: unknown;\n  actorId: string | null;\n  dedupeKey: string | null;\n  /** Whatever this plugin's own prepare() returned for this send. */\n  prepared: unknown;\n};\n\nexport type BeforeSendResult =\n  | { action: \"continue\"; payload?: unknown; dedupeKey?: string }\n  | { action: \"cancel\"; reason: string };\n\nexport type ChannelDecision = {\n  channel: Channel;\n  action: \"send\" | \"skip\" | \"defer\";\n  /** defer only. Written to notification_delivery.not_before. */\n  notBefore?: Date | undefined;\n};\n\nexport type ResolveChannelsContext = {\n  type: string;\n  recipient: Recipient;\n  payload: unknown;\n  decisions: readonly ChannelDecision[];\n  /** Whatever this plugin's own prepare() returned for this send. */\n  prepared: unknown;\n};\n\nexport type DeliverContext = {\n  channel: Channel;\n  deliveryId: string;\n  attempt: number;\n  recipient: Recipient;\n  notification: { id: string; userId: string; type: string; payload: unknown };\n  /** Aborted on the runner's timeout. */\n  signal: AbortSignal;\n};\n\nexport type AfterSendContext = {\n  type: string;\n  payload: unknown;\n  /** Committed rows. Ids exist only at this point. */\n  notifications: readonly { id: string; userId: string }[];\n  /** Whatever this plugin's own prepare() returned for this send. */\n  prepared: unknown;\n};\n\nexport type AfterDeliverContext = {\n  deliveryId: string;\n  notificationId: string;\n  userId: string;\n  channel: Channel;\n  outcome: DeliveryOutcome;\n  attempt: number;\n  isTerminal: boolean;\n};\n\n/** beforeSend and resolveChannels fail closed; afterDeliver fails open. */\nexport type PluginHooks = {\n  /** Once per send, for bulk loading — the per-recipient hooks would be an N+1. */\n  prepare?: (ctx: PrepareContext) => Promisable<unknown>;\n  beforeSend?: (ctx: BeforeSendContext) => Promisable<BeforeSendResult>;\n  resolveChannels?: (ctx: ResolveChannelsContext) => Promisable<readonly ChannelDecision[]>;\n  /**\n   * Once per send, after the rows are committed. The only hook that sees\n   * notification ids, which digests needs to bucket an entry against one.\n   * Fails open: the notification is already written.\n   */\n  afterSend?: (ctx: AfterSendContext) => Promisable<void>;\n  /**\n   * Delivers one of the plugin's declared `channels`. Core carries inApp and\n   * email; everything else arrives here, which is how push, sms and slack are\n   * added without core learning about them.\n   */\n  deliver?: (ctx: DeliverContext) => Promisable<DeliveryOutcome>;\n  afterDeliver?: (ctx: AfterDeliverContext) => Promisable<void>;\n};\n\nexport type FieldType = \"string\" | \"number\" | \"boolean\" | \"date\" | \"json\";\n\nexport type FieldDeclaration = {\n  type: FieldType;\n  required?: boolean;\n  default?: string | number | boolean;\n  /** date fields only. Renders as defaultNow() / CURRENT_TIMESTAMP. */\n  defaultNow?: boolean;\n};\n\nexport type IndexDeclaration = {\n  on: readonly string[];\n  unique?: boolean;\n  name?: string;\n};\n\nexport type TableDeclaration = {\n  tableName: string;\n  fields: Record<string, FieldDeclaration>;\n  primaryKey?: readonly string[];\n  indexes?: readonly IndexDeclaration[];\n};\n\nexport type SchemaDeclaration = Record<string, TableDeclaration>;\n\nexport type RouteScope =\n  | { type: \"user\" }\n  | { type: \"machine\" }\n  | { type: \"signed\"; purpose: string }\n  | { type: \"custom\"; justification: string };\n\nexport type RouteContext = {\n  request: Request;\n  /** Resolved for user-scoped routes, so a handler cannot forget to scope. */\n  userId: string | null;\n  /** Verified before dispatch, so a handler cannot forget to check. */\n  claims: TokenClaims | null;\n  params: Record<string, string>;\n};\n\nexport type RouteDefinition = {\n  path: string;\n  method: \"GET\" | \"POST\";\n  scope: RouteScope;\n  handler: (ctx: RouteContext) => Promise<Response>;\n};\n\n/** Handed to a plugin at startup so it need not be given the database twice. */\nexport type PluginInitContext = {\n  /** Scoped to the tables this plugin declares in schema(). */\n  store: PluginStore;\n  /**\n   * Mints tokens for this plugin's own `signed` routes and nothing else. The\n   * master secret itself is never handed out: a plugin cannot forge another\n   * plugin's links, or anything a future signed flow relies on.\n   */\n  sign: (request: SignRequest) => Promise<string>;\n  logger: Logger;\n  /** Configured notification names, so a route can refuse to store rows for types that do not exist. */\n  notificationTypes: readonly string[];\n  /** The app's resolver, for plugins that need timezones or addresses. */\n  getRecipients: (userIds: readonly string[]) => Promise<readonly Recipient[]>;\n  /**\n   * The instance's own send(). A plugin composing a message (a digest, say)\n   * routes it back through the pipeline rather than reaching for a provider,\n   * so it inherits retry, backoff and idempotency for free.\n   */\n  send: (\n    type: string,\n    args: { to: string | readonly string[]; payload: unknown; dedupeKey?: string },\n  ) => Promise<unknown>;\n};\n\nexport type EasyPingPlugin<\n  TId extends string = string,\n  TSchema extends SchemaDeclaration = SchemaDeclaration,\n> = {\n  id: TId;\n  dependsOn?: readonly string[];\n  schema?: TSchema;\n  routes?: readonly RouteDefinition[];\n  hooks?: PluginHooks;\n  /** Channels this plugin delivers. Makes them usable in a notification. */\n  channels?: readonly Channel[];\n  /** Called once by easyPing() before any hook or route can run. */\n  init?: (ctx: PluginInitContext) => void;\n};\n\nexport type AnyPlugin = EasyPingPlugin<string, SchemaDeclaration>;\n\nexport function definePlugin<TId extends string, TSchema extends SchemaDeclaration>(\n  plugin: EasyPingPlugin<TId, TSchema>,\n): EasyPingPlugin<TId, TSchema> {\n  return plugin;\n}\n\nexport type ClientFetch = (path: string, init?: RequestInit) => Promise<unknown>;\n\nexport type ClientPlugin<\n  TId extends string = string,\n  TActions extends Record<string, unknown> = Record<string, unknown>,\n> = {\n  id: TId;\n  /** Phantom. Links client types to the server plugin so a mismatch is a type error. */\n  $InferServerPlugin?: AnyPlugin;\n  actions: (fetch: ClientFetch) => TActions;\n};\n\nexport type AnyClientPlugin = ClientPlugin<string, Record<string, unknown>>;\n\nexport function defineClientPlugin<TId extends string, TActions extends Record<string, unknown>>(\n  plugin: ClientPlugin<TId, TActions>,\n): ClientPlugin<TId, TActions> {\n  return plugin;\n}\n\nexport type UnionToIntersection<U> = (U extends unknown ? (k: U) => void : never) extends (\n  k: infer I,\n) => void\n  ? I\n  : never;\n\n/** Naked type parameter, so the conditional distributes over the union. */\ntype ExtractActions<TPlugin> = TPlugin extends { actions: (fetch: never) => infer TActions }\n  ? TActions\n  : never;\n\n/** Indexes the tuple rather than recursing: a fold blows the instantiation depth limit. */\nexport type ActionsOf<TPlugins extends readonly AnyClientPlugin[]> = UnionToIntersection<\n  ExtractActions<TPlugins[number]>\n>;\n","import { defineClientPlugin } from \"../../core/plugin\";\nimport type { Channel, Frequency } from \"../../core/types\";\nimport type { preferences } from \"./index\";\n\nexport type PreferenceView = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n};\n\nexport type UpdatePreferenceInput = {\n  type: string;\n  channel: Channel;\n  enabled?: boolean;\n  frequency?: Frequency;\n};\n\n/** Paired by phantom type: importing the server plugin's value would bundle the DB. */\nexport const preferencesClient = () =>\n  defineClientPlugin({\n    id: \"preferences\",\n    $InferServerPlugin: {} as ReturnType<typeof preferences>,\n\n    actions: (fetch) => ({\n      listPreferences: async (): Promise<{\n        preferences: PreferenceView[];\n        defaultEnabled: boolean;\n      }> =>\n        (await fetch(\"/preferences\")) as {\n          preferences: PreferenceView[];\n          defaultEnabled: boolean;\n        },\n\n      updatePreference: async (input: UpdatePreferenceInput): Promise<{ ok: boolean }> =>\n        (await fetch(\"/preferences\", {\n          method: \"POST\",\n          body: JSON.stringify(input),\n        })) as { ok: boolean },\n    }),\n  });\n\nexport type PreferencesClient = ReturnType<typeof preferencesClient>;\n"]}

package/dist/plugins/preferences-client.d.cts

@@ -1,4 +1,4 @@
-import { f as ClientPlugin } from '../plugin-f5KaFWSN.cjs';
+import { f as ClientPlugin } from '../plugin-CiMsGlQe.cjs';
 import { C as Channel, F as Frequency } from '../adapter-BfLe2J0t.cjs';
 
 type PreferenceView = {

package/dist/plugins/preferences-client.d.ts

@@ -1,4 +1,4 @@
-import { f as ClientPlugin } from '../plugin-CmPOFVmn.js';
+import { f as ClientPlugin } from '../plugin-C9Hoxus2.js';
 import { C as Channel, F as Frequency } from '../adapter-BfLe2J0t.js';
 
 type PreferenceView = {

package/dist/plugins/preferences-client.js

@@ -1,4 +1,4 @@
-import { defineClientPlugin } from '../chunk-BV3U542P.js';
+import { defineClientPlugin } from '../chunk-W6I3B2CI.js';
 
 // src/plugins/preferences/client.ts
 var preferencesClient = () => defineClientPlugin({

package/dist/plugins/preferences.cjs

@@ -10,26 +10,87 @@ function encodeBase64Url(input) {
 
 // src/core/tokens.ts
 var encoder = new TextEncoder();
-async function hmacKey(secret) {
-  return crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
+var KEY_SALT = encoder.encode("easy-ping/tokens/v1");
+async function hmacKey(secret, purpose) {
+  const master = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, [
+    "deriveKey"
+  ]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: KEY_SALT, info: encoder.encode(purpose) },
+    master,
+    { name: "HMAC", hash: "SHA-256", length: 256 },
     false,
     ["sign", "verify"]
   );
 }
-async function signToken(secret, claims) {
-  const body = encodeBase64Url(JSON.stringify(claims));
-  const signature = await crypto.subtle.sign("HMAC", await hmacKey(secret), encoder.encode(body));
+async function signToken(secret, claims, now = /* @__PURE__ */ new Date()) {
+  const stamped = { ...claims, iat: claims.iat ?? Math.floor(now.getTime() / 1e3) };
+  const body = encodeBase64Url(JSON.stringify(stamped));
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    await hmacKey(secret, claims.purpose),
+    encoder.encode(body)
+  );
   return `${body}.${encodeBase64Url(new Uint8Array(signature))}`;
 }
 var DEFAULT_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
-var expiresIn = (seconds, now = /* @__PURE__ */ new Date()) => Math.floor(now.getTime() / 1e3) + seconds;
+var MAX_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
+var expiresIn = (seconds, now = /* @__PURE__ */ new Date()) => Math.floor(now.getTime() / 1e3) + Math.min(Math.max(seconds, 0), MAX_TOKEN_TTL_SECONDS);
+
+// src/core/handler.ts
+var MAX_BODY_BYTES = 64 * 1024;
+var PRIVATE_HEADERS = {
+  "cache-control": "private, no-store",
+  "x-content-type-options": "nosniff"
+};
+var json = (body, status = 200) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json", ...PRIVATE_HEADERS }
+});
+new TextEncoder();
+async function readJsonBody(request, maxBytes = MAX_BODY_BYTES) {
+  const tooLarge = () => ({ error: json({ error: `body exceeds ${maxBytes} bytes` }, 413) });
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) return tooLarge();
+  if (!request.body) return { body: {} };
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      return tooLarge();
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const text = new TextDecoder().decode(bytes);
+  if (text.trim() === "") return { body: {} };
+  try {
+    const parsed = JSON.parse(text);
+    return {
+      body: parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {}
+    };
+  } catch {
+    return { error: json({ error: "body must be a JSON object" }, 400) };
+  }
+}
 
 // src/plugins/preferences/index.ts
 var UNSUBSCRIBE_PURPOSE = "unsubscribe";
 var TABLE = "notification_preference";
+var CHANNELS = ["inApp", "email", "push", "sms", "slack"];
+var FREQUENCIES = ["instant", "daily", "weekly", "off"];
+var isChannel = (value) => CHANNELS.includes(value);
+var isFrequency = (value) => FREQUENCIES.includes(value);
 var key = (userId, type, channel) => `${userId} ${type} ${channel}`;
 function buildUnsubscribeToken(secret, userId, type, channel, ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS) {
   return signToken(secret, {
@@ -48,7 +109,9 @@ function preferences(options = {}) {
     return row ? row.enabled && row.frequency !== "off" : defaultEnabled;
   };
   const load = (userIds) => ctx.store.find(TABLE, { userId: { in: [...userIds] } });
-  const save = (row) => ctx.store.upsert(TABLE, [row], { onConflict: ["userId", "type", "channel"] });
+  const save = (row) => ctx.store.upsert(TABLE, [{ ...row, updatedAt: /* @__PURE__ */ new Date() }], {
+    onConflict: ["userId", "type", "channel"]
+  });
   return {
     id: "preferences",
     init: (context) => {
@@ -62,7 +125,8 @@ function preferences(options = {}) {
           type: { type: "string", required: true },
           channel: { type: "string", required: true },
           enabled: { type: "boolean", required: true, default: true },
-          frequency: { type: "string", required: true, default: "instant" }
+          frequency: { type: "string", required: true, default: "instant" },
+          updatedAt: { type: "date", required: true, defaultNow: true }
         },
         primaryKey: ["userId", "type", "channel"]
       }
@@ -100,9 +164,19 @@ function preferences(options = {}) {
         method: "POST",
         scope: { type: "user" },
         handler: async ({ request, userId }) => {
-          const body = await request.json().catch(() => null);
-          if (!body?.type || !body.channel) {
-            return Response.json({ error: "type and channel are required" }, { status: 400 });
+          const parsed = await readJsonBody(request);
+          if ("error" in parsed) return parsed.error;
+          const body = parsed.body;
+          const bad = (error) => Response.json({ error }, { status: 400 });
+          if (typeof body.type !== "string" || !ctx.notificationTypes.includes(body.type)) {
+            return bad("type must be a configured notification type");
+          }
+          if (!isChannel(body.channel)) return bad(`channel must be one of ${CHANNELS.join(", ")}`);
+          if (body.enabled !== void 0 && typeof body.enabled !== "boolean") {
+            return bad("enabled must be a boolean");
+          }
+          if (body.frequency !== void 0 && !isFrequency(body.frequency)) {
+            return bad(`frequency must be one of ${FREQUENCIES.join(", ")}`);
           }
           await save({
             userId: userId ?? "",
@@ -123,7 +197,18 @@ function preferences(options = {}) {
         handler: async ({ claims }) => {
           const type = claims?.data?.type;
           const channel = claims?.data?.channel;
-          if (!claims || !type || !channel) {
+          if (!claims || !type || !isChannel(channel)) {
+            return Response.json({ error: "invalid token" }, { status: 400 });
+          }
+          const [current] = await ctx.store.find(
+            TABLE,
+            { userId: claims.uid, type, channel },
+            { limit: 1 }
+          );
+          if (current && !current.enabled && current.frequency === "off") {
+            return Response.json({ ok: true, unsubscribed: { type, channel } });
+          }
+          if (current?.updatedAt && claims.iat !== void 0 && current.updatedAt.getTime() > (claims.iat + 1) * 1e3) {
             return Response.json({ error: "invalid token" }, { status: 400 });
           }
           await save({

package/dist/plugins/preferences.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/base64url.ts","../../src/core/tokens.ts","../../src/plugins/preferences/index.ts"],"names":[],"mappings":";;;AAEO,SAAS,gBAAgB,KAAA,EAAoC;AAClE,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,GAAI,KAAA;AAC5E,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;;;ACMA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAEhC,eAAe,QAAQ,MAAA,EAAoC;AACzD,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,KAAA;AAAA,IACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,GACnB;AACF;AAEA,eAAsB,SAAA,CAAU,QAAgB,MAAA,EAAsC;AACpF,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AACnD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAC,CAAA;AAC9F,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAC,CAAA,CAAA;AAC9D;AA2CO,IAAM,yBAAA,GAA4B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEjD,IAAM,SAAA,GAAY,CAAC,OAAA,EAAiB,GAAA,mBAAY,IAAI,IAAA,EAAK,KAC9D,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,OAAA,EAAQ,GAAI,GAAI,CAAA,GAAI,OAAA;;;ACjE9B,IAAM,mBAAA,GAAsB;AAEnC,IAAM,KAAA,GAAQ,yBAAA;AAkBd,IAAM,GAAA,GAAM,CAAC,MAAA,EAAgB,IAAA,EAAc,OAAA,KAAoB,GAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAIpF,SAAS,sBACd,MAAA,EACA,MAAA,EACA,IAAA,EACA,OAAA,EACA,aAAa,yBAAA,EACI;AACjB,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,GAAA,EAAK,MAAA;AAAA,IACL,OAAA,EAAS,mBAAA;AAAA,IACT,GAAA,EAAK,UAAU,UAAU,CAAA;AAAA,IACzB,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA;AAAQ,GACvB,CAAA;AACH;AAEO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAkC;AAC3F,EAAA,MAAM,cAAA,GAAiB,QAAQ,cAAA,IAAkB,IAAA;AACjD,EAAA,MAAM,aAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAA;AAGnD,EAAA,IAAI,GAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,CAAC,MAAA,EAAgB,IAAA,EAAc,SAAkB,IAAA,KAA8B;AAC/F,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,GAAA,GAAM,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,cAAc,KAAA,GAAQ,cAAA;AAAA,EACxD,CAAA;AAEA,EAAA,MAAM,OAAO,CAAC,OAAA,KACZ,GAAA,CAAI,KAAA,CAAM,KAAoB,KAAA,EAAO,EAAE,MAAA,EAAQ,EAAE,IAAI,CAAC,GAAG,OAAO,CAAA,IAAK,CAAA;AAEvE,EAAA,MAAM,OAAO,CAAC,GAAA,KACZ,GAAA,CAAI,KAAA,CAAM,OAAO,KAAA,EAAO,CAAC,GAAG,CAAA,EAAG,EAAE,UAAA,EAAY,CAAC,UAAU,MAAA,EAAQ,SAAS,GAAG,CAAA;AAE9E,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,aAAA;AAAA,IAEJ,IAAA,EAAM,CAAC,OAAA,KAAY;AACjB,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,sBAAA,EAAwB;AAAA,QACtB,SAAA,EAAW,KAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACzC,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACvC,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UAC1C,SAAS,EAAE,IAAA,EAAM,WAAW,QAAA,EAAU,IAAA,EAAM,SAAS,IAAA,EAAK;AAAA,UAC1D,WAAW,EAAE,IAAA,EAAM,UAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA;AAAU,SAClE;AAAA,QACA,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA;AAC1C,KACF;AAAA,IAEA,KAAA,EAAO;AAAA;AAAA,MAEL,OAAA,EAAS,OAAO,OAAA,KAA0D;AACxE,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG,2BAAW,GAAA,EAAI;AAEjD,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,SAAA,KAAc,SAAA,CAAU,MAAM,CAAC,CAAA;AAC/E,QAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,CAAC,QAAQ,CAAC,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,IAAI,IAAA,EAAM,GAAA,CAAI,OAAO,CAAA,EAAG,GAAG,CAAC,CAAC,CAAA;AAAA,MACjF,CAAA;AAAA,MAEA,eAAA,EAAiB,CAAC,OAAA,KAAoC;AACpD,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,SAAU,OAAA,CAAQ,SAAA;AAKjD,QAAA,IAAI,EAAE,OAAA,CAAQ,QAAA,YAAoB,GAAA,CAAA,EAAM;AACtC,UAAA,OAAO,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAgB,CAAE,CAAA;AAAA,QACvF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AAErB,QAAA,OAAO,QAAQ,SAAA,CAAU,GAAA;AAAA,UAAqB,CAAC,QAAA,KAC7C,SAAA,CAAU,OAAA,CAAQ,SAAA,CAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA,GACpE,QAAA,GACA,EAAE,GAAG,QAAA,EAAU,QAAQ,MAAA;AAAO,SACpC;AAAA,MACF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,KAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,CAAC,MAAA,IAAU,EAAE,CAAC,CAAA;AACtC,UAAA,OAAO,SAAS,IAAA,CAAK,EAAE,WAAA,EAAa,IAAA,EAAM,gBAAgB,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,MAEA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,QAAO,KAAM;AACtC,UAAA,MAAM,OAAQ,MAAM,OAAA,CAAQ,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAEnD,UAAA,IAAI,CAAC,IAAA,EAAM,IAAA,IAAQ,CAAC,KAAK,OAAA,EAAS;AAChC,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iCAAgC,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClF;AAGA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,IAAU,EAAA;AAAA,YAClB,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,OAAA,EAAS,KAAK,OAAA,IAAW,IAAA;AAAA,YACzB,SAAA,EAAW,KAAK,SAAA,IAAa;AAAA,WAC9B,CAAA;AAED,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACnC;AAAA,OACF;AAAA,MAEA;AAAA;AAAA;AAAA,QAGE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,mBAAA,EAAoB;AAAA,QACtD,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAM,IAAA;AAC3B,UAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAM,OAAA;AAC9B,UAAA,IAAI,CAAC,MAAA,IAAU,CAAC,IAAA,IAAQ,CAAC,OAAA,EAAS;AAChC,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,CAAO,GAAA;AAAA,YACf,IAAA;AAAA,YACA,OAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,SAAA,EAAW;AAAA,WACZ,CAAA;AAID,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,QACpE;AAAA;AACF;AACF,GACF;AACF","file":"preferences.cjs","sourcesContent":["// Web APIs, not Buffer: this runs on Workers and Vercel Edge.\n\nexport function encodeBase64Url(input: string | Uint8Array): string {\n  const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// Uint8Array<ArrayBuffer>: bare Uint8Array widens and is not a BufferSource.\nexport function decodeBase64UrlBytes(value: string): Uint8Array<ArrayBuffer> | null {\n  try {\n    const binary = atob(value.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n  } catch {\n    return null;\n  }\n}\n\nexport function decodeBase64Url(value: string): string | null {\n  const bytes = decodeBase64UrlBytes(value);\n  return bytes ? new TextDecoder().decode(bytes) : null;\n}\n","import { decodeBase64Url, decodeBase64UrlBytes, encodeBase64Url } from \"./base64url\";\n\nexport type TokenClaims = {\n  /** Subject — the user the token acts for. */\n  uid: string;\n  /** What the token is allowed to do. Verification requires an exact match. */\n  purpose: string;\n  /** Expiry, epoch seconds. */\n  exp: number;\n  /** Free-form, purpose-specific. */\n  data?: Record<string, string>;\n};\n\nconst encoder = new TextEncoder();\n\nasync function hmacKey(secret: string): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\nexport async function signToken(secret: string, claims: TokenClaims): Promise<string> {\n  const body = encodeBase64Url(JSON.stringify(claims));\n  const signature = await crypto.subtle.sign(\"HMAC\", await hmacKey(secret), encoder.encode(body));\n  return `${body}.${encodeBase64Url(new Uint8Array(signature))}`;\n}\n\n/** null for every failure mode. Distinguishing them tells an attacker which part to fix. */\nexport async function verifyToken(\n  secret: string,\n  token: string,\n  purpose: string,\n  now: Date = new Date(),\n): Promise<TokenClaims | null> {\n  const separator = token.lastIndexOf(\".\");\n  if (separator <= 0) return null;\n\n  const body = token.slice(0, separator);\n  const signature = decodeBase64UrlBytes(token.slice(separator + 1));\n  if (!signature) return null;\n\n  // crypto.subtle.verify is constant-time.\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    await hmacKey(secret),\n    signature,\n    encoder.encode(body),\n  );\n  if (!valid) return null;\n\n  const decoded = decodeBase64Url(body);\n  if (!decoded) return null;\n\n  let claims: TokenClaims;\n  try {\n    claims = JSON.parse(decoded) as TokenClaims;\n  } catch {\n    return null;\n  }\n\n  if (typeof claims?.uid !== \"string\" || typeof claims.exp !== \"number\") return null;\n  // Scoped so an unsubscribe token can never be replayed against another route.\n  if (claims.purpose !== purpose) return null;\n  if (claims.exp * 1000 <= now.getTime()) return null;\n\n  return claims;\n}\n\nexport const DEFAULT_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;\n\nexport const expiresIn = (seconds: number, now: Date = new Date()): number =>\n  Math.floor(now.getTime() / 1000) + seconds;\n","import type {\n  ChannelDecision,\n  EasyPingPlugin,\n  PluginInitContext,\n  PrepareContext,\n  ResolveChannelsContext,\n} from \"../../core/plugin\";\nimport { DEFAULT_TOKEN_TTL_SECONDS, expiresIn, signToken } from \"../../core/tokens\";\nimport type { Channel, Frequency } from \"../../core/types\";\n\nexport const UNSUBSCRIBE_PURPOSE = \"unsubscribe\";\n\nconst TABLE = \"notification_preference\";\n\nexport type PreferenceRow = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n};\n\nexport type PreferencesOptions = {\n  /** What an absent row means. Flip to false for opt-in-only notifications. */\n  defaultEnabled?: boolean;\n  /** Types that ignore preferences entirely: receipts, security alerts. */\n  alwaysSend?: readonly string[];\n  unsubscribeTtlSeconds?: number;\n};\n\nconst key = (userId: string, type: string, channel: string) => `${userId} ${type} ${channel}`;\n\ntype PreparedPreferences = Map<string, PreferenceRow>;\n\nexport function buildUnsubscribeToken(\n  secret: string,\n  userId: string,\n  type: string,\n  channel: Channel,\n  ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS,\n): Promise<string> {\n  return signToken(secret, {\n    uid: userId,\n    purpose: UNSUBSCRIBE_PURPOSE,\n    exp: expiresIn(ttlSeconds),\n    data: { type, channel },\n  });\n}\n\nexport function preferences(options: PreferencesOptions = {}): EasyPingPlugin<\"preferences\"> {\n  const defaultEnabled = options.defaultEnabled ?? true;\n  const alwaysSend = new Set(options.alwaysSend ?? []);\n\n  // Assigned by init(), which easyPing() runs before any hook or route.\n  let ctx: PluginInitContext;\n\n  const isAllowed = (userId: string, type: string, channel: Channel, rows: PreparedPreferences) => {\n    const row = rows.get(key(userId, type, channel));\n    return row ? row.enabled && row.frequency !== \"off\" : defaultEnabled;\n  };\n\n  const load = (userIds: readonly string[]) =>\n    ctx.store.find<PreferenceRow>(TABLE, { userId: { in: [...userIds] } });\n\n  const save = (row: PreferenceRow) =>\n    ctx.store.upsert(TABLE, [row], { onConflict: [\"userId\", \"type\", \"channel\"] });\n\n  return {\n    id: \"preferences\",\n\n    init: (context) => {\n      ctx = context;\n    },\n\n    schema: {\n      notificationPreference: {\n        tableName: TABLE,\n        fields: {\n          userId: { type: \"string\", required: true },\n          type: { type: \"string\", required: true },\n          channel: { type: \"string\", required: true },\n          enabled: { type: \"boolean\", required: true, default: true },\n          frequency: { type: \"string\", required: true, default: \"instant\" },\n        },\n        primaryKey: [\"userId\", \"type\", \"channel\"],\n      },\n    },\n\n    hooks: {\n      /** One query per send; doing this per recipient would be an N+1. */\n      prepare: async (context: PrepareContext): Promise<PreparedPreferences> => {\n        if (alwaysSend.has(context.type)) return new Map();\n\n        const rows = await load(context.recipients.map((recipient) => recipient.userId));\n        return new Map(rows.map((row) => [key(row.userId, row.type, row.channel), row]));\n      },\n\n      resolveChannels: (context: ResolveChannelsContext) => {\n        if (alwaysSend.has(context.type)) return context.decisions;\n\n        // prepare() failing leaves this undefined. Fail closed rather than\n        // assuming everyone opted in: that is exactly how people who\n        // unsubscribed get emailed anyway.\n        if (!(context.prepared instanceof Map)) {\n          return context.decisions.map((decision) => ({ ...decision, action: \"skip\" as const }));\n        }\n\n        const rows = context.prepared as PreparedPreferences;\n\n        return context.decisions.map<ChannelDecision>((decision) =>\n          isAllowed(context.recipient.userId, context.type, decision.channel, rows)\n            ? decision\n            : { ...decision, action: \"skip\" },\n        );\n      },\n    },\n\n    routes: [\n      {\n        path: \"/preferences\",\n        method: \"GET\",\n        scope: { type: \"user\" },\n        handler: async ({ userId }) => {\n          const rows = await load([userId ?? \"\"]);\n          return Response.json({ preferences: rows, defaultEnabled });\n        },\n      },\n\n      {\n        path: \"/preferences\",\n        method: \"POST\",\n        scope: { type: \"user\" },\n        handler: async ({ request, userId }) => {\n          const body = (await request.json().catch(() => null)) as Partial<PreferenceRow> | null;\n\n          if (!body?.type || !body.channel) {\n            return Response.json({ error: \"type and channel are required\" }, { status: 400 });\n          }\n\n          // userId comes from the resolved session, never from the body.\n          await save({\n            userId: userId ?? \"\",\n            type: body.type,\n            channel: body.channel,\n            enabled: body.enabled ?? true,\n            frequency: body.frequency ?? \"instant\",\n          });\n\n          return Response.json({ ok: true });\n        },\n      },\n\n      {\n        // Reached from a mail client with no session, so it is authenticated\n        // by the signature on the link itself.\n        path: \"/unsubscribe\",\n        method: \"POST\",\n        scope: { type: \"signed\", purpose: UNSUBSCRIBE_PURPOSE },\n        handler: async ({ claims }) => {\n          const type = claims?.data?.type;\n          const channel = claims?.data?.channel as Channel | undefined;\n          if (!claims || !type || !channel) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          await save({\n            userId: claims.uid,\n            type,\n            channel,\n            enabled: false,\n            frequency: \"off\",\n          });\n\n          // Gmail and Yahoo one-click requires the POST itself to unsubscribe,\n          // with no confirmation page.\n          return Response.json({ ok: true, unsubscribed: { type, channel } });\n        },\n      },\n    ],\n  };\n}\n"]}
+{"version":3,"sources":["../../src/core/base64url.ts","../../src/core/tokens.ts","../../src/core/handler.ts","../../src/plugins/preferences/index.ts"],"names":[],"mappings":";;;AAEO,SAAS,gBAAgB,KAAA,EAAoC;AAClE,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,GAAI,KAAA;AAC5E,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;;;ACQA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAGhC,IAAM,QAAA,GAAW,OAAA,CAAQ,MAAA,CAAO,qBAAqB,CAAA;AAOrD,eAAe,OAAA,CAAQ,QAAgB,OAAA,EAAqC;AAC1E,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,EAAQ,KAAA,EAAO;AAAA,IACzF;AAAA,GACD,CAAA;AACD,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAE;AAAA,IAC/E,MAAA;AAAA,IACA,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAW,QAAQ,GAAA,EAAI;AAAA,IAC7C,KAAA;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,GACnB;AACF;AAEA,eAAsB,UACpB,MAAA,EACA,MAAA,EACA,GAAA,mBAAY,IAAI,MAAK,EACJ;AACjB,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAK,MAAA,CAAO,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,OAAA,EAAQ,GAAI,GAAI,CAAA,EAAE;AAC9F,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,IACpC,MAAA;AAAA,IACA,MAAM,OAAA,CAAQ,MAAA,EAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,IACpC,OAAA,CAAQ,OAAO,IAAI;AAAA,GACrB;AACA,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAC,CAAA,CAAA;AAC9D;AAsDO,IAAM,yBAAA,GAA4B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEjD,IAAM,qBAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAE7C,IAAM,SAAA,GAAY,CAAC,OAAA,EAAiB,GAAA,uBAAgB,IAAA,EAAK,KAC9D,KAAK,KAAA,CAAM,GAAA,CAAI,SAAQ,GAAI,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,GAAA,CAAI,OAAA,EAAS,CAAC,CAAA,EAAG,qBAAqB,CAAA;;;AChFlF,IAAM,iBAAiB,EAAA,GAAK,IAAA;AAMnC,IAAM,eAAA,GAA0C;AAAA,EAC9C,eAAA,EAAiB,mBAAA;AAAA,EACjB,wBAAA,EAA0B;AAC5B,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,IAAA,EAAe,MAAA,GAAS,GAAA,KACpC,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,EACjC,MAAA;AAAA,EACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,GAAG,eAAA;AACpD,CAAC,CAAA;AAiBa,IAAI,WAAA;AAkCpB,eAAsB,YAAA,CACpB,OAAA,EACA,QAAA,GAAmB,cAAA,EACA;AACnB,EAAA,MAAM,QAAA,GAAW,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,aAAA,EAAgB,QAAQ,CAAA,MAAA,CAAA,EAAS,EAAG,GAAG,CAAA,EAAE,CAAA;AAExF,EAAA,MAAM,WAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAC,CAAA;AAC7D,EAAA,IAAI,OAAO,QAAA,CAAS,QAAQ,KAAK,QAAA,GAAW,QAAA,SAAiB,QAAA,EAAS;AACtE,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,SAAa,EAAE,IAAA,EAAM,EAAC,EAAE;AAErC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,IAAA,CAAK,SAAA,EAAU;AACtC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,WAAS;AACP,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,KAAA,IAAS,KAAA,CAAM,UAAA;AACf,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA,OAAO,QAAA,EAAS;AAAA,IAClB;AACA,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EACnB;AAEA,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,KAAK,CAAA;AAClC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AACvB,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAClB;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,MAAK,KAAM,EAAA,SAAW,EAAE,IAAA,EAAM,EAAC,EAAE;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACvC,IAAA,OAAO;AAAA,MACL,IAAA,EACE,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GACxD,MAAA,GACD;AAAC,KACT;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,OAAO,IAAA,CAAK,EAAE,OAAO,4BAAA,EAA6B,EAAG,GAAG,CAAA,EAAE;AAAA,EACrE;AACF;;;ACnIO,IAAM,mBAAA,GAAsB;AAEnC,IAAM,KAAA,GAAQ,yBAAA;AAEd,IAAM,WAA+B,CAAC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC9E,IAAM,WAAA,GAAoC,CAAC,SAAA,EAAW,OAAA,EAAS,UAAU,KAAK,CAAA;AAE9E,IAAM,SAAA,GAAY,CAAC,KAAA,KAAqC,QAAA,CAAS,SAAS,KAAgB,CAAA;AAC1F,IAAM,WAAA,GAAc,CAAC,KAAA,KACnB,WAAA,CAAY,SAAS,KAAkB,CAAA;AAoBzC,IAAM,GAAA,GAAM,CAAC,MAAA,EAAgB,IAAA,EAAc,OAAA,KAAoB,GAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAIpF,SAAS,sBACd,MAAA,EACA,MAAA,EACA,IAAA,EACA,OAAA,EACA,aAAa,yBAAA,EACI;AACjB,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,GAAA,EAAK,MAAA;AAAA,IACL,OAAA,EAAS,mBAAA;AAAA,IACT,GAAA,EAAK,UAAU,UAAU,CAAA;AAAA,IACzB,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA;AAAQ,GACvB,CAAA;AACH;AAEO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAkC;AAC3F,EAAA,MAAM,cAAA,GAAiB,QAAQ,cAAA,IAAkB,IAAA;AACjD,EAAA,MAAM,aAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAA;AAGnD,EAAA,IAAI,GAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,CAAC,MAAA,EAAgB,IAAA,EAAc,SAAkB,IAAA,KAA8B;AAC/F,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,GAAA,GAAM,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,cAAc,KAAA,GAAQ,cAAA;AAAA,EACxD,CAAA;AAEA,EAAA,MAAM,OAAO,CAAC,OAAA,KACZ,GAAA,CAAI,KAAA,CAAM,KAAoB,KAAA,EAAO,EAAE,MAAA,EAAQ,EAAE,IAAI,CAAC,GAAG,OAAO,CAAA,IAAK,CAAA;AAEvE,EAAA,MAAM,OAAO,CAAC,GAAA,KACZ,GAAA,CAAI,KAAA,CAAM,OAAO,KAAA,EAAO,CAAC,EAAE,GAAG,KAAK,SAAA,kBAAW,IAAI,IAAA,EAAK,EAAG,CAAA,EAAG;AAAA,IAC3D,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA,GACzC,CAAA;AAEH,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,aAAA;AAAA,IAEJ,IAAA,EAAM,CAAC,OAAA,KAAY;AACjB,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,sBAAA,EAAwB;AAAA,QACtB,SAAA,EAAW,KAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACzC,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACvC,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UAC1C,SAAS,EAAE,IAAA,EAAM,WAAW,QAAA,EAAU,IAAA,EAAM,SAAS,IAAA,EAAK;AAAA,UAC1D,WAAW,EAAE,IAAA,EAAM,UAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA,EAAU;AAAA,UAChE,WAAW,EAAE,IAAA,EAAM,QAAQ,QAAA,EAAU,IAAA,EAAM,YAAY,IAAA;AAAK,SAC9D;AAAA,QACA,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA;AAC1C,KACF;AAAA,IAEA,KAAA,EAAO;AAAA;AAAA,MAEL,OAAA,EAAS,OAAO,OAAA,KAA0D;AACxE,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG,2BAAW,GAAA,EAAI;AAEjD,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,SAAA,KAAc,SAAA,CAAU,MAAM,CAAC,CAAA;AAC/E,QAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,CAAC,QAAQ,CAAC,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,IAAI,IAAA,EAAM,GAAA,CAAI,OAAO,CAAA,EAAG,GAAG,CAAC,CAAC,CAAA;AAAA,MACjF,CAAA;AAAA,MAEA,eAAA,EAAiB,CAAC,OAAA,KAAoC;AACpD,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,SAAU,OAAA,CAAQ,SAAA;AAKjD,QAAA,IAAI,EAAE,OAAA,CAAQ,QAAA,YAAoB,GAAA,CAAA,EAAM;AACtC,UAAA,OAAO,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAgB,CAAE,CAAA;AAAA,QACvF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AAErB,QAAA,OAAO,QAAQ,SAAA,CAAU,GAAA;AAAA,UAAqB,CAAC,QAAA,KAC7C,SAAA,CAAU,OAAA,CAAQ,SAAA,CAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA,GACpE,QAAA,GACA,EAAE,GAAG,QAAA,EAAU,QAAQ,MAAA;AAAO,SACpC;AAAA,MACF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,KAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,CAAC,MAAA,IAAU,EAAE,CAAC,CAAA;AACtC,UAAA,OAAO,SAAS,IAAA,CAAK,EAAE,WAAA,EAAa,IAAA,EAAM,gBAAgB,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,MAEA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,QAAO,KAAM;AACtC,UAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAO,CAAA;AACzC,UAAA,IAAI,OAAA,IAAW,MAAA,EAAQ,OAAO,MAAA,CAAO,KAAA;AACrC,UAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAEpB,UAAA,MAAM,GAAA,GAAM,CAAC,KAAA,KAAkB,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAM,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAIvE,UAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,CAAC,IAAI,iBAAA,CAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AAC/E,YAAA,OAAO,IAAI,6CAA6C,CAAA;AAAA,UAC1D;AACA,UAAA,IAAI,CAAC,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,GAAA,CAAI,CAAA,uBAAA,EAA0B,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AACxF,UAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAa,OAAO,IAAA,CAAK,YAAY,SAAA,EAAW;AACnE,YAAA,OAAO,IAAI,2BAA2B,CAAA;AAAA,UACxC;AACA,UAAA,IAAI,KAAK,SAAA,KAAc,MAAA,IAAa,CAAC,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA,EAAG;AAChE,YAAA,OAAO,IAAI,CAAA,yBAAA,EAA4B,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,UACjE;AAGA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,IAAU,EAAA;AAAA,YAClB,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,OAAA,EAAS,KAAK,OAAA,IAAW,IAAA;AAAA,YACzB,SAAA,EAAW,KAAK,SAAA,IAAa;AAAA,WAC9B,CAAA;AAED,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACnC;AAAA,OACF;AAAA,MAEA;AAAA;AAAA;AAAA,QAGE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,mBAAA,EAAoB;AAAA,QACtD,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAM,IAAA;AAC3B,UAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAM,OAAA;AAC9B,UAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAQ,CAAC,SAAA,CAAU,OAAO,CAAA,EAAG;AAC3C,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAI,KAAA,CAAM,IAAA;AAAA,YAChC,KAAA;AAAA,YACA,EAAE,MAAA,EAAQ,MAAA,CAAO,GAAA,EAAK,MAAM,OAAA,EAAQ;AAAA,YACpC,EAAE,OAAO,CAAA;AAAE,WACb;AAGA,UAAA,IAAI,WAAW,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,cAAc,KAAA,EAAO;AAC9D,YAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,UACpE;AAIA,UAAA,IACE,OAAA,EAAS,SAAA,IACT,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAQ,GAAA,CAAK,MAAA,CAAO,GAAA,GAAM,CAAA,IAAK,GAAA,EACjD;AACA,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,CAAO,GAAA;AAAA,YACf,IAAA;AAAA,YACA,OAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,SAAA,EAAW;AAAA,WACZ,CAAA;AAID,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,QACpE;AAAA;AACF;AACF,GACF;AACF","file":"preferences.cjs","sourcesContent":["// Web APIs, not Buffer: this runs on Workers and Vercel Edge.\n\nexport function encodeBase64Url(input: string | Uint8Array): string {\n  const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// Uint8Array<ArrayBuffer>: bare Uint8Array widens and is not a BufferSource.\nexport function decodeBase64UrlBytes(value: string): Uint8Array<ArrayBuffer> | null {\n  try {\n    const binary = atob(value.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n  } catch {\n    return null;\n  }\n}\n\nexport function decodeBase64Url(value: string): string | null {\n  const bytes = decodeBase64UrlBytes(value);\n  return bytes ? new TextDecoder().decode(bytes) : null;\n}\n","import { decodeBase64Url, decodeBase64UrlBytes, encodeBase64Url } from \"./base64url\";\n\nexport type TokenClaims = {\n  /** Subject — the user the token acts for. */\n  uid: string;\n  /** What the token is allowed to do. Verification requires an exact match. */\n  purpose: string;\n  /** Expiry, epoch seconds. */\n  exp: number;\n  /** Issued at, epoch seconds. Set by signToken; lets a route refuse a token older than a later change. */\n  iat?: number;\n  /** Free-form, purpose-specific. */\n  data?: Record<string, string>;\n};\n\nconst encoder = new TextEncoder();\n\n// Changing this invalidates every outstanding token. Bump it on purpose only.\nconst KEY_SALT = encoder.encode(\"easy-ping/tokens/v1\");\n\n/**\n * One HMAC key per purpose, derived from the master secret with HKDF. A key\n * that can sign unsubscribe links cannot sign anything else, so a plugin\n * handed the unsubscribe key gets exactly that and no more.\n */\nasync function hmacKey(secret: string, purpose: string): Promise<CryptoKey> {\n  const master = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"HKDF\", false, [\n    \"deriveKey\",\n  ]);\n  return crypto.subtle.deriveKey(\n    { name: \"HKDF\", hash: \"SHA-256\", salt: KEY_SALT, info: encoder.encode(purpose) },\n    master,\n    { name: \"HMAC\", hash: \"SHA-256\", length: 256 },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\nexport async function signToken(\n  secret: string,\n  claims: TokenClaims,\n  now: Date = new Date(),\n): Promise<string> {\n  const stamped: TokenClaims = { ...claims, iat: claims.iat ?? Math.floor(now.getTime() / 1000) };\n  const body = encodeBase64Url(JSON.stringify(stamped));\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    await hmacKey(secret, claims.purpose),\n    encoder.encode(body),\n  );\n  return `${body}.${encodeBase64Url(new Uint8Array(signature))}`;\n}\n\n/** null for every failure mode. Distinguishing them tells an attacker which part to fix. */\nexport async function verifyToken(\n  secret: string,\n  token: string,\n  purpose: string,\n  now: Date = new Date(),\n): Promise<TokenClaims | null> {\n  const separator = token.lastIndexOf(\".\");\n  if (separator <= 0) return null;\n\n  const body = token.slice(0, separator);\n  const signature = decodeBase64UrlBytes(token.slice(separator + 1));\n  if (!signature) return null;\n\n  // Verified under the key for the purpose this route expects, before the\n  // body is even parsed. A token minted for another purpose fails here.\n  // crypto.subtle.verify is constant-time.\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    await hmacKey(secret, purpose),\n    signature,\n    encoder.encode(body),\n  );\n  if (!valid) return null;\n\n  const decoded = decodeBase64Url(body);\n  if (!decoded) return null;\n\n  let claims: TokenClaims;\n  try {\n    claims = JSON.parse(decoded) as TokenClaims;\n  } catch {\n    return null;\n  }\n\n  if (typeof claims?.uid !== \"string\" || typeof claims.exp !== \"number\") return null;\n  if (claims.purpose !== purpose) return null;\n  if (claims.exp * 1000 <= now.getTime()) return null;\n  if (claims.iat !== undefined && typeof claims.iat !== \"number\") return null;\n\n  if (claims.data !== undefined) {\n    if (typeof claims.data !== \"object\" || claims.data === null || Array.isArray(claims.data)) {\n      return null;\n    }\n    for (const value of Object.values(claims.data)) {\n      if (typeof value !== \"string\") return null;\n    }\n  }\n\n  return claims;\n}\n\nexport const DEFAULT_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;\n/** Ninety days. A link that must outlive this should be re-issued, not made immortal. */\nexport const MAX_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\nexport const expiresIn = (seconds: number, now: Date = new Date()): number =>\n  Math.floor(now.getTime() / 1000) + Math.min(Math.max(seconds, 0), MAX_TOKEN_TTL_SECONDS);\n\nexport type SignRequest = {\n  uid: string;\n  purpose: string;\n  data?: Record<string, string>;\n  /** Defaults to 30 days, capped at 90. */\n  ttlSeconds?: number;\n};\n\n/**\n * What a plugin gets instead of the secret: a signer that only mints tokens\n * for the purposes its own `signed` routes declared.\n */\nexport function createScopedSigner(\n  secret: string,\n  pluginId: string,\n  purposes: ReadonlySet<string>,\n  onViolation: (message: string) => Error,\n): (request: SignRequest) => Promise<string> {\n  return (request) => {\n    if (!purposes.has(request.purpose)) {\n      throw onViolation(\n        `plugin \"${pluginId}\" tried to sign a token for purpose \"${request.purpose}\", ` +\n          \"which none of its signed routes declare.\",\n      );\n    }\n    return signToken(secret, {\n      uid: request.uid,\n      purpose: request.purpose,\n      exp: expiresIn(request.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS),\n      ...(request.data ? { data: request.data } : {}),\n    });\n  };\n}\n","import type { DatabaseAdapter } from \"./adapter\";\nimport type { SessionConfig } from \"./config\";\nimport type { Logger } from \"./errors\";\nimport type { Promisable, RouteDefinition } from \"./plugin\";\nimport type { Runner } from \"./runner\";\nimport { verifyToken } from \"./tokens\";\n\nexport type HandlerDeps = {\n  adapter: DatabaseAdapter;\n  session: SessionConfig;\n  runner: Runner;\n  logger: Logger;\n  basePath: string;\n  secret: string;\n  cronSecret?: string | undefined;\n  /** Guards plugin machine routes. The instance defaults it to cronSecret. */\n  machineSecret?: string | undefined;\n  cronMaxSweeps?: number | undefined;\n  pluginRoutes?: readonly RouteDefinition[] | undefined;\n  /** Returns a 429 to send, or null to proceed. Runs after onRequest, before routing. */\n  rateLimit?: ((request: Request) => Response | null) | undefined;\n  /** Origins other than the request's own host that may POST. `*.example.com` allowed. */\n  trustedOrigins?: readonly string[] | undefined;\n  /** Runs before routing. Returning a Response short-circuits; use it for rate limiting. */\n  // biome-ignore lint/suspicious/noConfusingVoidType: a hook that returns nothing is the common case\n  onRequest?: ((request: Request) => Promisable<Response | undefined | void>) | undefined;\n  maxBodyBytes?: number | undefined;\n};\n\n/** Every JSON body is capped here. Nothing legitimate the routes accept is bigger. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\nconst MAX_READ_IDS = 200;\n\n// The inbox is per-user data: never let a shared cache keep it, never let a\n// browser sniff it into something executable.\nconst PRIVATE_HEADERS: Record<string, string> = {\n  \"cache-control\": \"private, no-store\",\n  \"x-content-type-options\": \"nosniff\",\n};\n\nconst json = (body: unknown, status = 200) =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { \"content-type\": \"application/json\", ...PRIVATE_HEADERS },\n  });\n\nconst empty = (status: number) => new Response(null, { status, headers: PRIVATE_HEADERS });\n\n/** Plugin responses get the same headers, without touching their body. */\nfunction harden(response: Response): Response {\n  const headers = new Headers(response.headers);\n  for (const [name, value] of Object.entries(PRIVATE_HEADERS)) {\n    if (!headers.has(name)) headers.set(name, value);\n  }\n  return new Response(response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n\nconst encoder = new TextEncoder();\n\n/**\n * Constant-time comparison over SHA-256 digests. Node's timingSafeEqual is\n * unavailable on edge runtimes, `===` leaks through timing, and comparing the\n * raw strings would still reveal the secret's length.\n */\nasync function timingSafeEqual(a: string, b: string): Promise<boolean> {\n  const [left, right] = await Promise.all(\n    [a, b].map(\n      async (value) => new Uint8Array(await crypto.subtle.digest(\"SHA-256\", encoder.encode(value))),\n    ),\n  );\n  let diff = 0;\n  for (let i = 0; i < 32; i += 1) diff |= (left?.[i] ?? 0) ^ (right?.[i] ?? 0);\n  return diff === 0;\n}\n\n/** Anchored at a segment boundary: `/foo/api/notifications/cron` is not a cron request. */\nfunction routePath(url: URL, basePath: string): string {\n  const { pathname } = url;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) return pathname.slice(basePath.length);\n  return pathname;\n}\n\nexport type JsonBody = { body: Record<string, unknown> } | { error: Response };\n\n/**\n * Reads a JSON object body with a byte cap enforced while streaming, so an\n * oversized body is refused before it is buffered. Malformed JSON is 400; an\n * empty body is `{}`. Plugin routes should use this rather than\n * `request.json()`, which has no limit.\n */\nexport async function readJsonBody(\n  request: Request,\n  maxBytes: number = MAX_BODY_BYTES,\n): Promise<JsonBody> {\n  const tooLarge = () => ({ error: json({ error: `body exceeds ${maxBytes} bytes` }, 413) });\n\n  const declared = Number(request.headers.get(\"content-length\"));\n  if (Number.isFinite(declared) && declared > maxBytes) return tooLarge();\n  if (!request.body) return { body: {} };\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      return tooLarge();\n    }\n    chunks.push(value);\n  }\n\n  const bytes = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n\n  const text = new TextDecoder().decode(bytes);\n  if (text.trim() === \"\") return { body: {} };\n\n  try {\n    const parsed: unknown = JSON.parse(text);\n    return {\n      body:\n        parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n          ? (parsed as Record<string, unknown>)\n          : {},\n    };\n  } catch {\n    return { error: json({ error: \"body must be a JSON object\" }, 400) };\n  }\n}\n\nconst isJsonContentType = (request: Request) =>\n  /^application\\/json\\s*(;|$)/i.test((request.headers.get(\"content-type\") ?? \"\").trim());\n\nfunction originAllowed(origin: string, url: URL, request: Request, trusted: readonly string[]) {\n  let host: string;\n  try {\n    host = new URL(origin).host;\n  } catch {\n    return false;\n  }\n\n  if (host === url.host) return true;\n  // Behind a proxy that rewrites Host, the public host arrives here instead.\n  const forwarded = request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  if (forwarded && host === forwarded) return true;\n\n  return trusted.some((entry) =>\n    entry.startsWith(\"*.\") ? host.endsWith(entry.slice(1)) : entry === origin,\n  );\n}\n\n/**\n * Two cheap CSRF defences for cookie-authenticated POSTs. A cross-site form\n * cannot send `application/json` without a preflight the browser will fail,\n * and it cannot forge `Origin`. Neither depends on the host app's SameSite\n * policy, which the library cannot see.\n */\nfunction csrfCheck(request: Request, url: URL, trusted: readonly string[]): Response | null {\n  if (!isJsonContentType(request)) {\n    return json({ error: \"content-type must be application/json\" }, 415);\n  }\n\n  const origin = request.headers.get(\"origin\");\n  if (origin === null) return null;\n  if (origin === \"null\" || !originAllowed(origin, url, request, trusted)) return empty(403);\n\n  return null;\n}\n\nexport function createHandler(deps: HandlerDeps) {\n  const trustedOrigins = deps.trustedOrigins ?? [];\n  const maxBodyBytes = deps.maxBodyBytes ?? MAX_BODY_BYTES;\n\n  async function resolveUserId(request: Request): Promise<string | null | \"error\"> {\n    try {\n      return await deps.session.getUserId(request);\n    } catch (error) {\n      // A broken session lookup is a 500, never a 401. Collapsing them makes\n      // an outage look like a mass logout. RFC 0002 §1.\n      deps.logger.error(\"session.getUserId threw\", { error });\n      return \"error\";\n    }\n  }\n\n  async function bearerMatches(request: Request, secret: string | undefined): Promise<boolean> {\n    if (!secret) return false;\n    const header = request.headers.get(\"authorization\") ?? \"\";\n    const presented = header.startsWith(\"Bearer \") ? header.slice(7) : header;\n    return timingSafeEqual(presented, secret);\n  }\n\n  async function handleCron(request: Request): Promise<Response> {\n    if (!deps.cronSecret) return empty(404);\n    if (!(await bearerMatches(request, deps.cronSecret))) return empty(401);\n\n    // Bounded: an overlapping scheduler must not hold a request open for as\n    // long as the backlog lasts.\n    const result = await deps.runner.drain(\n      deps.cronMaxSweeps === undefined ? {} : { maxSweeps: deps.cronMaxSweeps },\n    );\n    return json(result);\n  }\n\n  /**\n   * Plugin routes are dispatched before core ones and carry their scope with\n   * them. Authentication happens here rather than in the plugin handler, so a\n   * plugin physically cannot forget to check a signature or scope a query.\n   */\n  async function handlePluginRoute(\n    route: RouteDefinition,\n    request: Request,\n    url: URL,\n  ): Promise<Response> {\n    if (route.scope.type === \"user\") {\n      if (request.method === \"POST\") {\n        const rejected = csrfCheck(request, url, trustedOrigins);\n        if (rejected) return rejected;\n      }\n\n      const userId = await resolveUserId(request);\n      if (userId === \"error\") return empty(500);\n      if (userId === null) return empty(401);\n      return harden(await route.handler({ request, userId, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"machine\") {\n      if (!deps.machineSecret) return empty(404);\n      if (!(await bearerMatches(request, deps.machineSecret))) return empty(401);\n      return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"signed\") {\n      const token =\n        url.searchParams.get(\"token\") ??\n        (request.headers.get(\"authorization\") ?? \"\").replace(/^Bearer /, \"\");\n\n      const claims = await verifyToken(deps.secret, token, route.scope.purpose);\n      // One response for every failure mode. Distinguishing expired from\n      // forged tells an attacker which part to fix. RFC 0002 §5.\n      if (!claims) return empty(400);\n\n      return harden(await route.handler({ request, userId: claims.uid, claims, params: {} }));\n    }\n\n    return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n  }\n\n  async function route(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const path = routePath(url, deps.basePath);\n\n    if (deps.onRequest) {\n      const early = await deps.onRequest(request);\n      if (early instanceof Response) return early;\n    }\n\n    if (deps.rateLimit) {\n      const limited = deps.rateLimit(request);\n      if (limited) return limited;\n    }\n\n    if (path === \"/cron\") {\n      if (request.method !== \"POST\") return empty(405);\n      return handleCron(request);\n    }\n\n    const pluginRoute = deps.pluginRoutes?.find(\n      (candidate) => candidate.path === path && candidate.method === request.method,\n    );\n    if (pluginRoute) return handlePluginRoute(pluginRoute, request, url);\n\n    if (request.method === \"POST\") {\n      const rejected = csrfCheck(request, url, trustedOrigins);\n      if (rejected) return rejected;\n    }\n\n    const userId = await resolveUserId(request);\n    if (userId === \"error\") return empty(500);\n    if (userId === null) return empty(401);\n\n    if (request.method === \"GET\" && path === \"/\") {\n      const limitParam = Number(url.searchParams.get(\"limit\") ?? 20);\n      const limit = Number.isFinite(limitParam) ? Math.min(Math.max(limitParam, 1), 100) : 20;\n      const cursor = url.searchParams.get(\"cursor\");\n\n      // The badge count rides along with the first page, so a polling client\n      // needs one request per tick instead of two. Paginating past the first\n      // page omits it: a cursor request is scrollback, not a poll.\n      const [page, unseenCount] = await Promise.all([\n        deps.adapter.listNotifications({\n          userId,\n          limit,\n          ...(cursor ? { cursor } : {}),\n          ...(url.searchParams.get(\"unreadOnly\") === \"true\" ? { unreadOnly: true } : {}),\n        }),\n        cursor ? Promise.resolve(null) : deps.adapter.countUnseen(userId),\n      ]);\n\n      return json(unseenCount === null ? page : { ...page, unseenCount });\n    }\n\n    if (request.method === \"GET\" && path === \"/count\") {\n      return json({ unseen: await deps.adapter.countUnseen(userId) });\n    }\n\n    if (request.method === \"POST\" && path === \"/seen\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const before = typeof parsed.body.before === \"string\" ? new Date(parsed.body.before) : null;\n\n      // Defaults to now, but a client should send the timestamp of the newest\n      // notification it has actually rendered. Otherwise anything that arrived\n      // between the last poll and the click is marked seen without ever having\n      // produced a badge — the user silently misses it.\n      //\n      // +1ms because Postgres keeps microseconds while an ISO string carries\n      // only milliseconds. Without it the truncated cutoff falls *before* the\n      // very row it was taken from, and markSeen matches nothing at all.\n      const cutoff =\n        before && !Number.isNaN(before.getTime()) ? new Date(before.getTime() + 1) : new Date();\n\n      await deps.adapter.markSeen(userId, cutoff);\n      return json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && path === \"/read\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const ids = Array.isArray(parsed.body.ids)\n        ? parsed.body.ids.filter((id): id is string => typeof id === \"string\")\n        : [];\n      if (ids.length === 0) return json({ error: \"ids must be a non-empty string array\" }, 400);\n\n      // Unbounded, this builds a query with as many bind parameters as the\n      // caller cares to send. Postgres caps at 65535 and degrades long before.\n      if (ids.length > MAX_READ_IDS) {\n        return json({ error: `at most ${MAX_READ_IDS} ids per request` }, 400);\n      }\n\n      // Scoped by userId in the adapter. A miss is 404, not 403 — a 403 would\n      // confirm the row exists and belongs to someone else. RFC 0002 §2.\n      const updated = await deps.adapter.markRead(userId, ids);\n      return updated === 0 ? empty(404) : json({ updated });\n    }\n\n    if (request.method === \"POST\" && path === \"/read-all\") {\n      return json({ updated: await deps.adapter.markAllRead(userId) });\n    }\n\n    return empty(404);\n  }\n\n  async function handle(request: Request): Promise<Response> {\n    try {\n      return await route(request);\n    } catch (error) {\n      // Never let a driver error escape: on Node it becomes an unhandled\n      // rejection, on other hosts a stack trace in the response body.\n      deps.logger.error(\"request failed\", { url: request.url, error });\n      return empty(500);\n    }\n  }\n\n  return {\n    handle,\n    GET: handle,\n    POST: handle,\n  };\n}\n","import { readJsonBody } from \"../../core/handler\";\nimport type {\n  ChannelDecision,\n  EasyPingPlugin,\n  PluginInitContext,\n  PrepareContext,\n  ResolveChannelsContext,\n} from \"../../core/plugin\";\nimport { DEFAULT_TOKEN_TTL_SECONDS, expiresIn, signToken } from \"../../core/tokens\";\nimport type { Channel, Frequency } from \"../../core/types\";\n\nexport const UNSUBSCRIBE_PURPOSE = \"unsubscribe\";\n\nconst TABLE = \"notification_preference\";\n\nconst CHANNELS: readonly Channel[] = [\"inApp\", \"email\", \"push\", \"sms\", \"slack\"];\nconst FREQUENCIES: readonly Frequency[] = [\"instant\", \"daily\", \"weekly\", \"off\"];\n\nconst isChannel = (value: unknown): value is Channel => CHANNELS.includes(value as Channel);\nconst isFrequency = (value: unknown): value is Frequency =>\n  FREQUENCIES.includes(value as Frequency);\n\nexport type PreferenceRow = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n  /** Last explicit change. An unsubscribe token issued before it is refused. */\n  updatedAt?: Date;\n};\n\nexport type PreferencesOptions = {\n  /** What an absent row means. Flip to false for opt-in-only notifications. */\n  defaultEnabled?: boolean;\n  /** Types that ignore preferences entirely: receipts, security alerts. */\n  alwaysSend?: readonly string[];\n  unsubscribeTtlSeconds?: number;\n};\n\nconst key = (userId: string, type: string, channel: string) => `${userId} ${type} ${channel}`;\n\ntype PreparedPreferences = Map<string, PreferenceRow>;\n\nexport function buildUnsubscribeToken(\n  secret: string,\n  userId: string,\n  type: string,\n  channel: Channel,\n  ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS,\n): Promise<string> {\n  return signToken(secret, {\n    uid: userId,\n    purpose: UNSUBSCRIBE_PURPOSE,\n    exp: expiresIn(ttlSeconds),\n    data: { type, channel },\n  });\n}\n\nexport function preferences(options: PreferencesOptions = {}): EasyPingPlugin<\"preferences\"> {\n  const defaultEnabled = options.defaultEnabled ?? true;\n  const alwaysSend = new Set(options.alwaysSend ?? []);\n\n  // Assigned by init(), which easyPing() runs before any hook or route.\n  let ctx: PluginInitContext;\n\n  const isAllowed = (userId: string, type: string, channel: Channel, rows: PreparedPreferences) => {\n    const row = rows.get(key(userId, type, channel));\n    return row ? row.enabled && row.frequency !== \"off\" : defaultEnabled;\n  };\n\n  const load = (userIds: readonly string[]) =>\n    ctx.store.find<PreferenceRow>(TABLE, { userId: { in: [...userIds] } });\n\n  const save = (row: PreferenceRow) =>\n    ctx.store.upsert(TABLE, [{ ...row, updatedAt: new Date() }], {\n      onConflict: [\"userId\", \"type\", \"channel\"],\n    });\n\n  return {\n    id: \"preferences\",\n\n    init: (context) => {\n      ctx = context;\n    },\n\n    schema: {\n      notificationPreference: {\n        tableName: TABLE,\n        fields: {\n          userId: { type: \"string\", required: true },\n          type: { type: \"string\", required: true },\n          channel: { type: \"string\", required: true },\n          enabled: { type: \"boolean\", required: true, default: true },\n          frequency: { type: \"string\", required: true, default: \"instant\" },\n          updatedAt: { type: \"date\", required: true, defaultNow: true },\n        },\n        primaryKey: [\"userId\", \"type\", \"channel\"],\n      },\n    },\n\n    hooks: {\n      /** One query per send; doing this per recipient would be an N+1. */\n      prepare: async (context: PrepareContext): Promise<PreparedPreferences> => {\n        if (alwaysSend.has(context.type)) return new Map();\n\n        const rows = await load(context.recipients.map((recipient) => recipient.userId));\n        return new Map(rows.map((row) => [key(row.userId, row.type, row.channel), row]));\n      },\n\n      resolveChannels: (context: ResolveChannelsContext) => {\n        if (alwaysSend.has(context.type)) return context.decisions;\n\n        // prepare() failing leaves this undefined. Fail closed rather than\n        // assuming everyone opted in: that is exactly how people who\n        // unsubscribed get emailed anyway.\n        if (!(context.prepared instanceof Map)) {\n          return context.decisions.map((decision) => ({ ...decision, action: \"skip\" as const }));\n        }\n\n        const rows = context.prepared as PreparedPreferences;\n\n        return context.decisions.map<ChannelDecision>((decision) =>\n          isAllowed(context.recipient.userId, context.type, decision.channel, rows)\n            ? decision\n            : { ...decision, action: \"skip\" },\n        );\n      },\n    },\n\n    routes: [\n      {\n        path: \"/preferences\",\n        method: \"GET\",\n        scope: { type: \"user\" },\n        handler: async ({ userId }) => {\n          const rows = await load([userId ?? \"\"]);\n          return Response.json({ preferences: rows, defaultEnabled });\n        },\n      },\n\n      {\n        path: \"/preferences\",\n        method: \"POST\",\n        scope: { type: \"user\" },\n        handler: async ({ request, userId }) => {\n          const parsed = await readJsonBody(request);\n          if (\"error\" in parsed) return parsed.error;\n          const body = parsed.body;\n\n          const bad = (error: string) => Response.json({ error }, { status: 400 });\n\n          // Only types the app defined: otherwise every unknown string the\n          // client invents is a row that lives forever.\n          if (typeof body.type !== \"string\" || !ctx.notificationTypes.includes(body.type)) {\n            return bad(\"type must be a configured notification type\");\n          }\n          if (!isChannel(body.channel)) return bad(`channel must be one of ${CHANNELS.join(\", \")}`);\n          if (body.enabled !== undefined && typeof body.enabled !== \"boolean\") {\n            return bad(\"enabled must be a boolean\");\n          }\n          if (body.frequency !== undefined && !isFrequency(body.frequency)) {\n            return bad(`frequency must be one of ${FREQUENCIES.join(\", \")}`);\n          }\n\n          // userId comes from the resolved session, never from the body.\n          await save({\n            userId: userId ?? \"\",\n            type: body.type,\n            channel: body.channel,\n            enabled: body.enabled ?? true,\n            frequency: body.frequency ?? \"instant\",\n          });\n\n          return Response.json({ ok: true });\n        },\n      },\n\n      {\n        // Reached from a mail client with no session, so it is authenticated\n        // by the signature on the link itself.\n        path: \"/unsubscribe\",\n        method: \"POST\",\n        scope: { type: \"signed\", purpose: UNSUBSCRIBE_PURPOSE },\n        handler: async ({ claims }) => {\n          const type = claims?.data?.type;\n          const channel = claims?.data?.channel;\n          if (!claims || !type || !isChannel(channel)) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          const [current] = await ctx.store.find<PreferenceRow>(\n            TABLE,\n            { userId: claims.uid, type, channel },\n            { limit: 1 },\n          );\n\n          // Already off: a second click, or a mail client retrying, is fine.\n          if (current && !current.enabled && current.frequency === \"off\") {\n            return Response.json({ ok: true, unsubscribed: { type, channel } });\n          }\n\n          // The user changed this preference after the email went out. An old\n          // link must not silently undo a newer decision made while logged in.\n          if (\n            current?.updatedAt &&\n            claims.iat !== undefined &&\n            current.updatedAt.getTime() > (claims.iat + 1) * 1000\n          ) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          await save({\n            userId: claims.uid,\n            type,\n            channel,\n            enabled: false,\n            frequency: \"off\",\n          });\n\n          // Gmail and Yahoo one-click requires the POST itself to unsubscribe,\n          // with no confirmation page.\n          return Response.json({ ok: true, unsubscribed: { type, channel } });\n        },\n      },\n    ],\n  };\n}\n"]}

package/dist/plugins/preferences.d.cts

@@ -1,4 +1,4 @@
-import { h as EasyPingPlugin } from '../plugin-f5KaFWSN.cjs';
+import { h as EasyPingPlugin } from '../plugin-CiMsGlQe.cjs';
 import { C as Channel, F as Frequency } from '../adapter-BfLe2J0t.cjs';
 
 declare const UNSUBSCRIBE_PURPOSE = "unsubscribe";
@@ -8,6 +8,8 @@ type PreferenceRow = {
     channel: Channel;
     enabled: boolean;
     frequency: Frequency;
+    /** Last explicit change. An unsubscribe token issued before it is refused. */
+    updatedAt?: Date;
 };
 type PreferencesOptions = {
     /** What an absent row means. Flip to false for opt-in-only notifications. */

package/dist/plugins/preferences.d.ts

@@ -1,4 +1,4 @@
-import { h as EasyPingPlugin } from '../plugin-CmPOFVmn.js';
+import { h as EasyPingPlugin } from '../plugin-C9Hoxus2.js';
 import { C as Channel, F as Frequency } from '../adapter-BfLe2J0t.js';
 
 declare const UNSUBSCRIBE_PURPOSE = "unsubscribe";
@@ -8,6 +8,8 @@ type PreferenceRow = {
     channel: Channel;
     enabled: boolean;
     frequency: Frequency;
+    /** Last explicit change. An unsubscribe token issued before it is refused. */
+    updatedAt?: Date;
 };
 type PreferencesOptions = {
     /** What an absent row means. Flip to false for opt-in-only notifications. */

package/dist/plugins/preferences.js

@@ -1,9 +1,13 @@
-import { DEFAULT_TOKEN_TTL_SECONDS, signToken, expiresIn } from '../chunk-W3BMEPPQ.js';
+import { DEFAULT_TOKEN_TTL_SECONDS, signToken, expiresIn, readJsonBody } from '../chunk-DG3ZL5NP.js';
 import '../chunk-PTGHMCCG.js';
 
 // src/plugins/preferences/index.ts
 var UNSUBSCRIBE_PURPOSE = "unsubscribe";
 var TABLE = "notification_preference";
+var CHANNELS = ["inApp", "email", "push", "sms", "slack"];
+var FREQUENCIES = ["instant", "daily", "weekly", "off"];
+var isChannel = (value) => CHANNELS.includes(value);
+var isFrequency = (value) => FREQUENCIES.includes(value);
 var key = (userId, type, channel) => `${userId} ${type} ${channel}`;
 function buildUnsubscribeToken(secret, userId, type, channel, ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS) {
   return signToken(secret, {
@@ -22,7 +26,9 @@ function preferences(options = {}) {
     return row ? row.enabled && row.frequency !== "off" : defaultEnabled;
   };
   const load = (userIds) => ctx.store.find(TABLE, { userId: { in: [...userIds] } });
-  const save = (row) => ctx.store.upsert(TABLE, [row], { onConflict: ["userId", "type", "channel"] });
+  const save = (row) => ctx.store.upsert(TABLE, [{ ...row, updatedAt: /* @__PURE__ */ new Date() }], {
+    onConflict: ["userId", "type", "channel"]
+  });
   return {
     id: "preferences",
     init: (context) => {
@@ -36,7 +42,8 @@ function preferences(options = {}) {
           type: { type: "string", required: true },
           channel: { type: "string", required: true },
           enabled: { type: "boolean", required: true, default: true },
-          frequency: { type: "string", required: true, default: "instant" }
+          frequency: { type: "string", required: true, default: "instant" },
+          updatedAt: { type: "date", required: true, defaultNow: true }
         },
         primaryKey: ["userId", "type", "channel"]
       }
@@ -74,9 +81,19 @@ function preferences(options = {}) {
         method: "POST",
         scope: { type: "user" },
         handler: async ({ request, userId }) => {
-          const body = await request.json().catch(() => null);
-          if (!body?.type || !body.channel) {
-            return Response.json({ error: "type and channel are required" }, { status: 400 });
+          const parsed = await readJsonBody(request);
+          if ("error" in parsed) return parsed.error;
+          const body = parsed.body;
+          const bad = (error) => Response.json({ error }, { status: 400 });
+          if (typeof body.type !== "string" || !ctx.notificationTypes.includes(body.type)) {
+            return bad("type must be a configured notification type");
+          }
+          if (!isChannel(body.channel)) return bad(`channel must be one of ${CHANNELS.join(", ")}`);
+          if (body.enabled !== void 0 && typeof body.enabled !== "boolean") {
+            return bad("enabled must be a boolean");
+          }
+          if (body.frequency !== void 0 && !isFrequency(body.frequency)) {
+            return bad(`frequency must be one of ${FREQUENCIES.join(", ")}`);
           }
           await save({
             userId: userId ?? "",
@@ -97,7 +114,18 @@ function preferences(options = {}) {
         handler: async ({ claims }) => {
           const type = claims?.data?.type;
           const channel = claims?.data?.channel;
-          if (!claims || !type || !channel) {
+          if (!claims || !type || !isChannel(channel)) {
+            return Response.json({ error: "invalid token" }, { status: 400 });
+          }
+          const [current] = await ctx.store.find(
+            TABLE,
+            { userId: claims.uid, type, channel },
+            { limit: 1 }
+          );
+          if (current && !current.enabled && current.frequency === "off") {
+            return Response.json({ ok: true, unsubscribed: { type, channel } });
+          }
+          if (current?.updatedAt && claims.iat !== void 0 && current.updatedAt.getTime() > (claims.iat + 1) * 1e3) {
             return Response.json({ error: "invalid token" }, { status: 400 });
           }
           await save({